Hard — SOA-C03 Practice Quiz

Question 1

A company runs a stateful web application behind an Application Load Balancer (ALB) with a target group of six EC2 instances across three Availability Zones. To keep user sessions on the same backend, the team enabled duration-based cookie stickiness on the target group. After a marketing campaign, users report slow response times, and CloudWatch shows two instances consistently at high CPU while the other four remain nearly idle. What is the MOST likely cause of the uneven load and the BEST corrective action?

Accepted Answer

Session stickiness is binding long-lived client sessions to a subset of instances; the imbalance is expected with stickiness, and the team should scale based on connection distribution or reduce the stickiness duration.

Answer

Cross-zone load balancing is disabled; enable it on the ALB so requests are distributed evenly across all registered targets.

Answer

The health check interval is too long; shorten it so the ALB detects and reroutes traffic away from busy instances faster.

Answer

The target group deregistration delay is too high; lower it so busy instances drain connections and receive fewer new requests.

Question 2

A CloudOps engineer manages a production RDS database that was provisioned as part of a CloudFormation stack. The company has a policy requiring that database data must never be lost when infrastructure is decommissioned or when stacks are updated in ways that would replace the database. During a recent stack update, a change to the DB instance identifier caused CloudFormation to replace the resource, and the original data was deleted. What should the engineer configure to ensure the database and its data are preserved even if the resource is removed or replaced?

Accepted Answer

Set the DeletionPolicy attribute to Retain and the UpdateReplacePolicy attribute to Retain on the RDS resource

Answer

Enable termination protection on the CloudFormation stack

Answer

Add a Snapshot value to the DeletionPolicy attribute only

Answer

Enable drift detection on the stack and configure automatic remediation

Question 3

A CloudOps engineer applies a stack update to a production CloudFormation stack that provisions an RDS database and application tier. During the update, one resource fails to create and CloudFormation begins rolling back. The rollback also fails because a security group cannot be deleted (it is still referenced by a resource created outside the template). The stack is now in UPDATE_ROLLBACK_FAILED state. What is the correct way to recover the stack so future updates can proceed?

Accepted Answer

Manually resolve the underlying issue (remove the external reference to the security group), then call ContinueUpdateRollback, optionally skipping the resource that cannot roll back.

Answer

Delete the stack entirely and redeploy from the template, accepting recreation of the RDS database.

Answer

Run drift detection on the stack to force CloudFormation to reconcile the failed resource automatically.

Answer

Create a change set against the failed stack to preview and apply the corrective update.

Question 4

A CloudOps team maintains a large CloudFormation template that provisions a standardized logging configuration (a CloudWatch log group, an IAM role, and a subscription filter) reused across dozens of separate application stacks. When they update the logging pattern, they must currently copy the revised resource definitions into every application template and redeploy each one. They want a way to define the logging pattern once, version it in a registry, and reference it as a reusable building block inside each application template so updates propagate through normal stack updates. Which approach best meets this requirement?

Accepted Answer

Package the logging resources as a CloudFormation module, register it in the CloudFormation registry, and reference the module resource type from each application template

Answer

Convert each application template into a StackSet and deploy the logging resources as a stack instance to every account

Answer

Export the logging resource ARNs from a shared stack and use Fn::ImportValue in each application template

Answer

Create a nested stack that hardcodes the logging resources and copy the AWS::CloudFormation::Stack block into every application template

Question 5

A CloudOps engineer manages an Auto Scaling group of 12 EC2 instances defined in a CloudFormation template. When a new launch configuration with an updated AMI is deployed, the team requires that no more than 3 instances be replaced at a time, that each batch wait for a success signal from the application before continuing, and that the deployment roll back automatically if any batch fails. Which CloudFormation configuration meets these requirements?

Accepted Answer

Add an UpdatePolicy with AutoScalingRollingUpdate specifying MaxBatchSize of 3, MinSuccessfulInstancesPercent, and WaitOnResourceSignals with a PauseTime, and have instances send cfn-signal on successful startup.

Answer

Add a CreationPolicy with ResourceSignal to the Auto Scaling group so that each new instance signals completion during the update.

Answer

Add an UpdatePolicy with AutoScalingReplacingUpdate set to WillReplace true so the entire group is replaced behind a new group only after all instances are healthy.

Answer

Configure a DeletionPolicy of Snapshot on the Auto Scaling group and use a stack policy to limit the number of instances updated per change set.

Question 6

A company allows developers in each project team to create IAM roles for their own applications so they can move quickly. Security is concerned that a developer could create a role with full administrative access and attach it to an application. The security team wants developers to retain the ability to create roles and attach policies, but wants to guarantee that any role they create can never obtain permissions beyond a defined set (such as S3, DynamoDB, and CloudWatch access). What is the MOST appropriate way to enforce this constraint?

Accepted Answer

Attach a permission boundary to the developer IAM users and use a condition that requires them to attach the same permission boundary to any role they create.

Answer

Create a Service Control Policy in AWS Organizations that denies the iam:CreateRole action for all developers.

Answer

Grant developers full IAM access and rely on AWS Config rules to detect and delete any overly permissive roles after creation.

Answer

Use IAM Access Analyzer to continuously scan created roles and automatically revoke administrative permissions.

Question 7

A CloudOps engineer is troubleshooting access for a developer who cannot upload objects to an S3 bucket. The developer is a member of an IAM group that has an attached policy allowing s3:PutObject on the bucket. The bucket policy also allows the developer's IAM user to perform s3:PutObject. However, a permissions boundary attached to the IAM user allows only s3:GetObject and s3:ListBucket. What is the reason the upload is failing?

Accepted Answer

The permissions boundary limits the user's maximum permissions to only the actions it allows, so s3:PutObject is not effectively granted.

Answer

Bucket policies always override IAM identity-based policies, and the bucket policy is missing an explicit s3:PutObject grant.

Answer

IAM group policies do not apply to individual users unless the user is also granted the same policy directly.

Answer

The permissions boundary grants additional permissions, so PutObject should work; the failure must be caused by a bucket ACL.

Question 8

A financial services company must comply with a regulation that requires them to retain full control over the cryptographic key material used to encrypt sensitive data stored in Amazon S3. Their compliance policy mandates that the key material be generated in their on-premises hardware security module (HSM) and that they retain the ability to permanently delete the key material from AWS on demand. A CloudOps engineer must configure AWS KMS to meet these requirements. Which approach should the engineer take?

Accepted Answer

Create an AWS KMS key with imported key material (external origin), generate the key material in the on-premises HSM, and import it with an expiration date so the material can be deleted from AWS while the company retains the original copy.

Answer

Create an AWS managed KMS key and enable automatic annual key rotation to satisfy the requirement for company-controlled key material.

Answer

Create an AWS KMS key backed by an AWS CloudHSM cluster and rely on AWS to generate and manage the key material within the cluster.

Answer

Create a customer managed KMS key with AWS-generated key material and use a key policy that restricts decryption to the company's IAM principals.

Question 9

A CloudOps engineer is troubleshooting an application running on an EC2 instance that must decrypt objects in an S3 bucket encrypted with a customer managed KMS key. The EC2 instance role has an IAM policy granting kms:Decrypt on the key's ARN, but the application receives an AccessDenied error when calling Decrypt. The KMS key policy contains only the default statement granting the root account full access, plus a statement granting a separate administrator role kms:* permissions. What is the MOST likely cause and the correct fix?

Accepted Answer

The KMS key policy does not delegate permission management to IAM; add a key policy statement allowing the account principal (root ARN) to enable IAM policies, or explicitly grant the EC2 role kms:Decrypt in the key policy.

Answer

The EC2 instance role is missing the kms:GenerateDataKey permission; add it to the instance role's IAM policy to allow decryption.

Answer

S3 does not support customer managed KMS keys for object encryption; migrate the bucket to use an AWS managed key (aws/s3) instead.

Answer

The KMS key must have automatic key rotation enabled before any principal can call Decrypt; enable rotation on the key.

Question 10

A financial services company runs a customer-facing web application in us-east-1. The business requires a disaster recovery strategy with a near-zero RTO and RPO so that a full Regional outage causes almost no disruption. The application tier is stateless and already deployed behind an Application Load Balancer and Auto Scaling group. The team wants both Regions to actively serve production traffic and to keep the database synchronized bidirectionally with minimal replication lag. Which approach BEST meets these requirements?

Accepted Answer

Deploy the full application stack in a second Region (us-west-2), use a DynamoDB global table for the data tier, and configure Route 53 latency-based routing with health checks to send users to both Regions simultaneously.

Answer

Implement a pilot light strategy in us-west-2 with core infrastructure switched off, and use Route 53 failover routing to activate it during a disaster.

Answer

Use AWS Backup to copy DynamoDB and EBS backups to us-west-2 on an hourly schedule, and restore the environment manually if us-east-1 fails.

Answer

Deploy a warm standby in us-west-2 running at reduced capacity with a DynamoDB read replica, and scale it up using Route 53 failover routing after a Regional outage.

Question 11

A media company must serve users in Germany from an application stack hosted in eu-central-1 to comply with data-residency laws, while all other European users should be served from an application stack in eu-west-1. Users must never be routed to a region that violates residency rules, even if it means an error is returned. Which Amazon Route 53 configuration meets these requirements?

Accepted Answer

Create geolocation routing records mapping the Germany country to the eu-central-1 endpoint and a Europe continent record to the eu-west-1 endpoint, with no default record.

Answer

Create latency-based routing records for both endpoints so users are automatically directed to the region with the lowest response time.

Answer

Create weighted routing records that split traffic 50/50 between eu-central-1 and eu-west-1.

Answer

Create geolocation routing records for Germany and Europe, plus a default (*) record pointing to eu-west-1 to catch unmatched queries.

Question 12

A CloudOps engineer manages a centralized 'shared services' AWS account that builds a hardened, monthly golden AMI using an SSM Automation runbook. The organization has 40 workload accounts that must be able to launch EC2 instances from the newest golden AMI. The AMI is currently only available in the shared services account, and each workload team must manually copy the AMI ID. The engineer needs an automated, repeatable way to make the latest AMI ID discoverable across all workload accounts without granting broad AMI-sharing permissions each cycle. Which approach best meets these requirements?

Accepted Answer

After building the AMI, have the Automation runbook share the AMI with the AWS Organization and write the AMI ID to an SSM Parameter Store parameter that is shared across the organization via AWS Resource Access Manager (RAM).

Answer

Have the Automation runbook share the AMI with each account ID and write the AMI ID to a Parameter Store SecureString parameter in the shared services account, then have workload accounts read it directly.

Answer

Configure a CloudFormation StackSet that copies the AMI into all 40 accounts on a schedule and stores the AMI ID as a stack output in each account.

Answer

Enable AMI sharing to all accounts and require workload teams to use an EventBridge rule to detect the new AMI and manually update their launch templates.

Question 13

A CloudOps engineer manages three VPCs: VPC-A (10.0.0.0/16), VPC-B (10.1.0.0/16), and VPC-C (10.0.0.0/16). VPC-A is peered with VPC-B, and VPC-B is peered with VPC-C. An EC2 instance in VPC-A cannot reach an instance in VPC-C, even though route tables and security groups in both VPCs allow the traffic. What are the two underlying reasons this connectivity is failing? (The engineer must address both.)

Accepted Answer

VPC peering does not support transitive routing, and VPC-A and VPC-C have overlapping CIDR blocks which prevents a peering connection between them

Answer

Security group references across peering connections are not supported, and NACLs must be updated to allow the traffic

Answer

The peering connections are in different Regions, and inter-region peering requires a Transit Gateway instead

Answer

VPC peering requires a route to the intermediary VPC-B, and the DNS resolution option on the peering connection is disabled

Question 14

A CloudOps engineer is troubleshooting connectivity for an EC2 instance in a private subnet running a web service on port 8080. Instances in the same subnet can reach the service, but a bastion host in a different subnet within the same VPC cannot connect. The instance's security group allows inbound TCP 8080 from the VPC CIDR. The subnet's network ACL has an inbound rule allowing TCP 8080 from the VPC CIDR, but its only outbound rule allows TCP 443 to 0.0.0.0/0. What is the most likely cause of the failure?

Accepted Answer

The network ACL is stateless and lacks an outbound rule permitting the ephemeral port range, so response traffic to the bastion host is blocked.

Answer

The security group is stateful but requires an explicit outbound rule allowing TCP 8080 for the response traffic to leave the instance.

Answer

The bastion host must be in the same subnet as the target instance because network ACLs block all cross-subnet traffic by default.

Answer

The network ACL inbound rule must reference the bastion host's private IP explicitly instead of the VPC CIDR for the connection to succeed.