AWS Certified CloudOps Engineer — Associate (SOA-C03) practice questions and exam guide

An Auto Scaling group should scale out on custom application queue depth published from a Lambda every minute to a CloudWatch metric.

1. Configure a scheduled scaling action every minute to add capacity based on the graph
2. Attach a target-tracking policy referencing the custom queue-depth CloudWatch metric
3. Rely on ASG default health-check settings to indirectly scale when latency climbs
4. Use ASG lifecycle hooks that trigger on the CloudWatch metric to launch instances

Answer: B — Attach a target-tracking policy referencing the custom queue-depth CloudWatch metric

A) Scheduled is time-based, not demand-based. B) Correct — target tracking supports any CloudWatch metric. C) Health checks are for health, not scaling. D) Lifecycle hooks pause transitions, not trigger scaling.

An alarm should transition to ALARM only after three consecutive 5-minute breaches so a single spike does not page the on-call engineer at night.

1. Add three separate alarms and wire an SNS topic that suppresses duplicate messages
2. Configure the alarm with an evaluation period of three and a period of 300 seconds
3. Enable EventBridge scheduled rule to poll the metric only every fifteen minutes
4. Set the missing-data behavior to 'ignore' so the alarm ignores random spikes

Answer: B — Configure the alarm with an evaluation period of three and a period of 300 seconds

A) Reinvents alarm evaluation. B) Correct — datapoints-to-alarm + evaluation periods control the M-of-N flap suppression. C) EventBridge cannot poll metrics. D) Missing-data behavior addresses gaps, not spike suppression.

A rare log-line pattern indicates an internal error and must page ops within one minute of appearing in a CloudWatch log group.

1. Subscribe the log group to a Kinesis Data Firehose that forwards to email address
2. Add a metric filter that increments on the pattern and alarm at threshold one
3. Query the log group with Insights every five minutes via an EventBridge schedule
4. Enable CloudWatch Anomaly Detection on log-volume so it alerts on spikes only

Answer: B — Add a metric filter that increments on the pattern and alarm at threshold one

A) Firehose does not send email. B) Correct — metric filter + alarm converts a pattern match into an alarm quickly. C) 5-minute polling misses the 1-minute goal. D) Anomaly on volume misses low-rate patterns.

An RDS deployment must survive an AZ failure with automatic failover in the same region and no application-driven read-replica promotion logic.

1. Enable Multi-AZ deployment with a synchronous standby in a second AZ
2. Create a cross-region read replica and promote it during outages
3. Provision an Aurora Global Database with a secondary region cluster
4. Attach an EBS Multi-Attach volume across two Availability Zones

Answer: A — Enable Multi-AZ deployment with a synchronous standby in a second AZ

A) Correct — Multi-AZ maintains a synchronous standby; RDS automates DNS failover. B) Read replicas are async and require manual promotion. C) Global Database targets multi-region DR, overkill for single-AZ failure. D) EBS Multi-Attach is single-AZ only.

A batch workload must survive Spot interruptions gracefully by checkpointing progress and resuming on a fresh instance when a two-minute notice arrives.

1. Convert the workload to On-Demand to eliminate interruption risk on the batch fleet
2. Attach a lifecycle hook that pauses Spot termination so ops can intervene manually
3. Handle EC2 Spot interruption notices via IMDS and checkpoint state to S3 before shutdown
4. Rely on ASG Auto Recovery so terminated Spot instances are automatically re-launched

Answer: C — Handle EC2 Spot interruption notices via IMDS and checkpoint state to S3 before shutdown

A) Direction reversal — eliminates the requirement instead of meeting it. B) Lifecycle hooks can't pause Spot terminations. C) Correct — the 2-minute Spot notice via IMDS is the checkpoint trigger. D) Auto Recovery doesn't apply to Spot terminations.

A CloudFormation stack update fails partway through with a subnet CIDR conflict, leaving the stack in UPDATE_ROLLBACK_FAILED. What is the MOST direct first remediation step per SOA-C03 Domain 3 guidance?

1. Delete the entire stack immediately and recreate it from scratch to guarantee a clean state
2. Manually edit resources in the console to match the template, then continue the rollback
3. Identify and skip the specific resource causing the rollback failure via continue-update-rollback, after confirming its actual state
4. Ignore the failed state — CloudFormation will retry automatically on the next scheduled drift check

Answer: C — Identify and skip the specific resource causing the rollback failure via continue-update-rollback, after confirming its actual state

A) Destroys resources unnecessarily and risks data loss for a state that's usually recoverable. B) Manual console edits without reconciling the stack's tracked state often make the drift worse and don't resolve the ROLLBACK_FAILED status. C) Correct — continue-update-rollback with resources-to-skip (after verifying the resource's real state) is the documented path out of UPDATE_ROLLBACK_FAILED. D) CloudFormation does not auto-retry a failed rollback; drift detection is a separate, unrelated feature.

Per the SOA-C03 exam guide, which THIRD-PARTY tools does AWS explicitly call out under Domain 3's 'manage third-party tools to automate resource deployment' skill?

1. Ansible and Ansible Tower exclusively
2. Chef and Puppet exclusively
3. Terraform and Git
4. Jenkins and CircleCI exclusively

Answer: C — Terraform and Git

A) Ansible isn't the pair AWS names in this skill statement. B) Chef/Puppet are configuration-management tools, not the ones named here (and OpsWorks Chef integration is being deprecated, separate from this skill). C) Correct — the SOA-C03 exam guide explicitly names Terraform and Git as example third-party tools for this skill. D) Jenkins/CircleCI are CI/CD tools, not the pair called out in this specific skill statement.

A CI/CD pipeline must invalidate a CloudFront cache after each deployment so users see fresh static assets before TTL expiry.

1. Add a pipeline stage that calls CreateInvalidation on the CloudFront distribution paths
2. Reduce the CloudFront TTL to zero seconds globally so no caching happens on deploys ever
3. Rename every deployed file with a build-hash suffix and rely on cache-busting alone here
4. Rely on CloudFront's automatic behavior to detect origin-object changes on demand daily

Answer: A — Add a pipeline stage that calls CreateInvalidation on the CloudFront distribution paths

A) Correct - invalidations at deploy time expire cached paths. B) Direction reversal - kills caching. C) Half-right - hash busting works for JS/CSS but not for top-level HTML. D) CloudFront does not auto-detect origin changes.

Sensitive workloads must run on dedicated hardware for compliance, with instances placed on physical servers not shared with other AWS customers.

1. Launch instances with Dedicated Host tenancy managed by the customer directly
2. Use placement groups in cluster strategy across a single Availability Zone only
3. Enable EBS encryption and IAM instance-profile scoping on default tenancy
4. Attach the compliance tag and configure Trusted Advisor to alert on violations

Answer: A — Launch instances with Dedicated Host tenancy managed by the customer directly

A) Correct — Dedicated Host tenancy gives customer-visible physical server placement. B) Placement groups govern placement across hardware, not tenancy. C) Encryption is unrelated to tenancy. D) Tagging is bookkeeping.

A workload must send TLS-encrypted traffic to an internal endpoint using a certificate issued by an internal PKI trusted only inside the org.

1. Purchase a public CA certificate and install it manually on every internal endpoint host
2. Provision a private certificate via AWS Certificate Manager Private CA and export it now
3. Rely on ACM public certificates trusted globally and configure DNS validation on renewal
4. Use S3 default encryption to protect the traffic since the endpoint stores objects in a bucket

Answer: B — Provision a private certificate via AWS Certificate Manager Private CA and export it now

A) Public CA costs and is not tied to internal PKI. B) Correct - ACM Private CA issues internal-trust certificates. C) Public cert is not internal-PKI-issued. D) Bucket encryption is unrelated to TLS.

A team wants to allowlist S3 access from a VPC to only the specific bucket used by their workload, blocking other buckets entirely.

1. Rely on IAM policies attached to the workload's role to grant access only to that bucket ARN
2. Add a bucket policy on the S3 bucket that references the VPC ID via aws:SourceVpc condition
3. Configure a security group egress rule to the S3 prefix list and rely on IAM for bucket scope
4. Attach a VPC endpoint policy on the S3 gateway endpoint that allows only that bucket ARN

Answer: D — Attach a VPC endpoint policy on the S3 gateway endpoint that allows only that bucket ARN

A) IAM scopes the identity, not the network. B) Half-right; bucket policy controls the bucket, not other buckets. C) SGs don't scope by bucket. D) Correct - VPC endpoint policy limits which buckets are reachable through the endpoint.

A media site wants CloudFront to fail over from a primary origin to a secondary origin when the primary returns 5xx errors.

1. Use Lambda@Edge on origin response to retry the request on the second origin
2. Rely on Route 53 health checks to swap origin DNS entries when failure occurs
3. Configure CloudFront custom error pages to redirect to a backup S3 bucket URL
4. Enable an origin group with primary and secondary and configured failover codes

Answer: D — Enable an origin group with primary and secondary and configured failover codes

A) Lambda@Edge can retry but is more complex than the native origin group. B) DNS TTL delays failover; not the CloudFront-native path. C) Error pages serve static content, not a secondary origin. D) Correct — CloudFront origin groups implement native origin failover on configured status codes.

AWS GuardDuty?

Threat detection. Analyzes CloudTrail, VPC Flow Logs, DNS logs for anomalies.

VPC components?

Subnets, route tables, IGW, NAT gateway/instance, NACLs, security groups, VPC peering.

Need centralized log management for 100 accounts?

Org-wide CloudWatch Logs subscription → Kinesis Firehose → S3 + analysis.

EC2 placement groups?

Cluster (low latency, same AZ), Spread (across hardware), Partition (logical groups).

Config aggregator?

Centralizes Config data across accounts and regions.

Lambda can't access RDS — checks?

Same VPC? SG allows port? Subnets configured? IAM permissions?