AWS CloudOps Engineer – Associate (SOA-C03) — Free Sample Questions
Test your operational expertise with 30 free CloudOps Engineer Associate questions. This exam (SOA-C03) covers the day-to-day work of running AWS workloads — monitoring, automating deployments, and responding to incidents.
Domains Covered
- Monitoring, Logging, and Remediation (20%) — CloudWatch alarms, composite alarms, EventBridge rules, automated remediation with SSM
- Reliability and Business Continuity (16%) — multi-AZ RDS failover, Route 53 health checks, AWS Backup, pilot light DR
- Deployment, Provisioning, and Automation (18%) — CloudFormation drift detection, StackSets, Systems Manager Automation
- Security and Compliance (16%) — Config rules, remediation actions, GuardDuty findings, SCPs
- Networking and Content Delivery (18%) — VPC Flow Logs analysis, CloudFront behaviors, ALB routing rules
- Cost and Performance Optimization (12%) — Trusted Advisor, Compute Optimizer, S3 Intelligent-Tiering
What Sets SOA-C03 Apart
Unlike the Solutions Architect exam (which asks you to design), this exam asks you to operate. You'll encounter scenarios like: "An application is returning 5xx errors intermittently — which combination of actions identifies and resolves the issue?" Operational runbook thinking is essential.
Preparation Tips
- Know CloudWatch metric math, anomaly detection, and Logs Insights syntax
- Understand Systems Manager: Run Command, Patch Manager, Automation documents
- Practice CloudFormation troubleshooting — rollback triggers, dependency errors
- Study AWS Organizations: SCPs, tag policies, backup policies
Full Question Bank
Continue with 600 SOA-C03 questions across 30 quizzes and 2 practice exams — all mapped to official exam domains.
All 30 Free Sample Questions
Question 1
An operations team wants to receive email notifications whenever a CloudWatch alarm for high CPU utilization enters the ALARM state. The solution must use the fewest AWS services and require the least operational overhead. What should the engineer configure?
- Use CloudWatch Logs to trigger notifications
- Configure alarm to invoke Lambda which sends email
- Use EventBridge to route alarm state changes to SNS
- Configure alarm action to publish to SNS topic — Correct answer
Explanation:
- Why correct: CloudWatch alarms natively support adding an SNS topic as an alarm action. When the alarm transitions to ALARM state, it publishes directly to the SNS topic, which delivers email to subscribers. This is the simplest integration with no extra services.
- Why A is wrong: CloudWatch Logs stores log data but does not natively send email notifications when an alarm fires. Logs and alarms are separate CloudWatch features.
- Why B is wrong: While a Lambda function could send emails via Amazon SES, this introduces two additional services (Lambda and SES) and custom code, adding unnecessary complexity when the built-in alarm-to-SNS action already handles this.
- Why C is wrong: EventBridge can receive CloudWatch alarm state-change events and route them to SNS, but this adds an extra hop. The direct alarm action to SNS achieves the same result with fewer services and lower operational overhead.
Question 2
A company uses Amazon EC2 instances managed by Auto Scaling. When an instance fails a health check and is terminated, the operations team needs to automatically capture diagnostic information (system logs, memory dumps) BEFORE the replacement instance launches. Which approach meets this requirement? (Select TWO.)
- Create an EventBridge rule that matches Auto Scaling EC2 Instance-terminate Lifecycle Action events — Correct answer
- Create a CloudWatch alarm on StatusCheckFailed and configure it to invoke a Lambda function
- Schedule a Lambda function to poll instance health every minute and capture logs when unhealthy
- Configure an SNS notification when instances are terminated to alert the operations team
- Configure a Lambda function target on the EventBridge rule that collects diagnostics and completes the lifecycle action — Correct answer
Explanation:
- Why A and E are correct: EventBridge captures the Auto Scaling lifecycle event (EC2 Instance-terminate Lifecycle Action), and a Lambda function performs the diagnostic capture. Auto Scaling lifecycle hooks pause the termination process, giving the Lambda function time to collect logs and memory dumps before the instance is actually terminated. This is the standard AWS pattern for pre-termination diagnostics.
- Why B is wrong: CloudWatch alarms on StatusCheckFailed detect the failure but cannot pause the Auto Scaling termination process. By the time a Lambda function runs, the instance may already be terminated.
- Why C is wrong: A cron-based Lambda function that polls instance health introduces delay (up to the polling interval) and cannot guarantee it captures data before termination occurs. This is a polling anti-pattern compared to event-driven design.
- Why D is wrong: SNS can notify the operations team but notifications are informational — they cannot pause or delay the termination process to allow diagnostic capture. The requirement is to capture data BEFORE replacement.
Question 3
An operations engineer notices that an Amazon RDS MySQL instance on a 100 GiB gp2 volume experiences periodic latency spikes. CloudWatch metrics show the EBS burst balance dropping to 0% during peak hours, and VolumeReadOps returns to baseline levels afterward. Which action MOST effectively resolves the performance issue?
- Add a read replica to offload read traffic
- Migrate the gp2 volume to gp3 to get a consistent 3,000 IOPS baseline without burst credit dependency — Correct answer
- Enable Enhanced Monitoring on the RDS instance for more granular metrics
- Increase the RDS instance size to a larger instance class
Explanation:
- Why B is correct: gp2 volumes earn burst credits at a rate of 3 IOPS per GiB of volume size. A 100 GiB volume has a baseline of only 300 IOPS and relies on burst credits to reach 3,000 IOPS. Once burst credits are exhausted during sustained workloads, performance drops to the 300 IOPS baseline. Migrating to gp3 provides a guaranteed baseline of 3,000 IOPS regardless of volume size, with the ability to provision up to 16,000 IOPS independently. This eliminates the burst credit dependency entirely.
- Why A is wrong: Adding a read replica helps distribute read traffic for databases but does not address the underlying EBS I/O bottleneck on the primary instance. The volume's burst credit exhaustion would persist on the primary.
- Why C is wrong: Enabling Enhanced Monitoring provides more granular OS-level metrics (CPU, memory, file system) at 1-second intervals but does not change or improve actual I/O performance. It is a diagnostic tool, not a remediation.
- Why D is wrong: Increasing instance size may provide more CPU, memory, and network bandwidth, but it does not change the EBS volume's IOPS characteristics. The gp2 volume's burst credit behavior is tied to the volume, not the instance type.
Question 4
A data engineering team builds a serverless data pipeline consisting of an AWS Lambda function triggered by an Amazon SQS queue that processes records and writes results to an Amazon DynamoDB table. The team wants to define all three resources (Lambda function, SQS queue, DynamoDB table) in a single template, package the Lambda deployment artifact, and deploy the entire stack with one command. Which approach meets these requirements with the LEAST effort?
- Define the resources in an AWS SAM template using AWS::Serverless::Function with an SQS event source, then run sam build and sam deploy to package and deploy the stack — Correct answer
- Write a raw AWS CloudFormation template with AWS::Lambda::Function, AWS::SQS::Queue, and AWS::DynamoDB::Table resources, then use the aws cloudformation deploy CLI command
- Create the Lambda function, SQS queue, and DynamoDB table manually in the AWS Management Console, then export the configuration as a CloudFormation template
- Write a Terraform configuration defining the Lambda, SQS, and DynamoDB resources, then run terraform init and terraform apply
Explanation:
- Why correct: AWS SAM (Serverless Application Model) extends CloudFormation with simplified resource types like AWS::Serverless::Function that automatically create the Lambda function, IAM execution role, and event source mapping. An SQS event source is declared directly in the Events property. The sam build command compiles dependencies and packages the Lambda artifact, and sam deploy uploads the artifact to S3 and creates/updates the CloudFormation stack — all in one workflow. SAM templates are shorter and less error-prone than equivalent raw CloudFormation for serverless resources.
- Why B is wrong: A raw CloudFormation template works, but it requires significantly more boilerplate — you must manually define the IAM role, the event source mapping between SQS and Lambda, and the Lambda permission. CloudFormation also does not package the Lambda code automatically; you must upload the ZIP to S3 separately or use the aws cloudformation package command first. SAM handles all of this with less effort.
- Why C is wrong: Creating resources manually in the console and exporting them does not produce a reusable, version-controlled infrastructure-as-code template. Console exports are often incomplete (missing IAM roles, event source mappings) and do not include Lambda code packaging. This approach cannot be reliably repeated.
- Why D is wrong: Terraform is a valid IaC tool but is not an AWS-native service. The question asks for the least effort, and SAM provides tighter integration with Lambda packaging, local testing (sam local invoke), and one-command deployment specifically designed for serverless workloads. Terraform requires separate packaging steps and plugin management.
Question 5
A SysOps administrator needs to automatically scale a fleet of EC2 instances behind an Application Load Balancer. The application traffic is unpredictable, and the administrator wants the scaling to be fully managed with minimal configuration. What is the MOST operationally efficient approach?
- Set the minimum capacity to match peak demand at all times
- Create a target tracking scaling policy based on the ALB RequestCountPerTarget metric — Correct answer
- Use a cron job on one of the instances to call the RunInstances API when load increases
- Increase the instance type size instead of adding more instances
Explanation:
- Why correct: A target tracking scaling policy using ALBRequestCountPerTarget automatically adjusts the number of instances to maintain a specified request count per target. This is the recommended, fully managed approach for scaling a web application behind an ALB — AWS handles creating and managing the CloudWatch alarms and scaling adjustments automatically.
- Why A is wrong: Setting the minimum capacity to peak demand means you are always paying for peak resources even during low-traffic periods. This eliminates the cost benefit of elasticity and is not a scalable, cost-effective approach.
- Why B is correct: Target tracking with ALBRequestCountPerTarget is purpose-built for this use case. It scales out when requests per instance exceed the target and scales in when traffic drops, providing both elasticity and cost efficiency.
- Why C is wrong: Using a cron job to call RunInstances bypasses the Auto Scaling group entirely. Instances launched via RunInstances are not managed by the ASG, so they will not be tracked, health-checked, or terminated during scale-in. This is fragile, error-prone, and not an AWS best practice.
- Why D is wrong: Vertical scaling (increasing instance size) requires stopping and restarting the instance, causing downtime. It also has an upper limit (the largest instance type). Horizontal scaling via Auto Scaling is preferred for web applications because it provides fault tolerance and near-unlimited scale.
Question 6
A company runs a web application behind an Application Load Balancer (ALB) in us-east-1. The operations team must ensure that users are automatically redirected to a disaster recovery site in us-west-2 if the primary site becomes unavailable. Which TWO configurations are required? (Select TWO)
- Create a Route 53 health check that monitors the primary ALB endpoint — Correct answer
- Configure a Route 53 failover routing policy with primary and secondary records — Correct answer
- Enable sticky sessions on the primary ALB
- Attach an Elastic IP address to each EC2 instance behind the ALB
- Enable CloudWatch Logs agent on each EC2 instance
- Enable cross-zone load balancing on the ALB
Explanation:
- Why correct: Route 53 failover routing requires two components working together: (1) a health check that monitors the primary endpoint so Route 53 knows when it is down, and (2) a failover routing policy with a primary record (pointing to us-east-1 ALB) and a secondary record (pointing to the DR site in us-west-2). When the health check fails, Route 53 automatically returns the secondary record to DNS queries.
- Why A is correct: This is correct — the health check detects primary site failure.
- Why B is correct: This is correct — failover routing policy defines the primary/secondary relationship.
- Why C is wrong: Sticky sessions control how the ALB pins user sessions to specific targets. They do not affect DNS-level failover between Regions.
- Why D is wrong: Elastic IPs on instances do not enable cross-Region failover. ALBs use dynamic IPs and are accessed via DNS names, not Elastic IPs.
- Why E is wrong: CloudWatch Logs provide application-level logging and observability but do not trigger Route 53 failover.
- Why F is wrong: Cross-zone load balancing distributes traffic evenly across targets in all enabled AZs within a single ALB. It does not enable cross-Region failover.
Question 7
A company's Amazon RDS MySQL database was accidentally corrupted by a bad application deployment at 2:15 PM. The database has automated backups enabled with a 7-day retention period. The operations team needs to recover the database to its state at 2:10 PM. Which restore method should they use?
- Restore from the most recent automated snapshot taken that morning
- Use RDS point-in-time recovery (PITR) to restore to 2:10 PM, creating a new DB instance — Correct answer
- Revert the database by deleting and recreating it from the DB subnet group
- Contact AWS Support to roll back the database to 2:10 PM on the existing instance
Explanation:
- Why B is correct: RDS point-in-time recovery (PITR) allows restoring to any second within the backup retention period (up to 5 minutes before the current time). It uses automated backups and transaction logs to restore to a precise point. PITR always creates a new DB instance — it does not overwrite the existing one. This precisely meets the requirement of restoring to 2:10 PM.
- Why A is wrong: Automated snapshots are typically taken once per day during the backup window. Restoring from the morning snapshot would lose all data changes made between the snapshot time and 2:10 PM, resulting in significant data loss and not meeting the RPO requirement.
- Why C is wrong: Deleting and recreating the database from a DB subnet group does not restore any data. A DB subnet group only defines the subnets for the database — it contains no backup data.
- Why D is wrong: AWS Support cannot roll back an RDS instance to a specific point in time on the existing instance. PITR is a self-service feature that creates a new instance. AWS does not offer in-place rollback for RDS.
Question 8
A company hosts a web application across two Availability Zones behind an Application Load Balancer. Users report intermittent 502 Bad Gateway errors. The SysOps administrator discovers that the ALB is routing traffic to unhealthy instances. Which TWO actions should the administrator take to ensure the ALB only routes traffic to healthy instances? (Select TWO.)
- Increase the ALB idle timeout to 300 seconds
- Configure the target group health check with the correct path and port for the application — Correct answer
- Enable cross-zone load balancing on the ALB
- Reduce the health check interval and lower the unhealthy threshold count — Correct answer
- Enable sticky sessions on the target group
Explanation:
- Why correct (B & D): Configuring a target group health check with the correct path and port ensures the ALB can accurately determine whether each instance is serving the application correctly. Adjusting the health check interval and unhealthy threshold reduces the time it takes for the ALB to detect and stop routing to a failing instance — for example, a 10-second interval with 2 unhealthy thresholds means detection in ~20 seconds instead of the default ~150 seconds (30s interval × 5 thresholds).
- Why A is wrong: Increasing the idle timeout controls how long the ALB holds open an idle TCP connection. It does not affect how the ALB determines target health.
- Why C is wrong: Cross-zone load balancing distributes traffic evenly across all registered targets in all enabled AZs. While a best practice, it does not resolve the issue of routing to unhealthy targets — the ALB would still send traffic to unhealthy instances, just more evenly.
- Why E is wrong: Sticky sessions (session affinity) bind a user's session to the same target. This would make the problem worse, as affected users would remain pinned to the unhealthy instance.
Question 9
A company requires all EC2 instances to use approved, hardened AMIs with the latest security patches. The operations team needs an automated process that builds new AMIs weekly, applies CIS benchmark hardening, runs validation tests, and distributes the AMIs to multiple AWS accounts. Which approach meets these requirements with the LEAST operational overhead?
- Create a Lambda function that launches an EC2 instance, runs scripts via SSM Run Command, then creates an AMI manually
- Use AWS Systems Manager Patch Manager to patch running instances and create AMIs on a schedule
- Use EC2 Image Builder with a pipeline that includes build components, test components, and distribution settings — Correct answer
- Write a shell script on a bastion host that SSHs into instances, applies patches, and snapshots the volumes
Explanation:
- Why correct (C): EC2 Image Builder is a fully managed service purpose-built for automating AMI creation pipelines. It supports scheduled builds (e.g., weekly), build components (for installing software and applying CIS hardening), test components (for validation), and distribution settings (for copying AMIs to other accounts and regions). The entire pipeline is defined as infrastructure-as-code and runs automatically on schedule.
- Why A is wrong: Using Lambda with SSM Run Command requires custom code to orchestrate the full pipeline — launching an instance, running commands, waiting for completion, creating the AMI, handling errors, and distributing. This is significantly more operational overhead than using Image Builder, which handles all of this natively.
- Why B is wrong: Systems Manager Patch Manager patches running instances but does not create AMIs, apply CIS benchmark hardening, run validation tests, or distribute images to other accounts. It addresses patching only, not the full golden AMI pipeline requirement.
- Why D is wrong: SSH-based shell scripts on a bastion host are fragile, hard to maintain, and lack built-in scheduling, error handling, testing, and cross-account distribution. This approach also introduces security concerns with SSH key management and is not scalable or auditable.
Question 10
A company stores incoming invoices as PDF files in an Amazon S3 bucket. Each uploaded file must be automatically processed by extracting text and storing the results in Amazon DynamoDB. The solution must require no server management. Which approach automates this workflow?
- Configure an S3 Event Notification to invoke an AWS Lambda function that processes the file and writes results to DynamoDB — Correct answer
- Schedule a Lambda function to run every 5 minutes to list new objects in the S3 bucket
- Deploy an Amazon EC2 instance that continuously polls the S3 bucket for new files
- Use Amazon SNS to send an email notification so a team member can manually process each file
Explanation:
- Why correct: S3 Event Notifications can trigger a Lambda function immediately when an object is created. This is a fully event-driven, serverless pattern—no polling, no servers to manage. Lambda processes the file and writes to DynamoDB automatically.
- Why B is wrong: Polling on a schedule introduces latency (up to 5 minutes), incurs unnecessary Lambda invocations when no files exist, and may miss files if the volume exceeds the polling window. Event-driven invocation is more efficient and immediate.
- Why C is wrong: Running an EC2 instance for polling adds server management overhead (patching, scaling, monitoring) and cost. The requirement explicitly asks for no server management.
- Why D is wrong: Sending a notification for manual processing does not automate the workflow. The requirement is to automate the entire pipeline without human intervention.
Question 11
A development team manages an application stack with an Application Load Balancer, an Auto Scaling group, and an Amazon RDS instance using AWS CloudFormation. A developer accidentally modified the RDS instance's storage size directly in the console. The operations team wants to detect this kind of configuration change AND prevent future manual modifications to stack resources. Which TWO actions should the operations team take? (Select TWO.)
- Delete the stack and recreate it from the template to reset all resources to their defined state
- Run CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation — Correct answer
- Apply a CloudFormation stack policy that denies Update actions on the RDS resource
- Create an IAM policy that denies direct modification of resources tagged as CloudFormation-managed and attach it to the developer role — Correct answer
- Use CloudFormation Change Sets to detect manual changes made outside of CloudFormation
Explanation:
- Why correct: CloudFormation drift detection (B) compares the actual resource configuration against the template to identify out-of-band changes like the manual storage modification. Enabling termination protection and using an IAM policy that denies direct modifications to stack-managed resources (D) prevents engineers from making console changes to resources owned by CloudFormation.
- Why A is wrong: Deleting and recreating the stack would cause downtime for the RDS database and is unnecessarily disruptive. Drift detection can identify the change, and you can then decide whether to update the template to match or revert the resource.
- Why C is wrong: Stack policies control which resources CloudFormation itself can update during stack updates — they do not prevent users from modifying resources directly in the console outside of CloudFormation.
- Why E is wrong: CloudFormation Change Sets preview what CloudFormation will change during a stack update, but they do not detect out-of-band changes made directly to resources.
Question 12
A company requires that all IAM users with access to production AWS accounts must use multi-factor authentication (MFA) when performing any API actions. A SysOps administrator needs to enforce this requirement. Which approach should the administrator use?
- Enable MFA on the root account only
- Attach an IAM policy with a Deny effect and condition 'aws:MultiFactorAuthPresent' equals 'false' to all production users — Correct answer
- Enable CloudTrail to detect and block non-MFA API calls automatically
- Configure IAM password policy to require MFA
Explanation:
- Why correct: An IAM policy with a Condition key 'aws:MultiFactorAuthPresent' set to 'false' and Effect 'Deny' will deny all actions unless the user has authenticated with MFA. Attaching this policy to an IAM group containing all production users ensures enforcement. This is the standard AWS-recommended pattern for enforcing MFA.
- Why A is wrong: Enabling MFA on the root account only protects the root account — it does not enforce MFA for individual IAM users. Each user must have MFA enforced separately.
- Why B is correct: This is the correct approach. The 'aws:MultiFactorAuthPresent' condition key in a deny policy blocks any action taken without MFA authentication, effectively requiring all users to authenticate with MFA before performing actions.
- Why C is wrong: AWS CloudTrail logs API calls for auditing but cannot enforce or block actions. It is a detective control, not a preventive control. CloudTrail can tell you who made calls without MFA, but it cannot prevent those calls.
- Why D is wrong: IAM password policies control password complexity and rotation requirements. They do not enforce MFA usage — MFA must be enforced through IAM policies with condition keys.
Question 13
A SysOps administrator enables automatic key rotation on an AWS KMS customer managed key (CMK) that is used to encrypt Amazon EBS volumes. After rotation occurs, the administrator notices that existing EBS snapshots encrypted with the old key material can still be decrypted. What explains this behavior?
- KMS automatically re-encrypts all existing data with the new key material during rotation
- The old key material was not properly deleted and this represents a security vulnerability
- KMS retains all previous key material under the same key ID, so data encrypted with older material is still decryptable transparently — Correct answer
- EBS snapshots are exempt from key rotation and always use the original key material permanently
Explanation:
- Why correct: When KMS rotates a customer managed key, it generates new cryptographic material but retains all previous versions under the same key ARN/ID. Any data encrypted with older key material can still be decrypted transparently — KMS tracks which version was used for each encryption operation. New encrypt requests use the latest material, but decrypt operations work with any version. This is by design and not a security issue.
- Why A is wrong: KMS does NOT re-encrypt existing data during rotation. Re-encryption of existing data would require reading and re-writing every encrypted object, which KMS does not do automatically. If you need all data encrypted with the latest material, you must manually re-encrypt it.
- Why B is wrong: Retaining old key material is the intended and documented behavior of KMS key rotation. It is not a vulnerability — it ensures backward compatibility so that existing encrypted data remains accessible after rotation.
- Why D is wrong: EBS snapshots are not exempt from key rotation. They follow the same KMS behavior as all other services: the snapshot remains associated with the CMK, and KMS uses the appropriate key material version to decrypt it.
Question 14
A company's security team requires that all IAM users rotate their passwords every 90 days, use a minimum length of 14 characters, and cannot reuse any of their last 5 passwords. A SysOps administrator needs to enforce these requirements across the AWS account. Which action should the administrator take?
- Create an AWS Config rule to monitor password age and send SNS notifications to users who need to rotate
- Configure the IAM account password policy with maximum password age of 90 days, minimum length of 14, and password reuse prevention set to 5 — Correct answer
- Write a Lambda function triggered by a CloudWatch Events rule every 24 hours that checks each user's password age and forces a reset
- Apply a service control policy (SCP) in AWS Organizations to enforce password complexity on all member accounts
Explanation:
- Why correct: The IAM account password policy is the native AWS mechanism to enforce password rotation, minimum length, complexity, and reuse prevention. Setting maximum password age to 90 days, minimum length to 14, and password reuse prevention to 5 directly satisfies all three requirements. This policy applies to all IAM users in the account who use console passwords.
- Why A is wrong: AWS Config can monitor compliance but cannot enforce password rotation. Notifications alert users but do not prevent them from continuing to use expired passwords. This is a detection control, not a preventive control.
- Why C is wrong: A custom Lambda function adds unnecessary operational complexity and maintenance burden. The IAM password policy provides this functionality natively without custom code. Additionally, force-resetting passwords could disrupt users without proper notification.
- Why D is wrong: SCPs restrict which AWS API actions accounts and users can perform, but they cannot enforce IAM password policy settings. Password policies must be configured per account through the IAM password policy feature.
Question 15
A company runs application servers in private subnets that need to download software patches from the internet. The servers must NOT be directly reachable from the internet. What should the SysOps administrator configure?
- Deploy a NAT gateway in a public subnet and add a route from the private subnet's route table to the NAT gateway for 0.0.0.0/0 — Correct answer
- Attach an internet gateway directly to the private subnet's route table for 0.0.0.0/0
- Assign public IP addresses to the instances in the private subnet
- Create a VPC endpoint for the patch repository service
Explanation:
- Why correct: A NAT gateway allows instances in private subnets to initiate outbound internet connections (e.g., for downloading patches) while preventing inbound connections from the internet. The NAT gateway itself must reside in a public subnet (with a route to an internet gateway), and the private subnet's route table must have a 0.0.0.0/0 route pointing to the NAT gateway.
- Why B is wrong: Adding a route to an internet gateway from a private subnet would effectively make it a public subnet. Instances would need public IPs to use it, and this would expose them to inbound internet traffic, violating the requirement.
- Why C is wrong: Assigning public IPs to instances in a private subnet does not enable internet access if the route table lacks an internet gateway route. Even if a route were added, the instances would become publicly accessible, which violates the security requirement.
- Why D is wrong: VPC endpoints provide private access to specific AWS services (like S3 or DynamoDB), not to arbitrary internet patch repositories. If patches come from third-party sources on the public internet, a VPC endpoint would not help.
Question 16
An operations engineer needs to ensure that DNS queries from on-premises servers can resolve records in an AWS private hosted zone. The VPC is connected to the on-premises data center via AWS Direct Connect. What should the engineer configure in Route 53?
- Route 53 Resolver inbound endpoint in the VPC — Correct answer
- Route 53 Resolver outbound endpoint in the VPC
- A public hosted zone with the same domain name
- A VPN connection to replace Direct Connect
Explanation:
- Why correct: A Route 53 Resolver inbound endpoint provides an IP address inside the VPC that on-premises DNS servers can forward queries to. This allows on-premises servers to resolve records in AWS private hosted zones over the existing Direct Connect or VPN connection.
- Why B is wrong: An outbound endpoint is used for the opposite direction — it forwards DNS queries originating from within the VPC to on-premises or external DNS servers. It does not help on-premises servers resolve AWS private hosted zone records.
- Why C is wrong: Creating a public hosted zone would expose the records to the internet, which violates the requirement of using a private hosted zone. Private hosted zones are only resolvable within associated VPCs (or via Resolver inbound endpoints).
- Why D is wrong: Replacing Direct Connect with a VPN does not solve the DNS resolution issue. The problem is DNS forwarding, not network connectivity. A Resolver inbound endpoint is needed regardless of the connection type.
Question 17
A company's application in a public subnet can reach the internet but cannot communicate with instances in another subnet within the same VPC. Both subnets use the default network ACL. Which TWO items should the engineer check FIRST? (Select TWO.)
- Security group inbound rules on the destination instances to verify the required ports and source CIDR are allowed — Correct answer
- Whether the VPC has DNS hostnames enabled
- Route table entries for both subnets to confirm routes exist for each other's CIDR blocks — Correct answer
- Whether the NAT gateway is functioning correctly
- Whether the internet gateway has a public IP assigned
Explanation:
- Why A is correct: Security groups control inbound and outbound traffic at the instance level. If the destination instance's security group does not allow inbound traffic from the source subnet's CIDR or the source instance's security group, communication will be blocked.
- Why C is correct: Even within the same VPC, subnets may use custom route tables. The local route (which covers the VPC CIDR) is immutable and cannot be removed, but a more specific route (longer prefix match) could override it and redirect intra-VPC traffic to a network appliance or incorrect target. Additionally, the subnet itself may not be associated with the expected route table. Checking route table associations and entries confirms the routing path is correct.
- Why B is wrong: DNS hostnames affect name resolution, not network connectivity. Instances can still communicate via IP addresses even if DNS hostnames are disabled.
- Why D is wrong: NAT gateways provide internet access for private subnets. They are not involved in intra-VPC communication between subnets.
- Why E is wrong: Internet gateways provide internet connectivity. Intra-VPC traffic between subnets does not traverse the internet gateway.
Question 18
A SysOps administrator manages EC2 instances in a private subnet that need to download software patches from the internet. The instances must NOT be directly reachable from the internet. What should the administrator configure?
- Add a route to the internet gateway in the private subnet's route table
- Deploy a NAT gateway in a public subnet and add a route from the private subnet to the NAT gateway — Correct answer
- Create a VPC endpoint for the private subnet
- Attach a transit gateway to provide internet connectivity
Explanation:
- Why correct: A NAT gateway allows instances in private subnets to initiate outbound connections to the internet (e.g., to download patches or call external APIs) while preventing unsolicited inbound connections from the internet. The NAT gateway must be placed in a public subnet (one with a route to an internet gateway) and the private subnet's route table must have a route directing 0.0.0.0/0 traffic to the NAT gateway.
- Why A is wrong: An internet gateway alone enables internet access for resources with public IPs. Attaching an IGW to the VPC is necessary but not sufficient — adding a route to the IGW in the private subnet's route table would effectively make it a public subnet, which contradicts the requirement to keep instances private.
- Why C is wrong: A VPC endpoint provides private connectivity to supported AWS services (like S3 or DynamoDB) without traversing the internet. It does not provide general outbound internet access for downloading OS patches from external repositories.
- Why D is wrong: A transit gateway connects multiple VPCs and on-premises networks together. It does not provide internet access to private subnet instances by itself.
Question 19
A company runs a tightly coupled high-performance computing (HPC) workload on Amazon EC2. The application requires the lowest possible network latency between instances. Which placement group strategy should the SysOps administrator configure?
- Cluster placement group — Correct answer
- Spread placement group
- Partition placement group
- Default placement (no placement group)
Explanation:
- Why correct (A): A cluster placement group packs instances close together inside a single Availability Zone on the same underlying hardware rack. This provides low-latency, high-throughput network communication (up to 10 Gbps within the group using enhanced networking), which is essential for tightly coupled HPC workloads like MPI-based applications.
- Why B is wrong: A spread placement group places each instance on distinct underlying hardware across different racks (max 7 instances per AZ per group). This maximizes fault isolation but increases network latency between instances, making it unsuitable for tightly coupled HPC workloads.
- Why C is wrong: A partition placement group divides instances into logical partitions across separate racks. This is designed for large distributed workloads like HDFS or Cassandra where hardware failure isolation between partitions matters, not for minimizing inter-node latency.
- Why D is wrong: The default placement strategy distributes instances across underlying hardware without any proximity guarantees. It provides no latency optimization and offers no benefit over a cluster placement group for HPC workloads.
Question 20
An e-commerce application experiences heavy read traffic on its Amazon RDS PostgreSQL database during peak hours, causing slow query response times. The operations team wants to offload read traffic without modifying the primary database configuration. What is the recommended approach?
- Upgrade the primary instance to a larger instance class to handle additional read traffic
- Create RDS read replicas and direct read queries to the replica endpoints — Correct answer
- Enable Multi-AZ to distribute read traffic across the standby instance
- Increase the allocated storage on the primary instance to improve read performance
Explanation:
- Why correct: RDS read replicas allow you to create one or more read-only copies of your database instance. Applications can be configured to direct read queries (SELECT statements) to the replica endpoints, offloading read traffic from the primary instance. Read replicas use asynchronous replication, and you can create up to 15 read replicas for PostgreSQL. This horizontally scales read capacity without any changes to the primary database.
- Why A is wrong: Vertical scaling (upgrading instance class) increases the primary instance's capacity but has limits, causes downtime during the resize, and doesn't horizontally distribute the read load. It's also more expensive than adding read replicas for read-heavy workloads.
- Why B is correct: This is the correct answer.
- Why C is wrong: The Multi-AZ standby instance is not available for read traffic. It exists solely for high availability and failover purposes. You cannot direct queries to the standby; it only becomes active if the primary fails.
- Why D is wrong: Increasing allocated storage adds more disk space, not read throughput. Read performance is related to instance class (CPU/memory), IOPS configuration, and query optimization — not storage volume size.
Question 21
A company processes e-commerce orders and needs to fan out each order event to three independent downstream services: inventory, shipping, and billing. Each service processes events at a different rate. The SysOps administrator must design a decoupled, scalable solution. Which approach meets these requirements?
- Create a single SQS standard queue and have all three services poll the same queue
- Create an SNS topic and subscribe three separate SQS queues to it, one for each service — Correct answer
- Create a Kinesis Data Stream with three shards, one per service
- Create an EventBridge rule that triggers three AWS Lambda functions directly
Explanation:
- Why correct: Amazon SNS fanout to multiple SQS queues allows each downstream service to process the same event independently and at its own pace. This is the standard decoupled fanout pattern recommended by AWS. Each SQS queue subscriber receives a copy of every message published to the SNS topic.
- Why A is wrong: A single SQS queue shared by all three services means each message is consumed by only one consumer (competing consumers pattern). The other two services would never see that message, so not all three services would process every order event.
- Why C is wrong: Kinesis Data Streams can support multiple consumers via enhanced fan-out, but it adds unnecessary complexity and cost for a simple event distribution use case. SNS-to-SQS is the idiomatic AWS pattern for fan-out when consumers process messages at different rates and don't need strict ordering.
- Why D is wrong: EventBridge with three Lambda targets could work, but the requirement specifies the services already consume from SQS queues. Replacing the queue-based architecture with Lambda invocations changes the consumer model and loses the built-in buffering and retry capabilities of SQS.
Question 22
A security team needs to log all object-level read and write operations on a specific S3 bucket that stores financial reports. Management events are already being captured by an existing trail. What should the operations engineer configure?
- Create a new trail that logs only management events and filter by the S3 bucket ARN
- Enable S3 server access logging on the bucket and send logs to another S3 bucket
- Enable data events for S3 on the existing trail and scope it to the specific bucket ARN — Correct answer
- Enable CloudTrail Insights on the existing trail to detect unusual S3 API activity
Explanation:
- Why correct: CloudTrail data events capture object-level API operations (GetObject, PutObject, DeleteObject) on S3. By enabling data events on the existing trail and scoping to the specific bucket ARN, the team logs all read/write operations on that bucket without creating a separate trail or logging data events for all buckets (which would be costly).
- Why A is wrong: Management events capture control-plane operations like CreateBucket or PutBucketPolicy, not object-level operations like GetObject or PutObject. A management-event-only trail cannot satisfy the requirement to log object-level reads and writes.
- Why B is wrong: S3 server access logging provides basic access logs (requester, bucket, key, operation, status) but lacks the structured detail, identity information, and integration with other AWS services that CloudTrail data events provide. It also cannot be queried via CloudTrail Lake or Athena as easily.
- Why D is wrong: CloudTrail Insights detects unusual patterns in management event volume (e.g., spikes in API calls), not individual object-level operations. It does not log specific S3 GetObject or PutObject calls.
Question 23
A company is using AWS Database Migration Service (DMS) to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL with minimal downtime. The migration uses full load followed by change data capture (CDC). Which TWO statements are correct about this DMS configuration? (Select TWO.)
- CDC requires stopping all writes on the source database during migration
- CDC captures ongoing changes from the source database transaction log in near real-time — Correct answer
- A single replication task can combine multiple different source databases
- The replication instance must be sized to handle the change volume and buffer transaction log entries — Correct answer
- DMS only supports migrations between the same database engine
Explanation:
- Why B is correct: AWS DMS change data capture (CDC) continuously reads the source database transaction log and applies ongoing changes to the target in near real-time, keeping both databases synchronized after the initial full load completes.
- Why D is correct: DMS uses a replication instance (an EC2-managed instance) that runs the replication tasks. The instance must be sized appropriately for the workload — it needs enough memory and compute to handle the volume of changes, especially during CDC where it buffers transaction log entries.
- Why A is wrong: DMS does not require stopping writes on the source database for CDC. The entire purpose of CDC is to capture changes while the source remains fully operational, enabling minimal-downtime migrations.
- Why C is wrong: DMS replication tasks are defined per source-target endpoint pair. You cannot combine multiple different source databases into a single replication task. Each source database requires its own task configuration with its own endpoints.
- Why E is wrong: DMS supports heterogeneous migrations (e.g., Oracle to Aurora PostgreSQL), not just same-engine migrations. However, when migrating between different engines, you may also need AWS Schema Conversion Tool (SCT) to convert the schema and stored procedures.
Question 24
A SysOps administrator is troubleshooting why clients cannot reach an EC2 instance on port 443 even though the security group allows inbound HTTPS. The instance can initiate outbound connections successfully. Which TWO characteristics of VPC security controls explain why a NACL could cause this issue while the security group appears correct?
- NACLs are stateful and automatically allow return traffic
- Security groups operate at the subnet level and may block traffic before it reaches the instance
- Security groups are stateful; return traffic for allowed inbound connections is automatically permitted — Correct answer
- NACLs are stateless; both inbound and outbound rules must explicitly allow traffic — Correct answer
- NACLs only apply to traffic between subnets, not to traffic from the internet
Explanation:
- Why correct: Security groups are stateful (C)—if inbound traffic is allowed, the response is automatically allowed regardless of outbound rules. NACLs are stateless (D)—inbound and outbound rules are evaluated independently, so even if inbound port 443 is allowed in the NACL, the NACL must also have an outbound rule allowing ephemeral ports for response traffic. This is the most common NACL misconfiguration.
- Why A is wrong: NACLs are stateless, not stateful. This is a common misconception and the root cause of many connectivity issues.
- Why B is wrong: Security groups operate at the instance (ENI) level, not the subnet level. NACLs operate at the subnet level.
- Why E is wrong: NACLs apply to all traffic entering and leaving the subnet, including traffic from the internet routed through an Internet Gateway.
Question 25
A company has 15 VPCs across three AWS Regions that need to communicate with each other and with an on-premises data center via AWS Direct Connect. The operations team wants to simplify network management and avoid maintaining hundreds of individual VPC peering connections. Which TWO actions should the engineer take to build a scalable hub-and-spoke network architecture? (Select TWO.)
- Deploy an AWS Transit Gateway in each Region and attach all regional VPCs to it, then peer the Transit Gateways across Regions — Correct answer
- Create individual VPC peering connections between all 15 VPCs and configure route tables for each pair
- Associate the Direct Connect gateway with each Transit Gateway to provide on-premises connectivity through a single Direct Connect connection — Correct answer
- Connect each VPC directly to the Direct Connect virtual interface using separate private virtual interfaces per VPC
- Use AWS Global Accelerator to route traffic between the VPCs and the on-premises data center
Explanation:
- Why correct (A): AWS Transit Gateway acts as a regional hub that simplifies connectivity. By deploying a Transit Gateway in each Region and attaching VPCs, you avoid managing n*(n-1)/2 peering connections. Transit Gateway peering across Regions enables inter-Region VPC communication through the AWS backbone.
- Why correct (C): A Direct Connect gateway can be associated with Transit Gateways across Regions, allowing all attached VPCs to reach the on-premises data center through a single Direct Connect connection, dramatically simplifying hybrid connectivity.
- Why B is wrong: Creating individual VPC peering connections between 15 VPCs would require up to 105 peering connections (15 choose 2). VPC peering is also non-transitive and does not scale well. This is exactly the complexity the question asks to avoid.
- Why D is wrong: Direct Connect supports a limited number of private virtual interfaces per connection (50 by default). Connecting each VPC individually does not scale and defeats the purpose of centralized routing through Transit Gateway.
- Why E is wrong: AWS Global Accelerator optimizes internet-facing application performance by routing user traffic through the AWS global network to the nearest endpoint. It does not provide VPC-to-VPC or VPC-to-on-premises routing.
Question 26
An operations engineer needs to deploy a critical update to an application running on a fleet of EC2 instances behind an Application Load Balancer. The team requires the ability to instantly roll back to the previous version if issues are detected, with zero downtime during deployment. Which CodeDeploy deployment type should the engineer choose?
- In-place deployment with CodeDeployDefault.AllAtOnce configuration
- Blue/green deployment with traffic rerouting through the Application Load Balancer — Correct answer
- In-place deployment with CodeDeployDefault.OneAtATime configuration
- Rolling deployment using Auto Scaling group update policy in CloudFormation
Explanation:
- Why correct (B): Blue/green deployment creates a new set of replacement instances with the new application version behind the load balancer. Traffic is shifted from the original (blue) instances to the replacement (green) instances. If issues are detected, CodeDeploy can instantly reroute traffic back to the original instances, providing near-instantaneous rollback with zero downtime since the original instances remain running throughout.
- Why A is wrong: In-place with AllAtOnce deploys to all instances simultaneously. This causes downtime because all instances are updated at the same time, and rollback requires a full redeployment of the previous revision — it is not instantaneous.
- Why C is wrong: In-place with OneAtATime minimizes risk by updating one instance at a time, which reduces downtime. However, rollback still requires redeploying the previous revision to each updated instance, which is slow — not instant. The original instances are overwritten during deployment.
- Why D is wrong: Auto Scaling group update policies control how CloudFormation handles instance replacements during stack updates. This is a CloudFormation feature, not a CodeDeploy deployment type, and does not provide the instant rollback capability that blue/green deployments offer.
Question 27
A company uses Amazon AppStream 2.0 to deliver a design application to contractors. Usage peaks between 9 AM and 12 PM on weekdays, with minimal usage outside those hours. The operations team wants to minimize costs while ensuring contractors experience no delays when launching sessions during peak hours. Which scaling configuration should the SysOps administrator implement?
- Use an Always-On fleet with a fixed capacity matching peak demand at all times
- Use an On-Demand fleet with no scaling policy and rely on users waiting for instances to start
- Use an On-Demand fleet with a scheduled scaling policy that increases desired capacity before 9 AM and decreases it after 12 PM — Correct answer
- Use an Always-On fleet with step scaling based on CPU utilization metrics
Explanation:
- Why correct: An On-Demand fleet combined with scheduled scaling policies is the most cost-effective approach for predictable usage patterns. Scheduled scaling pre-provisions instances before the known peak window (9 AM) so contractors get instant sessions, then scales down after 12 PM to reduce costs. On-Demand fleets only charge for streaming hours, unlike Always-On fleets that charge for running hours regardless of user activity.
- Why A is wrong: An Always-On fleet at fixed peak capacity runs 24/7, incurring charges even during the many hours with zero or minimal usage. This is the most expensive option and does not optimize costs.
- Why B is wrong: Without a scaling policy, On-Demand instances must be started when users request sessions, causing wait times of several minutes for fleet provisioning during peak hours. This fails the requirement of no delays.
- Why D is wrong: Always-On fleets charge for all running instances regardless of user sessions. CPU-based step scaling reacts to load after it occurs rather than proactively provisioning before the known peak, and the Always-On pricing model is more expensive for this predictable usage pattern.
Question 28
A company uses CodePipeline to deploy a CloudFormation stack that provisions an ALB, an Auto Scaling group, and an RDS instance. The pipeline has a CodeBuild stage for testing and a CloudFormation deploy stage. Deployments occasionally fail at the CloudFormation stage with a rollback, but the team has no visibility into which resource caused the failure. Which TWO actions should the operations team take to improve deployment observability?
- Enable CloudTrail logging for all CloudFormation API calls and search the trail for error events
- Create an EventBridge rule that captures CloudFormation stack status change events and sends notifications to an SNS topic — Correct answer
- Add a manual approval stage in CodePipeline before the CloudFormation deploy stage
- Configure the CloudFormation stack to preserve successfully provisioned resources on failure and review stack events for the failed resource — Correct answer
- Review CodeBuild build logs for CloudFormation resource provisioning errors
Explanation:
- Why correct: (B) CloudFormation sends stack events (CREATE_FAILED, ROLLBACK_IN_PROGRESS) to EventBridge, so an EventBridge rule can route these to an SNS topic for real-time alerts identifying the exact failed resource. (D) Enabling CloudFormation termination protection and configuring stack failure options to preserve successfully provisioned resources allows the team to inspect the failed stack state rather than losing all resources on rollback. Together these provide both alerting and forensic capability.
- Why A is wrong: CloudTrail logs API calls made to CloudFormation (e.g., CreateStack, UpdateStack) but does not capture the internal resource-level provisioning events that show which specific resource failed and why. The detailed failure reason is in CloudFormation stack events, not CloudTrail.
- Why C is wrong: Adding a manual approval stage slows down the pipeline and does not provide any diagnostic information about why CloudFormation resources fail. It addresses a different concern (change control) rather than observability.
- Why E is wrong: CodeBuild logs show build and test output, not CloudFormation provisioning failures. The failure occurs after CodeBuild succeeds, during the CloudFormation deploy stage, so CodeBuild logs would not contain the relevant failure information.
Question 29
During a routine CloudFormation stack update, an engineer accidentally deleted the production Amazon RDS database by removing it from the template. The team wants to prevent this type of incident in the future while still allowing other resources in the stack to be updated freely. Which solution BEST prevents accidental deletion of critical resources during stack updates?
- Add DeletionPolicy: Retain to the RDS resource in the CloudFormation template
- Create an IAM policy that denies the rds:DeleteDBInstance action for all users
- Apply a stack policy that denies Update:Delete and Update:Replace actions on the RDS resource — Correct answer
- Enable termination protection on the CloudFormation stack
Explanation:
- Why C is correct: A CloudFormation stack policy is specifically designed to protect stack resources during updates. By setting a policy that denies Update:Delete and Update:Replace on the RDS logical resource, CloudFormation will block any stack update that would delete or replace that database. Other resources remain freely updatable. Stack policies are the purpose-built mechanism for this exact scenario.
- Why A is wrong: DeletionPolicy: Retain causes CloudFormation to preserve the physical resource when it is removed from the stack, but it does NOT prevent the stack update from proceeding—the resource is simply orphaned and no longer managed by CloudFormation. The team would lose infrastructure-as-code management of that database.
- Why B is wrong: An IAM deny policy on rds:DeleteDBInstance would prevent anyone from deleting the database via the RDS API, but CloudFormation uses its own service role or the caller's credentials. This is too broad—it blocks legitimate database deletions (e.g., decommissioning) and doesn't specifically protect against stack update accidents.
- Why D is wrong: Termination protection prevents the entire stack from being deleted (DeleteStack API), but it does NOT protect individual resources during stack updates. The engineer removed the resource from the template and ran an update, not a stack deletion.
Question 30
A company has an active AWS Site-to-Site VPN connection between its on-premises data center (10.1.0.0/16) and a VPC (10.0.0.0/16). EC2 instances in a private subnet cannot communicate with on-premises servers despite the VPN tunnel status showing UP. What should the SysOps administrator verify?
- Verify that the private subnet route table has a route for 10.1.0.0/16 pointing to the virtual private gateway, and that the on-premises router has a route for 10.0.0.0/16 through the VPN tunnel
B: Attach an internet gateway to the VPC and assign public IP addresses to the EC2 instances so VPN traffic can be routed over the public internet
C: Create a VPC peering connection between the on-premises network and the VPC to establish private connectivity
D: Deploy a NAT gateway in the VPC to translate the on-premises IP addresses to VPC-routable addresses — Correct answer
Explanation:
- Why correct (A): For traffic to flow over a Site-to-Site VPN, routing must be configured on both sides. The VPC private subnet route table must have a route entry directing on-premises traffic (10.1.0.0/16) to the virtual private gateway (VGW). Likewise, the on-premises router must have a route for the VPC CIDR (10.0.0.0/16) pointing through the VPN tunnel. A VPN tunnel can be UP at the IPsec level but carry no traffic if either side is missing the correct route entries. This is the most common cause of VPN connectivity issues after tunnel establishment.
- Why B is wrong: A Site-to-Site VPN uses the virtual private gateway to route traffic between the VPC and on-premises network — it does not require an internet gateway or public IP addresses on EC2 instances. VPN traffic traverses an encrypted tunnel over the internet but enters the VPC through the VGW, not through the IGW. Adding an IGW and public IPs would expose instances to the internet without solving the VPN routing issue.
- Why C is wrong: VPC peering connects two VPCs within AWS, not an on-premises network to a VPC. Peering is not applicable to on-premises connectivity. The Site-to-Site VPN (or AWS Direct Connect) is the correct mechanism for connecting on-premises networks to AWS, and it is already established in this scenario.
- Why D is wrong: A NAT gateway provides outbound internet access for private subnet instances by translating private IPs to a public IP. It does not translate or route traffic between on-premises and VPC networks. VPN traffic between 10.1.0.0/16 and 10.0.0.0/16 uses private IP addressing on both sides with no NAT required — the VPN tunnel handles the encapsulation.
JavaScript is required to use this application.
Please enable JavaScript in your browser to access the full NestedCerts platform.
Contact: support@nestedcerts.com