AWS Certified CloudOps Engineer - Associate (SOA-C03) Practice Exam

What the AWS Certified CloudOps Engineer - Associate (SOA-C03) exam covers

• Monitoring, Logging, Analysis, Remediation, and Performance Optimization227 questions
• Reliability and Business Continuity77 questions
• Deployment, Provisioning, and Automation89 questions
• Security and Compliance118 questions
• Networking and Content Delivery101 questions

Free AWS Certified CloudOps Engineer - Associate (SOA-C03) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 612.

1. Question 1Monitoring, Logging, Analysis, Remediation, and Performance Optimization

   Which service collects metrics and lets you set alarms that trigger actions when thresholds are breached?

   • AAWS IAM
   • BAmazon CloudWatchCorrect
   • CAmazon VPC
   • DAmazon S3
   ✓ Correct answer: B

   Amazon CloudWatch is a comprehensive monitoring service designed to collect metrics from AWS resources and user-defined applications, enabling operators to set alarms on these metrics that trigger automated actions when thresholds are breached. CloudWatch provides the foundation for operational visibility, alerting, and automated remediation workflows.

   Why the other options are wrong

   • AAWS IAM is incorrect because it manages identity and access control, not metrics collection or alarm configuration.
   • CAmazon VPC is incorrect because it is a networking service focused on virtual network configuration, not metrics collection.
   • DAmazon S3 is incorrect because it is an object storage service and does not provide monitoring or alarm capabilities.
2. Question 2Reliability and Business Continuity

   An Auto Scaling Group spans three AZs. During a scale-in event you notice instances are not removed from the AZ you expected. By default, how does ASG choose which instance to terminate?

   • AIt cycles through the AZs in strict round-robin order, terminating one instance per AZ regardless of how unbalanced the counts are
   • BIt scans all AZs and always terminates whichever instance currently reports the lowest CloudWatch CPU utilization
   • CIt first rebalances by terminating in the AZ with the most instances, then applies the default termination policy (oldest launch template/config)Correct
   • DIt ignores AZ balance and terminates whichever instance is closest to completing its next billing hour in a randomly chosen AZ
   ✓ Correct answer: C

   AWS Auto Scaling uses a multi-step termination process during scale-in. First, it identifies the AZ with the most instances to maintain balance across AZs. Within that AZ, the default termination policy then selects the instance using the oldest launch template or launch configuration. This two-step process means the AZ chosen for termination may not be the one you expect if AZ counts are uneven, which often surprises operators expecting purely age-based selection.

   Why the other options are wrong

   • AScale-in first rebalances by choosing the AZ with the most instances rather than cycling through AZs one at a time in round-robin order.
   • BThe default policy does not select by CPU utilization; it rebalances AZs and then favors the oldest launch config/template.
   • DBilling-hour proximity is only a later tiebreaker after AZ rebalancing and the oldest-configuration checks are applied.
3. Question 3Security and Compliance

   Which service evaluates resource configurations against rules for compliance/drift?

   • AAWS ConfigCorrect
   • BAWS CodeBuild
   • CAmazon CloudFront
   • DAmazon SQS
   ✓ Correct answer: A

   AWS Config provides continuous monitoring of AWS resource configurations by recording configuration changes and evaluating them against a library of managed rules or custom Lambda-backed rules. When a resource's configuration violates a rule - such as an S3 bucket becoming publicly accessible or a security group allowing unrestricted SSH - Config flags it as non-compliant. Config also maintains a timeline of configuration history, enabling drift investigation and compliance audits.

   Why the other options are wrong

   • BAWS CodeBuild is a managed build server for compiling application source code and executing test suites in CI/CD pipelines - it evaluates code builds, not AWS resource configurations.
   • CAmazon CloudFront is a content delivery network that caches and distributes web content at edge locations - it does not track or evaluate the configuration state of AWS infrastructure resources.
   • DAmazon SQS is a message queuing service for reliable asynchronous communication between application components - it has no configuration evaluation, compliance checking, or drift detection capabilities.
4. Question 4Monitoring, Logging, Analysis, Remediation, and Performance Optimization

   For steady-state, predictable EC2 usage over 1-3 years, which pricing reduces cost the most vs On-Demand?

   • ADedicated Hosts for everything
   • BSpot Instances for the production database
   • COn-Demand only
   • DSavings Plans or Reserved InstancesCorrect
   ✓ Correct answer: D

   For workloads with consistent, predictable usage over one to three years, Savings Plans and Reserved Instances provide discounts of up to 72% compared to On-Demand pricing in exchange for a usage commitment. These are the most cost-effective pricing models for stable production workloads.

   Why the other options are wrong

   • ADedicated Hosts provide physical server isolation for licensing or compliance requirements and are significantly more expensive than standard On-Demand pricing; they are not a cost-reduction strategy for typical workloads.
   • BSpot Instances for the production database is a high-risk approach - Spot Instances can be interrupted with two minutes of notice, making them unsuitable for stateful production databases that require continuous availability.
   • COn-Demand only provides no commitment discount and is the most expensive pricing model for steady, predictable workloads compared to Savings Plans or Reserved Instances.
5. Question 5Monitoring, Logging, Analysis, Remediation, and Performance Optimization

   After enabling a CloudTrail trail, your security team complains they cannot see object-level GetObject and PutObject activity on a sensitive S3 bucket. The trail logs management events fine. What must you enable?

   • AS3 data events for that bucket in the trail's event selectorsCorrect
   • BVPC Flow Logs on the subnet hosting the S3 gateway endpoint
   • CCloudTrail Insights for unusual API activity on the account
   • DS3 server access logging as the trail's event source
   ✓ Correct answer: A

   CloudTrail separates events into management events (control-plane actions like CreateBucket or ModifyDBInstance) and data events (data-plane actions like S3 GetObject and PutObject). Data events are not logged by default and must be explicitly enabled in a trail's event selectors, scoped either to all S3 buckets or to specific bucket ARNs. Once enabled, every GetObject and PutObject call - including the principal, timestamp, and object key - is recorded, giving the security team the object-level visibility they require.

   Why the other options are wrong

   • BVPC Flow Logs record IP traffic metadata, not object-level GetObject/PutObject API calls in CloudTrail.
   • CCloudTrail Insights surfaces anomalous API volume; it does not log individual object-level S3 data events.
   • DS3 server access logs are a separate best-effort log, not the CloudTrail data events the security team needs.
6. Question 6Monitoring, Logging, Analysis, Remediation, and Performance Optimization

   An EC2 instance running the unified CloudWatch agent is publishing metrics, but you notice the CPUUtilization values from the agent differ from the EC2 hypervisor-reported CPUUtilization in the AWS/EC2 namespace. A teammate asks which value reflects the guest OS perspective. Which statement is correct?

   • AThe CloudWatch agent's cpu_usage_active metric reflects the guest OS view, while AWS/EC2 CPUUtilization reflects the hypervisor viewCorrect
   • BBoth metrics are identical because they read from the same underlying data source
   • CAWS/EC2 CPUUtilization reports the guest OS view while the agent reports the hypervisor view
   • DNeither metric reflects CPU usage; both actually report memory pressure on the host
   ✓ Correct answer: A

   The default AWS/EC2 CPUUtilization metric is collected by the hypervisor and represents allocated compute capacity used. The CloudWatch agent collects OS-level counters (such as cpu_usage_active) from within the instance, so the two can legitimately differ, with the agent value representing the guest OS perspective.

   Why the other options are wrong

   • BThe two metrics come from different vantage points, the hypervisor and the guest OS, so they are not identical.
   • CThis reverses the relationship: AWS/EC2 CPUUtilization is the hypervisor view and the agent is the guest OS view.
   • DBoth metrics do measure CPU utilization, so claiming they report memory pressure is incorrect.
7. Question 7Reliability and Business ContinuitySelect all that apply

   A team needs to ensure that during a failover test, traffic is only shifted away from a Region when all dependent components are verified ready, and that failover decisions are not blocked by the same control-plane impairment affecting the workload. Which TWO Amazon Route 53 Application Recovery Controller (ARC) capabilities support this? (Choose TWO)

   • ARouting controls that let operators deliberately shift traffic between Regions using a highly available data planeCorrect
   • BReadiness checks that continuously audit whether recovery resources are scaled and configured correctlyCorrect
   • CAutomatic rewriting of application source code to remove Regional dependencies
   • DSynchronous database replication implemented inside the DNS resolver
   ✓ Correct answer: A, B

   ARC routing controls are simple on/off switches operated through an extremely reliable cluster data plane, so you can trigger failover even when control planes elsewhere are impaired. Readiness checks continuously evaluate whether your standby/recovery resources (capacity, quotas, configuration) are prepared to take over, giving confidence before shifting traffic. Together they make Regional failover deliberate and verified.

   Why the other options are wrong

   • CARC does not modify application source code; removing Regional dependencies is an application architecture task, not an ARC feature.
   • DARC does not perform database replication, and DNS resolvers do not implement synchronous database replication; that is handled by services like Aurora Global Database.
8. Question 8Security and Compliance

   A company must ensure that all data sent between an on-premises data center and a VPC traverses an encrypted, private connection that does not use the public internet. Which combination satisfies the encryption-in-transit requirement most directly?

   • AAn AWS Direct Connect connection with a private VPIF and MACsec encryptionCorrect
   • BA public internet route with security groups restricting source IPs
   • CAn S3 VPC gateway endpoint with a bucket policy
   • DA NAT gateway configured for outbound-only traffic
   ✓ Correct answer: A

   Direct Connect delivers a dedicated private network path between on-premises and AWS, avoiding the public internet. MACsec (available on supported Direct Connect connections) adds Layer 2 encryption so data in transit is protected on the link. Together they meet the requirement for a private, encrypted connection.

   Why the other options are wrong

   • BRouting over the public internet does not meet the private-connection requirement, and security groups do not encrypt traffic.
   • CAn S3 gateway endpoint provides private access to S3 from within a VPC but is unrelated to on-premises-to-VPC connectivity.
   • DA NAT gateway enables outbound internet access for private instances and does not create an encrypted private link to on-premises.
9. Question 9Networking and Content Delivery

   A SysOps administrator needs CloudFront to require viewers to use HTTPS but still allow the origin connection to use either protocol that CloudFront chooses automatically based on the viewer request. Which Viewer Protocol Policy setting forces secure viewer connections?

   • AHTTP and HTTPS
   • BRedirect HTTP to HTTPSCorrect
   • CMatch Viewer for the origin protocol policy
   • DAllow only GET, HEAD requests
   ✓ Correct answer: B

   The Viewer Protocol Policy controls how viewers connect to the CloudFront edge. 'Redirect HTTP to HTTPS' returns a 301/302 to the HTTPS URL so all viewer traffic ends up encrypted, while 'HTTPS Only' would reject HTTP outright. This is the standard way to enforce TLS for viewers.

   Why the other options are wrong

   • A'HTTP and HTTPS' allows insecure HTTP connections and does not force HTTPS.
   • CMatch Viewer is an Origin Protocol Policy controlling the CloudFront-to-origin connection, not the viewer-facing requirement.
   • DRestricting allowed HTTP methods controls which verbs are permitted, not the protocol used by viewers.
10. Question 10Monitoring, Logging, Analysis, Remediation, and Performance Optimization

    An application uses an Application Load Balancer in front of an Auto Scaling group. During predictable daily traffic peaks at 9 AM, the target-tracking policy reacts too slowly and users see latency until new instances warm up. The traffic pattern is highly predictable. Which scaling approach best addresses the slow warm-up while controlling cost?

    • AAdd a scheduled scaling action to increase desired capacity shortly before 9 AM in addition to dynamic scalingCorrect
    • BReplace the Auto Scaling group with a single large On-Demand instance permanently sized for the peak
    • CSet the target-tracking metric target value to 95% CPU utilization so scaling triggers later
    • DDisable the scaling cooldown period entirely so the group never pauses between scaling actions
    ✓ Correct answer: A

    For predictable, time-based demand, scheduled scaling raises desired capacity ahead of the spike so instances are ready before traffic arrives, eliminating the warm-up latency. Combined with target tracking for unexpected variation, it controls cost by only adding capacity around the known peak window.

    Why the other options are wrong

    • BA single peak-sized instance removes elasticity, wastes capacity off-peak, and reduces availability.
    • CRaising the target to 95% CPU makes scaling react even later, worsening the warm-up latency.
    • DRemoving cooldown risks thrashing and still does not pre-warm capacity before the predictable spike.

Related AWS resources

• AWS Certified CloudOps Engineer - Associate (SOA-C03) study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated

AWS Certified CloudOps Engineer - Associate (SOA-C03) practice exam FAQ