SOA-C03 Practice Test

The AWS Certified CloudOps Engineer – Associate (SOA-C03) is a associate-level AWS certification. The exam has 65 questions, runs 130 minutes, costs $150, and requires a passing score of 720/1000. CertSharp provides 500 exam-style SOA-C03 practice questions — 30 free with no credit card — each with a detailed explanation.

1. Question 2Reliability and Business ContinuityEasy

   A user overwrites an important object in an S3 bucket by mistake. The bucket must allow recovery of earlier versions of objects. Which S3 feature should be enabled?

   • A

     S3 Versioning, which retains previous versions of an object when it is overwritten or deleted

   • B

     S3 Inventory, which stores the earlier object contents in the report delivered to the destination bucket

   • C

     S3 Intelligent-Tiering, which keeps the earlier object in an archive tier when a new object arrives

   • D

     S3 Transfer Acceleration, which keeps a copy of the earlier object on edge locations for restoration

   Show answer & explanation

   Correct answer: A — S3 Versioning, which retains previous versions of an object when it is overwritten or deleted

   With versioning enabled, an overwrite creates a new version and keeps the previous one, and a delete adds a delete marker while the data stays recoverable. Transfer Acceleration speeds uploads, Intelligent-Tiering changes storage class based on access patterns, and Inventory lists object metadata rather than storing content.

2. Question 3Networking and Content DeliveryEasy

   A dual-stack VPC has instances that must start outbound IPv6 connections to the internet. The design must block internet-initiated inbound IPv6 at the routing layer, without relying on security group rules. What should be configured?

   • A

     A public NAT gateway with a ::/0 route in the subnet route table

   • B

     A virtual private gateway with a ::/0 route in the subnet route table

   • C

     An internet gateway with a ::/0 route in the subnet route table

   • D

     An egress-only internet gateway with a ::/0 route in the subnet route table

   Show answer & explanation

   Correct answer: D — An egress-only internet gateway with a ::/0 route in the subnet route table

   An egress-only internet gateway is stateful and permits outbound IPv6 while refusing connections that originate on the internet. A public NAT gateway translates IPv4 addresses and is not the IPv6 mechanism for this requirement. A standard internet gateway routes inbound IPv6 traffic too, so protection would depend on security groups. A virtual private gateway is for VPN connectivity and does not reach the internet.

3. Question 4Monitoring, Logging, Analysis, Remediation, and Performance OptimizationEasy

   A new CloudWatch alarm was created for a custom metric that has not yet received any datapoints. Which state does the alarm report right after creation?

   • A

     INSUFFICIENT_DATA, because there are not yet enough datapoints to evaluate the alarm threshold

   • B

     ALARM, because a missing metric is treated as a breach by default when the alarm is first created

   • C

     PENDING, because CloudWatch holds new alarms in a warm-up state for the first evaluation period

   • D

     OK, because no datapoint exceeding the threshold has been recorded since the alarm was created

   Show answer & explanation

   Correct answer: A — INSUFFICIENT_DATA, because there are not yet enough datapoints to evaluate the alarm threshold

   A CloudWatch alarm has three states: OK, ALARM, and INSUFFICIENT_DATA. INSUFFICIENT_DATA is the state when the alarm has just started or not enough data is available, so a new alarm with no datapoints reports it. During the warm-up evaluation state the alarm also remains in INSUFFICIENT_DATA until the warm-up ends. There is no PENDING alarm state.

4. Question 5Security and ComplianceEasy

   A company just created a new AWS account. Which action best protects the root user according to AWS best practices?

   • A

     Share the root user password with the operations team so that someone is available during an outage

   • B

     Create an access key for the root user and store it in the CI/CD system so pipelines can deploy resources

   • C

     Attach an IAM policy to the root user that denies deletion of resources outside business hours

   • D

     Enable MFA on the root user, do not create root access keys, and use the root user solely for tasks that require it

   Show answer & explanation

   Correct answer: D — Enable MFA on the root user, do not create root access keys, and use the root user solely for tasks that require it

   The root user has unrestricted access that cannot be limited by IAM policies, so MFA and minimal use are the key protections. Root access keys should not be created because they grant full account control. Sharing the root password increases exposure. IAM identity policies cannot be attached to the root user.

5. Question 6Deployment, Provisioning, and AutomationEasy

   A workflow must call several Lambda functions in order, retry failed steps, and branch based on results, without custom orchestration code. Which service should be used?

   • A

     AWS Step Functions, defining a state machine with Task, Choice, and Retry configuration

   • B

     Amazon S3 Event Notifications, defining prefixes that chain one function to the next

   • C

     AWS Systems Manager Inventory, defining collection steps that call each function

   • D

     Amazon EventBridge Scheduler, defining a schedule that calls each function in sequence

   Show answer & explanation

   Correct answer: A — AWS Step Functions, defining a state machine with Task, Choice, and Retry configuration

   Step Functions orchestrates multi-step workflows as state machines with built-in retry, error handling, and branching. EventBridge Scheduler triggers targets on a schedule but does not manage step results. Inventory gathers metadata, and S3 notifications can chain functions only by writing objects, with no retry or branching logic.

6. Question 7Reliability and Business ContinuityMedium

   A faulty deployment wrote bad data to a DynamoDB table at 10:02. The table has point-in-time recovery on. How should the engineer recover the data as of 10:00?

   • A

     Restore the table to 10:00 into a new table, then repoint the application or copy back the needed items

   • B

     Run a restore over the existing table so that its name, indexes, and stream settings stay unchanged

   • C

     Replay the DynamoDB Stream from 10:00 in reverse order to undo the bad writes in the existing table

   • D

     Disable point-in-time recovery and enable it again so that the table rolls back to the time of enabling

   Show answer & explanation

   Correct answer: A — Restore the table to 10:00 into a new table, then repoint the application or copy back the needed items

   Point-in-time recovery restores into a new table, and you then switch the application to it or move corrected items back; some settings such as auto scaling and alarms must be recreated. Restores do not overwrite a table, toggling the feature does not roll back data, and streams do not provide reverse replay.

7. Question 8Networking and Content DeliveryMedium

   A media company must serve users in Germany with a EU-specific catalog and users in all other locations with a global catalog. Users in countries with no explicit mapping must still receive an answer. What should be configured?

   • A

     Geoproximity records for Germany with a bias value of zero applied to the global record

   • B

     Latency records for the Frankfurt Region and a default latency record for other users

   • C

     Geolocation records for Germany and the EU with no default record for other locations

   • D

     Geolocation records for Germany and a default geolocation record for all other locations

   Show answer & explanation

   Correct answer: D — Geolocation records for Germany and a default geolocation record for all other locations

   Geolocation routing maps queries by user location, and a default record answers queries from locations without a specific mapping. Without the default, those users receive no answer. Latency routing considers network distance rather than the user's country. Geoproximity routes by distance from resource locations and bias values and does not offer country-specific mapping.

8. Question 9Monitoring, Logging, Analysis, Remediation, and Performance OptimizationMedium

   A fleet of 200 instances must use an identical CloudWatch agent configuration that can be updated centrally. Which approach is most appropriate?

   • A

     Store the agent JSON in Parameter Store and run fetch-config with the ssm: source through Run Command on tagged instances

   • B

     Set the configuration in the instance tags so that the agent reads the tag values on startup

   • C

     Upload the configuration to S3 and enable event notifications so that the running agents reconfigure themselves

   • D

     Attach the configuration to a CloudWatch alarm action so that the alarm pushes it to the Auto Scaling group

   Show answer & explanation

   Correct answer: A — Store the agent JSON in Parameter Store and run fetch-config with the ssm: source through Run Command on tagged instances

   The CloudWatch agent can load its JSON configuration from a Systems Manager Parameter Store parameter. Run Command can target instances by tag and call the agent control script with fetch-config and the ssm: prefix. Updating the parameter and re-running the command changes the whole fleet. Tags, S3 notifications, and alarm actions are not mechanisms the agent uses to read its configuration.

9. Question 10Security and ComplianceMedium

   A platform team wants developers to create IAM roles for their applications but not exceed a defined set of permissions. What should the team implement?

   • A

     Allow iam:CreateRole and rely on developers to attach a least-privilege policy to each role they create

   • B

     Allow iam:CreateRole with a condition that the iam:PermissionsBoundary key equals the approved boundary policy ARN

   • C

     Attach AdministratorAccess to developers and add a Config rule that flags overly broad roles each week

   • D

     Deny iam:CreateRole entirely and ask developers to open tickets for each new role request they have

   Show answer & explanation

   Correct answer: B — Allow iam:CreateRole with a condition that the iam:PermissionsBoundary key equals the approved boundary policy ARN

   Delegated administration with permission boundaries lets developers create roles while the iam:PermissionsBoundary condition forces the approved boundary on each new role. Relying on discipline does not enforce limits. A Config rule detects after the fact rather than preventing. Denying role creation blocks delegation and slows delivery.