AWS Certified CloudOps Engineer - Associate (SOA-C03) Practice Exam

A company runs applications on an Amazon EKS cluster with Linux managed node groups. A CloudOps engineer must collect node-level and pod-level CPU and memory metrics in CloudWatch and send application container stdout and stderr logs to CloudWatch Logs. The company requires Kubernetes metadata for troubleshooting and does not want to modify application manifests or maintain custom collector deployments. The EKS Pod Identity Agent is already installed, and the cluster has network connectivity to the required AWS endpoints. Which solution meets these requirements with the least operational overhead?

A company uses Amazon Route 53 failover records for an application hosted in two data centers. The primary record has an HTTPS health check configured with the primary server's fixed public IP address, the domain name api.example.com, and the path /ready. The secondary site is healthy. After a TLS configuration change, Route 53 marks the primary unhealthy, although browser requests to https://api.example.com/ready return HTTP 200 when directed to the primary server. The primary server hosts multiple HTTPS virtual hosts and now rejects TLS connections that do not include the requested hostname in the TLS handshake. Server logs show that Route 53 health check connections are rejected for this reason. Network access is correctly configured. A CloudOps engineer must restore health checks that verify the primary application's HTTP readiness response without weakening the server's TLS requirements. Which change meets these requirements?

A CloudOps engineer uses AWS CloudFormation to deploy eight m6i.xlarge On-Demand EC2 instances in us-east-1. Each instance requires 4 vCPUs. Existing workloads in the account consume 48 vCPUs from the same EC2 On-Demand Standard instance quota and must remain running. The deployment fails with a VcpuLimitExceeded error and rolls back completely. The applied quota is 64 vCPUs in us-east-1 and 128 vCPUs in us-west-2. The new fleet must use the specified instance type in us-east-1. Which solution will allow the deployment to proceed?

A company continuously evaluates its AWS accounts against the AWS Foundational Security Best Practices standard in three AWS Regions. The required resource recording and security checks are already operating in every account and Region. A dedicated security account already has administrator access to the member accounts' security findings in each Region. The operations team must view the findings and control compliance statuses from all three Regions in a single Regional console. Updates to finding workflow statuses must synchronize between this central view and the originating Regions. The company must continue running security checks in all three Regions. Which solution meets these requirements with the LEAST operational overhead?

A company uses a Route 53 public hosted zone for example.com. Its HTTP-only website runs on an on-premises server with a fixed public IPv4 address. During an outage, the company wants new DNS queries, after cached answers expire, to direct visitors to a maintenance page instead. When the server recovers, DNS responses must automatically direct visitors back to it. An S3 bucket named example.com already has static website hosting enabled, and its maintenance page is publicly accessible through the bucket's regional website endpoint. Which Route 53 configuration meets these requirements?