SOA-C03 question patterns

Managed, native features: target tracking, AWS Backup plans, Config auto-remediation, EventBridge to SSM Automation.

Anything with a person, a cron job on EC2 or a custom server is less automated.

Install the CloudWatch agent (config in Parameter Store, instance role with CloudWatchAgentServerPolicy).

The hypervisor can't see inside the OS, so default metrics exclude them.

Organizations features: service-managed StackSets with auto-deploy, delegated admin, SCPs, organization trail, Config aggregator.

Per-account setup misses accounts created later.

CloudWatch composite alarm using AND.

Child alarms stay quiet; the composite notifies.

Fix the SNS topic access policy (and KMS key policy if the topic is encrypted) so CloudWatch can publish.

The alarm can only publish to a topic that allows it.

Alarm on StatusCheckFailed_System with the recover action.

Keeps instance ID, private IP, EIP and volumes.

Log group metric filter, then a CloudWatch alarm.

Metric filters turn log text into metrics.

Subscription filter to Kinesis, Firehose or Lambda.

S3 export is batch and slow.

CloudWatch Logs Insights.

Ad hoc queries with filter and stats.

Check bus, event pattern, enabled state, target permissions and Region.

Those cover nearly every cause.

Config rule with an SSM Automation remediation action.

Native detect-and-fix loop with retries.

Check VolumeQueueLength and BurstBalance; move gp2 to gp3 or io2 with Elastic Volumes.

Changes without detaching.

Fast snapshot restore, or initialize the volume.

Blocks load lazily from S3.

Multipart upload with S3 Transfer Acceleration.

Parallel parts over the AWS edge network.

AWS DataSync.

Managed, scheduled, verified transfers.

RDS Performance Insights.

Shows database load by wait event and SQL.

Target tracking scaling policy.

Simplest policy, adjusts both directions.

Scheduled scaling (or predictive scaling).

Capacity is ready before the load arrives.

ElastiCache (needs app change) or DAX for DynamoDB.

Serve hot data from memory.

Target SG must allow the load balancer; path must return the matcher code.

Health checks come from the load balancer.

Route 53 failover records with health checks.

Primary health decides the answer.

Route 53 health check on a CloudWatch alarm.

Checkers are on the public internet.

RDS Multi-AZ or Aurora; connect by endpoint name.

Automatic failover; standby is not for reads.

Read replicas (cross-Region), Aurora Global Database for low RPO.

Asynchronous, promotable.

CloudFormation change set; look for Replacement.

Shows add, modify, replace, remove.

DeletionPolicy Snapshot or Retain (and UpdateReplacePolicy).

Protects data on delete and on replacement.

Drift detection, then update the template or revert.

It reports only; it doesn't fix.

Delete the stack and redeploy after fixing the cause.

A failed create can't be updated.

CreationPolicy with cfn-signal.

The stack succeeds only on the signal.

Service-managed StackSets with automatic deployment.

Organization integration adds new accounts.

AWS Resource Access Manager.

Shares the original resource.

EC2 Image Builder pipeline.

Recipe, test, distribute, publish AMI ID.

Check SCP, permission boundary, resource policy, KMS key policy, conditions.

Any one layer's deny or missing allow wins.

IAM policy simulator.

Evaluates without calling the service.

IAM Access Analyzer external access findings.

Zone of trust analysis.

IAM Identity Center with permission sets.

Replaces per-account IAM users.

Service control policy deny.

SCPs set the ceiling; Config only detects.

IAM Roles Anywhere.

Certificates exchange for temporary credentials.

Config conformance pack or Security Hub standard.

Rules deployed and scored as a unit.

Secrets Manager rotation.

Parameter Store has no native rotation.

NAT gateway in a public subnet with an Elastic IP; one per AZ.

Instances initiate, no inbound.

Egress-only internet gateway.

IPv6 has no NAT.

S3 gateway endpoint.

Free and route-based.

Interface endpoint (PrivateLink).

ENI with private DNS.

Transit Gateway.

Peering isn't transitive.

Check the stateless NACL for ephemeral ports.

Security groups are stateful.

VPC Reachability Analyzer.

Analyses configuration and names the blocker.

VPC Flow Logs, filter action REJECT.

Metadata of accepted and rejected flows.

AWS WAF web ACL with managed and rate-based rules.

L7 on CloudFront, ALB, API Gateway.

Route 53 Resolver DNS Firewall.

Filters outbound DNS.