Medium — SOA-C03 Practice Quiz

Question 1

A CloudOps engineer manages several Application Load Balancers that use TLS certificates issued by AWS Certificate Manager (ACM). Some certificates were imported into ACM from a third-party certificate authority, while others were requested directly from ACM. The security team wants proactive alerts at least 30 days before any certificate expires so they can renew in time. Which approach requires the LEAST ongoing operational effort to ensure the team is notified before expiration?

Accepted Answer

Create an EventBridge rule that matches the ACM 'ACM Certificate Approaching Expiration' event and routes it to an SNS topic to notify the security team.

Answer

Rely on ACM automatic renewal for all certificates, since ACM renews certificates before they expire without any manual intervention.

Answer

Enable the ACM-managed AWS Config rule and use a Lambda function that runs daily to describe each certificate and calculate days to expiry, then publish to SNS.

Answer

Create a CloudWatch alarm on the ACM DaysToExpiry metric for each certificate ARN and set the threshold to 30 days, sending notifications to SNS.

Question 2

A CloudOps engineer is deploying a global web application that uses Amazon CloudFront as the CDN with a custom domain name. The engineer requests an ACM certificate in the eu-west-1 Region (where the origin ALB resides) and attempts to associate it with the CloudFront distribution, but the certificate does not appear as a selectable option in the CloudFront console. What is the correct action to resolve this?

Accepted Answer

Request or import the ACM certificate in the us-east-1 Region, because CloudFront only accepts certificates from us-east-1.

Answer

Enable cross-region certificate replication on the eu-west-1 certificate so CloudFront can reference it.

Answer

Attach the ACM certificate to the origin ALB first, then CloudFront will automatically inherit it.

Answer

Convert the ACM certificate to an IAM server certificate and upload it to the us-east-1 Region.

Question 3

A company runs internal microservices on EC2 instances within a private VPC. Security policy requires all service-to-service communication to use TLS with certificates issued from a trusted internal certificate authority. The certificates must not be publicly trusted, and the company wants to automate issuance and renewal without managing its own CA infrastructure on servers. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Private CA (AWS Certificate Manager Private Certificate Authority) to issue certificates for internal services, integrating with ACM for automated renewal.

Answer

Request public certificates from AWS Certificate Manager (ACM) and distribute them to each internal service.

Answer

Deploy an OpenSSL-based CA on an EC2 instance and write cron jobs to issue and rotate certificates for each microservice.

Answer

Import self-signed certificates into ACM and reference them from each EC2 instance.

Question 4

A CloudOps engineer deploys an Application Load Balancer (ALB) across three Availability Zones, but each AZ contains a different number of registered targets: AZ-a has 8 instances, AZ-b has 4, and AZ-c has 2. Users report that instances in AZ-c are experiencing significantly higher CPU utilization than instances in the other zones. What is the most likely cause of this uneven load?

Accepted Answer

Cross-zone load balancing has been disabled on the ALB, so traffic is split evenly per AZ, forcing the 2 instances in AZ-c to handle a full one-third of all requests.

Answer

The ALB distributes traffic evenly across all healthy targets regardless of AZ because cross-zone load balancing is always enabled and cannot be disabled for ALBs.

Answer

The ALB is using least-outstanding-requests routing, which always sends more traffic to zones with fewer instances.

Answer

Sticky sessions are enabled, which forces all traffic into the AZ with the fewest instances.

Question 5

A CloudOps engineer manages a single Application Load Balancer that fronts three microservices running on separate Amazon ECS services. Requests to /api/orders must reach the orders service, /api/inventory must reach the inventory service, and all other requests must reach a default web frontend service. All three services are already registered in separate target groups. What is the correct way to configure the ALB to achieve this routing?

Accepted Answer

Create listener rules on the HTTPS listener that use path-based conditions (/api/orders*, /api/inventory*) to forward to the respective target groups, and set the default action to forward to the web frontend target group.

Answer

Create three separate Application Load Balancers, one per target group, and use Route 53 weighted records to distribute traffic based on the request path.

Answer

Configure a single listener rule with host-based conditions mapping each hostname to a target group, then rely on the security groups to filter requests by path.

Answer

Attach all three target groups to the listener's default action as a weighted forward action so the ALB balances requests across services.

Question 6

A company runs a stateless web application behind an Application Load Balancer (ALB) with an EC2 Auto Scaling group across three Availability Zones. During scale-in events, users occasionally report failed requests and reset connections. The CloudOps engineer confirms that instances are being terminated while still actively serving in-flight requests. Which configuration change will MOST directly prevent these dropped requests during scale-in?

Accepted Answer

Increase the ALB target group deregistration delay (connection draining) so in-flight requests can complete before instances are terminated

Answer

Enable cross-zone load balancing on the Application Load Balancer

Answer

Change the target group health check protocol from HTTP to HTTPS

Answer

Increase the Auto Scaling group health check grace period

Question 7

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Recently, an instance's web server process crashed, returning HTTP 503 errors to users, but the Auto Scaling group did not replace the instance for a long time. The EC2 instance itself remained running and passed all EC2 system and instance status checks. What should the CloudOps engineer configure so that Auto Scaling replaces instances that fail the application-level check?

Accepted Answer

Change the Auto Scaling group's health check type to ELB and ensure the ALB target group health check targets the application's health endpoint.

Answer

Enable EC2 detailed monitoring so that status checks are evaluated every minute instead of every five minutes.

Answer

Increase the Auto Scaling group's health check grace period so instances have more time to recover before replacement.

Answer

Attach a target-tracking scaling policy based on the ALB request count per target metric.

Question 8

A CloudOps engineer manages an EC2 Auto Scaling group that uses a launch template. The security team releases a hardened AMI monthly, and the engineer updates the launch template by creating a new version each time with the new AMI ID. However, when the Auto Scaling group scales out, newly launched instances continue to use the older AMI from the previous month. The Auto Scaling group is configured to use the launch template with version set to a specific number. What is the MOST appropriate change to ensure new instances always launch with the newest hardened AMI without manual reconfiguration each month?

Accepted Answer

Set the Auto Scaling group's launch template version to '$Latest' so it automatically uses the most recently created template version.

Answer

Enable instance refresh on the Auto Scaling group and rely on it to detect the new AMI automatically.

Answer

Set the Auto Scaling group's launch template version to '$Default' and leave the default version pointing at the original template version.

Answer

Replace the launch template with a launch configuration that references the AMI ID directly.

Question 9

A company runs a stateful application on EC2 instances behind an Application Load Balancer in an Auto Scaling group. During scale-out events, new instances require about 4 minutes to download configuration files, warm a local cache, and register with an internal service registry before they can serve traffic. Currently, the ALB begins routing requests to instances as soon as they pass the EC2 status checks, causing intermittent errors from instances that are not yet fully initialized. Which approach best ensures instances only receive traffic after initialization completes?

Accepted Answer

Add an EC2 Auto Scaling lifecycle hook for the launch (Pending:Wait) state and have the instance signal CompleteLifecycleAction once initialization finishes.

Answer

Increase the Auto Scaling group's default cooldown period to 300 seconds so new instances have time to initialize.

Answer

Change the Auto Scaling group health check type from EC2 to ELB so unhealthy instances are replaced.

Answer

Configure a target-tracking scaling policy with a longer estimated instance warmup value.

Question 10

A CloudOps engineer manages an EC2 Auto Scaling group spanning three Availability Zones behind an Application Load Balancer. After a recent AZ impairment, one AZ was temporarily removed and instances were relaunched in the two remaining AZs. Now that all three AZs are healthy again, the engineer notices the group has 8 instances in AZ-a, 8 in AZ-b, and only 2 in AZ-c, creating an uneven distribution. What is the MOST appropriate way to ensure the group automatically restores balanced capacity across all three AZs going forward?

Accepted Answer

Rely on the Auto Scaling group's built-in Availability Zone rebalancing, which launches instances in under-provisioned AZs and terminates instances in over-provisioned AZs to even out distribution.

Answer

Manually terminate three instances each in AZ-a and AZ-b so the group launches replacements evenly across all AZs.

Answer

Attach a target-tracking scaling policy on CPU utilization so scaling activity redistributes instances across the AZs.

Answer

Create a scheduled action that sets desired capacity to zero nightly and back to 18 each morning to force even redistribution.

Question 11

A CloudOps engineer manages a stateless web tier running on an EC2 Auto Scaling group backed by a single launch template that specifies one instance type and 100% On-Demand capacity. During a regional capacity event, the group failed to launch replacement instances because the specified instance type was temporarily unavailable in two of the three subnets, causing reduced availability. The team wants to improve the group's resilience to capacity shortages while also lowering cost, without managing multiple Auto Scaling groups. What should the engineer do?

Accepted Answer

Configure a mixed instances policy on the Auto Scaling group with multiple instance types and a combination of On-Demand and Spot capacity, using the capacity-optimized allocation strategy.

Answer

Create three separate Auto Scaling groups, one per subnet, each with a different instance type, and place them behind the same load balancer.

Answer

Increase the desired capacity of the existing group and enable predictive scaling so extra instances are pre-provisioned before capacity shortages occur.

Answer

Switch the launch template to use a larger instance type from the same family and enable detailed monitoring to detect launch failures faster.

Question 12

A CloudOps engineer manages an EC2 Auto Scaling group that processes long-running batch jobs. Each instance can take up to two hours to finish a job. During target-tracking scale-in events triggered by low average CPU, the ASG frequently terminates instances that are still mid-job, causing the batch work to be lost and reprocessed. The team wants scale-in to avoid terminating instances that are actively processing a job, while still allowing the group to shrink when instances become idle. What is the MOST appropriate solution?

Accepted Answer

Have the application enable instance scale-in protection on an instance when it starts a job and disable it when the job completes.

Answer

Increase the health check grace period on the Auto Scaling group so instances have more time before termination.

Answer

Switch the scaling policy from target tracking to a step scaling policy based on CPU utilization.

Answer

Set the Auto Scaling group's default cooldown period to two hours to match the maximum job duration.

Question 13

A financial services company runs a production application backed by an Amazon Aurora MySQL-compatible cluster in us-east-1. The compliance team requires a disaster recovery solution in us-west-2 with an RPO of under 1 second and an RTO of a few minutes, with minimal impact on the primary database's write performance. Which approach best meets these requirements?

Accepted Answer

Configure an Aurora global database with a secondary cluster in us-west-2 and promote it during a regional outage.

Answer

Enable AWS Backup with cross-Region copy of Aurora snapshots on an hourly schedule and restore in us-west-2 when needed.

Answer

Create a cross-Region Aurora read replica in us-west-2 using standard binlog-based asynchronous replication.

Answer

Use Aurora Multi-AZ deployment with reader instances spread across three Availability Zones in us-east-1.

Question 14

A CloudOps engineer must ensure that any S3 bucket created without default encryption is automatically remediated within minutes, with no human intervention. AWS Config already has a managed rule (s3-bucket-server-side-encryption-enabled) evaluating bucket compliance. The team wants a low-maintenance, event-driven solution that applies default encryption to noncompliant buckets. Which approach best meets these requirements?

Accepted Answer

Configure the AWS Config rule with an automatic remediation action that invokes the AWS-EnableS3BucketEncryption Systems Manager Automation document.

Answer

Create a CloudWatch alarm on the AWS Config compliance metric that triggers an SNS notification to the security team for manual remediation.

Answer

Enable S3 Event Notifications for bucket creation events and forward them to an SQS queue polled by an EC2 instance running a remediation script.

Answer

Schedule a Lambda function every 5 minutes using EventBridge to scan all buckets and enable encryption on those missing it.

Question 15

A CloudOps engineer manages an AWS Organization with 40 member accounts. Compliance requires that all EBS volumes and RDS databases across every account be backed up on a consistent schedule, with backups stored centrally and protected from deletion by individual account administrators. The team wants to enforce this centrally without deploying scripts into each account. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a delegated administrator account, create a backup policy in AWS Organizations, and assign resources using tags across all member accounts.

Answer

Create an EventBridge scheduled rule in each member account that triggers a Lambda function to invoke EBS and RDS snapshot APIs on the defined schedule.

Answer

Deploy an AWS Backup plan in a single central account and grant that account IAM permissions to snapshot resources in all other member accounts.

Answer

Enable automated RDS backups and EBS Data Lifecycle Manager policies independently in each of the 40 member accounts.

Question 16

A financial services company runs a production Amazon RDS for PostgreSQL database in the us-east-1 Region. Compliance requires that, in the event of a full Regional outage, the company must be able to restore the database in us-west-2 with a Recovery Point Objective (RPO) of no more than 1 hour and a Recovery Time Objective (RTO) of a few hours. The CloudOps team wants a managed, centrally governed solution that requires minimal custom scripting. Which approach best meets these requirements?

Accepted Answer

Create an AWS Backup plan with a backup rule that runs hourly and configure a cross-Region copy action to copy each recovery point to us-west-2.

Answer

Enable automated RDS backups with a 7-day retention period and rely on point-in-time recovery, which automatically replicates to us-west-2.

Answer

Create a cross-Region read replica of the RDS instance in us-west-2 and promote it manually only after a Regional failure is confirmed.

Answer

Write a Lambda function triggered every 6 hours to create a manual DB snapshot and copy it to us-west-2 using the RDS API.

Question 17

A CloudOps engineer manages a production Amazon RDS for PostgreSQL database that supports an order-processing application. The business requires the ability to recover the database to any specific second within the last 5 days in case of accidental data corruption from a bad application deployment. The team currently relies only on daily automated snapshots taken at 2 AM. During a recent incident, a faulty batch job corrupted data at 3 PM, and the team could only restore to the previous night's snapshot, losing 13 hours of transactions. Which action best meets the recovery requirement going forward?

Accepted Answer

Ensure automated backups are enabled with a 5-day retention period and use point-in-time recovery (PITR) to restore to a specific timestamp.

Answer

Increase the automated snapshot frequency to run every hour using an AWS Backup scheduled plan.

Answer

Enable a Multi-AZ deployment so the standby replica can be promoted to the exact moment before corruption.

Answer

Create a cross-Region read replica and promote it to recover data from before the corruption event.

Question 18

A financial services company uses AWS Backup to protect its RDS databases, EBS volumes, and EFS file systems across multiple accounts. Auditors require documented proof that backups can actually be restored within the defined 4-hour RTO. The CloudOps team currently performs manual restores quarterly, but this is time-consuming and inconsistent. Which approach provides an automated, repeatable way to validate that backups are recoverable and meet RTO expectations?

Accepted Answer

Enable AWS Backup restore testing plans that automatically run scheduled restore jobs on selected recovery points and validate completion

Answer

Enable AWS Backup Vault Lock in compliance mode to guarantee that recovery points cannot be altered before restore

Answer

Configure cross-Region copy of all recovery points and rely on the copy job success status as proof of recoverability

Answer

Create an EventBridge rule that alerts when a backup job completes successfully and log the notification for auditors

Question 19

A financial services company must ensure that its RDS and EBS backups cannot be deleted or altered before their retention period expires, even by administrators with full IAM permissions. This is a regulatory requirement to protect against accidental deletion and ransomware. The team already centralizes backups using AWS Backup. Which action best satisfies this requirement?

Accepted Answer

Enable AWS Backup Vault Lock in compliance mode with a defined minimum and maximum retention period on the backup vault.

Answer

Attach an IAM policy to all administrators that denies the backup:DeleteRecoveryPoint action.

Answer

Enable AWS Backup Vault Lock in governance mode on the backup vault.

Answer

Enable versioning and MFA delete on the S3 bucket where AWS Backup stores recovery points.

Question 20

A company runs a batch analytics application in a single AWS Region. The workload is only used for monthly reporting and is not customer-facing. Leadership has approved a disaster recovery plan with an RTO of 24 hours and an RPO of 24 hours, and they want the lowest possible ongoing cost. The application data is stored in Amazon S3 and an Amazon RDS database. Which DR strategy best meets these requirements?

Accepted Answer

Backup and restore — replicate S3 data and copy RDS snapshots to a second Region, and provision infrastructure only when a disaster is declared

Answer

Pilot light — keep a minimal core of infrastructure (such as a stopped RDS instance) always running in the second Region

Answer

Warm standby — run a scaled-down but fully functional copy of the environment in the second Region at all times

Answer

Multi-site active/active — run full production capacity in two Regions simultaneously with Route 53 routing traffic to both

Question 21

A CloudOps engineer is deploying a fleet of EC2 web servers using an AWS CloudFormation template. The requirement is that after each instance launches, it must install packages, write configuration files, and start services in a defined order, and the CloudFormation stack must not report CREATE_COMPLETE until the instances have finished their configuration and signaled success. Which approach best meets these requirements?

Accepted Answer

Use AWS::CloudFormation::Init metadata with cfn-init in UserData, and pair a CreationPolicy on the instance with cfn-signal to report bootstrap completion.

Answer

Place all installation commands in the instance UserData script and rely on the default stack timeout to determine when configuration completes.

Answer

Use a DependsOn attribute between the EC2 instances and a wait resource so CloudFormation pauses until packages are installed.

Answer

Configure an SSM State Manager association to bootstrap the instances after the stack reaches CREATE_COMPLETE.

Question 22

A CloudOps engineer manages a production application using a single AWS CloudFormation stack that includes an RDS instance, an EC2 Auto Scaling group, and several security groups. Before applying an update to the template that modifies the RDS parameter group and instance class, the team wants to know exactly which resources will be modified, replaced, or deleted so they can avoid an unexpected database replacement during the deployment. What should the engineer do?

Accepted Answer

Create a CloudFormation change set from the updated template and review it before executing the update.

Answer

Run CloudFormation drift detection on the stack to identify which resources would be affected by the update.

Answer

Enable termination protection on the stack and then execute the update directly.

Answer

Deploy the updated template to a new stack and manually compare resources against the production stack.

Question 23

A CloudOps engineer uses AWS CloudFormation to launch a single EC2 instance that runs a lengthy application installation script via UserData. Currently CloudFormation marks the stack as CREATE_COMPLETE as soon as the instance launches, but before the application finishes installing, causing downstream resources to fail because the app is not yet ready. The engineer needs the stack to wait until the application setup completes successfully before reporting the resource as created. What is the MOST appropriate way to achieve this?

Accepted Answer

Add a CreationPolicy with a ResourceSignal timeout to the EC2 instance and call cfn-signal from the UserData script once installation succeeds

Answer

Add a DependsOn attribute referencing the EC2 instance to all downstream resources

Answer

Configure a DeletionPolicy of Retain on the EC2 instance so CloudFormation waits before completing

Answer

Enable termination protection on the stack and use drift detection to confirm the application is ready

Question 24

A CloudOps engineer manages infrastructure using multiple CloudFormation stacks. A networking stack creates a VPC and subnets, and several application stacks need to reference the subnet IDs from the networking stack. The engineer wants a solution where application stacks can consume these values by name, and CloudFormation prevents the networking stack from being deleted or its exported values from being changed while they are still in use. Which approach meets these requirements?

Accepted Answer

Use the Outputs section of the networking stack with the Export field, and reference the values in application stacks using the Fn::ImportValue intrinsic function.

Answer

Store the subnet IDs in the Mappings section of each application stack and update them manually whenever the networking stack changes.

Answer

Pass the subnet IDs as CloudFormation parameters to each application stack manually at deployment time.

Answer

Use nested stacks so the networking resources are created as part of each application stack's template.

Question 25

A CloudOps team maintains a single CloudFormation template that provisions an application stack. They must deploy it to dev, staging, and production, where each environment uses a different EC2 instance type and a different number of instances, but the underlying resource structure is identical across environments. The team wants to keep one template file and avoid hardcoding environment-specific values inside the resource definitions. Which approach best meets these requirements?

Accepted Answer

Use a Parameter for the environment name and a Mappings section that returns the correct instance type and count per environment, referenced with Fn::FindInMap.

Answer

Create three separate CloudFormation templates, one per environment, each with the values hardcoded into the resource properties.

Answer

Use a single template with the production values hardcoded, then manually edit the resources in the console after each dev and staging deployment.

Answer

Store all environment values in the Metadata section and reference them directly from the Resources section using Fn::GetAtt.