AWS SOA-C03: AWS Certified CloudOps Engineer - Associate

Last checked October 22, 2026 against the official AWS exam page.

1. Question 1Monitoring, Logging, and Remediation

   An operations team wants an alarm when an EC2 instance's CPU stays above 80 percent for 15 minutes, and the alarm should notify an on-call SNS topic. Which configuration meets this with the least effort?

   1. AA CloudWatch alarm on the CPUUtilization metric with a period and evaluation periods that cover 15 minutes, with an SNS action
   2. BA CloudTrail trail that emails the on-call team for each management API call logged through an SNS topic
   3. CAn AWS Config rule that checks each instance type against an approved list and flags noncompliant resources
   4. DA Systems Manager Parameter Store SecureString entry holding the threshold value, encrypted with a KMS key
   Show answer and explanationHide answer

   Correct answer: A

   A CloudWatch alarm evaluates the CPUUtilization metric over the configured periods and triggers an SNS action when the threshold is breached. CloudTrail records API activity, Config checks configuration state, and Parameter Store holds values but does not evaluate metrics.

2. Question 2Deployment, Provisioning, and Automation

   A team manages its VPC, subnets and security groups in CloudFormation. Someone changed a security group rule in the console. The team wants to find all resources that differ from the template. Which action should they take?

   1. ARun CloudFormation drift detection on the stack
   2. BDelete and recreate the entire stack hourly
   3. CCheck the billing dashboard for cost changes
   4. DEnable S3 Object Lock on the templates
   Show answer and explanationHide answer

   Correct answer: A

   Drift detection compares the deployed resources to the template and lists properties that were changed outside it. Recreating the stack every hour is disruptive, and Object Lock and billing views do not compare resource state.

3. Question 3Security and Compliance

   An auditor asks for proof that every security group in an account complies with a rule that forbids inbound SSH from 0.0.0.0/0. Which service provides continuous evaluation with a compliance history?

   1. AAWS Config managed rule for restricted SSH with the compliance timeline
   2. BAWS Cost and Usage Report with tags for monthly allocation
   3. CAmazon Polly text-to-speech service for narrating release notes
   4. DAmazon Forecast time-series model for future web demand
   Show answer and explanationHide answer

   Correct answer: A

   AWS Config evaluates resources against rules, including a managed restricted SSH rule, and keeps a compliance timeline for audits. The other services do not evaluate security group configuration.

4. Question 4Reliability and Business Continuity

   A production database must survive the loss of an Availability Zone with minimal downtime and no manual action. Which RDS configuration meets this?

   1. AA single-AZ instance with weekly automated snapshots that are restored into a new Availability Zone after an outage
   2. BA Multi-AZ deployment, which keeps a synchronous standby in another AZ and fails over automatically
   3. CA read replica in the same Availability Zone that an engineer promotes manually after the primary fails and the team confirms
   4. DA larger instance class with more vCPU and memory running in one Availability Zone
   Show answer and explanationHide answer

   Correct answer: B

   A Multi-AZ deployment maintains a synchronous standby in another AZ and fails over automatically during an AZ outage. Snapshots need restoration time, a manual promotion adds delay, and a bigger instance does not protect against an AZ failure.

5. Question 5Networking and Content Delivery

   Instances in a private subnet must download operating system updates from the internet, but the internet must not be able to start connections to the instances. Which component provides this?

   1. AA public IP on each instance with inbound SSH ports open
   2. BAn internet gateway linked to the private subnet route table
   3. CA VPC peering connection to a gateway that reaches the internet
   4. DA NAT gateway in a public subnet with a route from the private subnet
   Show answer and explanationHide answer

   Correct answer: D

   A NAT gateway in a public subnet lets private instances initiate outbound connections while blocking unsolicited inbound traffic. An internet gateway on a private route table would expose the instances, and peering does not reach the internet.