Free SOA-C03 practice test: 30 questions with answers

A CloudWatch alarm evaluates the CPUUtilization metric over the configured periods and triggers an SNS action when the threshold is breached. CloudTrail records API activity, Config checks configuration state, and Parameter Store holds values but does not evaluate metrics.

The CloudWatch agent streams log files to CloudWatch Logs, where they persist after an instance terminates and can be searched with Logs Insights. Local storage is lost when instances are replaced, and the serial console is for troubleshooting boot issues.

A CloudWatch alarm on the instance status check can trigger the EC2 recover action, which moves the instance to healthy hardware while keeping its ID and IP. Email filters and manual steps are not automated recovery, and lifecycle rules do not act on running instances.

AWS Config can trigger a remediation action that runs an Systems Manager Automation document, which can apply the fix when a rule is non-compliant. Reports and drift checks do not remediate, and a blanket IAM deny does not correct the bucket setting.

AWS X-Ray traces requests across services and shows segments and subsegments, so the failing downstream call can be identified. Route 53 logs DNS queries, Budgets tracks cost, and Macie discovers sensitive data.

Drift detection compares the deployed resources to the template and lists properties that were changed outside it. Recreating the stack every hour is disruptive, and Object Lock and billing views do not compare resource state.

Patch Manager applies patch baselines through the SSM agent on managed instances, and maintenance windows schedule the work without SSH. The other services do not patch EC2 instances.

Instance refresh replaces instances in batches while keeping a minimum healthy percentage in service, and it can roll back when health checks fail. Recreating the group causes downtime, manual changes are inconsistent, and stopping everything is an outage.

A service control policy sets the maximum permissions for accounts in the organization, so a deny applies even to administrators in those accounts. Dashboards, tags and documentation do not block launches.

Version control with a pipeline and approvals makes changes reviewable and repeatable, and StackSets applies the same template across accounts and Regions. Console changes, laptop-only templates and disabling change sets all reduce consistency and review.

AWS Config evaluates resources against rules, including a managed restricted SSH rule, and keeps a compliance timeline for audits. The other services do not evaluate security group configuration.

IAM Access Analyzer can generate a least-privilege policy based on the access activity recorded in CloudTrail. Shield, Inspector and Global Accelerator do not analyze IAM permissions usage.

Session Manager opens shells through the SSM agent without inbound ports, controls access with IAM, and can log sessions. Open ports, shared passwords and shared key files all violate the requirement.

Block Public Access prevents public grants regardless of policy or ACL, and CloudTrail records changes to the bucket configuration so alerts can be raised. Making the bucket public, emailing policies and deleting logging all weaken control.

An instance profile role provides temporary credentials automatically, and a policy limited to one bucket enforces least privilege. Keys in user data are exposed, public access is too broad, and shared root passwords are unsafe.

A Multi-AZ deployment maintains a synchronous standby in another AZ and fails over automatically during an AZ outage. Snapshots need restoration time, a manual promotion adds delay, and a bigger instance does not protect against an AZ failure.

Setting the health check type to ELB makes Auto Scaling replace instances that the load balancer marks unhealthy, not only those failing EC2 status checks. Disabling checks removes replacement, and instance size or Elastic IPs do not trigger replacement.

Scheduled EBS snapshots provide point-in-time copies that can be used to create a new volume with the earlier data. Instance store is ephemeral, recreating a volume gives an empty disk, and dashboards do not hold data.

AWS Backup can copy recovery points to another Region on a schedule, and a tested restore runbook supports recovery within the target time. Monthly uploads and single-AZ disks do not protect against Regional failure, and a long retrieval delay conflicts with the 15-minute objective.

Spreading the group across subnets in several Availability Zones lets capacity continue in healthy zones, and choosing an instance type available in every AZ avoids launch failures during rebalancing. A single subnet, zero minimum capacity and disabled health checks each weaken availability.

A NAT gateway in a public subnet lets private instances initiate outbound connections while blocking unsolicited inbound traffic. An internet gateway on a private route table would expose the instances, and peering does not reach the internet.

CloudFront is a content delivery network that caches content at edge locations and terminates TLS close to users. Direct Connect is a private network link, EFS is file storage, and Snowcone is a portable device.

ALB access logs record each request with the client IP, target status and processing times, which shows timeouts. VPC Flow Logs show network flows without HTTP detail, CloudTrail records API calls, and Budgets tracks cost.

DNS resolution and DNS hostnames must be enabled on the VPC for the Amazon-provided resolver to answer names of resources inside it. Public IP settings and gateways do not control private name resolution.

Direct Connect provides a dedicated private network connection to AWS with more consistent bandwidth than internet paths. Public addresses use the internet, and Snowmobile and Resolver endpoints do not provide this connection.

Spot Instances offer large discounts for interruptible workloads, and diversifying instance types improves capacity availability. Reservations for idle capacity waste money, and Dedicated Hosts cost more than shared hardware.

A target tracking policy adjusts capacity automatically to hold a metric near a target, which fits demand that rises and falls each day. Fixed capacity wastes money, and manual scaling needs ongoing effort.

Savings Plans or Reserved Instances reduce the rate on a steady baseline in exchange for a commitment. Spot can be interrupted and is unsuitable for steady production capacity, and Dedicated Hosts cost more.

Scheduled stop and start keeps the instances and their data while removing compute charges during idle hours. Terminating loses the instances, and upgrading the size increases cost.

Cost Explorer can group spend by activated cost allocation tags such as team and environment. Inspector, Shield and Route 53 do not report spending by tag.