View Full Amazon AWS Certified CloudOps Engineer – Associate SOA-C03 Exam Dumps and Practice Test Dumps

 

Question 61. Which IAM policy element takes precedence when an Allow statement and an explicit Deny statement apply to the same request?

1. The Allow statement
2. The explicit Deny statement
3. The statement with the newest creation date
4. The statement attached directly to the user

Correct Answer: 2. The explicit Deny statement

Explanation:

AWS IAM policy evaluation uses several policy types and evaluation rules, but an explicit Deny takes precedence over an Allow whenever both apply to the same request. This behavior is important for CloudOps engineers because permissions can come from identity-based policies, resource-based policies, permissions boundaries, session policies, and organization policies such as SCPs. Even if a user or role has an Allow permission for an action, an applicable explicit Deny can prevent the request from succeeding. Operational troubleshooting should therefore examine all relevant policy layers rather than assuming that an Allow statement guarantees access. Removing an unnecessary explicit Deny or correcting its scope may resolve the authorization failure.

Question 62. An administrator wants to identify resources that can be accessed by external principals through resource-based policies. Which AWS service should be used?

1. AWS IAM Access Analyzer
2. AWS CloudTrail
3. Amazon Inspector
4. AWS Trusted Advisor

Correct Answer: 1. AWS IAM Access Analyzer

Explanation:

IAM Access Analyzer helps organizations identify resources that are accessible from outside their AWS account or organization when external access is created through resource-based policies. It can analyze supported resources and generate findings when a policy grants access to external principals. This is particularly useful during operational security reviews because administrators can identify unintended sharing without manually inspecting every policy. Access Analyzer can also support validation of IAM policies before deployment. CloudTrail records API activity, Inspector evaluates workload vulnerabilities, and Trusted Advisor provides broader recommendations, but IAM Access Analyzer is specifically designed to analyze resource-based access relationships.

Question 63. An application running on an EC2 instance needs temporary permissions to access an S3 bucket. Which approach is most appropriate?

1. Store an IAM access key in the application’s configuration file
2. Create a long-term IAM user access key
3. Attach an IAM role to the EC2 instance
4. Store credentials in an AMI

Correct Answer: 3. Attach an IAM role to the EC2 instance

Explanation:

An IAM role attached to an EC2 instance allows applications running on that instance to obtain temporary security credentials automatically through the instance metadata service. This eliminates the need to embed long-term access keys in application configuration files, AMIs, scripts, or source code. Temporary credentials are automatically rotated by AWS, reducing operational credential-management requirements. The role should follow least-privilege principles and grant only the S3 permissions required by the workload. This approach is generally preferable for EC2 applications because it improves security while making credential rotation and operational maintenance significantly easier.

Question 64. A company needs to store database passwords and automatically rotate them using an AWS-managed service. Which service is most appropriate?

1. Amazon S3
2. AWS Secrets Manager
3. Amazon CloudWatch
4. AWS Config

Correct Answer: 2. AWS Secrets Manager

Explanation:

AWS Secrets Manager is designed to securely store, retrieve, and manage sensitive information such as database credentials, API keys, and application secrets. It also supports automated rotation for supported secret types and integrations, reducing the operational burden of manually changing credentials. Applications can retrieve secrets at runtime instead of storing passwords directly in source code or configuration files. Parameter Store can also store sensitive values, particularly when using SecureString, but Secrets Manager provides dedicated secret-management capabilities and automated rotation features. For an operational requirement specifically mentioning automatic credential rotation, Secrets Manager is therefore the appropriate service.

Question 65. An application needs to encrypt data using an AWS KMS key. The IAM role has permission to call the encryption API, but the request is still denied. What should the administrator check?

1. The EC2 instance type
2. The VPC route table only
3. The CloudWatch dashboard
4. The KMS key policy and related permissions

Correct Answer: 4. The KMS key policy and related permissions

Explanation:

AWS KMS uses key policies as an important part of authorization for cryptographic operations. Having an IAM permission for an action such as kms does not necessarily mean the request will succeed if the key policy or another applicable policy does not permit the principal to use the key. The administrator should review the KMS key policy, IAM permissions, grants if applicable, and any organization-level restrictions that could affect authorization. This is a common operational troubleshooting scenario because KMS authorization differs from simply granting access to an AWS API through an identity policy.

Question 66. A CloudFormation stack administrator wants to preview how a template update will affect existing resources before executing the update. Which feature should be used?

1. CloudFormation Change Sets
2. CloudFormation Drift Detection
3. AWS Config Rules
4. CloudTrail Event History

Correct Answer: 1. CloudFormation Change Sets

Explanation:

CloudFormation Change Sets allow administrators to preview the proposed changes that CloudFormation would make to a stack before actually executing an update. The change set can show resources that will be added, modified, or removed, helping operators assess the potential impact of a deployment. This is especially valuable when infrastructure changes could affect production resources or cause replacement of existing resources. Drift Detection serves a different purpose: it identifies differences between the expected CloudFormation configuration and the actual deployed resource configuration. Change Sets are therefore the appropriate operational tool for reviewing planned infrastructure modifications before execution.

Question 67. An administrator suspects that an EC2 security group was manually modified outside CloudFormation. Which CloudFormation feature can identify configuration differences between the template-managed state and the actual resource?

1. StackSets
2. Change Sets
3. Drift Detection
4. Nested Stacks

Correct Answer: 3. Drift Detection

Explanation:

CloudFormation drift detection identifies differences between the configuration that CloudFormation expects and the current configuration of supported resources. If an administrator manually changes a security group or another managed resource outside CloudFormation, drift detection can help reveal that the deployed state no longer matches the expected stack configuration. This capability is useful for maintaining infrastructure consistency and investigating unexpected changes. A Change Set previews future modifications, while StackSets are designed for deploying stacks across multiple accounts or Regions. Drift detection is therefore the appropriate choice when the goal is to discover configuration changes that have already occurred outside the CloudFormation workflow.

Question 68. A CloudOps engineer needs to run a predefined sequence of operational actions on several AWS resources using automation documents. Which Systems Manager capability should be used?

1. Session Manager
2. Automation
3. Patch Manager
4. Inventory

Correct Answer: 2. Automation

Explanation:

AWS Systems Manager Automation allows administrators to execute predefined workflows using Automation runbooks. These workflows can perform operational tasks such as restarting services, modifying resources, creating snapshots, applying configuration changes, or responding to incidents. Automation is useful when the same operational procedure must be performed consistently across environments or multiple resources. Runbooks can include multiple steps and can use AWS APIs to carry out actions without requiring an administrator to manually perform each task. Session Manager is primarily for interactive shell access, Patch Manager focuses on patching, and Inventory collects information about managed instances.

Question 69. A company wants to collect installed applications, operating-system details, and other metadata from managed EC2 instances. Which Systems Manager capability provides this information?

1. Systems Manager Inventory
2. Systems Manager Automation
3. Systems Manager Session Manager
4. Systems Manager Parameter Store

Correct Answer: 1. Systems Manager Inventory

Explanation:

Systems Manager Inventory collects metadata about managed nodes, including operating-system information, installed applications, network configuration details, and other inventory-related data depending on the configured collection settings. This information helps CloudOps teams understand what software and configurations exist across their fleet. Inventory can be particularly valuable for compliance checks, software management, troubleshooting, and operational reporting. Automation executes runbooks, Session Manager provides interactive access without requiring traditional SSH connectivity, and Parameter Store manages configuration data and parameters. When the requirement is specifically to discover installed software and system information across managed instances, Inventory is the relevant capability.

Question 70. A company wants to define a recurring maintenance period during which Systems Manager can perform operational tasks on selected instances. Which feature should be configured?

1. Systems Manager State Manager
2. Systems Manager Inventory
3. Systems Manager Maintenance Windows
4. Systems Manager Session Manager

Correct Answer: 3. Systems Manager Maintenance Windows

Explanation:

Systems Manager Maintenance Windows allow administrators to define recurring time periods when disruptive or administrative tasks can be performed on selected managed resources. Tasks can include patching, running commands, invoking Automation runbooks, or other supported operational activities. Maintenance Windows help organizations control when scheduled maintenance occurs, reducing the likelihood that operational changes will interfere with business activity. State Manager is primarily intended to maintain a desired configuration continuously or according to an association schedule. Inventory collects metadata, while Session Manager provides interactive management access. Therefore, a defined recurring maintenance period is best handled with Maintenance Windows.

Question 71. A team needs to execute a task at a specific future time and does not require a continuously evaluated event pattern. Which service is designed for this scheduling requirement?

1. Amazon EventBridge Scheduler
2. AWS CloudTrail
3. AWS Config
4. Amazon GuardDuty

Correct Answer: 1. Amazon EventBridge Scheduler

Explanation:

Amazon EventBridge Scheduler is designed to schedule one-time or recurring actions at specified times. It can invoke supported AWS APIs and services according to a schedule, making it useful for operational activities such as starting or stopping resources, triggering Lambda functions, or initiating workflows. This differs from an EventBridge rule, which commonly evaluates incoming events against event patterns or schedules. Scheduler is particularly useful when CloudOps teams need centralized scheduling with flexible timing controls and service integrations. Choosing Scheduler can simplify scheduled operational tasks without requiring administrators to build and maintain custom scheduling infrastructure.

Question 72. A Lambda function processes messages from an asynchronous event source, but some invocations repeatedly fail. The administrator wants failed events routed to another destination for investigation. Which feature is appropriate?

1. Lambda Layers
2. Lambda Environment Variables
3. Lambda Event Destinations
4. Lambda Provisioned Concurrency

Correct Answer: 3. Lambda Event Destinations

Explanation:

Lambda Event Destinations can route asynchronous invocation results to another AWS service after processing succeeds or fails. For failed asynchronous invocations, an administrator can configure a destination such as Amazon SQS, Amazon SNS, EventBridge, or another supported destination to preserve information about the invocation and facilitate investigation or additional processing. This is useful operationally because failed events do not simply disappear from the workflow without a defined handling mechanism. Lambda Layers package reusable dependencies, environment variables provide configuration values, and Provisioned Concurrency addresses startup latency rather than failure routing. Event Destinations therefore directly address the requirement.

Question 73. A workload requires a message queue where duplicate messages are acceptable and very high throughput is important. Which Amazon SQS queue type is generally appropriate?

1. FIFO queue
2. Standard queue
3. Dead-letter queue only
4. Delay queue only

Correct Answer: 2. Standard queue

Explanation:

Amazon SQS Standard queues are designed to provide very high throughput and at-least-once message delivery. Because duplicate message delivery can occur, applications consuming Standard queues should be designed to handle duplicate processing safely, commonly through idempotent application logic. FIFO queues provide stronger ordering guarantees and exactly-once processing behavior within their supported design, but they are intended for workloads where message ordering and deduplication requirements are important. When the scenario explicitly states that duplicates are acceptable and emphasizes high throughput, an SQS Standard queue is generally the suitable operational choice.

Question 74. A company publishes one application event and needs multiple independent systems to receive notifications about it. Which AWS messaging pattern is most suitable?

1. Amazon SNS topic with multiple subscriptions
2. A single SQS queue shared by all consumers
3. Amazon EBS snapshot
4. AWS CloudTrail trail

Correct Answer: 1. Amazon SNS topic with multiple subscriptions

Explanation:

Amazon SNS supports a publish-subscribe messaging model in which a publisher sends a message to a topic and multiple subscribers can independently receive the notification. This creates a useful fanout pattern for operational architectures where the same event must be delivered to multiple systems, such as queues, Lambda functions, or other supported endpoints. A single shared SQS queue distributes messages among consumers rather than delivering each message independently to every consumer. SNS therefore provides the appropriate pattern when one event needs to be propagated to several independent processing paths.

Question 75. A company wants objects in an S3 bucket to automatically transition to a cheaper storage class after 30 days and eventually expire after a defined retention period. Which feature should be configured?

1. S3 Access Points
2. S3 Lifecycle rules
3. S3 Transfer Acceleration
4. S3 Event Notifications

Correct Answer: 2. S3 Lifecycle rules

Explanation:

Amazon S3 Lifecycle rules allow organizations to automate object-management actions based on object age, tags, prefixes, or other supported conditions. A lifecycle configuration can transition objects to different storage classes after a specified number of days and can also expire objects when they are no longer required. This helps reduce storage costs and automate retention management without requiring custom scripts to inspect and modify objects. Access Points primarily simplify controlled data access, Transfer Acceleration improves data transfer performance, and Event Notifications trigger actions when certain bucket events occur. Lifecycle rules are therefore the appropriate feature for automated transitions and expiration.

Question 76. An administrator creates an EC2 AMI from a running instance and wants the AMI to contain the instance’s EBS-backed data. What does the AMI creation process use for the EBS volumes?

1. EBS snapshots
2. VPC Flow Logs
3. CloudWatch Logs
4. NAT Gateway storage

Correct Answer: 1. EBS snapshots

Explanation:

For an EBS-backed EC2 instance, creating an AMI involves creating snapshots of the EBS volumes associated with the image configuration. The AMI references those snapshots so that new instances launched from the AMI can recreate the required EBS-backed storage configuration. This makes AMIs useful for standardized instance deployments, recovery procedures, and repeatable infrastructure provisioning. The underlying snapshot mechanism also means administrators should consider snapshot retention, encryption, and lifecycle management as part of operational planning. VPC Flow Logs and CloudWatch Logs capture network or application information, while a NAT Gateway does not provide storage for AMI creation.

Question 77. An Auto Scaling group needs to pause launching or terminating an instance while a custom initialization process completes. Which feature should be used?

1. Auto Scaling lifecycle hooks
2. Auto Scaling target tracking
3. EC2 placement groups
4. Elastic IP addresses

Correct Answer: 1. Auto Scaling lifecycle hooks

Explanation:

Auto Scaling lifecycle hooks allow an Auto Scaling group to pause an instance during specific lifecycle transitions, such as launching or terminating, so that additional actions can be completed before the instance moves to its next state. During a launch hook, for example, automation can perform initialization, configuration, registration, or application setup before the instance begins serving production traffic. During termination, a hook can provide time for cleanup or log collection. This capability is especially useful when an application requires custom operational steps that cannot be completed within the normal EC2 launch or termination sequence.

Question 78. An Application Load Balancer administrator notices that a target is receiving no traffic because it is repeatedly marked unhealthy. Which configuration should be checked first?

1. S3 bucket versioning
2. CloudTrail log file validation
3. The target group’s health check configuration
4. AWS Backup vault policy

Correct Answer: 3. The target group’s health check configuration

Explanation:

An Application Load Balancer determines whether registered targets are healthy by using the health check configuration associated with the target group. Administrators should verify the health check protocol, port, path, timeout, interval, and success criteria, along with whether the application is actually listening and responding correctly on the expected endpoint. A target can be operational from the operating system’s perspective but still fail the load balancer health check if the configured path or port is incorrect. Reviewing target health details and comparing them with the application configuration is therefore an important first troubleshooting step.

Question 79. A Route 53 failover configuration should send DNS traffic to a secondary endpoint when the primary endpoint becomes unavailable. Which Route 53 capability supports this design?

1. Route 53 Resolver endpoints
2. Route 53 health checks with failover routing
3. Route 53 private hosted zones only
4. Route 53 domain registration

Correct Answer: 2. Route 53 health checks with failover routing

Explanation:

Amazon Route 53 health checks can monitor the availability of an endpoint, while failover routing can use the health status to determine which resource should receive DNS responses. In a typical active-passive configuration, the primary record is associated with the primary endpoint and the secondary record provides an alternate destination. If Route 53 determines that the primary endpoint is unhealthy according to the configured health check, DNS responses can direct clients toward the secondary resource. Resolver endpoints serve DNS resolution connectivity functions, private hosted zones provide private DNS namespaces, and domain registration is unrelated to endpoint failover.

Question 80. A production RDS database requires automatic failover to a standby database in another Availability Zone. Which configuration should the CloudOps engineer use?

1. RDS Read Replica only
2. RDS Multi-AZ deployment
3. RDS automated backup only
4. RDS snapshot export

Correct Answer: 2. RDS Multi-AZ deployment

Explanation:

An Amazon RDS Multi-AZ deployment is designed to improve database availability by maintaining a standby instance in another Availability Zone and providing automatic failover when certain failures affect the primary database. The standby is intended for high availability rather than serving normal read traffic. This differs from an RDS Read Replica, which is primarily designed for read scaling and replication use cases and does not provide the same automatic high-availability architecture as Multi-AZ. Automated backups support recovery to a point in time, while snapshots provide backup copies. For automatic database failover across Availability Zones, Multi-AZ is the relevant configuration.