Amazon AWS Certified CloudOps Engineer - Associate SOA-C03 Free Practice Test - 20 Questions
This practice bank exercises key operational decisions for managing and automating AWS environments. You will apply knowledge of Auto Scaling policies, cross-account S3 access, CloudFormation resource dependencies, VPC networking (NAT gateways, public/private subnets), CodeDeploy and ALB connection draining for zero-downtime deployments, CloudTrail data events for object-level auditing, AWS Systems Manager Patch Manager for multi‑account patching, RDS read replica promotion for disaster recovery, CloudWatch custom metrics (memory) via the CloudWatch agent, and AWS Config auto‑remediation. The questions test your ability to choose the right scaling metric, configure cross‑account permissions, ensure deployment order, enable outbound internet without public IPs, handle lifecycle hooks, and enforce compliance policies.
What this SOA-C03 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Scalability and High Availability Architectures
This section covers decisions for Auto Scaling groups, load balancing, and stateless application design. Questions require selecting the correct CloudWatch metric (Average CPU over two 1‑minute periods) to avoid false positives, configuring connection draining on an ALB target group to complete in‑flight requests, and placing session data in ElastiCache for Redis to maintain statelessness. Lifecycle hooks and Auto Scaling group target group attachments ensure proper instance registration and graceful termination. Understanding the difference between public and private subnets, and when to use NAT gateways versus internet gateways, is critical for secure outbound access.
- Use Average CPU utilization over multiple periods for stable scaling triggers.
- Enable connection draining on target groups to complete in‑flight requests before instance termination.
- Store session state externally (ElastiCache) to allow any instance to serve requests.
- Lifecycle hooks require calling complete-lifecycle-action to proceed with termination.
- Auto Scaling groups can automatically register new instances with a target group.
Security and Compliance Controls
This section focuses on cross‑account access, encryption key rotation, and compliance enforcement. A bucket policy in the resource account plus an IAM user policy in the caller account is required for cross‑account S3 access. KMS customer managed keys can enable automatic annual rotation to meet security policies. AWS Config rules with auto‑remediation (via Systems Manager Automation) can enforce S3 bucket versioning or other compliance checks. CloudTrail data events capture object‑level API calls for auditing, while management events are insufficient for tracking object access.
- Cross‑account S3 access needs both a bucket policy (resource account) and an IAM policy (caller account).
- Enable automatic key rotation on customer managed KMS keys for annual rotation.
- Use AWS Config rules with remediation actions to enforce compliance (e.g., S3 versioning).
- CloudTrail data events capture object‑level operations (GetObject, PutObject).
- Management events only cover bucket‑level API calls, not object access.
Monitoring, Logging, and Remediation
Effective operations rely on proper monitoring and logging setup. CloudTrail data events must be enabled to log S3 object access, and those events can be sent to CloudWatch Logs for real‑time analysis. Standard EC2 metrics do not include memory; the CloudWatch agent must be installed to publish custom memory metrics, then an alarm can be created. RDS read replica promotion is the fastest recovery for a failed primary. For backups, manual snapshots can be copied across regions using AWS Backup for compliance. Understanding these logging and recovery strategies is essential for incident response.
- Send CloudTrail data events to CloudWatch Logs for real‑time S3 object access monitoring.
- Install CloudWatch agent on EC2 to collect custom metrics like memory utilization.
- Promote a read replica to standalone to quickly restore write operations after primary failure.
- Manual RDS snapshots can be copied across regions using AWS Backup for compliance.
- Automated backups cannot be directly copied to another region.
Infrastructure as Code and Automation
CloudFormation templates use DependsOn to explicitly order resource creation, ensuring dependencies like an Elastic IP association complete before dependent resources. AWS CodePipeline with a rolling deployment strategy minimizes downtime for in‑place EC2 updates. AWS Systems Manager Patch Manager integrates with AWS Organizations to manage patching across accounts. CloudFormation also enables automated resource provisioning. Understanding how to define dependencies and deployment strategies is key for reliable infrastructure automation.
- Use DependsOn in CloudFormation to specify the creation order for dependent resources.
- A rolling deployment updates batches of instances to minimize downtime during in‑place updates.
- AWS Systems Manager Patch Manager with Organizations centrally automates patching across accounts.
- CodePipeline with rolling deployment is appropriate for in‑place EC2 deployments.
- CloudFormation templates can define entire environments with dependencies.
Practice Amazon AWS Certified CloudOps Engineer - Associate SOA-C03 with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 20-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application experiences variable traffic patterns. The operations team wants to scale out based on CPU utilization. Which CloudWatch metric and threshold combination should be used in a simple scaling policy?
Show hint
Set up and maintain scalable environments
Study workflow
Turn one SOA-C03 attempt into a study plan
- 1
Configure Auto Scaling with CPU‑Based Scaling
Create a CloudWatch alarm on the Average CPU Utilization metric for the Auto Scaling group, evaluate over 2 consecutive 1‑minute periods at a threshold of 70%. In the scaling policy, set the adjustment type to add a fixed number or percentage of instances. This avoids reacting to short spikes while scaling out when sustained load occurs.
- 2
Set Up Cross‑Account S3 Access
In Account B (bucket owner), attach a bucket policy that grants the IAM user ARN from Account A the desired S3 actions. In Account A, attach an IAM user policy allowing the same S3 actions on the bucket. Both policies are required; the user must have explicit allow in their own account to attempt the action.
- 3
Use CloudFormation DependsOn for Resource Ordering
Identify the resource that must be created after the Elastic IP association (e.g., a dependent EC2 instance or load balancer). Add a DependsOn attribute to that resource referencing the Elastic IP association resource. CloudFormation will wait for the association to complete before creating the dependent resource.
- 4
Enable Connection Draining on ALB Target Group
On the target group attached to your ALB, enable connection draining (deregistration delay). Set the timeout to a value that allows most in‑flight requests to complete (e.g., 300 seconds). This ensures the ALB stops sending new requests to terminating instances while completing existing ones.
- 5
Install CloudWatch Agent for Custom Memory Metrics
Deploy the CloudWatch agent on your EC2 instances using AWS Systems Manager Run Command or a launch template. Configure the agent to collect memory metrics (e.g., mem_used_percent). Then create a CloudWatch alarm on the custom metric to trigger when memory exceeds 90% for a specified period.
FAQ
Questions about this SOA-C03 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
When should I use CloudWatch average vs. sum for CPU scaling?+
Use Average for metrics that already represent a percentage or rate, like CPU Utilization. Sum is appropriate for count metrics (e.g., request count). Average over multiple periods evens out short peaks for more stable scaling decisions.
Can I grant cross‑account S3 access using only a bucket policy?+
No. The bucket policy alone allows the user to attempt the action, but the user must also have an IAM policy in their own account that permits the same action. Both policies must allow the operation for access to succeed.
How do I promote an RDS read replica for failover?+
You can promote a read replica to a standalone DB instance using the AWS Console, CLI, or API. This makes the replica accept writes immediately. It is faster than restoring from a snapshot because the replica already has recent replicated data.
What is the difference between CloudTrail management and data events for S3?+
Management events log bucket‑level operations like CreateBucket, while data events log object‑level operations like GetObject and PutObject. To track who accessed a specific object, you must enable data events for that bucket.
Does AWS Config automatically remediate noncompliant resources?+
Not by default. AWS Config evaluates rules and can trigger remediation actions using Systems Manager Automation or Lambda. You must configure a remediation action for the rule to automatically fix noncompliant resources like S3 buckets with versioning disabled.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.