SOA-C03 sample questions with answers
The other 360 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsMonitoring, logging and remediation
- EC2 instances in a fleet report CPU and network statistics to CloudWatch, but memory and disk utilization are missing. What is the standard way to publish those two metrics?
- A security team wants to deploy one curated collection of AWS Config rules and remediations to many accounts and Regions at once. Which Config feature provides that bundle?
- Compute Optimizer reports that several EC2 instances consistently use under 10 percent CPU and memory. Which recommendation category describes them?
- A gp3 volume reaches its included 3,000 IOPS during nightly batch runs. Which change adds IOPS with the least disruption and lowest cost?
- During a suspected scraping attack, the team wants a real-time ranking of the client IP addresses generating the most 4xx responses on an ALB. Which feature provides that ranking?
- Compliance requires every S3 bucket to use SSE-KMS with a customer managed key. Buckets that do not meet the rule must be corrected automatically within minutes of creation, with an auditable record. Which design should be used?
- An operations team wants one dashboard that shows metrics for workloads in us-east-1, eu-west-1, and ap-southeast-2. Is that possible with CloudWatch dashboards?
- A team has no reliable idea of what normal request latency looks like across the day and does not want to hand-tune static thresholds. Which CloudWatch feature should it use?
- An application runs in four Regions and the security team needs one place to query all of its logs. Which architecture avoids copying data between Regions?
- A CloudWatch alarm is in the ALARM state, but nobody received the notification. What should you check?
- A video transcoding service on EC2 should page the team only when two independent conditions hold together on one instance: CPU stays above 80 percent and outbound network throughput stays above a set level. Which CloudWatch capability should the engineer use to combine the two signals?
- A fleet of Linux web servers reports only CPU and network numbers to CloudWatch by default. The team now needs memory consumption and root volume fullness graphed alongside those. What should they deploy?
- A subscription filter sends CloudWatch Logs events to a Firehose delivery stream that writes to S3. The team needs to drop noisy records and reshape the rest before they are stored in S3. What should the team configure?
Reliability and business continuity
- An RDS for MySQL database must survive an Availability Zone failure with automatic failover and no changes to application connection code. Which configuration meets that?
- A Route 53 health check should report unhealthy only when a specific CloudWatch alarm is in the ALARM state. Which health check type should be created?
- An operator accidentally deleted rows in an Aurora MySQL cluster two hours ago. The team must return the cluster to a point before the mistake without restoring a snapshot or creating a new cluster. Which feature applies?
- An Auto Scaling group must add capacity quickly when CPU passes 70 percent, but must remove capacity slowly to avoid flapping. How should scaling be configured?
- A three-year Standard Reserved Instance for a steady production workload expires in two weeks. The workload will stay on the same instance family in the same Region for at least three more years, and the company wants maximum savings. What should it purchase?
- What is the key availability benefit of Amazon EFS compared with a single EBS volume?
- A company publishes an application at www.example.com through Route 53 failover routing, with a health check attached to the primary endpoint. The check starts reporting failures. Where do new DNS resolutions for the site go?
- The monthly AWS bill jumps by 300 percent overnight. What should you check first to find which service and usage type is responsible?
- A Spot Instance receives a two-minute interruption notice. What should the application do?
- A CloudWatch alarm that already combines several metrics is maintained in this account. Route 53 should mark a health check unhealthy only when that alarm enters the ALARM state, and the health check should not probe any endpoint directly. What should be configured?
- A healthcare company must back up EBS volumes, RDS databases, EFS file systems, and DynamoDB tables in two Regions. Recovery points must be undeletable for seven years, even by administrators with full account rights. Which setup satisfies this?
- Among disaster recovery strategies, which one delivers the shortest recovery time and the smallest data loss, while also carrying the greatest ongoing expense?
- An RDS Multi-AZ DB cluster runs one writer and two readable standby instances, each in a different Availability Zone. When the writer fails, what failover time does AWS state for this deployment?
Deployment, provisioning and automation
- A central account must deploy an identical VPC baseline into 50 accounts across 4 Regions, including accounts created later. Which CloudFormation capability fits best?
- A pod running on Amazon EKS needs to call AWS APIs under a narrowly scoped IAM role, and the security team forbids storing access keys in the container. Which approach meets the requirement?
- A team runs workloads on Amazon EKS and wants AWS to handle node provisioning, AMI patching and scaling, but the workloads must still run on EC2 instances. Which option should they choose?
- After a stack was deployed, an engineer changed a security group rule by hand in the console. Which CloudFormation feature reports that the live resource no longer matches the template?
- Every instance in a fleet must always have the CloudWatch agent installed and running, and the configuration must be reapplied whenever someone removes it. Which Systems Manager feature fits best?
- A company has one large template that creates a network tier, a database tier, and an application tier. The network portion must be reusable by other teams and updated on its own. Which CloudFormation feature supports this?
- A stack creates an S3 bucket that holds audit records. The stack will be deleted next week and the objects must survive. Which attribute keeps the bucket?
- A company has 40 accounts in AWS Organizations and needs the same baseline stack in each account across three Regions, including accounts created next month. Which approach meets this with the least manual effort?
- A team must deploy to EC2 instances while keeping the previous application version running on the original fleet until the new fleet passes validation. Which CodeDeploy option matches?
- An image pipeline must install specific application packages, apply hardening scripts, and set configuration files during the build. What are these steps defined as in EC2 Image Builder?
- A pipeline must build a container image, push it to a private registry, and deploy to a Kubernetes cluster. The source code lives in GitHub, and the company will not use CodeCommit for its repositories. Which source integration should the pipeline use?
- A platform team wants a scheduled pipeline that bakes a fresh hardened machine image every week. Which EC2 Image Builder resource specifies the base image, the ordered software components to apply, and the storage settings for the output?
- An ECS service on Fargate rolls out a new task definition. If the replacement tasks keep failing to reach a healthy steady state, the team wants the deployment halted and the service returned automatically to the last working revision. Which deployment setting provides this?
- A fleet of EC2 instances must keep a specific configuration, such as the CloudWatch agent installed and running. If someone changes it by hand, the desired configuration should be reapplied automatically on a schedule. Which Systems Manager capability does this?
Security and compliance
- An RDS database, an EBS snapshot and an S3 bucket must each be encrypted with the same KMS key, and that key must be usable in two Regions. Which key should be created?
- A company suspects that S3 buckets contain unencrypted customer records and card numbers. Which service discovers and classifies that data automatically?
- A manufacturing plant runs software on servers outside AWS and needs those workloads to obtain temporary AWS credentials through IAM roles instead of long-term access keys. Which service enables this?
- An IAM user has hit the quota for attached managed policies. What is the right way to grant the remaining permissions?
- A workload spans two Regions and encrypts its database, block volumes, and object storage with one customer managed key. The same key identifier must work in both Regions so that replicated data can be decrypted locally. Which KMS feature is required?
- A Secrets Manager rotation schedule for an Aurora cluster started failing right after the team moved the rotation function into a different subnet. Logs show timeouts connecting to the database endpoint, with no authentication errors. What is the most probable cause?
- A bank's security team wants a managed threat detection service that continuously analyzes account activity and network telemetry for compromised instance credentials, unusual API usage, and cryptocurrency mining, without deploying agents. Which service should be enabled?
Networking and content delivery
- A Route 53 health check marks an endpoint unhealthy. What does Route 53 do with the DNS record?
- Which statement describes a functional difference between an internet gateway and a NAT gateway?
- A CloudFront distribution uses an ALB in us-east-1 as its only origin, and users in Europe and Asia report slow first loads. What improves performance for those users?
- A transit gateway connects production, development, and shared-services VPCs. Development must never reach production, while both need shared services. How should this be built?
- A company wants to attach a third-party SD-WAN appliance to a transit gateway using GRE and BGP, with more throughput than a Site-to-Site VPN tunnel provides. Which attachment type should it use?
- Route 53 weighted records with 50/50 weights are sending almost all traffic to one version. What is the likely cause?
- VPC Flow Logs record REJECT entries for traffic that is supposed to be allowed. What should you examine?
- A multiplayer game backend uses TCP across several Regions. Players in some countries see slow connections because their resolvers cache DNS answers, and failover takes minutes. Which capability addresses this and is absent from latency-based DNS routing?
- A Java service needs about four minutes to reach full throughput after launch because its caches and JIT compiler warm up. Each new instance should receive a growing share of requests once it passes health checks. Which target group setting does this?
- A central security account must collect VPC flow logs from dozens of accounts in one organization. The logs must land in an S3 bucket in the security account and be encrypted with a KMS key that the security account owns. Which destination satisfies this?
- A TCP service behind a Network Load Balancer writes access logs showing every connection from the balancer's own node addresses. Host firewall rules on the backend instances filter by the real caller address and are now rejecting legitimate users. Which target group setting resolves both symptoms?
- An application load balancer returns sporadic 503 responses right after each release. The on-call engineer suspects a security group or network ACL is blocking responses from the instances back to the balancer. Which tool should the engineer run first to check that path?