SOA-C03 practice questions and answers

Correct answer: A, B — Enable Multi-AZ on the RDS instance · Enable automated backups with a suitable retention period

Multi-AZ gives automatic failover to a synchronously replicated standby, and automated backups provide point-in-time restore after data corruption. Hardcoded credentials are a security defect, instance store loses data on stop, and disabling deletion protection makes accidental loss easier.

Correct answer: A — AWS Secrets Manager

Secrets Manager provides built-in scheduled rotation with Lambda rotation functions for supported databases. Standard Parameter Store parameters have no rotation engine, KMS manages encryption keys rather than application credentials, and ACM issues TLS certificates.

Correct answer: A — AWS Backup with a backup plan and organisation-level policy

AWS Backup centralises schedules, retention, and cross-account enforcement through backup policies attached in AWS Organizations. Per-instance cron jobs are unmanaged and drift, S3 replication copies objects rather than volumes, and termination protection prevents deletion of an instance without creating any backup.

Correct answer: A — A NAT gateway in a public subnet with a default route from the private subnet's route table to it

A NAT gateway placed in a public subnet, plus a default route pointing at it, gives private instances outbound internet access without inbound reachability. Routing straight to an internet gateway requires public addressing, peering connects VPCs rather than the internet, and outbound security group rules are already permissive by default and do not create a route.

Correct answer: A — AWS Direct Connect

Direct Connect provisions a physical circuit into an AWS location, which is what delivers consistent bandwidth and predictable latency. A Site-to-Site VPN rides the public internet, CloudFront caches content at edge locations, and Global Accelerator improves internet path selection rather than providing a private circuit.

Correct answer: A — Add Aurora Replicas and point reporting traffic at the reader endpoint

Aurora Replicas serve read traffic from the shared storage volume, and the reader endpoint load balances across them so reporting never touches the writer. Aurora storage grows automatically, Multi-AZ addresses availability rather than read offload, and snapshots are a backup mechanism.

Correct answer: A — A change set

A change set is a dry run that lists every add, modify, and replace the update would perform, so a replacement that would cause downtime is visible before you commit. Drift detection compares deployed state against the template, a stack policy blocks changes, and termination protection prevents stack deletion.

Correct answer: A — An EventBridge rule matching the CloudTrail management event, targeting an SNS topic

CloudTrail publishes management events to EventBridge, so a rule that matches the security group revoke API call can push straight to SNS for near real-time notification. A NetworkIn alarm measures traffic, an S3 notification only tells you a log file landed without parsing it, and Cost Anomaly Detection watches spend.

Correct answer: A — IAM Access Analyzer unused access findings and last accessed information

Access Analyzer surfaces unused roles, permissions, and access keys, and service last accessed data shows which services an identity actually used. Budgets track spend, Inspector scans for software vulnerabilities, and the Well-Architected Tool runs architectural reviews.

Correct answer: A — AWS Systems Manager Patch Manager with a maintenance window

Patch Manager defines patch baselines, applies them during maintenance windows, and reports patch compliance per instance. CodeDeploy deploys application revisions, Inspector finds vulnerabilities without patching them, and Batch schedules compute jobs.

Correct answer: A — AWS Transit Gateway

Transit Gateway acts as a regional routing hub, so each VPC and the on-premises VPN or Direct Connect attaches once instead of maintaining dozens of peering links. Full mesh peering scales badly and has no transitive routing, NAT gateways cannot be shared as a routing hub, and a load balancer distributes application traffic.

Correct answer: A — Amazon GuardDuty

GuardDuty is the managed threat detection service and consumes exactly those data sources to raise findings. Config evaluates configuration compliance, Trusted Advisor gives best-practice checks, and Macie classifies sensitive data in S3.

Correct answer: A — An Auto Scaling lifecycle hook on instance terminate

A terminate lifecycle hook pauses the instance in a wait state so automation can gather diagnostics before the instance is removed. Scheduled actions and target tracking policies control capacity, and metadata tags are labels with no effect on the termination sequence.

Correct answer: A — A gateway VPC endpoint for S3

Gateway endpoints for S3 add a route table entry, carry no hourly or data processing charge, and keep traffic on the AWS network. NAT gateways cost per hour and per gigabyte, an internet gateway defeats the private requirement, and a VPN does not provide S3 access.

Correct answer: A — Amazon Data Lifecycle Manager cross-Region copy

Data Lifecycle Manager schedules snapshot creation, retention, and cross-Region copies without custom automation. Auto Recovery restarts an impaired instance on new hardware, Direct Connect is a dedicated network link, and Elastic IPs are addresses.

Correct answer: B — A warm standby in a second Region with continuous replication and automated promotion

Single-digit-minute RTO and RPO require replication that is always running and a promotion step that is automated, which is the warm standby pattern. Nightly snapshots give an RPO measured in hours, deep archive restores take hours by design, and a pilot light without replication has no recent data to promote.

Correct answer: A — An AWS Config remediation action running a Systems Manager Automation document

Config rules can attach a remediation action that invokes an Automation runbook, so non-compliant resources are corrected without human intervention. A dashboard visualises, an SNS subscription only notifies, and Cost Explorer analyses spend.

Correct answer: A — The stack rolls back to the previous working configuration

CloudFormation rolls a failed update back to the last known good state by default so the stack is not left half-applied. It does not delete the stack, does not leave it partially updated as the default outcome, and does not retry forever.

Correct answer: A — Route tables in one or both VPCs lack routes to the peer CIDR

Accepting a peering connection does not create routes, so each VPC's route tables must add an entry for the peer CIDR pointing at the peering connection. Peering needs no NAT, it works across Regions and zones, and it supports IPv4 as well as IPv6.

Correct answer: A — CloudFormation StackSets

StackSets deploy one template across many accounts and Regions from a single administrator operation, including automatic deployment to new organisation accounts. Nested stacks compose one deployment, change sets preview a single stack update, and a stack policy restricts which resources an update may modify.

Correct answer: A — An alias A record

DNS forbids a CNAME at the zone apex, so Route 53 provides alias records that resolve to AWS resources and work at the apex with no extra query charge. MX records route mail and TXT records hold arbitrary text.

Correct answer: A — Increase the provisioned throughput on the gp3 volume

gp3 lets you provision IOPS and throughput independently, so a throughput bottleneck with headroom on IOPS is fixed by raising the throughput setting. sc1 is a cold HDD type with far lower performance, detaching does nothing to the limit, and encryption is a security setting.

Correct answer: A — The health check grace period, which is too short for the application to start

If the grace period expires before the application finishes booting, the health check marks a perfectly good instance unhealthy and the group replaces it, producing exactly this cycle. Tenancy, template descriptions, and subnet sizing do not cause instances to be judged unhealthy at start-up.

Correct answer: B — Install and configure the CloudWatch agent to publish memory metrics

Memory is a guest operating system metric that the hypervisor cannot see, so it only reaches CloudWatch when the CloudWatch agent collects and publishes it. Detailed monitoring only shortens the interval for existing EC2 metrics to one minute, a dashboard displays metrics that already exist, and IMDSv2 is a metadata security setting.

Correct answer: A — Origin access control with a bucket policy restricted to the distribution

Origin access control signs CloudFront's requests to S3 so the bucket policy can allow only that distribution and deny everything else. A public bucket is directly reachable, a NAT gateway is unrelated to CloudFront-to-S3 traffic, and Transfer Acceleration only speeds uploads.

Correct answer: A — EC2 Image Builder

EC2 Image Builder runs image recipes with build and test components on a schedule and distributes the resulting AMIs to target accounts and Regions. CodeArtifact hosts software packages, ECR hosts container images, and Service Catalog publishes approved products rather than building AMIs.

Correct answer: A — Failover routing

Failover routing is built for active-passive designs and depends on a health check to decide when to serve the secondary record. Weighted routing splits traffic by proportion, latency routing picks the fastest Region, and multivalue returns several healthy records at once.

Correct answer: A — The ALB access logs and the HTTPCode_ELB_5XX_Count metric

A 502 is generated by the load balancer when the target response is malformed or the connection fails, so the ALB access log entries and the ELB 5XX metric identify which targets and requests are affected. Volume burst balance, DNS health check latency, and S3 error counts are unrelated to this failure path.

Correct answer: A — An instance refresh with a minimum healthy percentage

Instance refresh replaces instances in batches while honouring a minimum healthy percentage, which keeps the service up during the roll. Mass termination and scaling to zero both cause an outage, and detaching the load balancer removes traffic entirely.

Correct answer: B — The data is lost because instance store is ephemeral

Instance store is physically attached ephemeral storage and its contents do not survive a stop, hibernate-less shutdown, or hardware failure. There is no automatic snapshot and no cross-zone replication, which is why durable data belongs on EBS, EFS, or S3.

Correct answer: A — VPC Flow Logs

Flow Logs capture source, destination, ports, and an accept or reject action for traffic on network interfaces, which is how you prove whether a security group or ACL blocked a packet. CloudFront and S3 logs cover their own request paths, and Config items record resource configuration.

Correct answer: A, B — It routes at layer 7 and can make decisions based on host and path · It requires subnets in at least two Availability Zones

The ALB is an HTTP-aware layer 7 balancer with host and path rules, and it must be given subnets in two or more Availability Zones. It terminates the connection and passes the client IP in X-Forwarded-For rather than preserving it at layer 4, static IPs are a Network Load Balancer feature, and it can target IPs and Lambda functions as well as instances.

Correct answer: A — A service control policy in AWS Organizations

An SCP sets the maximum permissions for every principal in the affected accounts, so denying the trail-stopping actions makes them impossible even for account administrators. A permissions boundary applies to a single identity, an alarm only detects afterwards, and a bucket policy protects the destination rather than the trail configuration.

Correct answer: A — CloudWatch cross-account observability with a monitoring account

Cross-account observability links source accounts to a central monitoring account so metrics, logs, and traces are visible and searchable in one place. Spreadsheets and per-account dashboards defeat the single-pane requirement, and billing reports show cost rather than operational metrics.

Correct answer: A — The endpoint DNS name stays the same and resolves to the promoted standby

Multi-AZ failover is DNS-based: the same endpoint name is repointed to the promoted standby, so applications reconnect without configuration changes. There is no new endpoint, the promoted instance is fully writable, and backups are unaffected.

Correct answer: A — Set the Auto Scaling group health check type to ELB and attach a target group with an HTTP health check

With the ELB health check type, the Auto Scaling group treats a target group health check failure as an unhealthy instance and replaces it, which catches application faults on a running host. Detailed monitoring only changes metric granularity, raising desired capacity adds instances without removing broken ones, and termination protection prevents the replacement.

Correct answer: A — An Auto Scaling group spanning at least two Availability Zones behind an Application Load Balancer

Spreading an Auto Scaling group across multiple Availability Zones behind a load balancer lets healthy zones absorb traffic and lets the group launch replacements automatically. A single instance, two instances in one zone, and AMI backups all require manual recovery or fail entirely when the zone goes down.

Correct answer: A — DependsOn

CloudFormation infers ordering from Ref and GetAtt, so when no such reference exists you declare it explicitly with DependsOn. Metadata carries arbitrary information, Outputs export values, and Conditions decide whether a resource is created at all.

Correct answer: A — Parameter Store

Parameter Store holds plain and SecureString parameters organised by path and integrates with KMS for encryption. State Manager enforces desired configuration, Inventory collects software and settings data, and Compliance reports on patch and association status.

Correct answer: A, B — Security groups are stateful, so a permitted inbound request's response is automatically allowed out · Network ACLs are stateless, so inbound and outbound rules must both be configured

Statefulness is the key distinction: security groups track connections while network ACLs evaluate each direction independently. Security groups only contain allow rules, network ACLs attach to subnets rather than instances, and security groups evaluate all rules rather than stopping at a numbered match.

Correct answer: A, B — An AWS Systems Manager Automation runbook · An AWS Lambda function

Automation runbooks and Lambda functions are both first-class EventBridge targets and are the two usual ways to run remediation code. IAM groups, route tables, and tags are resources rather than invocable targets.

Correct answer: A — Systems Manager State Manager associations

State Manager associations reapply a document on a schedule, which is what continuously enforcing desired state means. A single Run Command run does not repeat, user data executes only at first boot by default, and a tag records metadata without changing the instance.

Correct answer: A — Move session state to a shared store such as ElastiCache or DynamoDB

Externalising session state makes the fleet stateless so any instance can serve any user and scaling events stop affecting logins. Disabling scale-in wastes money and still loses sessions on failure, a larger instance does not change where state lives, and Elastic IPs do not share session data.

Correct answer: A — VPC Reachability Analyzer

Reachability Analyzer traces the logical path between two resources and names the specific component that blocks it, without sending any packets. Inspector scans for vulnerabilities, Trusted Advisor offers best-practice checks, and the Health Dashboard reports AWS-side events.

Correct answer: B — Require the threshold to be breached for several evaluation periods before the alarm changes state

Requiring N out of M evaluation periods means a transient single-request blip does not page anyone while a sustained problem still does. Deleting the alarm removes all detection, a Minimum statistic on an error count is meaningless, and treating missing data as breaching adds false alarms rather than removing them.

Correct answer: A — Attach an IAM role to the instance through an instance profile

An instance profile delivers temporary rotating credentials through the metadata service, which removes long-lived secrets from the host entirely. Storing static keys risks leakage, public buckets expose data to everyone, and a bucket policy cannot authorise a private IP address as a principal.

Correct answer: A — CloudFormation drift detection

Drift detection compares the live resource configuration with what the stack template declares and reports the properties that differ. Change sets describe a proposed update rather than current divergence, conformance packs evaluate compliance rules, and the Health Dashboard reports AWS service events.

Correct answer: A — Enable EBS encryption by default in each Region

EBS encryption by default is a per-Region account setting that encrypts every new volume and snapshot copy automatically. Tags do not enforce anything, S3 default encryption covers a different service, and MFA delete protects object deletion in a bucket.

Correct answer: B — Ship logs to CloudWatch Logs and run a CloudWatch Logs Insights query across the log group

Centralising logs into a CloudWatch log group and querying with Logs Insights searches every stream at once with a purpose-built query language. Per-instance SSH and bulk downloads do not scale to hundreds of hosts, and VPC Flow Logs record network metadata rather than application request IDs.

Correct answer: A — Set the log group retention to 90 days and export or subscribe the logs to S3 with a lifecycle policy to Glacier storage classes

CloudWatch Logs is the wrong place to keep seven years of data at scale, so the pattern is a short retention window for querying plus delivery to S3 where lifecycle rules move objects into archival storage classes. Seven-year CloudWatch retention and never expiring both cost far more, and cross-Region copies address disaster recovery rather than cost.

Correct answer: A — Create an invalidation for the affected paths

An invalidation removes the cached objects at the edge so the next request goes back to the origin. Toggling the distribution causes a lengthy redeploy without a guaranteed cache purge, the bucket Region is irrelevant, and Requester Pays only changes who is billed for transfer.

Correct answer: A — AWS reserves five IP addresses in every subnet

Every VPC subnet has five unusable addresses: the network address, the VPC router, DNS, a future-use address, and the broadcast address. AWS does not reserve half a subnet, and neither security groups nor route table entries consume addresses.

Correct answer: A — Composite alarms

Composite alarms combine child alarm states with a rule expression so notification happens once for the overall condition rather than for every underlying alarm. Dashboard metric math only affects display, subscription filters stream log events elsewhere, and Contributor Insights ranks top contributors in log data.

Correct answer: A — Network Load Balancer

The Network Load Balancer operates at layer 4, supports static or Elastic IPs per zone, and is designed for extreme connection rates with very low latency. The ALB is HTTP-focused without static IPs, the Gateway Load Balancer fronts virtual appliances, and the Classic Load Balancer is a previous generation product.

Correct answer: A — Run a scheduled game day that restores into an isolated environment and measures actual RTO and RPO

A recovery plan is only credible once it has been executed and timed, and doing it in an isolated environment gives real numbers without customer impact. Reading and assuming produce no evidence, and deliberately destroying production is reckless rather than a test.

Correct answer: A — Amazon EFS

EFS is a managed NFS file system that many instances across Availability Zones can mount concurrently with a shared namespace. A standard EBS volume attaches to a single instance, S3 is object storage rather than a POSIX block device, and instance store is local and ephemeral.

Correct answer: A — Enable AWS X-Ray tracing to see where time is spent inside the invocation

X-Ray breaks the invocation into segments and subsegments so you can see which downstream call or code path is consuming the time before changing anything. Reserved concurrency limits parallelism rather than duration, a Region change does not address the code, and repackaging as a container does not alter what the function does.

Correct answer: A — Weighted target groups on the listener rule

An ALB listener rule can forward to multiple target groups with weights, which is how a canary percentage is shifted without DNS changes. A second load balancer without DNS changes receives no traffic, security groups filter rather than split traffic, and NAT routes handle outbound connectivity.

Correct answer: A, B — S3 Versioning · S3 Object Lock in compliance mode

Versioning keeps prior versions so a delete becomes a marker you can roll back, and Object Lock in compliance mode makes objects immutable for the retention period even to the root user. Transfer Acceleration speeds uploads, Requester Pays shifts data transfer cost, and Storage Lens reports on usage.

Correct answer: A — Data encrypted with that key becomes permanently unrecoverable

Once a KMS key is deleted the ciphertext it protected can never be decrypted, which is why deletion has a mandatory waiting period and should be preceded by checking key usage. AWS does not re-encrypt or decrypt your data automatically, and no cached key survives deletion.

Correct answer: A, B — AWS Systems Manager Run Command · AWS Systems Manager Session Manager

Run Command executes documents on managed instances and Session Manager provides an interactive shell, both over the SSM agent with no inbound ports. Opening SSH to the world is the practice being avoided, and Elastic IPs and NAT gateways are networking constructs rather than command channels.

Correct answer: A — Amazon RDS Performance Insights

Performance Insights charts database load by wait event and attributes it to individual SQL statements, which is exactly what identifying the offending query requires. Enhanced Monitoring reports OS-level process metrics, X-Ray traces application requests, and basic CloudWatch metrics show CPU without any SQL attribution.

Correct answer: A — DeletionPolicy set to Retain or Snapshot

DeletionPolicy tells CloudFormation to keep the resource or take a final snapshot instead of deleting it when the resource leaves the stack. UpdatePolicy governs how Auto Scaling groups are updated, metadata comments do nothing, and outputs merely export values.

Correct answer: A — CloudTrail log file integrity validation

Log file integrity validation produces signed digest files that let you verify cryptographically that no log file was modified or deleted. Transfer Acceleration speeds uploads, metric filters extract metrics from logs, and Intelligent-Tiering optimises storage cost.

Correct answer: A — AWS Service Catalog portfolios and products

Service Catalog publishes approved products with launch constraints so users provision governed stacks without broad permissions. Administrator access removes governance entirely, emailing templates provides no enforcement, and Config rules detect problems after the fact rather than constraining provisioning.