View Full Amazon AWS Certified CloudOps Engineer – Associate SOA-C03 Exam Dumps and Practice Test Dumps

 

Question 261. Which Amazon ECR capability helps an operations team identify vulnerabilities in container images automatically?

1. ECR image scanning
2. ECR lifecycle policies
3. ECR replication
4. ECR repository tags

Correct Answer: 1. ECR image scanning

Explanation:

Amazon Elastic Container Registry (Amazon ECR) image scanning helps operations and security teams identify software vulnerabilities contained within container images. When scanning is enabled, ECR analyzes packages and dependencies in an image and reports findings that can be reviewed before deployment. This is useful for maintaining secure container workloads because vulnerable images can be identified as part of an operational workflow. Lifecycle policies serve a different purpose by removing old images, while replication copies images between repositories or Regions. Repository tags organize images but do not perform vulnerability analysis. Therefore, image scanning is the appropriate capability for detecting vulnerabilities in container images.

Question 262. An ECS task running on AWS Fargate needs permission to pull an image from Amazon ECR and write logs to CloudWatch Logs. Which IAM role should provide these permissions?

1. ECS task role
2. ECS task execution role
3. IAM user role
4. Service Control Policy

Correct Answer: 2. ECS task execution role

Explanation:

The Amazon ECS task execution role provides AWS permissions required by the ECS or Fargate platform to perform operations on behalf of a task. Typical permissions include pulling container images from Amazon ECR and sending container logs to CloudWatch Logs when the appropriate logging configuration is used. The task role is different because it grants permissions to the application code running inside the container, such as accessing S3 or DynamoDB. A Service Control Policy does not grant permissions itself, and an IAM user role is not the normal mechanism for this ECS operation. Therefore, the task execution role is the correct choice.

Question 263. An Amazon ECS service deployment introduces unhealthy tasks. The operations team wants ECS to automatically stop the deployment when the service cannot become healthy. Which feature should be configured?

1. ECS service discovery
2. ECS capacity providers
3. ECS deployment circuit breaker
4. ECS task role

Correct Answer: 3. ECS deployment circuit breaker

Explanation:

The Amazon ECS deployment circuit breaker is designed to detect deployments that fail to reach a steady state and can stop the unsuccessful deployment. When configured with rollback, ECS can also return the service to the most recent deployment that reached a stable state. This is particularly useful when a new container image, configuration, or application version causes tasks to repeatedly fail health checks. Service discovery handles how services locate one another, capacity providers influence compute capacity, and the task role controls permissions available to application containers. Therefore, the deployment circuit breaker directly addresses automatic handling of failed ECS deployments.

Question 264. An ECS service experiences increased application traffic during business hours. The operations team wants the number of running tasks to increase automatically based on CPU utilization. What should be configured?

1. ECS service auto scaling
2. ECR lifecycle policy
3. ECS task execution role
4. CloudFormation drift detection

Correct Answer: 1. ECS service auto scaling

Explanation:

Amazon ECS service auto scaling allows the desired number of tasks in an ECS service to change automatically according to workload conditions. A target tracking scaling policy can monitor a metric such as average CPU utilization and adjust task count to maintain a configured target. For example, if CPU utilization rises because application traffic increases, ECS can launch additional tasks, while lower utilization can allow the service to scale in. The task execution role provides permissions rather than scaling behavior. ECR lifecycle policies manage container images, and CloudFormation drift detection identifies infrastructure changes. Therefore, ECS service auto scaling is the appropriate solution.

Question 265. A Lambda function experiences short bursts of high invocation volume, and the operations team wants a pool of execution environments initialized in advance to reduce startup latency. Which feature should be used?

1. Reserved concurrency
2. Dead-letter queue
3. Provisioned concurrency
4. Lambda destination

Correct Answer: 3. Provisioned concurrency

Explanation:

AWS Lambda provisioned concurrency keeps a specified number of execution environments initialized and ready to respond to invocations. This helps reduce startup latency, which can be important for applications that require more predictable response times. Reserved concurrency serves a different purpose: it sets a maximum amount of concurrency for a function and can reserve capacity for it, but it does not pre-initialize execution environments. Dead-letter queues are used for certain failed asynchronous invocations, while Lambda destinations route invocation results to other services. Therefore, when the operational requirement specifically involves pre-initialized execution environments, provisioned concurrency is the appropriate feature.

Question 266. A Lambda function processes asynchronous events, but some events continue to fail after the configured retry attempts. The operations team wants failed events delivered to an Amazon SQS queue for later investigation. What should be configured?

1. Provisioned concurrency
2. Dead-letter queue
3. Reserved concurrency
4. Lambda layer

Correct Answer: 2. Dead-letter queue

Explanation:

A Lambda dead-letter queue can be configured for asynchronous invocation processing so that events that cannot be successfully processed after the applicable retry behavior can be sent to Amazon SQS or Amazon SNS. This provides an operational mechanism for retaining failed events instead of losing visibility into them. The team can then inspect, analyze, or reprocess those events according to its recovery procedures. Provisioned concurrency addresses initialization latency, reserved concurrency controls concurrency limits, and Lambda layers package reusable code or dependencies. Because the requirement is specifically to capture failed asynchronous events in a queue, a dead-letter queue is the appropriate feature.

Question 267. A Lambda function invoked asynchronously by an AWS service fails during processing. The operations team wants successful and failed invocation results routed to different destinations. Which Lambda capability supports this requirement?

1. Event filtering
2. Lambda layers
3. Function URLs
4. Lambda destinations

Correct Answer: 4. Lambda destinations

Explanation:

Lambda destinations provide a mechanism for routing the result of asynchronous function invocations to another AWS service based on whether processing succeeded or failed. An operations team can configure an on-success destination and an on-failure destination, allowing successful processing to continue through one workflow while failed events are directed toward another workflow for investigation or recovery. Event filtering determines which events invoke a function, layers provide shared libraries and dependencies, and function URLs expose Lambda through an HTTP endpoint. Therefore, Lambda destinations are specifically designed for routing asynchronous invocation results according to their execution outcome.

Question 268. A DynamoDB workload has unpredictable traffic, and the operations team does not want to manage read and write capacity units manually. Which capacity mode is most appropriate?

1. On-demand capacity mode
2. Provisioned capacity with no scaling
3. Reserved capacity mode
4. Dedicated capacity mode

Correct Answer: 1. On-demand capacity mode

Explanation:

DynamoDB on-demand capacity mode is designed for workloads where traffic can be unpredictable or where the team wants DynamoDB to manage capacity automatically without configuring provisioned read and write capacity units. It can be useful for applications with irregular traffic patterns, new workloads with uncertain demand, or systems where operational simplicity is more important than manually managing capacity. Provisioned capacity requires the team to define capacity and can be combined with auto scaling, but that is a different operational model. Therefore, when the requirement explicitly states that traffic is unpredictable and manual capacity management should be avoided, on-demand capacity mode is the appropriate choice.

Question 269. A DynamoDB table uses provisioned capacity. The operations team wants read and write capacity to adjust automatically as application demand changes. Which feature should be used?

1. DynamoDB Streams
2. DynamoDB auto scaling
3. DynamoDB TTL
4. DynamoDB global tables

Correct Answer: 2. DynamoDB auto scaling

Explanation:

DynamoDB auto scaling automatically adjusts a table’s provisioned read and write capacity in response to utilization. An operations team can define target utilization levels, allowing capacity to increase when demand rises and decrease when demand falls within the configured boundaries. This helps maintain application performance while avoiding unnecessary permanently provisioned capacity. DynamoDB Streams instead captures item-level changes for downstream processing, TTL removes expired items, and global tables provide multi-Region replication. Because the table is specifically using provisioned capacity and the requirement is to adjust that capacity automatically according to workload demand, DynamoDB auto scaling is the correct feature.

Question 270. An application requires the same DynamoDB data to be available for low-latency reads and writes in multiple AWS Regions. Which DynamoDB feature should be used?

1. DynamoDB Streams
2. DynamoDB TTL
3. DynamoDB global tables
4. DynamoDB backup

Correct Answer: 3. DynamoDB global tables

Explanation:

DynamoDB global tables provide a multi-Region, multi-active database capability that allows applications to access replicated table data across supported AWS Regions. This architecture is useful when users are geographically distributed and the application requires low-latency access near different user populations. Global tables also support resilience by maintaining replicated data across Regions. DynamoDB Streams captures item changes but does not itself provide the complete multi-Region database architecture described in the question. TTL removes expired items, while backups provide recovery capabilities rather than active multi-Region application access. Therefore, DynamoDB global tables are the appropriate solution for this operational requirement.

Question 271. An RDS database has automatic backups enabled. The operations team wants to restore the database to a specific point in time within the backup retention period. Which capability should be used?

1. Read replica
2. Point-in-time restore
3. Database snapshot deletion
4. Performance Insights

Correct Answer: 2. Point-in-time restore

Explanation:

Amazon RDS point-in-time restore allows an operations team to create a new DB instance from a specific point within the available automated backup retention period. RDS uses the stored automated backup and transaction logs to reconstruct the database state corresponding to the selected time. This is useful when recovering from accidental changes, application errors, or data corruption that occurred after the last known good state. A read replica is primarily intended for read scaling and replication, while Performance Insights helps analyze database performance. Therefore, when the requirement is restoring an RDS database to a particular time, point-in-time restore is the appropriate recovery capability.

Question 272. An RDS database frequently runs low on storage as the amount of application data increases. The operations team wants RDS to automatically increase storage when necessary. Which setting should be configured?

1. Storage autoscaling
2. Multi-AZ failover
3. Enhanced Monitoring
4. Read replica

Correct Answer: 1. Storage autoscaling

Explanation:

Amazon RDS storage autoscaling automatically increases allocated storage when database storage consumption approaches the configured threshold. This reduces the need for administrators to monitor storage continuously and manually modify the DB instance whenever capacity becomes insufficient. The team can configure limits and thresholds that control how storage scaling occurs. Multi-AZ improves database availability, Enhanced Monitoring provides operating-system-level metrics, and read replicas primarily support read scaling and certain disaster-recovery architectures. Because the requirement is specifically to increase database storage automatically as usage grows, RDS storage autoscaling is the feature designed for this operational scenario.

Question 273. An operations team needs operating-system-level metrics such as CPU, memory, and filesystem usage from an RDS DB instance. Which feature should they enable?

1. RDS automated backups
2. RDS read replicas
3. RDS Enhanced Monitoring
4. RDS Multi-AZ

Correct Answer: 3. RDS Enhanced Monitoring

Explanation:

Amazon RDS Enhanced Monitoring provides more detailed monitoring information about the operating system environment supporting an RDS database instance. Metrics can include CPU utilization, memory consumption, filesystem usage, and other process-level or operating-system-level information, depending on the database engine and configuration. This is different from standard CloudWatch RDS metrics, which focus on database-instance-level metrics. Automated backups support recovery, read replicas provide replicated database instances for read workloads, and Multi-AZ improves availability through standby infrastructure. Therefore, when the operations team specifically needs operating-system-level visibility into an RDS instance, Enhanced Monitoring is the appropriate feature.

Question 274. An ElastiCache for Redis deployment must continue serving traffic if the primary cache node becomes unavailable. Which capability should be configured?

1. Redis replication with automatic failover
2. S3 Versioning
3. CloudFront invalidation
4. DynamoDB TTL

Correct Answer: 1. Redis replication with automatic failover

Explanation:

ElastiCache for Redis can use replication and automatic failover to improve cache availability. In a replicated configuration, a primary node can have replica nodes that maintain replicated data. If the primary becomes unavailable, ElastiCache can promote an appropriate replica to become the new primary, reducing service disruption. This architecture is particularly useful for applications where cache availability is important and losing the primary node should not require a manual recovery process. S3 Versioning, CloudFront invalidation, and DynamoDB TTL address unrelated storage, content delivery, and database lifecycle requirements. Therefore, Redis replication with automatic failover directly satisfies the availability requirement.

Question 275. A CloudFront distribution should automatically use a secondary origin when the primary origin returns certain HTTP errors. Which feature should be configured?

1. CloudFront signed cookies
2. CloudFront origin failover
3. CloudFront cache invalidation
4. CloudFront field-level encryption

Correct Answer: 2. CloudFront origin failover

Explanation:

CloudFront origin failover allows a distribution to use an origin group containing a primary origin and a secondary origin. When the primary origin returns configured failure responses, CloudFront can route the request to the secondary origin. This can improve application availability when an origin becomes unavailable or cannot successfully serve certain requests. Signed cookies control access to restricted content, cache invalidation removes cached objects, and field-level encryption protects sensitive form-field information. Because the operational requirement involves automatically switching content requests from an unhealthy primary origin to another origin based on configured failure conditions, CloudFront origin failover is the appropriate capability.

Question 276. An organization wants CloudFront to retain frequently requested objects at edge locations while controlling how long cached objects remain fresh. Which configuration should be reviewed?

1. CloudFront cache policy and TTL settings
2. CloudFront origin access control
3. Route 53 health checks
4. S3 lifecycle expiration

Correct Answer: 1. CloudFront cache policy and TTL settings

Explanation:

CloudFront cache policies and TTL-related settings determine how CloudFront caches objects and how long cached responses can remain fresh before CloudFront needs to obtain updated content from the origin. Properly configuring these values can reduce origin requests and improve delivery performance while still allowing content changes to propagate according to the application’s requirements. Origin access control is focused on securing access from CloudFront to supported origins, Route 53 health checks monitor endpoints for DNS routing decisions, and S3 lifecycle rules manage object transitions or expiration. Therefore, cache policy and TTL configuration should be reviewed when controlling CloudFront object freshness and caching behavior.

Question 277. An application uses private S3 objects and needs CloudFront to provide controlled access to those objects without making the S3 bucket publicly accessible. Which feature should be used?

1. S3 website hosting
2. CloudFront Origin Access Control
3. S3 public-read ACLs
4. Route 53 weighted routing

Correct Answer: 2. CloudFront Origin Access Control

Explanation:

CloudFront Origin Access Control (OAC) allows CloudFront to securely access an S3 origin while the S3 bucket can remain private. The bucket policy can be configured to permit requests originating through the CloudFront distribution rather than granting public access to the objects. This architecture provides a controlled path for users to retrieve content through CloudFront while protecting direct access to the S3 bucket. S3 website hosting and public-read ACLs would not satisfy the requirement for a private bucket, while Route 53 weighted routing controls DNS traffic distribution. Therefore, CloudFront Origin Access Control is the appropriate feature.

Question 278. An S3 bucket receives objects continuously, and the operations team wants objects to transition automatically to a lower-cost storage class after a defined period. Which feature should be configured?

1. S3 Event Notifications
2. S3 Versioning
3. S3 Lifecycle rules
4. S3 Access Points

Correct Answer: 3. S3 Lifecycle rules

Explanation:

Amazon S3 Lifecycle rules allow an organization to automate object management based on object age or other supported conditions. A lifecycle configuration can transition objects to different storage classes after a specified number of days, helping align storage costs with access patterns. Lifecycle rules can also support expiration and management of certain versions or incomplete multipart uploads. S3 Event Notifications are used to notify other services about object events, Versioning maintains multiple object versions, and Access Points provide application-specific access configurations. Therefore, when the requirement is automatic movement of objects to a lower-cost storage class after a defined period, S3 Lifecycle rules are the appropriate solution.

Question 279. An EC2 instance must use temporary credentials to access AWS services, and the operations team wants to avoid storing long-term access keys on the instance. Which mechanism should be used?

1. IAM user access keys stored in a file
2. EC2 instance profile with an IAM role
3. Hard-coded AWS credentials in user data
4. Root account credentials

Correct Answer: 2. EC2 instance profile with an IAM role

Explanation:

An EC2 instance profile allows an EC2 instance to obtain temporary AWS credentials associated with an IAM role. Applications running on the instance can use these credentials to access AWS services without requiring administrators to store long-term access keys in configuration files or application code. Temporary credentials are automatically managed and rotated by AWS, reducing the operational risk associated with persistent credentials. Storing IAM user access keys, hard-coding credentials in user data, or using root credentials introduces unnecessary security and management risks. Therefore, attaching an IAM role through an EC2 instance profile is the recommended mechanism for providing temporary AWS permissions to an EC2 instance.

Question 280. An Auto Scaling group experiences predictable increases in demand at specific times of day. The operations team wants the group to automatically prepare additional capacity based on historical recurring patterns. Which feature should be considered?

1. Auto Scaling lifecycle hooks
2. Auto Scaling predictive scaling
3. Auto Scaling termination protection
4. Auto Scaling instance refresh

Correct Answer: 2. Auto Scaling predictive scaling

Explanation:

Amazon EC2 Auto Scaling predictive scaling uses historical workload patterns to forecast future demand and proactively adjust capacity before expected traffic increases occur. This can be useful for applications with recurring, predictable usage patterns, such as business-hour traffic or regularly scheduled workloads. Predictive scaling differs from reactive target tracking or step scaling because it can prepare capacity ahead of an anticipated demand increase. Lifecycle hooks control actions during instance launch or termination, termination protection influences whether instances can be terminated, and instance refresh updates instances according to a configured replacement process. Therefore, predictive scaling is the feature suited to recurring, forecastable demand patterns.