SOA-C03 practice questions
Amazon Web Services · SOA-C03 · 300 questions
Original practice questions for the AWS Certified CloudOps Engineer - Associate exam, covering every domain of the official exam objectives.
This course contains the use of artificial intelligence.
About the SOA-C03 exam
- Questions
- 65 (50 scored + 15 unscored)
- Passing score
- 720 on a scaled score of 100-1000
- Format
- 130 minutes; multiple choice and multiple response
Schedule this exam The certification this earns
Exam details published by the vendor, checked 7 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%) · 66 questions
- The CloudWatch agent is running on a university's EC2 instances and its config lists the memory metric. The agent log reports AccessDenied for PutMetricData, and no memory datapoints arrive. Which change fixes the publish failure?
- A grocery chain sees CPU on every EC2 graph in CloudWatch, but memory-used percent does not appear for any instance. The instances run Amazon Linux and no extra agent is installed. What should the team configure so memory becomes a CloudWatch metric?
- A retailer puts EC2 state-change events on a custom EventBridge bus. A rule there should invoke a Lambda function, but the function never runs. A sample event has detail-type EC2 Instance State-change Notification, while the rule requires detail-type EC2 Instance State Change. What is the first fix?
- A CloudWatch alarm publishes to an SNS topic. An on-call email address was subscribed an hour ago, a test alarm fired, and no mail arrived. The subscription shows PendingConfirmation. What should the operator do first?
- A bank's Application Load Balancer 5xx rate jumped in one Region while the same application in another Region stayed steady and instance CPU looked normal. AWS Health Dashboard has an open event for the load balancing service in the affected Region. What should operators do before they rebuild the fleet?
- A game studio pages on-call when an instance is both high on CPU and failing its status check. Separate alarms already exist for each condition, and CPU-only spikes are waking people overnight. What should send the page?
- A logistics fleet of private EC2 instances needs the same agent restarted, using a procedure someone reviewed, without SSH keys or passwords pasted into chat. Which approach fits?
- A factory database data volume is gp2 and does random writes. During peak, its EBS burst balance sits at zero and write latency climbs. The team needs more IOPS without a much larger disk. Which change addresses that limit?
- A SaaS Lambda function's CloudWatch Errors metric is above zero, but operators cannot see the exception text. The function's log group exists and the execution role may write logs. Where is that exception text?
- A hospital security team must name the IAM principal that called StopInstances on a production instance yesterday. CPU graphs for that hour look normal. Where should the operator look first?
- A media company's Amazon Bedrock workload is slow, and operators need invocation latency and error counts for the model calls. They do not need a cost report. Which place should they instrument and watch?
- A logistics platform on EKS already scrapes metrics with Prometheus and wants a managed, Prometheus-compatible query endpoint instead of running its own long-term store. Which service fits?
- An ECS service on EC2 sends container logs with the awslogs driver, and those logs are arriving. Memory used on the container instances does not appear in CloudWatch. No agent is installed on the instances. What should be added for the memory metric?
- A grocery chain wants the depth of an application queue, a number the application already computes, on a CloudWatch graph. Default EC2 metrics show CPU only. What should the application publish?
- A city's CloudWatch agent is supposed to ship one application log file from each instance. Instead, operators are looking at Systems Manager Inventory and cannot find a log stream. What collects that file into CloudWatch Logs?
- A golden AMI carries a CloudWatch agent config that points at a retired log group. New instances keep shipping logs to that retired name. The team wants the current config applied without baking a new AMI for every edit. Where should the config live?
- An auditor asks a city for every s3:GetObject against a records bucket last week. The trail logs management events only. Lookups for those object reads return nothing. What should be enabled?
- An EKS cluster's nodes run out of disk, and CloudWatch shows no disk-used metric for them. No metrics agent is installed. The team does not want a trail of API calls as a substitute. What should they run on the nodes?
- A payments API pages on-call whenever the error count is at least one in five minutes. Overnight, a single failed call pages them even though almost nobody is using the API. They want a page only when errors are a large share of requests. What should the alarm use?
- A CPU alarm on a fleet flips between OK and ALARM every evaluation period, and on-call is paging on each flip. The metric really does bounce around the threshold. Deleting the alarm was proposed. What should they change so a brief bounce does not page?
- A CloudWatch alarm on a grocery chain's ECS service has stayed in INSUFFICIENTDATA since it was created. The CPU metric exists and has datapoints. The alarm's dimensions do not match the dimensions on that metric. What should change?
- A CloudWatch alarm on a hospital's API should start a Lambda function only when the alarm changes state. Someone suggested an S3 event notification as the trigger. What should invoke the function?
- A single EC2 instance fails its system status check, and a CloudWatch alarm sees that failure. The instance is not in an Auto Scaling group. What is the least disruptive recovery?
- The CloudWatch agent on a fleet in us-east-1 is running, and the memory metric never appears in that Region. The agent configuration file sets the Region to us-west-2. Where are the metrics going?
- A CloudWatch dashboard widget for an ALB went blank after the load balancer was recreated in another Region. The metric is healthy in the new Region. The widget still queries the old Region. What should change?
- Operators want one CloudWatch dashboard that shows metrics from three accounts. They currently paste screenshots into chat. What should be configured?
- An operations review wants the ELB 5xx graph and the state of its alarm on one screen. A teammate exported a Cost Explorer view instead. What should be on the dashboard?
- Operators must see a CloudWatch dashboard of the production fleet. They must not be able to edit the dashboard or administer the account. What should they be given?
- A bank built its CloudWatch dashboard in a central monitoring account, but widgets for two application accounts stay empty. Those accounts have not shared their metrics with the monitoring account. What must happen before the central dashboard can graph them?
- One CloudWatch alarm watches a heartbeat metric that the application publishes every minute. Another watches a sparse error metric that is published only when an error happens. How should missing data be treated?
- A media company's CloudWatch alarm is in ALARM, and the action names an SNS topic in a different Region from the alarm. Subscribers on a topic in the alarm's own Region receive tests, but this action never delivers. What should the action use?
- A hospital alarm already emails the on-call list from one SNS topic. The same alarm must also POST to the paging vendor's HTTPS endpoint. A teammate wants a second alarm with the same threshold. What should be added?
- A factory fleet's disks are filling, and a CloudWatch alarm already sees the disk metric cross the threshold. Operators have been SSHing to each instance to delete files. How should the alarm drive the cleanup?
- A SaaS alarm reboots an instance every time CPU crosses the threshold for a single one-minute period. The metric genuinely bounces, and production instances are rebooting all afternoon. What should change so a brief bounce does not reboot the fleet?
- A hospital alarm invokes a Lambda function that is supposed to restart a stuck agent through Systems Manager. The function log shows it ran, and the instance never changes. The function role has no ssm:SendCommand permission. What should be granted?
- A logistics job already pages operators through an SNS topic when a queue-depth alarm fires. The job also needs to page that same topic when the nightly run finishes cleanly. What should the job do?
- A freight broker must reshape each EventBridge event into the JSON a ticket API accepts. The application that publishes the event cannot be changed. What should they add?
- A factory runbook repaired the failed host, yet the CloudWatch alarm is still ALARM. The metric has not come back inside its threshold. Why has the alarm not cleared?
- A transit authority calls PutEvents and does not set an event bus name. The rule that should match those events is on a custom bus, and the rule never runs. What is going wrong?
- A university needs the caller and the error text for one failed API call. A CloudWatch alarm on the error count is already ALARM. Where should the team look first?
- Minutes before a bank's database outage, someone changed the instance. Operators need that API call and the identity that made it. Where should they look?
- A payments service has an EventBridge rule whose Lambda target shows failed invocations. The function logs never record a start. What should the operator inspect?
- A media Automation document must run only on instances tagged Env=prod. The ticket pastes private IP addresses copied from last week's spreadsheet. What should the document target?
- A factory Automation execution has been in Waiting for an hour. The security group on the instance already allows the traffic the document needs. Opening another port was proposed. What is the execution waiting for?
- Compute Optimizer shows no memory data for a university fleet, so the rightsizing view uses CPU only. The CloudWatch agent is not installed on those instances. What must happen before anyone trusts a rightsizing decision that depends on memory?
- A hospital must restart one clinical instance a single time. The ticket includes a shell script with long-lived access keys embedded in it. What should perform that restart?
- Compute Optimizer reports that a retail web instance is oversized and recommends a smaller size. Memory metrics for the instance are already being collected. A teammate wants the resize done during the next business rush. When should that smaller size be applied?
- A SaaS job must snapshot a data volume and only then run a cleanup script, every time an operator starts the job. A laptop cron that calls both steps with stored access keys was proposed. How should the steps run?
- On a data volume, VolumeQueueLength stays high and VolumeIdleTime stays near zero while the application waits on disk. Instance CPU is modest. An operator wants a larger instance family and no volume change. What should change?
- A large object upload from a distant branch office to an S3 bucket is slow. The long path from that office to the bucket Region is the constraint. A teammate wants a faster computer in the office. What should change?
- A lab cluster must attach one data volume to several instances at the same time in a single Availability Zone. The volume is gp3, and a second attach is rejected. What should they use instead?
- A logistics API runs a steady CPU load on a burstable instance, and the CPU credit balance is exhausted. Unlimited mode was proposed so this same size can stay the permanent home. The team does not want the steady load to depend on CPU credits. What should the load move to?
- CPU is hot only on a SaaS fleet's instances tagged payments. Instances with every other tag are idle. Scaling out every Auto Scaling group in the account was proposed. How should operators focus the response?
- A freight logger writes large sequential files to a data volume. Time is spent moving those bytes, not serving small random reads. An operator wants to raise the gp3 IOPS setting as high as it will go. Which volume change fits this workload?
- Security logs in an S3 bucket are rarely read after each investigation closes, and every object remains in the Standard storage class. Which change keeps the archives while storing them more cheaply?
- A media archive bucket keeps growing after the application stopped uploading. Inventory shows many multipart uploads that were started and never completed. Which change stops that unfinished data from accumulating?
- Applications must mount an existing S3 bucket as a file system and open objects without copying the entire bucket to disk first. The team will not run a gateway appliance. Versioning is turned off on that bucket. What should the team configure?
- An RDS instance is consuming high CPU. CloudWatch Database Insights shows that one write statement accounts for most of that load. The team is ready to move the instance to a larger class. What should they do first?
- A Windows line-of-business application must share one folder using SMB and Windows access control lists. Which service should host that share?
- Linux home directories on a build fleet must present the same files after an instance is replaced in any Availability Zone. Which storage should those home directories use?
- A weather service's short-lived workers open a new RDS connection for each request, and the database is refusing connections. Which change addresses that connection pattern?
- A telemetry database on RDS shows freeable memory near zero while swap usage climbs. The CPU credit balance stays steady. Which change matches that evidence?
- A large distributed cache must keep serving if one rack fails. The nodes can be divided across partitions, and someone suggested a cluster placement group to pack them close. Which placement group fits the failure goal?
- A handful of critical license servers must not run on the same underlying hardware. They may be placed in more than one Availability Zone. Which placement group matches that requirement?
- A simulation places tightly coupled compute nodes in a single Availability Zone and needs the lowest latency between those nodes. Which placement group should the nodes use?
- Performance Insights on a production RDS for MySQL instance recommends a parameter change that matches a wait the team has already confirmed. What should the team do with that recommendation?
Reliability and Business Continuity (22%) · 66 questions
- A SaaS billing tier's RDS for MySQL instance is CPU-bound by the same product-catalog SELECT statements from many application servers. Results may be a few seconds stale. Which change takes most of those repeated reads off the database?
- A bank runs Amazon RDS for PostgreSQL as a single Availability Zone instance. The database must fail over on its own if that Availability Zone is lost, without an operator promoting a replica. Which configuration meets that requirement?
- A streaming studio keeps a smaller but complete copy of its control plane in a second Region. That copy serves almost no traffic until failover, when the team scales it up. Which disaster recovery pattern is this?
- A university Application Load Balancer marks every target unhealthy, yet a curl of each instance's home page returns HTTP 200. The target group health check uses the path /healthz, and the application does not serve that path. What is the least disruptive fix?
- A hospital web Auto Scaling group stays at four instances while CPU remains above the target tracking policy threshold and pages are timing out. The group's maximum capacity is also four. What should the operator change so the group can add instances?
- A freight carrier takes occasional manual EBS snapshots and has no backup plan for its RDS instances. Leadership wants tagged EBS volumes and RDS instances backed up on a schedule, with a recovery copy in a second Region. Which service should operations configure?
- An Auto Scaling group's activity says there is not enough instance capacity in the single subnet it is allowed to use. The launch template's instance type is acceptable in other Availability Zones. What should change first?
- A payments Auto Scaling group has both a target tracking policy, aimed at holding average CPU near a set point, and a step scaling policy on the same CPU metric. Capacity oscillates all afternoon. The team wants the CPU held near that set point. Which change matches the goal?
- A retailer knows a sale will start at 09:00 and that the web tier must already be scaled out before traffic arrives. Last time, an operator edited desired capacity during the rush and was late. What should they configure beforehand?
- A game studio's Auto Scaling instances stay in Pending:Wait. A lifecycle hook is attached, and the hook's action never calls back. The application on the instance is already healthy. What should the hook do so launching can finish?
- An Auto Scaling group scaled out, and a second CPU alarm fired two minutes later. No further instances launched. The group's cooldown is still running from the first scale-out. The team is about to add another scaling policy on the same metric. What should they do instead?
- A retail Auto Scaling group shows desired capacity above the number of instances in service. Target tracking raised desired capacity, and the activity history is not launching anything. Launch is in the list of suspended processes. What should the operator do?
- Scale-out for a retail Auto Scaling group works, but new instances take several minutes to serve traffic and the warm pool is empty. The team is about to raise only the health-check grace period. What addresses the slow start?
- A Lambda function is throttled during a sale. The account is well under its regional concurrency quota. This function's reserved concurrency is set to 10, and the sale is driving far more concurrent executions than that. What should change?
- An ECS service on EC2 is set to a higher desired count, and the count does not rise. The service maximum percent is 100, and the cluster's container instances have no spare CPU or memory. What is the constraint?
- New instances in an Auto Scaling group fail their health checks within a minute and are replaced, over and over. The application never listens. Raising the maximum was proposed. What should be fixed?
- A university's web tier is busy every weekday at 08:00 and quiet afterward. Last week, target tracking added instances ten minutes after students had already timed out. What should be in place before 08:00?
- An Auto Scaling group uses target tracking on ALBRequestCountPerTarget. Desired capacity never changes, and no targets are registered in the load balancer. The application is not receiving traffic. Why is the policy idle?
- A media company's ElastiCache for Redis catalog is rejecting new writes because the node is at maxmemory and maxmemory-policy is noeviction. Every catalog key can be rebuilt from the database. Which change lets new keys in by dropping cold ones?
- A SaaS API sends every catalog read to the ElastiCache primary endpoint, from instances in another Availability Zone, while replicas in the cache's own zone sit idle. Writes are rare. Which change offloads those reads?
- A retailer's CloudFront distribution is serving one shopper's cart JSON to a different shopper. The behavior caches the API path, and the cache policy does not include the session cookie. Cart responses must not be stored at the edge. What should change?
- ECS tasks stay pending. The service uses a capacity provider backed by an Auto Scaling group, and that group is already at its maximum size. The instances are full. What is the limit?
- A public marketing site serves images and CSS that rarely change. The team is about to cache those files in an ElastiCache node inside one VPC. What reaches viewers at the edge instead?
- A session cache must keep serving after one cache node is lost. The data is in ElastiCache. Memcached was proposed because it is simple. What should they run instead?
- A bank's RDS for PostgreSQL instance is near its CPU limit, and Performance Insights shows the time going to read-only reporting queries. Writes are light. The standby in the Multi-AZ pair does not serve those reads. What should be added?
- A retail inventory table in DynamoDB is provisioned, and the request rate swings without a daily pattern. Throttling shows up on both reads and writes at unpredictable hours. Which capacity mode fits that pattern?
- A logistics table in DynamoDB throttles one popular tracking key while the table's consumed capacity stays well under its provisioned ceiling. Other keys on the table are fine. What should change?
- A retailer caches product prices in ElastiCache with a TTL of several hours. The merchandising rule is that a shopper must not see a price older than a minute. Stale prices are showing on the site well after each update. What should change?
- A game studio stored session tokens only in ElastiCache for Memcached. A node replacement emptied that node and every player on it was signed out. The sessions must survive a node replacement. What should hold them?
- A media company's Aurora writer is at high CPU while its readers sit idle. The busy statements are read-only audience reports, and the application sends those reports to the writer endpoint. Where should the reports connect?
- A game studio's DynamoDB table uses auto scaling, reaches the maximum capacity on that policy during the evening peak, and still returns throttle errors. What should they change?
- Readers of a news site connect through an Application Load Balancer, but the Route 53 health check targets one instance IP. The check stayed healthy while the load balancer failed. What should they change?
- A water utility's Auto Scaling group replaces new instances before the application is listening. The group uses load balancer health checks, and the grace period is shorter than boot. What should they change?
- A city agency's RDS database has storage autoscaling disabled, and free storage is almost gone. They need to act before the instance can stop accepting connections. What should they do?
- A media company's Aurora Serverless v2 writer sits at its minimum capacity while new connections queue, and the cluster minimum and maximum capacity are set to the same value. What should the operator change?
- A logistics company expects its Amazon RDS cross-Region read replica to fail over synchronously, with no lag, when the primary Availability Zone is lost. What does that replica actually provide?
- A hospital target group has its deregistration delay set to zero. Every deploy removes targets while requests are still in flight, and those requests fail. What should change?
- Every instance in an ALB target group stays unhealthy, yet a login on an instance gets a normal response from the application on the health port. The instance security group does not allow the load balancer to reach that port. What should change?
- A ticket seller sees errors only from customers whose session is pinned to one Application Load Balancer target. That target still passes its health check, and the other targets are healthy. What should they change?
- A logistics Route 53 health check fails only because it targets a private address the public checkers cannot reach. The service also has a healthy public endpoint. What should the health check target?
- A logistics Network Load Balancer has cross-zone load balancing turned off. One Availability Zone has no healthy targets, and requests that reach the node in that zone fail while other zones are healthy. What lets that node send work to healthy targets in other zones?
- Players of a game receive errors from a target that the Network Load Balancer still marks healthy. The target group health check is a TCP check on the listener port. What should operators investigate?
- An Auto Scaling group for a clinic portal launches every instance into one subnet in a single Availability Zone. During a zone impairment the whole fleet goes offline. What should be added so the group can launch in the other zones?
- Game clients connect to an Elastic IP associated with one instance. When that Availability Zone fails, an operator must move the address by hand, and the rest of the fleet is unused. What should clients use for failover instead?
- Three private subnets, one in each Availability Zone, send all egress through a single zonal NAT gateway in one zone. If that zone fails, instances in the other zones lose their default route. Keeping zonal NAT gateways, what should change so a surviving zone keeps egress?
- Two Regional checkout endpoints already have Route 53 health checks, but the public name is still one simple record with a fixed address and no health check. DNS keeps answering when both Regions are down. How should that name follow both checks?
- A campus portal stores user sessions as files on one instance disk. When that Availability Zone is lost, new instances have no session and users are signed out. What removes that single-instance session store?
- A library catalog points read-only reports at a hostname the team reserved for the standby of a Multi-AZ RDS DB instance. Those connections never get a database session. Where should the reports read?
- A DBA tested Multi-AZ failover by rebooting the RDS primary from the console without failover selected. The same instance returned as the primary and the standby never took over. Which action tests the standby path?
- An Aurora cluster already stores its data across Availability Zones, and the only database instance is the writer in one zone. Loss of that zone would leave no instance to promote. What should be added?
- Finance policy forbids deleting recovery points before their retention ends. Operators who can use the backup vault can still delete those points today. The vault has no lock. What should be added?
- An AWS Backup plan should protect every volume tagged for the nightly job, but each run reports that no resources were selected. Those volumes use a different tag key than the plan selection. What should be corrected?
- A technician copies EBS snapshots to another Region with a script on a laptop. The copies stop whenever that laptop sleeps or leaves the network. How should the cross-Region copy run instead?
- Point-in-time recovery is turned off on a DynamoDB table. The only recovery copy is a monthly export to S3, and the team must restore to a recent moment between those exports. What should be enabled?
- A ledger application must be able to recover recent writes. Its only backup is a snapshot taken once a day, and that misses the recovery point the application requires. What should change?
- After a point-in-time restore, a new RDS instance is online with a different endpoint. The ticketing application's configuration still names the original endpoint, so it reads the old database. What should change?
- A bank holds an RDS snapshot in one Region and must restore the database in a second Region. The snapshot has not been copied anywhere else. What must exist in the second Region before the restore?
- A city's AWS Backup job cannot snapshot an RDS database. The IAM role AWS Backup uses to take RDS snapshots was never created. What should the operator do?
- An operator restores an RDS snapshot and selects the production database's existing identifier. The restore fails, and the original instance is still running under that name. What should the restore use?
- A clinic needs its patient-records database as it stood about 20 minutes ago. Automated backups are enabled, and the only hand-made copy is last night's manual snapshot. Which restore reaches that time?
- Versioning is enabled on a contracts bucket. A cleanup deleted an object and did not specify a version ID. The console shows the key as deleted, and the older versions are still listed. How is the current view of that key restored?
- In the recovery Region, only the database is running. Application instances are launched from images when a failover is declared, and no scaled-down copy of the application is already serving there. Which disaster-recovery pattern is this?
- The only recovery copy of an application is a nightly backup. Nothing is running at the second site until that backup is restored, and the rebuild takes a full day. The business wants the service back the same morning. Which disaster-recovery pattern is this, and why does it miss that recovery time?
- Two Regions serve this application's production traffic all the time. When one Region is unhealthy, traffic shifts to the other, and nothing has to be launched for that shift. Which disaster-recovery pattern is this?
- A bad push corrupted folders on an Amazon FSx for Windows File Server share. A user-initiated FSx backup from the evening before the push exists, and automatic backups are turned off. One Windows client that maps the share has an EBS snapshot taken this morning. What restores the share?
- An analyst overwrote a pricing object in an S3 bucket that has never had versioning. No backup or replica of that object exists, and the previous contents are required for an audit. What is true about recovery, and what should change before the next overwrite?
Deployment, Provisioning, and Automation (22%) · 66 questions
- A game studio keeps creating the next production AMI by snapshotting a live EC2 instance that operators patch by hand. Last month that image shipped a temporary debug package and one person's SSH key. Which change makes every new instance start from a known build?
- A retailer's CloudFormation stack includes the production order database. A small template edit is ready, and the team needs to know whether the update will replace that database before anything changes. What should they do first?
- A game studio patched a container by running docker commit on a live ECS task and pushing that image. The next task picked up a debug shell that was only meant for the incident. How should operations produce the next image?
- EC2 Image Builder published a new AMI for a game studio, but the Auto Scaling group still launches last month's AMI. The group uses a launch template. What should operations update so the next instance uses the new image?
- An EC2 Image Builder pipeline for a bank's golden AMI failed in the test component. The build instance is already gone. What should the operator read before changing the VPC?
- A factory's new AMI must be launched by an application account in the same Organization. The image must not be public. How should the platform team share it?
- An Image Builder pipeline meant for a hospital's Windows fleet fails while applying a component. The recipe is a Windows image, and the component that fails is marked for Linux. What should the team change in the build?
- A CloudFormation stack for a studio fails with CREATEFAILED. The first failed event is an IAM role, and the status reason says the deploying user is not authorized to perform iam:CreateRole. What should be fixed?
- A university's new EC2 instances never appear as managed nodes in Systems Manager. The golden AMI used by the launch template does not include the SSM agent. Network paths and instance profiles were copied from a fleet that does show up. What should the image build change?
- A bank's EC2 Image Builder pipeline must download packages and reach Image Builder service endpoints without a path to the public internet. The build subnet is private. What should the network team add?
- A studio changed an instance type in the console on a host that CloudFormation created. The template still names the old type. Before the next stack update, what should operations do so they can see that difference without applying it?
- A hospital's CloudFormation stack includes the production RDS instance. The team must be able to delete the stack later without deleting that database. Which template setting does that?
- A CloudFormation update failed and the stack rolled back to UPDATEROLLBACKCOMPLETE. Several events are marked rollback. Where is the cause of the failure?
- An operator resized a CloudFormation-managed instance in the console during an incident. The template still lists the smaller type. What will a drift-aware change set (REVERTDRIFT mode) do to that instance if the template is not edited?
- An approved change to a production database is blocked during a CloudFormation update. The stack policy denies updates to that database resource. The database must stay. What should operations change?
- A CDK deploy for a retailer fails. The command prints a CloudFormation stack error and stops. The team is about to rewrite the application code that the stack was not changing. What should they read first?
- A parent CloudFormation stack shows the nested stack resource as failed and nothing else useful. The workload that broke is defined in the nested stack. Where is the resource error?
- Two CloudFormation stacks in a university account both create workloads in the same VPC. Each template currently pastes its own copy of the VPC id, and the copies have already diverged. How should both stacks get the id?
- New ECS tasks stay pending. The service event says the subnet has no free IP addresses. The tasks use awsvpc mode, one address each. A teammate wants a larger instance type. What should change instead?
- A CloudFormation deploy fails immediately and says the template is not valid. No resource events are created. A teammate starts hunting for a missing iam:CreateRole permission. What should be checked first?
- A CloudFormation create fails with a message that the named resource already exists. The same name works in a template in another account. Health Dashboard shows no Regional event. What is the failure?
- A CloudFormation stack is UPDATEROLLBACKFAILED. One resource that CloudFormation tried to roll back was modified by hand and now blocks the rollback. The team is about to create a second stack with the same resources. What should they do instead?
- A new CloudFormation stack fails because an S3 bucket name is already taken. The previous stack was deleted with DeletionPolicy Retain, so the bucket is still in the account. Retrying the same template fails the same way. What should they do?
- A CDK application deploys in the home Region and fails in a new Region on the first attempt. The error says the environment is not bootstrapped. The template itself was not changed. What should run in the new Region before the deploy is retried?
- A university CloudFormation stack launches instances in a private subnet, then waits until the helper signals success. The instances boot and the application listens, but the signal never arrives and the subnet has no path to CloudFormation. What should be added?
- An ECS service on a port-8080 container never reaches steady state. The target group health check uses port 80. The tasks start and then fail the check. What should be aligned?
- A CloudFormation stack fails while creating an instance. The event says the deployer is not authorized to perform ec2:RunInstances. A teammate wants to pick a smaller AMI first. What should be fixed?
- A bank's deploy role has an identity policy allowing the KMS actions a stack needs, but CloudFormation still fails with AccessDenied on the customer managed key. The key policy names no statement for this role and does not delegate to IAM in the account. What is missing?
- A game studio's Lambda deploy fails when the console tries to upload the zip directly, and the message says the package is too large for a direct upload. A teammate wants to raise the function's memory setting. How should the package be published?
- CloudFormation replaced an instance during an update. The Elastic IP that had been associated by hand stayed behind on nothing, and the new instance has no public address. The template never mentioned the address. What should the template include?
- A parcel carrier's application account must launch instances into a subnet that stays owned by the network account. Both accounts are in the same organization. What should they configure?
- An auto-parts maker wants every new account that joins a specific organizational unit to receive a baseline stack, without an operator registering that account on the StackSet. What meets that requirement?
- A hospital's CloudFormation stack is stuck rolling back because it cannot delete a security group that is still attached to a network interface an operator created outside the stack. What should the operator do?
- A hospital reviews a CloudFormation change set that would replace the production database. The only intended edit was a tag. The change set has not been executed. What should the operator do?
- One account in a grocery chain's StackSet failed an update that succeeded in every other account. The template and parameters were the same. What should the operator inspect first?
- A SaaS platform must run one CloudFormation template as the same stack in three Regions and stop those copies from being edited separately. What should they use?
- A broadcast network is changing a StackSet that already has stack instances in several Regions. A bad template should affect one Region before any other. How should they deploy the change?
- Drift detection on a university StackSet shows that one account's stack instance has drifted. Every other stack instance still matches the template. Rebuilding every account was proposed. What should be fixed?
- An animation studio created a RAM resource share for an account that is not in its organization. The share stays pending, and the other account cannot use the resource. What must happen next?
- A media company deploys by replacing targets inside its only target group. The last bad build left no prior group for the listener to return to. How should the next deploy make rollback a listener change?
- A game studio must replace Auto Scaling instances with a new launch template version without dropping below the healthy capacity the team requires. Deleting the group and creating it again was proposed. What should perform the replacement?
- A regional health system owns a transit gateway in its network account and wants a second account to attach a VPC to that same gateway. Ownership of the gateway should stay put. How should they share it?
- A city portal must send a small share of Application Load Balancer requests to a new target group and leave the rest on the current group. Changing the public DNS record and waiting out a long TTL was proposed. What should carry the canary?
- An ECS service rolling deployment stops every running task before any replacement is healthy. The service is configured so the minimum healthy percent is zero. What should change so the service keeps serving?
- A warehouse patch must be reversible by returning to the previous machine image. Operators currently install that patch on the live instances with a remote command. Which deployment gives that rollback?
- A storefront Auto Scaling group rolled out a new AMI, and the application is misbehaving. Database metrics look normal and recent writes are intact. What should the rollback be?
- A Lambda alias was moved entirely onto a new published version, and errors spiked. The previous version is still published. How should a small share of traffic reach the new version while the rest stays on the known-good version?
- A rolling CloudFormation update replaces Auto Scaling instances that never start the application, and the stack still finishes successfully. The template does not wait for a success signal from those instances. What should the template require so a failed boot rolls the update back?
- A library still patches a tagged Linux fleet by copying one SSH script onto every instance. Patching should run only inside an approved window and should select instances by tag. Which approach meets that requirement?
- A parks department hotfix changed a security group rule in the console. The nightly pipeline applies that stack from a Git repository and will run again tonight. How should the team keep the hotfix after the next apply?
- An OpenTofu apply for a shared network account failed because the provider rejected the credential. The remote state still lists the existing VPC and its subnets. What should the operator do before applying again?
- An operator needs a command shell on an instance that has no public address. Allowing port 22 from the office would publish SSH on the subnet. How should the operator open the shell?
- A Terraform plan says the billing database will be destroyed. The database block was deleted from the configuration by mistake, and the data is still required. What should the operator do?
- A Terraform apply crashed halfway through and left the state lock held. A teammate wants the lock cleared and a new apply started immediately. What is the safe handling of that lock?
- Operators use Session Manager to reach private instances. A later review asks which commands ran in a session, and nothing was recorded. What should be configured so later sessions can be reviewed?
- A water utility's maintenance window patched the wrong instances. Its target is a tag those instances do not share with the group that should have been patched, and the window has not been widened. What should be fixed first?
- A shipping line wants the CloudWatch agent to stay installed on its instances, including instances that lose the agent later. A user-data script installed it once at first boot and does not run again. What keeps the agent installed?
- Transit-agency instances need a non-secret boot setting, the name of their log bucket, and that name changes without building a new image. Where should the name live?
- A Run Command update reached most of a factory fleet and skipped several EC2 instances. Those instances do not appear as managed nodes. What should the operator check?
- A research lab's inventory lists a compiler package that the build standard does not allow. The team wants the service that produced that package list. Which service is it?
- An EventBridge rule is enabled and its target is healthy, but the target never runs. A real event from the application was captured. What should be compared to explain the miss?
- Billing, paging, and inventory each need the same event when a deployment finishes. The pipeline makes one synchronous call and stops when that single consumer is down. How should the event be routed?
- An S3 bucket is configured to send object-created events to an SQS queue. S3 cannot publish to the queue, and the queue exists in the same Region. What is missing?
- A change workflow must wait for an approval, retry a step that failed, and then run a follow-up step. One Lambda function sleeps between the steps and sometimes stops halfway. What should own the workflow?
- A billing job should start when a partner uploads a CSV into an S3 bucket. A host lists that bucket every minute, sometimes processes the same object twice, and sometimes misses a quiet stretch. What should start the job instead?
- When a new configuration object is written to a specific S3 bucket, a reviewed Systems Manager Automation runbook should run against a tagged fleet. Operators currently reboot every instance in the Region. What should start the runbook?
Security and Compliance (16%) · 48 questions
- A bank rotates its RDS master password by hand and has missed two rotations. The application reads the password from an environment variable set in the task definition. Operations wants automatic rotation and one place for the application to fetch the current value. What should they use?
- A city agency attaches an identity policy that allows s3:DeleteObject on a bucket, but deletes still fail with an explicit deny. An Organizations service control policy on the account denies s3:DeleteObject. Why do the deletes fail?
- A studio disabled a customer managed KMS key during cleanup. Applications can no longer read S3 objects that were encrypted with that key, and the objects are still in the bucket. What restores read access with the least data movement?
- A hospital wants a finding when an EC2 instance communicates with a known command-and-control address. Which service is built to raise that threat finding?
- A university must continuously detect security groups that allow 0.0.0.0/0 on port 22 and show each group as noncompliant until that rule is gone. A weekly look at the console is not enough. Which service should they use for the ongoing evaluation?
- A SaaS team wants to know whether an IAM user will be allowed to call ec2:RebootInstances after a policy edit, before anyone saves the policy or makes the call. Which tool gives that preview?
- Trusted Advisor reports that the root user of a bank account has no MFA. No person should use root for daily work. What should the account owner do about that finding?
- An identity policy on a retail role allows s3:PutObject on a bucket. Puts still fail. The role's permission boundary does not include s3:PutObject, and no service control policy mentions S3. Why is the call denied?
- An audit of a university account finds that IAM users can set short passwords that never expire. The auditor wants a minimum length and expiration for those IAM user passwords. What should be configured?
- A role in a logistics account can call S3, and its identity policy allows s3:GetObject on a bucket in a partner account. Gets still fail with Access Denied. The bucket is not public, and the partner's bucket policy has no statement for this role. What is missing?
- A company requires workforce access through federation, but one IAM user still has an active long-lived access key used by a script. What should operations do so that script follows the same rule?
- A records bucket should be readable only through one gateway VPC endpoint. The bucket policy allows the application role and has no condition on the endpoint. Calls from the public internet still succeed when the role's keys are used. What should the policy add?
- A role has two identity policies. One allows ec2:RebootInstances. The other explicitly denies ec2:RebootInstances. A reboot is denied. Why does the allow lose?
- IAM Access Analyzer reports that a log bucket policy allows a foreign account to call s3:GetObject. The security team thought the finding was about an expired password. What is the finding actually about?
- CloudTrail shows an s3:DeleteObject call made with an IAM user access key that the team thought was retired months ago. The user still owns other keys that a build uses. What should happen to the key in the event first?
- A role in account A can be assumed by principals in an account the company does not own. The trust policy's Principal lists that foreign account. Security thought a NACL was the cause. Where is the mistake?
- A production instance was rebooted last night. The team needs the IAM principal that called RebootInstances. Nobody is about to change a policy. Which record answers who did it?
- A role's identity policy allows s3:PutObject, and puts are denied. CloudTrail shows AccessDenied and does not name the statement. The role has a permission boundary that omits s3:PutObject. Which tool shows that the boundary is the cut, before the next live call?
- An engineer added an SCP that only contains Allow statements and expects those statements to grant S3 access in a member account. The account's identities have no identity policy allowing S3. Puts still fail. Why?
- A member account in a bank's organization enabled a Region the company forbids. New resources must not be created there. What should the organization attach so the account cannot use that Region?
- A new account was created and left in the organization root, outside the production OU. The production OU's SCP denies a Region, and the new account can still use that Region. Why was the guardrail missed?
- A city employee can open the development account through IAM Identity Center but is denied in the production account. The same permission set exists, and the production assignment was never created for this user. Why does production refuse the sign-in?
- A city's workforce signs in with individual passwords on a shared IAM user so they can all reach the same account. The company wants each person to receive their own access through a central directory. What should replace the shared user?
- A platform team tried to attach a service control policy inside a member account's IAM console, as if it were a user policy. The policy never took effect on the account. Where must that SCP be attached?
- A brokerage keeps AWS Config exceptions on a spreadsheet and wants the same rules evaluated in every account. What should they deploy?
- AWS Config reports that a bank data volume is unencrypted. Disabling the rule was proposed so the finding disappears. The data must stay in use, and the volume that stores it must actually be encrypted. How is that done?
- Trusted Advisor shows a university security group that allows a management port from the whole internet. An operator wants to exclude that check so the weekly report stays green. What should the operator do?
- A school district on Basic Support is treating a cost-optimization Trusted Advisor result that never updates as if it were live evidence. What should the team do?
- Trusted Advisor reports unrestricted access on a retailer's S3 bucket that should not be public. What should the team do?
- Trusted Advisor shows that an insurance company's root user still has an access key, and that key is not part of any approved workload. What should the team do?
- A city agency needs the ongoing timeline of how one security group's configuration changed. A single describe call was pasted into chat. Where does that continuous configuration timeline live?
- A payroll customer managed key is pending deletion, and objects are still encrypted with it. Someone wants to re-encrypt every object under a new key before the waiting period ends. The key cannot be used while deletion is pending. What should be done first?
- A university bucket stays public so students can download course files. Objects tagged Confidential must not be readable from that bucket. A wiki page tells staff not to upload those objects. What enforces the block?
- A research bucket mixes two data classes under one prefix. One class must expire sooner and stay private to one role, and the other must be retained and readable by a partner role. What lets lifecycle and access differ?
- A Macie sensitive-data finding says a permits bucket holds credentials inside object content. The on-call engineer wants to disable Macie so the finding disappears. What should the team do?
- A factory deployed the same AWS Config rule in every Region it uses. Only one Region produces no real compliance result, and the configuration recorder in that Region was never started. What should be started there?
- An application in account B cannot decrypt objects that account A encrypted with a customer managed key. The role in account B already allows kms:Decrypt. The key policy in account A has no statement for that role. What should change?
- A payments Lambda function stores an API token in an environment variable inside its CloudFormation template. The token must be removed from the template, and the function must still read it at runtime. What should change?
- A public Application Load Balancer for a patient portal listens only on HTTP. A certificate for the portal name is already issued in AWS Certificate Manager. How should inbound traffic be encrypted?
- A museum's public ACM certificate on an Application Load Balancer failed to renew after a DNS cleanup deleted the validation records ACM uses for that certificate. What should the team restore?
- New objects are encrypted with a new customer managed key. The old key was disabled before existing objects were re-encrypted, and reads of those older objects fail. Each old object still names the old key. What restores the reads?
- A public certificate requested through the default ACM path shows in the console that it cannot be exported. The team wanted that certificate installed on one EC2 web server. How should TLS for the site be terminated?
- A security review wants one place that shows this account's GuardDuty threat findings and Inspector vulnerability findings together. An operator opens only the GuardDuty console. What does that approach miss?
- Macie reports payment-card numbers in objects in a log bucket that several applications can read. The card data is not needed after the logs are reviewed, and those objects are not fetched through a website. What should change?
- GuardDuty raises a high-severity finding on an EC2 instance that is still running and still in the application security group. What should be done first?
- Amazon Inspector reports a critical CVE in packages on instances launched from a warehouse gold AMI. A teammate expects GuardDuty to scan that AMI and clear the CVE. What removes the finding's cause?
- A design studio must store a vendor license key encrypted at rest, and the key must not be rotated. The application can read a parameter when it starts. Which store meets both requirements?
- AWS Config marks a security group noncompliant because it allows a management port from anywhere. GuardDuty has no findings for the instances that use that group. What is the work?
Networking and Content Delivery (18%) · 54 questions
- A research VPC must let private subnets open outbound IPv6 connections and must not accept unsolicited inbound IPv6 from the internet. NAT gateways already handle IPv4. What should they add for IPv6?
- A city application in private subnets reads and writes one S3 bucket and must stop sending that traffic through the NAT gateway. The team also wants to avoid the hourly charge of an interface VPC endpoint. Which change keeps the S3 path on the AWS network?
- Clients time out reaching a university web tier on port 443. The instance security group allows 443 from the internet, and the subnet NACL allows inbound 443. Return traffic never leaves. Which change matches that symptom?
- Users on the internet cannot open a city's public web instances. Those instances have public addresses, and their subnet route table sends 0.0.0.0/0 to a NAT gateway. A private subnet in the same VPC is the one that was meant to use that NAT gateway. What should change?
- A factory's private-subnet instances cannot download patches. Their route table has no route for 0.0.0.0/0. A NAT gateway is already up in a public subnet whose route table sends 0.0.0.0/0 to an internet gateway. What should the operator add first?
- A freight carrier's Route 53 record sends users to a primary Application Load Balancer. DNS must switch to a secondary load balancer only when the primary health check fails. Which routing configuration does that?
- A freight API is reachable from inside its subnet and times out from the office across a VPN. The instance security group allows the API port from the office CIDR. The subnet NACL has no inbound allow for that port from the office CIDR, and a later rule denies the rest. What should change?
- A clinic's public and private subnets were given the same route table to save time. Someone then pointed 0.0.0.0/0 at a NAT gateway so the private instances could patch. The public website in that VPC stopped answering the internet. What is the durable fix?
- A private application must call a partner API that the partner exposes only through AWS PrivateLink. The application must not use the public internet. Which endpoint type is the right one to create?
- Instances in a public subnet cannot download patches. The subnet route table sends 0.0.0.0/0 to an internet gateway. The instances have no public IPv4 address, and there is no route to a NAT gateway. What gives them egress with the least change?
- Two VPCs are peered. Instances in VPC A can send packets toward VPC B, and VPC B never answers. VPC A's route table has a route to VPC B's CIDR through the peering connection. VPC B's route table has no route back to VPC A's CIDR. What is missing?
- Private instances in a factory VPC suddenly cannot reach the internet to pull patches. The private subnet's default route now shows a blackhole status because the NAT gateway was deleted during a cleanup. What restores egress?
- A private application cannot call an interface VPC endpoint on port 443. The endpoint is available. Its security group does not allow the application's security group. What should change?
- Three application VPCs must reach each other. The team peered A to B and B to C, and instances in A still cannot reach C. They expected the path to pass through B. What connectivity should they use instead?
- A private application reaches S3 through a gateway endpoint, and the route to the S3 prefix list is in place. The IAM role allows s3:GetObject. Gets of one bucket still return Access Denied. The gateway endpoint policy does not allow that bucket. What is denying the call?
- An interface VPC endpoint for a service exists in a private subnet, and private DNS on the endpoint is disabled. The application uses the service's normal public DNS name and its traffic still goes out the NAT gateway. What should be enabled?
- A public retail site behind an Application Load Balancer is receiving a flood of HTTP requests that look like a scripted scrape. The team wants to block that request pattern. A security group change was proposed. What fits the HTTP pattern better?
- A public IP on an Application Load Balancer is under a volumetric flood of packets. The proposed fix is a long list of NACL deny rules for the source addresses. Which service is built for that volumetric flood?
- Instances in a VPC are resolving a known malware domain. The team wants those DNS queries blocked. A security group change was suggested. What blocks the name?
- A design places a NAT gateway in every Availability Zone. The availability requirement is that only two of the four zones need outbound internet, and the NAT data charge is the top network cost. What should change?
- Trusted Advisor flags a security group that allows port 22 from 0.0.0.0/0. The audit wants that finding cleared. What should change?
- A manufacturer must filter east-west traffic inside a VPC by domain name and by port. The traffic is not HTTP to a public load balancer. Which control matches that filter?
- A chatty pair of services runs one task in each of two Availability Zones, and cross-AZ data transfer is the largest network charge. The design allows both tasks to run in the same zone. What cuts that charge?
- Most of a private subnet's NAT gateway bill is traffic to Amazon S3. The instances must keep using private addresses. What removes that S3 traffic from the NAT gateway?
- A logistics security review asks which DNS names instances in a VPC resolved last Tuesday, including names that were blocked. VPC Flow Logs are already on. Where is that name evidence?
- A hospital is moving a public DNS name to a new endpoint and wants only a small share of queries to receive the new address. The rest must keep the current endpoint. A geolocation record for one country was proposed. Which policy performs that canary?
- Factory instances resolve a name in their private hosted zone to the wrong address. A Resolver forwarding rule for that same domain sends queries to the plant, and the private zone is associated with the VPC. Why does the private record lose?
- Shoppers in two Regions use a retail checkout site, and each Region has its own Application Load Balancer. Each shopper should reach the balancer with lower latency. A failover record with one primary Region was proposed. Which Route 53 policy fits?
- Factory instances in a private VPC must resolve a corporate DNS name that exists only on the plant's resolvers. Public DNS has no such name, and no inbound endpoint is involved. What should the VPC use?
- On-premises DNS servers must resolve private names that exist only in a VPC. The names must not be published on the public internet. What should the VPC side provide?
- A CloudFront distribution uses an ALB as its origin. Viewers reach CloudFront over HTTPS, but origin fetches fail after the ALB stopped accepting HTTP. The origin protocol policy is still HTTP only. What should change?
- A museum photo site serves the same images to viewers worldwide, and the images rarely change. A teammate wants Global Accelerator in front of the origin so those images are cached near viewers. Which design caches the images at the edge?
- CloudFront must reach an application that runs on a private instance. An operator wants the instance private IP published in a public DNS record and used as the origin domain. What should the origin be instead?
- A factory license name must be returned only to resolvers in one country. Resolvers in other countries must not receive that address. Latency-based routing across the factory Regions was proposed. Which policy enforces the country limit?
- A bank wants a service name to hand clients several healthy endpoints so a client can try more than one address. A simple record containing only the primary address was proposed. Which Route 53 policy fits?
- A retailer needs static anycast IP addresses that accept TCP and forward it to Application Load Balancers in two Regions. A CloudFront distribution in front of those balancers was proposed for the same TCP flows. Which service fits?
- Instances in a private subnet need outbound IPv6 and must not accept connections started from the internet. The route table sends the IPv4 default route to a NAT gateway and has no IPv6 default route. What should be added?
- A private instance in one VPC cannot reach a database subnet in a peered VPC. The peering connection is active, and only the instance side route table sends the database CIDR through that connection. What should be added?
- A payroll service allows its application port from the corporate prefix on the instance security group. Clients still time out. The subnet network ACL has no inbound allow for that port from the prefix. What should be changed?
- A new VPC attachment on a Transit Gateway is available, and the VPC route table sends the remote CIDR to that gateway. Traffic still drops. The attachment is not associated with any Transit Gateway route table. What should be configured?
- Two instances in the same VPC cannot connect on the application port. VPC Reachability Analyzer reports that the path is blocked by a security group. What should the operator do next?
- Private subnets in three Availability Zones send internet-bound traffic to one NAT gateway, and that gateway's zone is impaired. Instances have lost egress. How should outbound access be restored?
- A parts catalog returns the same CloudFront object for two different query strings. The cache policy does not include the query string. What should change so each query string is cached separately?
- Players of a trivia app report errors from an Application Load Balancer. An operator needs the request line and the target status those players hit. Which log contains that HTTP detail?
- A game studio sees REJECT entries in VPC Flow Logs for clients that never reach an API. An engineer wants the HTTP status code those clients received. What do those REJECT entries show?
- A bookstore's web ACL is blocking some checkout requests. The Application Load Balancer access log shows 403 and does not name a rule. Where is the rule that terminated the request?
- A news site's CloudFront cache statistics show a high error rate, and the team needs the per-request HTTP status and error type, including whether the origin caused it. Which source provides that?
- Magazine editors replaced an object in the origin this morning, but viewers still receive yesterday's file from CloudFront. No invalidation has been created, and the cached object has not expired. Why do viewers still see yesterday's file?
- Instances in a spoke VPC reach the transit gateway, and that attachment's transit gateway route table has a route to a shared-services VPC. Return traffic dies. The shared-services attachment uses a route table with no route to the spoke. What should be added?
- A benefits portal caches the signed-in account page at CloudFront. The cache policy includes no cookies, one member receives another member's page, and that page must not be cached. What should that behavior do?
- A plant's Site-to-Site VPN tunnel shows UP on the AWS side and down on the on-premises firewall. The firewall's Phase 2 traffic selector does not match the networks the VPN is set to carry. What should change?
- A hybrid application is losing packets between a private subnet and the on-premises network. Instance CPU is low. Which measurement should be used for that path?
- Users on the public internet report slow responses. The origin in the VPC is healthy and lightly loaded. Operators need the client ISP and the internet path, which a VPC flow log does not show. What provides that view?
- New instances in a shared VPC cannot resolve the corporate DNS zone. Instances that still use a hard-coded plant resolver can. The outbound Resolver rule for that zone targets two resolvers that were retired last week. What should be updated?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Amazon Web Services and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Amazon Web Services.