Amazon AWS Certified CloudOps Engineer - Associate SOA-C03 Exam Questions

Page: 1 / 14
Total 219 questions

Want more questions? Get Premium Access.
()

Question 1

A company has created a new video-on-demand (VOD) application. The application runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The company configured an Amazon CloudFront distribution and set the ALB as the origin. Because of increasing application demand, the company wants to move all video files to a central Amazon S3 bucket.

A SysOps administrator needs to ensure that video files can be cached at edge locations after the company migrates the files to Amazon S3.

Which solution will meet this requirement?

AConfigure CloudFront to send the X-Forwarded-For header to the origin and to redirect video requests to Amazon S3 instead of the ALB.

BConfigure a new CloudFront cache behavior to route to Amazon S3 as a new origin, based on matching a URL path pattern.

CConfigure URL signing in the CloudFront distribution by using a custom policy. Ensure that video files are accessed through signed URLs only.

DConfigure a CloudFront origin group. Specify the required HTTP status codes to direct connection attempts to a secondary origin.

Answer : B

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

To ensure video files are cached at CloudFront edge locations after migrating the files to Amazon S3, CloudFront must be able to fetch those video objects directly from S3 as an origin. The most operationally straightforward pattern is to add S3 as a second origin and create a separate cache behavior that routes requests for video paths (for example, /video/* or /*.mp4) to the S3 origin. With this configuration, CloudFront caches the S3-served objects at edge locations according to the cache policy/headers, while the existing ALB origin continues serving dynamic application paths. This isolates static media delivery from the application tier and improves performance by maximizing cache hits at the edge.

Option A is not how CloudFront origin selection works: CloudFront does not ''redirect'' to S3 based on headers; it selects an origin per behavior. Option C (signed URLs) is an access-control mechanism and does not, by itself, ensure the objects are retrieved from S3 or cached correctly. Option D (origin groups) is for origin failover (primary/secondary) and does not provide path-based routing to ensure videos come from S3.

Amazon CloudFront Developer Guide -- Origins and Cache Behaviors (path pattern routing)

Amazon S3 User Guide -- Using S3 as an origin for CloudFront

AWS SysOps Administrator Study Guide -- Content delivery patterns with CloudFront

Question 2

A company runs a high performance computing (HPC) data-processing application on Amazon EC2 instances in one Availability Zone within a development environment. The application uses a dataset that the company stores on an Amazon S3 general purpose bucket in the same AWS Region as the EC2 instances.

A SysOps administrator must improve the application's performance for retrieval of objects from Amazon S3.

Which solution will meet these requirements?

AEnable S3 Transfer Acceleration for the S3 bucket. Create an S3 access point for the bucket. Update the application to use the access point.

BCreate an S3 Lifecycle configuration for the S3 bucket to move all objects to the S3 Express One Zone storage class. Update the application to use an S3 Regional endpoint.

CCreate a second general purpose S3 bucket in the same Region. Copy the objects from the original bucket to the new bucket. Use the S3 Express One Zone storage class to store the objects in the new bucket. Update the application to use an S3 Regional endpoint.

DCreate an S3 directory bucket in the same Availability Zone. Import objects from the original bucket to the new bucket. Use the S3 Express One Zone storage class to store the objects in the new bucket. Update the application to use an S3 Zonal endpoint.

Answer : D

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The correct answer is D because Amazon S3 Express One Zone with directory buckets and zonal endpoints is specifically designed for single--Availability Zone, high-performance workloads such as HPC, machine learning, and analytics applications running on Amazon EC2. AWS CloudOps documentation states that S3 Express One Zone delivers single-digit millisecond latency and up to 10x higher request performance compared to general purpose S3 buckets when data is accessed from the same Availability Zone.

An S3 directory bucket is required to use the S3 Express One Zone storage class. These buckets are explicitly associated with a single Availability Zone and use zonal endpoints, which eliminate cross-AZ network hops and significantly reduce latency. Importing the data from the existing general purpose bucket ensures compatibility while achieving maximum throughput and lowest latency.

Option A is incorrect because S3 Transfer Acceleration is optimized for long-distance, internet-based transfers, not for in-Region HPC workloads. Option B is incorrect because lifecycle policies cannot move objects into S3 Express One Zone, and S3 Express One Zone does not use Regional endpoints. Option C is incorrect because general purpose buckets do not support zonal endpoints and therefore cannot achieve the same performance benefits.

AWS CloudOps performance optimization guidance clearly identifies S3 directory buckets with S3 Express One Zone and zonal endpoints as the optimal architecture for high-throughput, low-latency workloads in a single Availability Zone.

Amazon S3 User Guide -- S3 Express One Zone and Directory Buckets

AWS SysOps Administrator Study Guide -- Storage Performance Optimization

AWS Well-Architected Framework -- Performance Efficiency Pillar

Question 3

A company runs an application on Amazon EC2 instances in an Auto Scaling group. Scale-out actions take a long time because of long-running boot scripts. The CloudOps engineer must reduce scale-out time without overprovisioning.

Which solution will meet these requirements?

AChange the launch configuration to use a larger instance size.

BIncrease the minimum number of instances in the Auto Scaling group.

CAdd a predictive scaling policy to the Auto Scaling group.

DAdd a warm pool to the Auto Scaling group.

Answer : D

An Auto Scaling warm pool keeps pre-initialized instances in a stopped or running state, allowing them to be quickly attached to the Auto Scaling group when scaling events occur. This significantly reduces scale-out latency caused by long bootstrapping scripts.

Unlike increasing the minimum instance count, warm pools do not permanently overprovision resources. Predictive scaling improves timing but does not eliminate boot time delays.

Therefore, warm pools provide the fastest scale-out with minimal cost overhead.

Question 4

A company has a new security policy that requires all Amazon Elastic Block Store (Amazon EBS) volumes to be encrypted at rest. The company needs to use a custom key policy to manage access to the encryption keys. The company must rotate the keys once each year.

Which solution will meet these requirements with the LEAST operational overhead?

ACreate AWS KMS symmetric customer managed keys. Enable automatic key rotation.

BUse AWS owned AWS KMS keys across the company's AWS environment.

CCreate AWS KMS asymmetric customer managed keys. Enable automatic key rotation.

DCreate AWS KMS symmetric customer managed keys by using imported key material. Rotate the keys on a yearly basis.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The correct answer is A because AWS KMS symmetric customer managed keys with automatic key rotation provide encryption, access control, and compliance with minimal operational effort. AWS CloudOps documentation states that Amazon EBS encryption supports AWS KMS symmetric keys only, and customer managed keys allow administrators to define custom key policies to control access.

Automatic key rotation is supported for symmetric customer managed keys and rotates the backing key material once every year, fully satisfying the company's rotation requirement without manual intervention. This approach minimizes operational overhead while maintaining strong security controls and auditability.

Option B is incorrect because AWS owned keys do not allow custom key policies and therefore cannot meet the access control requirement. Option C is incorrect because asymmetric KMS keys are not supported for EBS encryption. Option D is incorrect because imported key material requires manual rotation and re-import, increasing operational complexity and risk.

AWS CloudOps security best practices strongly recommend customer managed symmetric keys with automatic rotation when organizations need fine-grained access control, regulatory compliance, and low maintenance overhead.

AWS KMS Developer Guide -- Customer Managed Keys and Rotation

Amazon EBS User Guide -- Encryption at Rest

AWS SysOps Administrator Study Guide -- Security and Key Management

Question 5

A CloudOps engineer has an AWS CloudFormation template of the company's existing infrastructure in us-west-2. The CloudOps engineer attempts to use the template to launch a new stack in eu-west-1, but the stack partially deploys, receives an error message, and then rolls back.

Why would this template fail to deploy? (Select TWO.)

AThe template referenced an IAM user that is not available in eu-west-1.

BThe template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1.

CThe template did not have the proper level of permissions to deploy the resources.

DThe template requested services that do not exist in eu-west-1.

ECloudFormation templates can be used only to update existing services.

Answer : B, D

Amazon Machine Images (AMIs) are Region-specific. An AMI ID that exists in us-west-2 does not automatically exist in eu-west-1. If a CloudFormation template references a hardcoded AMI ID from one Region, stack creation in another Region will fail when that AMI cannot be found.

Additionally, not all AWS services or service features are available in every AWS Region. If the template includes a resource type or feature that is unsupported in eu-west-1, CloudFormation will fail during stack creation.

IAM users are global resources, not Region-specific, so Option A is incorrect. Permission issues would typically fail immediately and are not Region-dependent. Option E is incorrect because CloudFormation can both create and update resources.

Therefore, Region-specific AMIs and unavailable services are the valid reasons for failure.

Question 6

A company is using an Amazon Aurora MySQL DB cluster that has point-in-time recovery, backtracking, and automatic backups enabled. A CloudOps engineer needs to be able to roll back the DB cluster to a specific recovery point within the previous 72 hours. Restores must be completed in the same production DB cluster.

Which solution will meet these requirements?

ACreate an Aurora Replica. Promote the replica to replace the primary DB instance.

BCreate an AWS Lambda function to restore an automatic backup to the existing DB cluster.

CUse backtracking to rewind the existing DB cluster to the desired recovery point.

DUse point-in-time recovery to restore the existing DB cluster to the desired recovery point.

Answer : C

Amazon Aurora backtracking allows a DB cluster to be rewound to a specific point in time without creating a new DB cluster. This feature is designed for fast recovery from logical errors, such as accidental data changes, within a configured backtrack window. Because backtracking operates directly on the existing cluster, it satisfies the requirement that the restore occur in the same production DB cluster.

Point-in-time recovery (Option D) restores data by creating a new DB cluster, which violates the requirement. Option A involves promoting a replica, which does not allow rolling back to an arbitrary historical point. Option B introduces unnecessary complexity and is not supported for restoring directly into the same cluster.

Backtracking provides near-instant rollback and minimal operational disruption, making it the correct solution.

Question 7

A web application runs on Amazon EC2 instances in the us-east-1 Region and the us-west-2 Region. The instances run behind an Application Load Balancer (ALB) in each Region. An Amazon Route 53 hosted zone controls DNS records.

The instances in us-east-1 are production resources. The instances in us-west-2 are for disaster recovery. EC2 Auto Scaling groups are configured based on the ALBRequestCountPerTarget metric in both Regions.

A SysOps administrator must implement a solution that provides failover from us-east-1 to us-west-2. The instances in us-west-2 must be used only for failover.

Which solution will meet these requirements?

AImplement a Route 53 health check and a failover routing policy for the hosted zone. Configure the failover routing policy to automatically redirect traffic to the resources in us-west-2.

BImplement a Route 53 health check and a latency routing policy for the hosted zone. Configure the latency routing policy to automatically redirect traffic to the resources in us-west-2.

CIn us-east-1, create an Amazon CloudWatch alarm that enters ALARM state when an EC2 instance is terminated. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.

DIn us-west-2, create an Amazon CloudWatch alarm that enters ALARM state when resources in us-east-1 cannot be resolved. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The requirement is classic active-passive (production in us-east-1, DR in us-west-2 ''only for failover''). The most operationally efficient and purpose-built solution is Route 53 failover routing combined with health checks. With failover routing, Route 53 designates one record as PRIMARY (us-east-1) and another as SECONDARY (us-west-2). Route 53 continuously evaluates the health check associated with the primary endpoint (commonly the ALB DNS name or a specific health-check path). If the primary fails, Route 53 automatically returns the secondary record, directing client DNS resolution to the DR region. This ensures us-west-2 is used only when us-east-1 is unhealthy, directly matching the requirement.

Latency routing (Option B) is designed to route users to the region with the lowest latency, which can actively send traffic to us-west-2 even when us-east-1 is healthy---violating the ''DR only'' constraint. Options C and D introduce custom automation (CloudWatch + Lambda + DNS record updates) that increases operational overhead, adds failure modes, and is unnecessary because Route 53 already provides managed health-check-based failover. Additionally, ''EC2 instance terminated'' is not a reliable proxy for full application availability, and DNS modification automation is more complex than using native Route 53 failover policies.

Amazon Route 53 Developer Guide -- Health checks and failover routing policy

AWS Well-Architected Framework -- Reliability pillar (failover, DR patterns)

AWS SysOps Administrator Study Guide -- DNS failover and Route 53 routing policies