SOA-C03 practice questions with answers

Answer: A) Run the query in Logs Insights and use Add to dashboard to place the results in a widget

Using Add to dashboard from Logs Insights places a query widget on a CloudWatch dashboard. The query reruns whenever the dashboard loads or refreshes. Metric filters, exported results and saved queries don't give a self-refreshing ranked list on the dashboard.

• ACorrect. You can add a Logs Insights query to a CloudWatch dashboard as a widget. The query reruns each time the dashboard loads and each time it refreshes. These runs count toward the limit on concurrent Logs Insights queries.
• BIncorrect. A metric filter turns matching log events into numeric metric data points. It cannot produce a ranked list of individual requests like the Logs Insights query does.
• CIncorrect. Exported results are a one-time snapshot that someone would have to refresh by hand. CloudWatch dashboard widgets also don't display files stored in S3.
• DIncorrect. A saved query is only kept in Logs Insights so it can be run again later. Saving it doesn't put it on a dashboard, so someone would still need to run it by hand.

Answer: A) Deploy the AWS Config managed rule s3-default-encryption-kms in the account

AWS Config managed rules evaluate resource configurations continuously and flag noncompliant resources. The s3-default-encryption-kms rule checks specifically that S3 buckets are encrypted with AWS KMS keys.

• ACorrect. This managed AWS Config rule checks whether S3 buckets are encrypted with AWS KMS and marks a bucket NON_COMPLIANT if it is not encrypted with a KMS key. It runs when configurations change, and it can be limited to specific key ARNs.
• BIncorrect. CloudTrail data events record object-level API activity for auditing. They do not compare bucket configurations with a policy or produce a compliance status.
• CIncorrect. Trusted Advisor's S3 check looks at bucket permissions such as open access. It does not evaluate whether default encryption uses AWS KMS keys against a custom policy.
• DIncorrect. IAM Access Analyzer finds buckets that are shared publicly or with external principals. It does not evaluate encryption settings.

Answer: A) Add the application's resources to Amazon CloudWatch Application Insights

CloudWatch Application Insights detects application components such as IIS and SQL Server and recommends and configures the right metrics, logs, and dashboards for them. The other options need manual monitor design or apply to other workload types.

• ACorrect. Application Insights scans the application's resources and recommends and configures CloudWatch metrics and logs for components such as SQL Server databases and IIS web tiers. It also creates dashboards that show detected problems and how severe they are.
• BIncorrect. Container Insights collects metrics and logs from containerized workloads on Amazon ECS, Amazon EKS, ROSA, and Kubernetes. It does not detect an IIS or SQL Server stack running directly on EC2 or recommend monitors for one.
• CIncorrect. With anomaly detection, the team still has to choose each metric and build each alarm. It does not discover application components or recommend a monitoring set for the stack.
• DIncorrect. The agent collects system-level metrics and logs that someone has to configure. On its own, it does not analyze the application stack or recommend and set up stack-specific alarms and dashboards.

Answer: A) Enable cross-Region automated backups so RDS copies the instance's snapshots and transaction logs to the second Region

RDS cross-Region automated backup replication copies snapshots and transaction logs to another Region, which enables point-in-time recovery there. Multi-AZ, a longer retention period, and nightly snapshot copies don't meet the cross-Region point-in-time requirement.

• ACorrect. With backup replication turned on, RDS starts a cross-Region copy of each snapshot and transaction log as soon as it is ready. This supports point-in-time restore of the instance in the destination Region.
• BIncorrect. Multi-AZ keeps the standby in another Availability Zone in the same Region. It doesn't protect against the loss of the whole Region.
• CIncorrect. A longer retention period keeps more backups, but they stay in the primary Region. They won't be available if that Region goes down.
• DIncorrect. A copied snapshot can be restored only to the moment it was taken. Without the transaction logs, it can't restore to any point in time, and it also needs scheduling or scripting.

Answer: B) Use online resharding to add shards to the cluster

In ElastiCache with cluster mode enabled, write and memory capacity scale out by adding shards with online resharding. Replicas only scale reads.

• AIncorrect. Replicas add read capacity and availability, but all writes still go to each shard's primary, so the write bottleneck stays.
• BCorrect. With cluster mode enabled, ElastiCache supports online resharding. Adding shards spreads the key space, and therefore the writes and memory, across more primaries while the cluster keeps serving requests.
• CIncorrect. Restoring to a new cluster interrupts the application and needs an endpoint change, which the requirement rules out. Online scaling is available.
• DIncorrect. Reading from replicas offloads reads, but the primaries are saturated by writes, which can't go to replicas.

Answer: C) Enable AWS Backup's advanced features for DynamoDB in the AWS Backup settings

Copying DynamoDB backups across Regions or accounts requires AWS Backup's advanced DynamoDB features, which older accounts must enable in AWS Backup settings.

• AIncorrect. PITR gives continuous backups inside DynamoDB, but it isn't what controls whether AWS Backup can copy DynamoDB backups to another Region.
• BIncorrect. Global tables replicate live data, so mistakes and corruption replicate too. They aren't backup copies and don't enable the copy action.
• CCorrect. Cross-Region and cross-account copies of DynamoDB backups are part of AWS Backup's advanced DynamoDB backup features, along with cold storage and cost allocation tags. Accounts that started using AWS Backup before these features launched must turn them on.
• DIncorrect. Vault names don't have to match between Regions. A copy action just names the destination vault's ARN.

Answer: A) Reference the VPC template from each template by using an AWS::CloudFormation::Stack resource

Nested stacks, declared with AWS::CloudFormation::Stack, let a dedicated template be reused as a child stack whose lifecycle and outputs belong to the parent. Cross-stack references share one separately managed stack, and StackSets and change sets solve different problems.

• ACorrect. This creates a nested stack. The parent template points to the dedicated template through TemplateURL, and CloudFormation deploys it as a child stack that is managed through the parent or root stack. The parent can read the child's outputs with Fn::GetAtt NestedStack.Outputs.<name>.
• BIncorrect. Cross-stack references let several stacks share one independently managed VPC through exported outputs. They don't give each application stack its own copy of the VPC that is created and deleted along with that application stack.
• CIncorrect. StackSets deploy stack instances of one template across accounts and Regions. Those instances are managed through the StackSet, not as child resources inside each application stack, and the application templates still can't read their outputs.
• DIncorrect. A change set only previews proposed changes to a stack before they are run. It isn't a way to reference a separate reusable template, so the VPC resources would still be duplicated in each template.

Answer: A) A forward action on the listener rule that includes both target groups, with a weight of 95 for TG-v1 and 5 for TG-v2

Use a forward action with weighted target groups on the ALB listener rule to send a set percentage of requests to the new version's target group, then adjust the weights to shift more traffic. Slow start, path-based rules and stickiness don't give a weighted split between target groups.

• ACorrect. A forward action can list several target groups, each with a weight from 0 to 999. The ALB splits matching requests in proportion to the weights. The team can change the weights later to move more traffic to TG-v2.
• BIncorrect. Slow start gradually ramps up the requests sent to newly healthy targets within one target group. After the duration ends, the targets get a full share. It doesn't control what percentage of listener traffic goes to one target group versus another.
• CIncorrect. A path-pattern condition routes requests based on the URL path, not as a percentage of all traffic. Only clients that request /v2/* would reach the new version, so this isn't a random 5% sample of production traffic.
• DIncorrect. Target group stickiness only keeps a client on the target group it was first routed to. It needs weighted target groups to decide the split, so on its own it doesn't send any share of traffic to TG-v2.

Answer: A) AWS Systems Manager Fleet Manager

Systems Manager Fleet Manager gives one console to view and manage nodes on AWS and on premises. It covers node status, file browsing, RDP to Windows and OS user management, all without opening inbound ports.

• ACorrect. Fleet Manager is a unified console for remotely managing nodes on AWS or on premises. It shows node status and performance, lets you view folder and file contents and logs, supports RDP connections to Windows instances, and manages OS user accounts and the Windows registry. Connections go through Systems Manager, so no inbound ports are needed.
• BIncorrect. Inventory collects metadata from managed nodes, such as installed applications, network settings and files. It does not let you connect to nodes, start RDP sessions or manage OS user accounts.
• CIncorrect. EC2 Instance Connect pushes temporary SSH keys so you can open SSH connections to EC2 instances. It does not manage on-premises servers and does not offer fleet-wide file browsing, RDP or user management.
• DIncorrect. Explorer is a dashboard that summarizes operational data such as OpsItems, patch compliance and inventory across accounts and Regions. It does not let you connect to nodes or manage their files and users.

Answer: A) Add an inbound rule for TCP 7000 whose source is the cluster's own security group ID

A security group rule that names its own group as the source lets all current members talk to each other over private IPs. Membership changes are picked up automatically, so no IP list needs maintaining.

• ACorrect. When a security group is the source of a rule, the rule applies to all instances associated with that group, using their private IP addresses. Because the group references itself, instances are covered when they join and stop being covered when they leave, with no IP upkeep.
• BIncorrect. A customer-managed prefix list holds CIDR entries that someone must keep current, so the list would need updating every time Auto Scaling changes the cluster. It also counts against the rule quota at the prefix list's maximum size.
• CIncorrect. This avoids maintenance, but it lets every resource in the VPC reach port 7000. That breaks the requirement that only cluster members can connect.
• DIncorrect. Network ACLs apply to whole subnets, are stateless, and cannot reference security groups. Any resource in the subnet could connect, and return traffic would need its own rules.

Answer: A) The source account has not created an authorization that grants the aggregator account and Region permission to collect its AWS Config data

When source accounts are added to an AWS Config aggregator individually, each source account must authorize the aggregator account and Region. Authorization isn't needed when source accounts come from AWS Organizations.

• ACorrect. When source accounts are added individually, each one must authorize the aggregator account and Region before its configuration and compliance data is copied into the aggregator. Authorization is only skipped when the source accounts come from AWS Organizations.
• BIncorrect. An IAM role with Organizations permissions is used by organization-based aggregators. This aggregator lists accounts individually, so it relies on per-account authorization instead.
• CIncorrect. Trusted access is part of setting up an organization-based aggregator. It plays no role when source accounts are entered individually, and the other accounts' data is already showing up.
• DIncorrect. A delivery channel sends snapshots and history files to an S3 bucket. An aggregator copies data from the source account through authorization, not by reading another account's delivery channel bucket.

Answer: A) Create a KMS grant for the partner's role that allows only the Decrypt operation, then revoke the grant when the migration ends

A KMS grant gives a specific principal, including one in another account, permission to use one key for only the operations listed. You can revoke or retire it later without editing the key policy or IAM policies.

• ACorrect. A grant gives one grantee principal (which can be in another account) permission to use exactly one KMS key for the operations you list. It can be retired or revoked later without changing key policies or IAM policies, which is why grants are often used for temporary access.
• BIncorrect. Cross-account use of a KMS key is authorized through the key policy or through grants. Sharing the key through AWS RAM is not how KMS key access is given to another account.
• CIncorrect. An alias is only a friendly name that points to a key. It gives no permission to use the key, so the partner still could not call Decrypt.
• DIncorrect. A permissions boundary only caps the most permissions an identity can have; it never grants any. It also does nothing to authorize the partner's role on the key's side.

Answer: A) Create a Route 53 Resolver DNS Firewall rule group that blocks a managed domain list, and associate the rule group with the VPC

Route 53 Resolver DNS Firewall blocks or allows outbound DNS queries that go through the VPC Resolver, so known-bad domains are never resolved. Network Firewall filters traffic after resolution, WAF inspects incoming HTTP requests, and query logging only records queries.

• ACorrect. DNS Firewall filters outbound DNS queries that pass through the Route 53 VPC Resolver. It can deny queries for known-bad domains and can send custom responses for blocked domains, so the name is never resolved.
• BIncorrect. Network Firewall can filter traffic by domain, but AWS documents that it has no visibility into queries made by the Route 53 VPC Resolver. It filters the traffic that flows after a name is resolved, not the DNS lookup itself.
• CIncorrect. AWS WAF inspects HTTP(S) requests coming into supported resources such as CloudFront, Application Load Balancers and API Gateway. It does not filter DNS queries that instances send to the VPC Resolver.
• DIncorrect. Query logging records DNS queries, and an alarm can alert on them, but neither blocks resolution. The instances would still get IP addresses for the malicious domains.

Answer: A) The DNS name of an Application Load Balancer that fronts the web tier's Auto Scaling group

Route 53 alias records can be created at the zone apex. They point to selected AWS resources such as ELB load balancers, CloudFront, S3 website endpoints, API Gateway, Global Accelerator, and same-zone records of the same type. Queries to AWS resources are free. Alias records can't point to EC2 DNS names or external domains.

• ACorrect. Elastic Load Balancing load balancers (Application, Network, and Classic) are supported alias targets. You can create alias records at the zone apex, Route 53 tracks IP address changes in the resource, and Route 53 doesn't charge for alias queries to AWS resources.
• BIncorrect. An EC2 instance's public DNS name isn't a supported alias target. Alias records can only point to selected AWS resources, such as load balancers, CloudFront distributions, and S3 website endpoints.
• CIncorrect. Only a CNAME record can point to an arbitrary DNS name, such as one hosted by another DNS provider. A CNAME also can't be created at the zone apex.
• DIncorrect. An alias record must have the same type as the record it routes to, and a CNAME at the zone apex isn't supported, even as an alias. So an apex alias can't point to a CNAME record.

Answer: A) Raise the deregistration_delay.timeout_seconds attribute so draining targets can finish in-flight requests

The deregistration delay controls how long an ALB keeps a deregistering target in the draining state so in-flight requests can complete. Raising it stops requests from being cut off during scale-in.

• ACorrect. A deregistering target enters the draining state. The load balancer stops sending it new requests and waits for the deregistration delay before completing deregistration, which lets in-flight requests finish before the Auto Scaling group terminates the instance.
• BIncorrect. Slow start only ramps up traffic to newly registered healthy targets so they can warm up. It has no effect on requests in flight on targets that are being deregistered.
• CIncorrect. Stickiness controls which target receives a client's later requests. When a target is draining, new requests are routed to a healthy target anyway, and stickiness does not give in-flight requests more time to finish.
• DIncorrect. The unhealthy threshold only changes how many failed health checks it takes to mark a target unhealthy. Scale-in deregistration is not triggered by health checks, so this does not protect in-flight requests.