AWS Certified CloudOps Engineer - Associate (SOA-C03) Practice Exam

What the AWS Certified CloudOps Engineer - Associate (SOA-C03) exam covers

• Monitoring, Logging, Analysis, Remediation, and Performance Optimization235 questions
• Reliability and Business Continuity81 questions
• Deployment, Provisioning, and Automation93 questions
• Security and Compliance123 questions
• Networking and Content Delivery105 questions

Free AWS Certified CloudOps Engineer - Associate (SOA-C03) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 637.

1. Question 1Monitoring, Logging, Analysis, Remediation, and Performance Optimization

   Which service collects metrics and lets you set alarms that trigger actions when thresholds are breached?

   • AAWS IAM
   • BAmazon CloudWatchCorrect
   • CAmazon VPC
   • DAmazon S3
   ✓ Correct answer: B

   Amazon CloudWatch is a comprehensive monitoring service designed to collect metrics from AWS resources and user-defined applications, enabling operators to set alarms on these metrics that trigger automated actions when thresholds are breached. CloudWatch provides the foundation for operational visibility, alerting, and automated remediation workflows.

   Why the other options are wrong

   • AAWS IAM is incorrect because it manages identity and access control, not metrics collection or alarm configuration.
   • CAmazon VPC is incorrect because it is a networking service focused on virtual network configuration, not metrics collection.
   • DAmazon S3 is incorrect because it is an object storage service and does not provide monitoring or alarm capabilities.
2. Question 2Reliability and Business Continuity

   You copied an encrypted EBS snapshot to a second Region for DR, but a colleague says the destination instances can't launch volumes. What is the most likely KMS-related gotcha?

   • AThe snapshot copy was encrypted with a CMK that exists only in the source RegionCorrect
   • BThe destination instances need an IAM instance profile that grants kms:Decrypt on the source Region CMK directly
   • CCross-Region snapshot copies inherit the source key ARN, so the destination must share that exact CMK ARN
   • DThe copy defaults to the AWS-managed EBS key, which cannot be used to launch encrypted volumes at all
   ✓ Correct answer: A

   AWS KMS keys are Regional resources - a CMK created in us-east-1 cannot be used to decrypt data in eu-west-1. When you copy an encrypted EBS snapshot across Regions, you must specify a KMS key in the destination Region to re-encrypt the copy. If the destination instances try to use a key ARN that belongs to a different Region, the decryption call fails and volumes cannot be mounted. The fix is to explicitly provide a destination-Region KMS key during the cross-Region copy operation.

   Why the other options are wrong

   • BThe problem is the key's Region, not an instance profile; the copy must reference a KMS key that exists in the destination Region.
   • CA CMK ARN is Region-specific and cannot be shared across Regions, so the copy must use a destination-Region key.
   • DThe AWS-managed EBS key can encrypt and launch volumes normally; the issue is the source-only CMK, not that key.
3. Question 3Security and ComplianceSelect all that apply

   Which TWO commands are used to enable an organization-wide CloudTrail and confirm it is logging? (Choose TWO)

   • Aaws cloudtrail create-trail --name org-trail --s3-bucket-name my-logs --is-organization-trail --is-multi-region-trailCorrect
   • Baws cloudtrail begin --name org-trail
   • Caws cloudtrail enable-trail --org true
   • Daws cloudtrail start-logging --name org-trailCorrect
   ✓ Correct answer: A, D

   Creating an organization-wide CloudTrail requires two separate steps. First, `aws cloudtrail create-trail` with --is-organization-trail and --is-multi-region-trail creates the trail definition and configures it to cover all accounts in the AWS Organization. Second, `aws cloudtrail start-logging` activates log collection for the trail - without this step, the trail exists but does not record events. Both commands are required to have a functioning organization trail.

   Why the other options are wrong

   • B`aws cloudtrail begin` is not a valid AWS CLI command - there is no `begin` subcommand in the cloudtrail CLI namespace for starting a trail.
   • C`aws cloudtrail enable-trail` does not exist in the AWS CLI - the correct command to activate logging is `start-logging`, and `--org` is not a valid parameter for any cloudtrail command.
4. Question 4Monitoring, Logging, Analysis, Remediation, and Performance Optimization

   A consistently 5%-CPU instance suggests which optimization?

   • AAdd a second internet gateway
   • BRight-size to a smaller/cheaper instance typeCorrect
   • CAttach more IAM roles
   • DEnable Multi-AZ
   ✓ Correct answer: B

   When an EC2 instance consistently runs at only 5% CPU utilization, the vast majority of its provisioned compute capacity is idle and being paid for without benefit. Right-sizing - moving to a smaller or cheaper instance type that matches actual workload needs - is the standard optimization that eliminates this waste and directly reduces the EC2 bill.

   Why the other options are wrong

   • AAdding a second internet gateway is a network redundancy measure that has no effect on compute cost or instance utilization efficiency.
   • CAttaching more IAM roles modifies the security permissions available to the instance but does not change the instance type, pricing, or CPU performance characteristics.
   • DEnabling Multi-AZ increases database availability by maintaining a standby replica but adds cost rather than reducing it, and does not address CPU over-provisioning on a single instance.
5. Question 5Deployment, Provisioning, and Automation

   Systems Manager Patch Manager shows several EC2 instances as 'not applicable' targets and never patches them, although they are running. What is the most common reason an instance is not a managed node?

   • AThe instances are missing the resource tags that Patch Manager uses to target its patch groups
   • BPatch Manager only supports patching Windows Server instances and cannot manage Linux nodes
   • CThe instances are using gp3 EBS root volumes, which block the patch operation from running
   • DThe SSM Agent cannot reach the Systems Manager endpointsCorrect
   ✓ Correct answer: D

   For an EC2 instance to appear as a managed node in Systems Manager, three conditions must be met: the SSM Agent must be installed and running, the agent must be able to communicate with the SSM regional endpoints (either via internet gateway, NAT, or VPC endpoints), and the instance's IAM instance profile must include the AmazonSSMManagedInstanceCore managed policy (or equivalent permissions). If either connectivity or the role policy is missing, the instance does not register with SSM and Patch Manager cannot target it.

   Why the other options are wrong

   • AMissing target tags would just exclude instances from a patch group, not report them as unmanaged nodes entirely.
   • BPatch Manager supports both Linux and Windows, so the operating system is not why a node is not managed.
   • CThe EBS volume type has no bearing on whether an instance registers as an SSM managed node.
6. Question 6Monitoring, Logging, Analysis, Remediation, and Performance OptimizationSelect all that apply

   You must reduce CloudWatch costs while preserving monitoring quality. Which TWO actions reduce cost without losing the ability to alarm on important conditions? (Choose TWO)

   • ASet appropriate retention periods on log groups so logs expire instead of being kept indefinitelyCorrect
   • BUse metric filters to convert needed log patterns into metrics and reduce reliance on frequent Logs Insights scansCorrect
   • CDisable all CloudWatch alarms across the account
   • DSwitch every standard-resolution metric to high resolution to consolidate billing
   ✓ Correct answer: A, B

   Defining retention periods stops indefinite log storage growth, a major cost driver. Converting important patterns into metrics via metric filters lets you alarm cheaply on those values instead of running frequent, data-heavy Logs Insights queries, preserving alerting quality at lower cost.

   Why the other options are wrong

   • CDisabling all alarms removes the monitoring capability you are required to preserve.
   • DHigh-resolution metrics are billed at a higher rate and increase cost; they do not consolidate billing.
7. Question 7Deployment, Provisioning, and Automation

   An SSM Automation runbook must call other AWS APIs (such as creating an AMI and tagging instances) on your behalf. After running, it fails with an access-denied error. What is the most likely cause?

   • AThe Automation execution is missing an IAM service roleCorrect
   • BThe target instances are missing the CloudWatch agent for the runbook
   • CThe runbook is authored in YAML rather than the required JSON format
   • DThe S3 bucket used for command output has versioning disabled
   ✓ Correct answer: A

   SSM Automation steps that call AWS APIs execute with the permissions of the Automation service role (assume role) you specify, or your user permissions if running interactively. An access-denied error during AMI creation or tagging indicates the role lacks those API permissions. Granting the role the necessary actions resolves the failure.

   Why the other options are wrong

   • BThe CloudWatch agent ships metrics and logs; it is unrelated to the API permissions the automation needs.
   • CSSM Automation runbooks support both YAML and JSON, so the document format does not cause access-denied.
   • DS3 bucket versioning affects object history, not the IAM permissions required to call the target AWS APIs.
8. Question 8Security and Compliance

   A web application served from an Application Load Balancer needs a publicly trusted TLS certificate that renews automatically with no operator action. Which AWS service should you use to provision and manage the certificate?

   • AAWS Certificate Manager (ACM) with an ACM-issued public certificateCorrect
   • BAWS Key Management Service (KMS) with an asymmetric customer managed key
   • CAWS Secrets Manager storing the PEM-encoded certificate and private key
   • DAWS CloudHSM generating and storing the certificate
   ✓ Correct answer: A

   ACM provisions publicly trusted certificates at no cost and integrates directly with Application Load Balancers, CloudFront, and API Gateway. ACM-issued certificates are renewed automatically as long as the domain validation remains in place, eliminating manual rotation. This is the purpose-built service for managing certificates on integrated AWS endpoints.

   Why the other options are wrong

   • BKMS manages encryption keys, not publicly trusted X.509 TLS certificates, and cannot be attached to an ALB listener.
   • CSecrets Manager can store a certificate as a secret, but it does not issue publicly trusted certificates or auto-renew them, and you cannot import an externally stored cert into ACM auto-renewal this way.
   • DCloudHSM provides dedicated hardware key storage but does not issue or auto-renew publicly trusted TLS certificates for an ALB.
9. Question 9Networking and Content Delivery

   A web tier must be reachable on TCP 443 from the internet, and instances must reach a database tier on TCP 3306. Using security groups, which approach correctly allows the web tier to reach the database while keeping rules minimal?

   • AReference the web tier's security group as the source in the database security group's inbound ruleCorrect
   • BAdd an outbound deny rule for port 3306 on the web tier security group
   • COpen the database security group inbound to 0.0.0.0/0 on port 3306
   • DAdd an inbound allow rule on the web tier security group for port 3306 from the database
   ✓ Correct answer: A

   Security groups can reference other security groups as the source, so any instance in the web tier group is automatically allowed to the database on 3306 without managing IP ranges. Security groups are stateful, so the return traffic is permitted automatically. This minimizes rules and adapts as instances scale.

   Why the other options are wrong

   • BSecurity groups do not support deny rules; they are allow-only, and an outbound deny is invalid.
   • COpening 3306 to 0.0.0.0/0 exposes the database to the entire internet, which is insecure.
   • DDatabase access must be controlled inbound on the database security group; an inbound rule on the web tier for 3306 does not permit the web tier to initiate connections to the database.
10. Question 10Monitoring, Logging, Analysis, Remediation, and Performance Optimization

    An organization wants a high-level set of best-practice recommendations across cost optimization, performance, security, fault tolerance, and service limits, with checks that flag idle load balancers, underutilized resources, and overprovisioned components. Which service provides these categorized checks?

    • AAWS Trusted AdvisorCorrect
    • BAWS Config
    • CAmazon CloudWatch
    • DAWS CloudTrail
    ✓ Correct answer: A

    AWS Trusted Advisor inspects your account against best practices across cost optimization, performance, security, fault tolerance, and service limits. Its cost checks flag idle load balancers, underutilized EBS volumes, low-utilization EC2 instances, and similar waste, directly matching the requirement for categorized optimization guidance.

    Why the other options are wrong

    • BAWS Config tracks resource configuration history and compliance rules, not cross-category cost/performance best-practice recommendations.
    • CCloudWatch collects metrics, logs, and alarms but does not produce categorized best-practice optimization checks.
    • DCloudTrail records API activity for auditing and does not evaluate cost or performance best practices.

Who this AWS Certified CloudOps Engineer - Associate (SOA-C03) practice exam is for

This practice set is for anyone preparing for the AWS Certified CloudOps Engineer - Associate (SOA-C03) exam at the intermediate level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS Certified CloudOps Engineer - Associate (SOA-C03) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS Certified CloudOps Engineer - Associate (SOA-C03) exam.

Related AWS resources

• AWS Certified CloudOps Engineer - Associate (SOA-C03) study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated

AWS Certified CloudOps Engineer - Associate (SOA-C03) practice exam FAQ