AWS CloudOps Engineer Associate (SOA-C03) - Full Practice Exam 1

1. A CloudFormation stack contains an S3 bucket with retained audit data. The stack will be deleted, but the bucket and its contents must remain available outside CloudFormation management. Which resource attribute directly expresses this requirement?
2. A CloudFormation stack launches an EC2 instance whose user-data script installs and configures a service. CloudFormation currently reports CREATE_COMPLETE before bootstrap finishes. The stack should fail if bootstrap fails or does not finish within 15 minutes. Which changes implement this behavior? Select 2 answers.
3. A CloudFormation update fails, and rollback also fails because an externally changed resource cannot return to its previous configuration. The stack is UPDATE_ROLLBACK_FAILED. Operations fixes the resource problem. What should the engineer do next?
4. A CloudFront distribution uses an S3 REST endpoint as its origin. The bucket must stay private, and viewers should access objects through the distribution rather than directly from S3. Which configuration is recommended?
5. A company uses AWS Backup for supported regional resources. Its disaster-recovery procedure requires recoverable copies in a second Region, independent of availability of the primary Region. Which steps are required? Select 2 answers.
6. A compliance review finds that backup jobs succeed, but no one has verified whether a supported RDS backup can be restored within the documented RTO. Operations wants a recurring, isolated validation process without directing production users to the restored database. Which actions meet this goal? Select 2 answers.
7. A deployment corrupts rows in an RDS database at 14:10. Automated backups are enabled, and 14:09 is inside the available point-in-time recovery window. The team must recover to immediately before the corruption and preserve the current instance for investigation. Which procedure should it follow?
8. A documented pilot-light recovery environment already replicates critical data to a secondary Region. Its application infrastructure is defined but most compute is not running. During a primary-Region outage, which sequence best follows this recovery model?
9. A DynamoDB table in provisioned mode has target-tracking auto scaling enabled. A batch job jumps from low traffic to a large write burst within seconds, causing temporary throttling before capacity increases. Which operational change best addresses repeated scheduled bursts without depending on auto scaling reacting instantly?
10. A fleet of managed EC2 Linux instances must receive approved operating-system patches during a weekly maintenance window. The team also needs patch compliance reporting. Which combination is the best fit?
11. A Lambda-based application opens many short-lived connections to an RDS database. During bursts, connection setup consumes database resources even though query volume is manageable. The team needs managed connection pooling while retaining RDS. Which option best addresses the problem?
12. A Lambda Errors alarm watches a function that runs only a few times each day. The team wants missing datapoints to be treated as healthy, while real nonzero error datapoints should still trigger the configured threshold. What should the engineer change?
13. A legacy EC2 data volume is unencrypted. The approved migration must preserve its contents on an encrypted EBS volume and allow validation before the original is retired. Which steps belong in the migration? Select 2 answers.
14. A Linux EC2 web server receives HTTPS through a subnet network ACL. Its security group permits the traffic. The ACL allows inbound TCP 443 but blocks outbound ephemeral destination ports. Clients time out during connections. What should operations change?
15. A Linux service on EC2 runs out of memory while its CPUUtilization metric remains low. Operations needs alarms for memory usage and filesystem utilization without changing the application. Which approach provides these metrics?
16. A platform team has an approved CloudFormation template for operational monitoring. It must deploy and update that template across several AWS Organizations member accounts and two Regions from one management workflow. Which feature is designed for this task?
17. A production RDS MySQL DB instance uses a traditional Multi-AZ deployment with one synchronous standby. The primary Availability Zone fails. What should the application expect during the managed failover?
18. A Redis OSS replication group stores disposable session cache data. It currently has a primary and a replica in the same Availability Zone. Operations needs managed failover if that Availability Zone fails. Which configuration is the best fit?
19. A repository defines infrastructure with AWS CDK. Before deployment, operations wants to inspect the proposed infrastructure differences against the deployed stack. Which CDK command provides this review?
20. A script deletes thousands of items from a DynamoDB table. Point-in-time recovery was already enabled, and the desired time is within its recovery window. Operations needs the data from before the script and must retain the current table for analysis. Which action is appropriate?
21. A security engineer must identify supported resources whose resource-based policies allow access from principals outside the organization. The requirement is policy analysis, not detection of already-occurring network attacks. Which capability is the best fit?
22. A security group managed by CloudFormation was manually modified in the console. The team wants to identify differences between supported resource properties and the stack template without applying another deployment. Which operation should it run?
23. A security team provides a standard set of AWS Config rules with optional remediation actions. Operations must deploy them together and assess resource compliance continuously in an account. Which feature packages these controls as one deployable collection?
24. A service has primary and secondary public endpoints. An approved recovery procedure calls for Route 53 to return the secondary when the primary health check fails, rather than distributing normal traffic between them. Which routing policy should operations configure?
25. A stateless web tier runs in an Auto Scaling group behind an ALB. Traffic varies throughout the day. Operations wants the group to add and remove instances automatically to keep average CPU utilization near 50%, without maintaining several step thresholds. Which policy is the best fit?
26. A Systems Manager Automation runbook must restart services on 200 managed nodes. Operations wants at most ten target executions running concurrently and wants the rollout to stop starting additional target executions after its configured error threshold is exceeded. Which settings should it use? Select 2 answers.
27. A team manually creates a hardened AMI every month. It wants a repeatable process that builds the image, runs validation tests, and distributes approved images to configured Regions. Which managed service is the most direct fit?
28. A team publishes private container images to Amazon ECR. Security requires managed scanning for software vulnerabilities and updated findings as vulnerability intelligence changes. Which option most directly provides this capability?
29. A team replaces /assets/banner.png at its S3 origin, but CloudFront viewers continue to receive the previous image because the cached object has not expired. The object path cannot change for this urgent correction. What should operations do?
30. A transfer service uploads 20-GiB files to S3 over an unreliable WAN link. Single-request uploads are impractical, and retransmitting a whole file after a late failure is expensive. Which steps should the engineer implement? Select 2 answers.
31. A web service performs requests that can take 90 seconds. During planned instance removal, requests are cut off because the ALB target group deregistration delay is 30 seconds. Instances remain alive for several minutes after deregistration. Which change most directly addresses the interrupted in-flight requests?
32. ALB targets are unhealthy with Target.ResponseCodeMismatch. Direct checks show that the configured /health path consistently returns HTTP 302 to a login page, while the target group matcher accepts only HTTP 200. What is the best operational correction?
33. An ACM public certificate uses DNS validation and is attached to a supported AWS service. Someone removes its validation CNAME from DNS after issuance. The certificate still works today. What should operations do to support future managed renewal?
34. An API writes JSON access logs to CloudWatch Logs. During an incident, an engineer needs the ten request paths with the highest count of HTTP 500 responses over the last hour. No permanent dashboard or alert is required. Which tool is the most direct fit?
35. An application cannot connect from an EC2 network interface to another supported resource inside the VPC. Operations wants configuration-based analysis of route tables, security groups, and network ACLs to identify a blocking component without sending live test packets. Which tool is the most direct fit?
36. An application connects to an RDS database using a password stored in a repository. The team must move the credential to a managed secret and rotate it automatically. What is the most appropriate operational approach?
37. An application on EC2 reads from one S3 prefix. It currently uses a long-lived IAM user access key in a local configuration file. Operations wants temporary credentials and least-privilege access without manual key rotation on every instance. What should it do?
38. An application writes JSON events to CloudWatch Logs with a severity field. The on-call team must receive an SNS notification when at least five events with severity ERROR arrive in a five-minute period. Which configuration meets this requirement with the least operational effort?
39. An audit trail records S3 bucket configuration changes, but investigators cannot find a GetObject request for a sensitive object. The team must record future object reads for one sensitive prefix while limiting additional logging volume. Which change is required?
40. An Auto Scaling group processes SQS messages. CPU utilization remains low because jobs wait on external services, but queue latency rises when demand increases. Average processing time is stable. Which metric best supports target tracking for this worker fleet?
41. An Auto Scaling group uses a launch template. Operations creates a new template version with a patched AMI and configures the group to use it. Existing instances still run the old AMI. Which action performs a controlled replacement of the existing fleet?
42. An Auto Scaling worker instance must upload local processing checkpoints before termination. The upload can take several minutes, and the termination workflow needs a bounded wait rather than an indefinite delay. Which feature should operations use?
43. An EC2 application role can call s3:GetObject on an object but receives AccessDenied when downloading it. The object uses SSE-KMS with a customer managed key, and no explicit denies apply. Which authorization checks are necessary? Select 2 answers.
44. An EC2 Auto Scaling group spans two Availability Zones behind an ALB. An instance passes EC2 status checks, but its application is hung and ALB marks it unhealthy. The group uses only EC2 health checks and does not replace it. Which changes enable appropriate application-level replacement? Select 2 answers.
45. An EC2 database uses a 500-GiB gp3 EBS volume. Measurements show sustained throughput demand near 200 MiB/s, below the instance EBS bandwidth limit. The volume has baseline gp3 settings, and storage capacity and IOPS are sufficient. Which change most directly addresses the throughput bottleneck?
46. An ECS service uses the rolling-update deployment controller. A new task revision repeatedly fails startup health checks, leaving the deployment unable to reach steady state. Operations wants failed deployments detected and rolled back to the last completed deployment. Which setting should it enable?
47. An engineer must update a production CloudFormation stack. The team requires a review of which resources will be added, modified, or replaced before applying the update. Which workflow best satisfies this control?
48. An EventBridge rule matches the expected events in testing. Its Lambda target receives no invocations, and the rule reports FailedInvocations. The function works when invoked manually. Which permission should the engineer check first?
49. An IAM role in an Organizations member account allows ec2:RunInstances. Launch attempts in a particular Region return AccessDenied. An applicable SCP explicitly denies that operation in the Region. Which statement explains the effective permissions?
50. An origin returns different product-search results for /search?lang=en and /search?lang=fr. A CloudFront behavior caches these responses but its cache policy excludes lang. Users sometimes receive results in the wrong language. What is the most direct configuration fix?
51. An RDS for PostgreSQL instance shows high CPU utilization. Operations needs operating-system process and thread information to identify what is consuming CPU on the DB instance. Which RDS feature supplies this level of operating-system detail?
52. An S3 bucket has versioning enabled. A user sends DeleteObject without a version ID. The current object is now hidden by a delete marker, but its previous version is still present. What is the simplest way to make the previous version current again without copying its contents?
53. CloudWatch log groups were created with no expiration. A policy now requires application logs to be retained for 90 days, while new events must continue to arrive normally. Which action should operations take?
54. During an incident, an engineer must run a diagnostic shell command on managed EC2 instances selected by tag. The hosts have no inbound SSH access. Execution status and output should be available centrally. Which operational tool should the engineer use?
55. EC2 instances in a private IPv4 subnet need outbound access to public package repositories without accepting unsolicited inbound internet connections. The VPC has an internet gateway. Which configuration is required for a public NAT gateway solution? Select 2 answers.
56. EC2 instances in private subnets do not appear as Systems Manager managed nodes. The SSM Agent is installed and running. They have no internet egress. Which checks most directly address the missing prerequisites? Select 2 answers.
57. Every weekday at 09:00, a training portal receives a sharp traffic spike. New instances take ten minutes to initialize, and reactive scaling causes slow responses at the start of each session. Which operational change most directly prevents the predictable capacity gap?
58. Instances in private subnets access S3 buckets in the same Region through a NAT gateway. Operations wants supported S3 requests to use a private gateway endpoint path and reduce NAT processing. Which actions are appropriate? Select 2 answers.
59. Many private instances open large numbers of concurrent connections through one public NAT gateway to the same external destination IP and port. The NAT gateway ErrorPortAllocation metric rises while destination and route checks pass. Which cause should operations investigate first?
60. On-premises DNS servers must resolve records in a Route 53 private hosted zone associated with a VPC. Private network connectivity to the VPC already exists. Which configuration should operations implement?
61. Operations has a tested Systems Manager Automation runbook that restarts a failed service and verifies recovery. A CloudWatch alarm must trigger this procedure automatically. The workflow needs a durable execution record and permission to perform only the remediation steps. Which combination meets the requirement? Select 2 answers.
62. Operations needs a standard configuration document applied to all EC2 instances tagged Environment=Production every hour. Newly tagged managed instances should receive the same configuration without a manual command for each host. Which service feature best fits?
63. Operations needs managed threat findings for suspicious API activity and potentially compromised credentials. It wants detection based on supported AWS telemetry rather than maintaining its own collection of threat-detection rules. Which service is the best fit?
64. Two CloudWatch metric alarms monitor high request latency and elevated HTTP 5xx responses for an API. Operations wants one SNS notification only when both alarms are in ALARM. Individual alarms should continue to evaluate but should not send their own notifications. Which changes should the engineer make? Select 2 answers.
65. VPC A is peered with VPC B, and VPC B is peered with VPC C. A workload in A cannot reach a private address in C even though administrators added routes pointing toward B. What explains the failure?

Comments — 0