View Full Amazon AWS Certified CloudOps Engineer – Associate SOA-C03 Exam Dumps and Practice Test Dumps

 

Question 361. Which AWS KMS feature can automatically create new cryptographic key material for a customer managed KMS key on a recurring schedule?

1. Key grants
2. Automatic key rotation
3. Key aliases
4. External key store

Correct Answer: 2. Automatic key rotation

Explanation:

AWS KMS automatic key rotation periodically generates new cryptographic key material for eligible customer managed KMS keys while retaining previous key material so that existing encrypted data can still be decrypted. Applications generally continue using the same KMS key ID or alias, so they do not need to be redesigned each time rotation occurs. This feature is useful for organizations that want regular cryptographic hygiene without manually creating and replacing keys. Key aliases, grants, and external key stores serve different purposes. Therefore, automatic key rotation is the appropriate feature when the requirement is scheduled replacement of cryptographic key material.

Question 362. A security administrator needs to allow a specific IAM role to use a KMS key while the key policy remains restrictive. Which KMS feature can grant permissions directly for cryptographic operations?

1. KMS grant
2. KMS alias
3. Key rotation
4. CloudTrail trail

Correct Answer: 1. KMS grant

Explanation:

A KMS grant provides a way to delegate specific permissions to an AWS principal for operations involving a KMS key. Grants are useful when applications or services need controlled access to cryptographic operations without requiring broad modifications to the key policy. A grant can specify allowed operations and the principal receiving them. An alias only provides an alternative name for a key, while rotation changes cryptographic key material over time. CloudTrail records API activity but does not grant access. Consequently, a KMS grant is the appropriate mechanism when controlled, delegated access to a KMS key is required.

Question 363. An AWS account uses a customer managed KMS key. An IAM policy allows a user to call kms, but the KMS key policy does not permit that user or the account to use the key. What is the most likely result?

1. The request automatically succeeds because IAM policies always override KMS policies
2. The request succeeds only after CloudWatch is enabled
3. The request is denied because the key policy does not authorize the operation
4. The request succeeds if the key has an alias

Correct Answer: 3. The request is denied because the key policy does not authorize the operation

Explanation:

AWS KMS evaluates permissions using both IAM policies and the KMS key policy. For a customer managed KMS key, the key policy is a critical authorization mechanism and must permit the relevant principal or otherwise provide a path for IAM policies to grant access. Simply attaching kms to an IAM identity does not guarantee successful access when the key policy does not support that authorization. A key alias does not grant permissions, and CloudWatch has no role in KMS authorization. Therefore, the decrypt operation can be denied even though the IAM policy explicitly contains the required API action.

Question 364. A company wants an AWS service to automatically assume an IAM role so it can perform tasks on behalf of the company. Which IAM feature is commonly used for this purpose?

1. Customer managed policy
2. IAM group
3. Permissions boundary
4. Service-linked role

Correct Answer: 4. Service-linked role

Explanation:

A service-linked role is an IAM role directly associated with an AWS service and is designed specifically for that service to perform actions on a customer’s behalf. AWS manages many aspects of these roles, including the trust relationship and required permissions, which reduces the administrative effort involved in configuring service permissions manually. A customer managed policy defines permissions but does not itself provide an automatically assumable service identity. IAM groups organize users, while permissions boundaries restrict the maximum permissions an identity can receive. Therefore, a service-linked role is appropriate when an AWS service needs a predefined IAM role for operational activities.

Question 365. An administrator wants to determine whether an IAM policy contains syntax or permission issues before deploying it. Which IAM capability should be used?

1. IAM Policy validation
2. IAM credential report
3. IAM user group
4. IAM access key rotation

Correct Answer: 1. IAM Policy validation

Explanation:

IAM policy validation helps administrators identify problems in JSON-based IAM policies before or during deployment. It can identify syntax problems, malformed policy elements, and certain policy issues that may prevent the intended authorization behavior. This makes it useful during policy development and review, particularly in environments where permissions are managed through infrastructure or deployment pipelines. A credential report provides information about users and credentials, while groups organize users with shared permissions. Access key rotation addresses credential lifecycle management rather than policy correctness. Therefore, IAM Policy validation is the appropriate capability for checking a policy before it is relied upon for access control.

Question 366. An operations team needs to manage EC2 instances through a graphical interface that provides access to instance information and operational actions from AWS Systems Manager. Which feature is designed for this purpose?

1. Systems Manager Distributor
2. Systems Manager Fleet Manager
3. Systems Manager Parameter Store
4. Systems Manager Patch Manager

Correct Answer: 2. Systems Manager Fleet Manager

Explanation:

AWS Systems Manager Fleet Manager provides a browser-based interface for viewing and managing the operating system state of managed nodes. It can help administrators inspect files, processes, users, Windows registry information, and other system-level details without requiring traditional remote administration methods. Distributor focuses on packaging and distributing software, Parameter Store manages configuration data and parameters, and Patch Manager handles patching operations. Fleet Manager is particularly useful when operations teams need centralized visibility into multiple managed instances and want to perform administrative tasks through the Systems Manager console rather than building separate remote-access workflows.

Question 367. An operations team wants centralized visibility into operational issues and wants to aggregate relevant findings and automate actions for troubleshooting. Which AWS Systems Manager capability is designed to organize operational work items?

1. Systems Manager OpsCenter
2. Systems Manager Inventory
3. Systems Manager Distributor
4. Systems Manager Parameter Store

Correct Answer: 1. Systems Manager OpsCenter

Explanation:

Systems Manager OpsCenter is designed to centralize and organize operational issues called OpsItems. It provides operations teams with a structured place to review incidents, related resources, operational data, and remediation information. OpsCenter can integrate with other AWS services so that operational events can result in the creation of actionable work items. Inventory collects metadata about managed nodes, Distributor handles software packages, and Parameter Store stores configuration values and secrets-related parameters. When the primary requirement is to provide centralized operational visibility and manage troubleshooting work, OpsCenter is the appropriate Systems Manager capability.

Question 368. A company wants to provide operations teams with a centralized view of resource and operational information across AWS accounts and Regions. Which Systems Manager capability can provide this broader operational view?

1. Patch Manager
2. Fleet Manager
3. Systems Manager Explorer
4. Run Command

Correct Answer: 3. Systems Manager Explorer

Explanation:

Systems Manager Explorer provides an operational dashboard that helps teams view information about managed resources and operational data in a centralized manner. It can aggregate information such as operational issues, compliance-related information, and other resource data to help teams understand the overall state of their AWS environment. Patch Manager specializes in patching, Fleet Manager provides node-level management capabilities, and Run Command executes commands on managed instances. Explorer is therefore suited to situations where administrators need a higher-level operational overview rather than a tool focused on one specific management activity.

Question 369. A company needs to track whether managed EC2 instances meet required patch baselines and identify machines that are missing required patches. Which Systems Manager capability should be used?

1. Systems Manager Patch Manager
2. Systems Manager Session Manager
3. Systems Manager Inventory
4. Systems Manager Automation

Correct Answer: 1. Systems Manager Patch Manager

Explanation:

Systems Manager Patch Manager helps administrators assess and manage operating system patch compliance across managed nodes. Patch baselines define which patches should be installed or considered compliant, allowing organizations to identify instances that are missing required updates. Patch Manager can also be integrated with Maintenance Windows to schedule patching activities during controlled operational periods. Session Manager provides interactive shell access, Inventory collects system metadata, and Automation executes predefined operational workflows. When the requirement specifically involves determining whether instances meet patch requirements and addressing missing patches, Patch Manager is the appropriate Systems Manager capability.

Question 370. An administrator creates a State Manager association that applies a configuration to a fleet of managed instances. What is a primary operational benefit of this association?

1. It permanently disables AWS Config
2. It automatically creates an RDS read replica
3. It continuously helps maintain the desired instance configuration
4. It replaces IAM policies with local operating-system permissions

Correct Answer: 3. It continuously helps maintain the desired instance configuration

Explanation:

Systems Manager State Manager uses associations to define and maintain a desired configuration on managed nodes. An association can specify documents, parameters, schedules, and target instances so that configuration tasks can be performed repeatedly rather than relying on a one-time manual change. This is useful for maintaining settings such as software configurations, services, or other operational state across a fleet. State Manager does not replace IAM authorization, create database replicas, or disable AWS Config. Its primary operational purpose is configuration consistency and ongoing enforcement, making it valuable for reducing configuration drift across managed instances.

Question 371. An organization wants to review the output, status, and execution details of an AWS Systems Manager Automation runbook after an automated operation completes. Which information should the administrator examine?

1. Automation execution details
2. S3 Versioning configuration
3. Route 53 hosted zone records
4. IAM group membership

Correct Answer: 1. Automation execution details

Explanation:

Systems Manager Automation provides execution information for runbooks, allowing administrators to inspect the status and results of individual automation steps. Execution details can help operators determine whether a workflow succeeded, identify the step that failed, and review outputs or error information associated with the runbook execution. This is particularly important when automation performs infrastructure changes, because troubleshooting requires knowing exactly where the workflow stopped and what information was returned by each step. S3 Versioning, Route 53 records, and IAM group membership do not provide the execution-specific information needed to investigate an Automation runbook.

Question 372. A company wants to identify which EC2 instances are compliant with its approved patch baseline. Which Systems Manager information is most relevant?

1. Session Manager connection history
2. Patch compliance status
3. Parameter Store hierarchy
4. Automation document version

Correct Answer: 2. Patch compliance status

Explanation:

Patch compliance status provides information about whether managed instances satisfy the requirements defined by their applicable patch baselines. Administrators can use this information to identify instances that are compliant, noncompliant, or missing expected patches. This allows operations teams to prioritize remediation and maintain consistent operating system update standards. Session Manager focuses on interactive management access, Parameter Store organizes configuration parameters, and Automation documents define workflows. Although these capabilities can participate in an overall management strategy, patch compliance status is the information directly needed when the goal is to determine whether EC2 instances meet approved patch requirements.

Question 373. An AWS account receives an account-specific AWS Health event indicating that an EC2 resource may be affected by planned maintenance. What is the main value of the AWS Health Dashboard in this situation?

1. It automatically encrypts the affected EC2 volumes
2. It provides account-specific information about AWS service events affecting resources
3. It changes the EC2 security group rules
4. It creates an Auto Scaling group automatically

Correct Answer: 2. It provides account-specific information about AWS service events affecting resources

Explanation:

The AWS Health Dashboard provides personalized information about AWS service events that can affect an organization’s resources. Unlike general public service-status information, account-specific Health events can identify affected resources, provide event details, and communicate recommended actions or timelines when applicable. This makes the dashboard valuable for operational planning and incident response. It does not automatically modify security groups, encrypt EBS volumes, or create Auto Scaling groups. Operations teams can also integrate AWS Health events with automation and notification workflows when they need to respond systematically to infrastructure-impacting service events.

Question 374. A company wants to use AWS Backup to protect resources in one account while allowing another AWS account to manage or access copies of those backups. Which AWS Backup capability is relevant?

1. Cross-account backup
2. S3 Transfer Acceleration
3. CloudWatch composite alarms
4. EC2 instance recovery

Correct Answer: 1. Cross-account backup

Explanation:

AWS Backup supports cross-account backup strategies that allow backup copies to be shared or copied across AWS accounts, helping organizations improve isolation and resilience. Separating backups into another account can reduce the risk that an issue affecting the source environment also compromises the backup copies. This pattern is commonly useful for centralized backup administration or stronger recovery isolation. S3 Transfer Acceleration is an S3 data-transfer feature, CloudWatch composite alarms combine alarm states, and EC2 recovery addresses instance availability. Therefore, cross-account backup is the relevant AWS Backup capability when protection must extend across account boundaries.

Question 375. An administrator needs to protect backup recovery points from accidental or unauthorized deletion for a defined retention period. Which AWS Backup feature is designed for this requirement?

1. Backup copy job
2. Backup plan
3. Backup Vault Lock
4. Backup gateway

Correct Answer: 3. Backup Vault Lock

Explanation:

AWS Backup Vault Lock helps protect recovery points from deletion or modification according to configured retention requirements. It can support a governance model in which backup data becomes protected from actions that could otherwise compromise recovery availability. This is particularly useful for organizations that need stronger safeguards against accidental deletion or unauthorized changes to backups. A backup plan defines backup schedules and lifecycle behavior, while a copy job transfers recovery points and Backup Gateway integrates supported workloads with AWS Backup. When the requirement is specifically to prevent unwanted alteration or deletion of protected recovery points, Backup Vault Lock is the relevant feature.

Question 376. A company wants to deploy the same CloudFormation infrastructure template consistently across multiple AWS accounts and Regions. Which CloudFormation capability is designed for centralized multi-account and multi-Region deployments?

1. CloudFormation StackSets
2. CloudFormation Change Sets
3. CloudFormation Drift Detection
4. CloudFormation Outputs

Correct Answer: 1. CloudFormation StackSets

Explanation:

CloudFormation StackSets allows administrators to create and manage stacks across multiple AWS accounts and Regions from a centralized operation. This is useful when organizations need standardized infrastructure deployments across environments while maintaining consistent templates and configurations. Change Sets are used to preview modifications to an existing stack, Drift Detection identifies differences between declared and actual resource configurations, and Outputs expose values from stack resources. StackSets is therefore the appropriate choice for repeated, centrally managed infrastructure deployment across multiple accounts and Regions, particularly in organizations that use a standardized infrastructure-as-code model.

Question 377. An administrator needs to change a CloudFormation stack that contains nested stacks. Which approach allows the parent stack to manage resources defined by the nested templates as part of the overall deployment?

1. CloudTrail Lake
2. CloudFormation nested stacks
3. Route 53 Resolver
4. Systems Manager Inventory

Correct Answer: 2. CloudFormation nested stacks

Explanation:

CloudFormation nested stacks allow a parent CloudFormation stack to include other CloudFormation stacks as resources. This structure helps organizations break large infrastructure templates into smaller, reusable components while still managing the overall deployment through the parent stack. Nested stacks can improve template organization and make complex infrastructure easier to maintain. CloudTrail Lake is designed for event analysis, Route 53 Resolver handles DNS resolution, and Systems Manager Inventory collects managed-node metadata. When infrastructure needs to be modularized while retaining CloudFormation-based management, nested stacks provide the appropriate mechanism.

Question 378. A CloudFormation update fails and the stack enters UPDATE_ROLLBACK_FAILED. The administrator has corrected the underlying issue and needs to allow the rollback process to continue. Which action is appropriate?

1. Delete the AWS account
2. Disable CloudTrail
3. Continue the CloudFormation rollback
4. Create a new IAM group

Correct Answer: 3. Continue the CloudFormation rollback

Explanation:

When a CloudFormation stack enters UPDATE_ROLLBACK_FAILED, the rollback process itself has encountered an issue and cannot complete normally. After correcting the underlying resource or configuration problem, an administrator can use the continue rollback operation to allow CloudFormation to resume the rollback process. This helps return the stack to a stable state without unnecessarily rebuilding the entire environment. Deleting an account, disabling CloudTrail, or modifying IAM groups does not address the stack’s rollback state. Properly resolving the underlying failure and continuing the rollback is therefore the operational approach for this CloudFormation condition.

Question 379. A CloudWatch alarm should trigger only when both a CPU alarm and a status-check alarm indicate problems. Which CloudWatch feature can combine these alarm states into a single decision?

1. CloudWatch Logs Insights
2. CloudWatch composite alarm
3. CloudWatch metric stream
4. CloudWatch dashboard

Correct Answer: 2. CloudWatch composite alarm

Explanation:

A CloudWatch composite alarm combines the states of multiple individual CloudWatch alarms using logical expressions. This allows operations teams to create higher-level alerting conditions that reduce unnecessary notifications and represent more meaningful operational scenarios. For example, a composite alarm can require both a high CPU alarm and an instance status-check alarm to be in an alarm state before triggering an action. Logs Insights analyzes log data, metric streams deliver metrics to destinations, and dashboards provide visualization. Therefore, a composite alarm is the appropriate feature when an alert must depend on the combined state of multiple existing alarms.

Question 380. A CloudWatch alarm monitors an application metric, but the metric sometimes stops reporting. The operations team wants the alarm to treat missing data as a non-breaching condition. Which alarm configuration should be selected?

1. Treat missing data as breaching
2. Treat missing data as not breaching
3. Disable the alarm
4. Delete the metric

Correct Answer: 2. Treat missing data as not breaching

Explanation:

CloudWatch alarms provide configurable treatment for missing data, allowing administrators to determine how an alarm should behave when expected metric datapoints are unavailable. Selecting “not breaching” causes missing datapoints to be treated as if they do not violate the alarm threshold. This can be useful for applications where periods without metrics are expected and should not automatically produce operational alerts. Treating missing data as breaching would make the alarm more aggressive, while disabling or deleting the alarm removes monitoring rather than configuring its behavior. Therefore, “treat missing data as not breaching” directly satisfies the stated requirement.