SOA-C03PRACTICE QUESTIONS

SOA-C03 practice questions with answers

5 example questions from the AWS Certified CloudOps Engineer - Associate question bank, grouped by exam domain. Pick an answer and check it to see the explanation.

Monitoring, Logging, Analysis, Remediation, and Performance Optimization

Question 1Select 1

null Implement metrics, alarms, and filters by using AWS monitoring and logging services

A company runs applications on an Amazon EKS cluster with Linux managed node groups. A CloudOps engineer must collect node-level and pod-level CPU and memory metrics in CloudWatch and send application container stdout and stderr logs to CloudWatch Logs. The company requires Kubernetes metadata for troubleshooting and does not want to modify application manifests or maintain custom collector deployments. The EKS Pod Identity Agent is already installed, and the cluster has network connectivity to the required AWS endpoints. Which solution meets these requirements with the least operational overhead?

A. Install the Amazon CloudWatch Observability EKS add-on with Container Insights enhanced observability and container log collection enabled. Configure EKS Pod Identity associations that grant the collectors the required CloudWatch permissions.

B. Install the Kubernetes Metrics Server EKS add-on and deploy Fluent Bit to forward container logs. Grant Metrics Server permission to publish CloudWatch metrics and Fluent Bit permission to write CloudWatch logs.

C. Enable detailed monitoring on the worker nodes and enable all EKS control plane logging types. Use the resulting CloudWatch metrics and log groups for workload troubleshooting.

D. Deploy Fluent Bit as a DaemonSet with the CloudWatch Logs output enabled and Kubernetes metadata enrichment configured. Grant its service account permission to write to CloudWatch Logs.

Reliability and Business Continuity

Question 1Select 1

null Implement highly available and resilient environments

A company uses Amazon Route 53 failover records for an application hosted in two data centers. The primary record has an HTTPS health check configured with the primary server's fixed public IP address, the domain name api.example.com, and the path /ready. The secondary site is healthy. After a TLS configuration change, Route 53 marks the primary unhealthy, although browser requests to https://api.example.com/ready return HTTP 200 when directed to the primary server. The primary server hosts multiple HTTPS virtual hosts and now rejects TLS connections that do not include the requested hostname in the TLS handshake. Server logs show that Route 53 health check connections are rejected for this reason. Network access is correctly configured. A CloudOps engineer must restore health checks that verify the primary application's HTTP readiness response without weakening the server's TLS requirements. Which change meets these requirements?

A. Enable Server Name Indication (SNI) on the HTTPS health check, retaining the configured IP address, domain name, and path.

B. Remove the domain name from the HTTPS health check and retain the primary server's fixed public IP address and /ready path.

C. Replace the primary server's certificate with a publicly trusted certificate that includes the server's fixed public IP address as a subject alternative name.

D. Change the health check protocol to TCP on port 443, retaining the primary server's fixed public IP address.

Deployment, Provisioning, and Automation

Question 1Select 1

null Provision and maintain cloud resources

A CloudOps engineer uses AWS CloudFormation to deploy eight m6i.xlarge On-Demand EC2 instances in us-east-1. Each instance requires 4 vCPUs. Existing workloads in the account consume 48 vCPUs from the same EC2 On-Demand Standard instance quota and must remain running. The deployment fails with a VcpuLimitExceeded error and rolls back completely. The applied quota is 64 vCPUs in us-east-1 and 128 vCPUs in us-west-2. The new fleet must use the specified instance type in us-east-1. Which solution will allow the deployment to proceed?

A. Configure the deployment pipeline to use the Service Quotas endpoint in us-west-2 to validate the 128-vCPU quota, and then retry the CloudFormation deployment in us-east-1.

B. Request an On-Demand Standard instance quota of at least 80 vCPUs in us-east-1 through Service Quotas. Verify that the applied quota has increased before retrying the deployment.

C. Request an On-Demand Standard instance quota of 32 vCPUs in us-east-1 through Service Quotas. Retry the deployment after the request is approved.

D. Add CloudFormation DependsOn attributes to launch the new instances sequentially, and then retry the deployment without changing the quota.

Security and Compliance

Question 1Select 1

null Implement and manage security and compliance tools and policies

A company continuously evaluates its AWS accounts against the AWS Foundational Security Best Practices standard in three AWS Regions. The required resource recording and security checks are already operating in every account and Region. A dedicated security account already has administrator access to the member accounts' security findings in each Region. The operations team must view the findings and control compliance statuses from all three Regions in a single Regional console. Updates to finding workflow statuses must synchronize between this central view and the originating Regions. The company must continue running security checks in all three Regions. Which solution meets these requirements with the LEAST operational overhead?

A. Configure cross-Region aggregation in AWS Security Hub CSPM in the security account. Select an aggregation Region and link the other two Regions, while leaving the service and standards enabled in each Region.

B. Enable AWS Security Hub CSPM and the standard only in the security account's central Region. Disable the service in the other two Regions and use the central Region to evaluate resources across all three Regions.

C. Create an organization-wide AWS Config aggregator in the security account. Include all three Regions and use its aggregated compliance results to manage the security findings' workflow statuses.

D. Create an AWS Security Hub CSPM custom insight in one Region that groups findings by Region. Grant the security account permission to read findings in the other two Regions without configuring cross-Region aggregation.

Networking and Content Delivery

Question 1Select 1

null Configure domains, DNS services, and content delivery

A company uses a Route 53 public hosted zone for example.com. Its HTTP-only website runs on an on-premises server with a fixed public IPv4 address. During an outage, the company wants new DNS queries, after cached answers expire, to direct visitors to a maintenance page instead. When the server recovers, DNS responses must automatically direct visitors back to it. An S3 bucket named example.com already has static website hosting enabled, and its maintenance page is publicly accessible through the bucket's regional website endpoint. Which Route 53 configuration meets these requirements?

A. Create primary and secondary failover A records. Point the primary record to the server's IPv4 address and associate an HTTP health check for the server. Configure the secondary as an alias to the S3 website endpoint with Evaluate Target Health enabled.

B. Create weighted A records with a weight of 100 for the server's IPv4 address and a weight of 0 for an alias to the S3 website endpoint. Disable Evaluate Target Health on the alias and do not associate health checks with either record.

C. Create primary and secondary failover A records. Point the primary record to the server's IPv4 address and associate an HTTP health check for the server. Configure the secondary as an alias to the S3 website endpoint with Evaluate Target Health disabled.

D. Create primary and secondary failover A records. Point the primary record to the server's IPv4 address without a health check. Configure the secondary as an alias to the S3 website endpoint with Evaluate Target Health disabled, and associate an HTTP health check with the secondary record.

PRACTICE EXAMSOA-C03 exam simulator

862 questions covering every domain and task, full-length exams, explanations for every answer and a pass probability indicator.

Open the simulator →