This is the free Amazon SOA-C03 practice question bank —
70 of 130 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-04.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company uses AWS Lambda to process files that users upload to an Amazon S3 bucket. When a user uploads a file to the S3 bucket, S3 Event Notifications invokes a Lambda function to process the file.
The company wants to automatically invoke the Lambda function only for flies with a .txt extension that users upload to the S3 bucket.
Which solution will meet these requirements?
A. Configure a Lambda function that is invoked by S3 PUT requests for .txt files in the S3 bucket.
B. Configure a Lambda function that is invoked by S3 GET requests for .txt files in the S3 bucket.
C. Configure an S3 bucket notification to send all object creation events to an Amazon SNS topic. Subscribe the Lambda function to the SNS topic. Apply a filter policy on the SNS topic for .txt file extensions.
D. Modify the existing S3 Event Notifications configuration to send events for .txt file uploads to Amazon CloudWatch Logs to invoke the existing Lambda function.
Show Answer
Correct Answer: A
Explanation: Amazon S3 Event Notifications support filtering by object key name prefix and suffix. Configure the S3 bucket notification for ObjectCreated (PUT) events with a suffix filter of .txt so the Lambda function is invoked only when .txt files are uploaded. GET requests do not trigger upload processing, SNS filter policies do not filter on S3 object key suffix in this way, and CloudWatch Logs cannot be used to invoke Lambda from S3 event notifications.
Question 2
An ecommerce company hires a cybersecurity company to audit the ecommerce company's AWS account. The cybersecurity company requests read-only access to the account. The ecommerce company creates an IAM role, adds a trust relationship with the cybersecurity company's AWS account, and adds read-only permissions to the ecommerce company's account.
An employee at the cybersecurity company unsuccessfully tries to assume the read-only role that the ecommerce company created.
A CloudOps engineer at the ecommerce company must resolve the access issue.
Which solution will meet this requirement?
A. Configure multi-factor authentication (MFA).
B. Configure an identity provider by using OpenID Connect (OIDC).
C. Create a policy that allows the sts:AssumeRole action. Add the policy to the cybersecurity employee's role. Ensure that the resource for the policy is the role that the employee needs to assume.
D. Create a policy that allows the sts:SetSourceIdentity action. Add the policy to the cybersecurity employee's role. Ensure that the resource for the policy is in the ecommerce company's account.
Show Answer
Correct Answer: C
Explanation: Cross-account role assumption requires both a trust policy on the target role and an identity-based policy in the source account that permits sts:AssumeRole on the target role. The trust relationship alone is not sufficient. MFA and OIDC are not required for this scenario, and sts:SetSourceIdentity does not grant permission to assume a role.
Question 3
A healthcare company uses Amazon SageMaker within a VPC to build machine learning (ML) models that use data that is stored in Amazon S3 buckets. The company wants to ensure that SageMaker accesses the data securely without using public IP addresses.
Which solution will meet this requirement?
A. Create Amazon S3 gateway endpoints. Configure SageMaker to access the S3 buckets by using AWS PrivateLink.
B. Provision a NAT gateway within the same VPC where the company runs SageMaker. Configure SageMaker to access the S3 buckets by using the NAT gateway.
C. Configure an AWS Site-to-Site VPN connection to connect SageMaker to the S3 buckets.
D. Configure AWS Transit Gateway to route traffic from SageMaker to the S3 buckets.
Show Answer
Correct Answer: A
Explanation: Amazon SageMaker running in a VPC can access Amazon S3 privately by using an Amazon S3 VPC gateway endpoint. This keeps traffic on the AWS network without requiring public IP addresses or a NAT gateway. AWS PrivateLink is used for interface VPC endpoints for many AWS services, while S3 private VPC access is provided via the S3 gateway endpoint. Site-to-Site VPN and Transit Gateway are not used for private access from a VPC to S3.
Question 4
A CloudOps engineer has blocked public access to all company Amazon S3 buckets. The CloudOps engineer wants to be notified when an S3 bucket becomes publicly readable in the future.
What is the MOST operationally efficient way to meet this requirement?
A. Create an AWS Lambda function that periodically checks the public access settings for each S3 bucket. Set up Amazon SNS to send notifications.
B. Create a cron script that uses the S3 API to check the public access settings for each S3 bucket. Set up Amazon SNS to send notifications.
C. Enable S3 Event Notifications for each S3 bucket. Subscribe S3 Event Notifications to an Amazon SNS topic.
D. Enable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon SNS topic.
Show Answer
Correct Answer: D
Explanation: AWS Config's managed rule s3-bucket-public-read-prohibited continuously evaluates S3 buckets for public read access and can trigger notifications through Amazon SNS when a bucket becomes noncompliant. This is the most operationally efficient solution because it is managed, event-driven, and avoids building and maintaining custom polling with Lambda or cron jobs. S3 Event Notifications do not natively notify on changes to bucket public readability/compliance.
Question 5
A school uses a web application to track student attendance. The application uses an Amazon API Gateway REST API and backend AWS Lambda functions. The application stores data in an Amazon DynamoDB table that is in on-demand capacity mode.
Teachers report slow application performance at the same time every weekday. A CloudOps engineer notices that the performance problems happen only when the application demand suddenly increases. The application can handle the peak load if the load increases gradually. The CloudOps engineer must modify the application to resolve the performance issue.
Which solution will meet this requirement?
A. Configure provisioned concurrency with scheduled auto scaling for the Lambda functions.
B. Configure reserved concurrency with scheduled auto scaling for the Lambda functions.
C. Change the DynamoDB table from on-demand capacity mode to provisioned capacity mode with auto scaling.
D. Change the DynamoDB table from on-demand capacity mode to provisioned capacity mode. Set the provisioned capacity to match peak usage.
Show Answer
Correct Answer: A
Explanation: The symptoms indicate Lambda cold-start latency during predictable traffic spikes. The application performs well when load ramps up gradually, but suffers when demand suddenly increases at the same time each weekday. Provisioned concurrency keeps Lambda execution environments pre-initialized, and scheduled auto scaling can increase provisioned concurrency before the expected spike. Reserved concurrency only limits and guarantees concurrency; it does not eliminate cold starts. Changing DynamoDB to provisioned capacity does not address this pattern because the table is already using on-demand mode, which is designed to absorb traffic, and the described behavior matches Lambda initialization latency rather than DynamoDB throughput limits.
Question 6
A CloudOps engineer monitors and maintains the availability of resources in an AWS environment. The CloudOps engineer notices that the CPU utilization of an Amazon EC2 instance that runs web server software peaks above 80% at various times during each day. The CPU spikes correlate with peak daily loads. The high CPU load has resulted in performance issues for customers.
The CloudOps engineer needs to resolve the system performance issue without causing any service disruptions.
Which solution will meet these requirements?
A. Configure an Amazon CloudWatch alarm that invokes an AWS Systems Manager Automation runbook to vertically scale the EC2 instance when the CPU utilization exceeds 80%.
B. Configure an AWS Systems Manager Automation runbook to run a script that automatically restarts the application when CPU utilization exceeds 80%.
C. Configure an Amazon EventBridge rule that invokes an AWS Systems Manager Automation document. Configure the document to increase the EC2 instance size when CPU utilization exceeds 80%.
D. Set up an Auto Scaling group with an Amazon CloudWatch alarm that triggers a scaling policy to launch additional EC2 instances when the CPU utilization exceeds 80%.
Show Answer
Correct Answer: D
Explanation: Using an Auto Scaling group with a CloudWatch alarm and scaling policy adds additional EC2 instances during peak CPU demand, distributing load without disrupting service. The other options rely on vertical scaling or restarts, which typically require stopping/replacing the instance or cause service interruption and are less suitable for handling recurring load spikes.
Question 7
A company stores critical data in Amazon S3 buckets. A CloudOps engineer must build a solution to record all S3 API activity.
Which action will meet this requirement?
A. Configure S3 bucket metrics to record object access logs.
B. Create an AWS CloudTrail trail to log data events for all S3 objects.
C. Enable S3 server access logging for each S3 bucket.
D. Use AWS IAM Access Analyzer for Amazon S3 to store object access logs.
Show Answer
Correct Answer: B
Explanation: AWS CloudTrail data events record object-level Amazon S3 API activity (such as GetObject, PutObject, DeleteObject) for S3 buckets. S3 server access logging records HTTP access requests but is not the AWS API audit mechanism for all S3 API activity. S3 bucket metrics and IAM Access Analyzer do not record API activity logs.
Question 8
A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB).
A CloudOps engineer must implement deployments without any service interruptions. The company needs the ability to shift traffic between application versions and quickly revert to the previous version by redirecting traffic if issues occur.
Which deployment approach will meet these requirements?
A. Use AWS CodeDeploy blue/green deployment with two ALB target groups. Deploy the new version to a separate fleet. Shift traffic gradually to the new target group. Maintain the original fleet for immediate rollback if necessary.
B. Implement an in-place rolling update by using Auto Scaling instance refresh on the existing target group. Configure connection draining for each instance. Update the launch template. Rely on health checks during the replacement process.
C. Create a new AMI by using the updated application. Modify the Auto Scaling launch template. Temporarily increase desired capacity to add new instances. Then terminate old instances while using ALB connection draining to manage the transition.
D. Design an AWS Step Functions workflow that creates a parallel Auto Scaling group and updates monitoring configurations. Configure the workflow to change instance registrations on the ALB and automatically terminate the previous fleet after a verification period.
Show Answer
Correct Answer: A
Explanation: Blue/green deployments with AWS CodeDeploy and two ALB target groups are designed for zero-downtime deployments, controlled traffic shifting (including gradual/canary), and rapid rollback by redirecting traffic back to the original target group and fleet. The other options perform rolling or manual replacements that do not provide the same built-in traffic shifting and immediate rollback capabilities.
Question 9
A company needs to deploy a MySQL database on AWS to support an application. The database must be highly available and recoverable. The database must meet a recovery time objective (RTO) of 15 minutes. The database must meet a recovery point objective (RPO) of 5 minutes.
Which solution will meet these requirements in the MOST operationally effective manner?
A. Deploy a MySQL database in a single Availability Zone by using Amazon RDS. Enable automated backups.
B. Deploy a MySQL database across two Availability Zones by using Amazon RDS with a Multi-AZ deployment. Enable point-in-time restore.
C. Deploy a MySQL database across two Availability Zones by using Amazon EC2 instances. Configure database replication and Amazon EBS volume snapshots.
D. Deploy a MySQL database across two Availability Zones by using Amazon RDS. Enable automated backups and database replication.
Show Answer
Correct Answer: B
Explanation: Amazon RDS Multi-AZ for MySQL provides synchronous replication to a standby in another Availability Zone and automatic failover, typically meeting a low RTO. Enabling point-in-time restore through automated backups supports recovery objectives. This is the most operationally effective managed solution compared with self-managed EC2 replication or single-AZ deployment.
Question 10
A CloudOps engineer maintains the security and compliance of a company's AWS account. To ensure the company's Amazon EC2 instances are following company policy, a CloudOps engineer wants to terminate any EC2 instances that do not contain a department tag. Noncompliant resources must be terminated in near real time.
Which solution will meet these requirements?
A. Create an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS-TerminateEC2Instance automation runbook to terminate noncompliant resources.
B. Create a new Amazon EventBridge rule to monitor when new EC2 instances are created. Send the event to an Amazon SNS topic for automatic remediation.
C. Ensure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.
D. Ensure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2Instances automation runbook to stop noncompliant resources.
Show Answer
Correct Answer: A
Explanation: AWS Config's managed required-tags rule can evaluate EC2 instances for the presence of required tags such as a department tag. By configuring automatic remediation with the AWS Systems Manager Automation runbook AWS-TerminateEC2Instance, noncompliant instances can be terminated automatically shortly after they are detected, satisfying the near real-time requirement. The other options either do not enforce compliance automatically, only notify, rely on user behavior, or stop rather than terminate instances.
$19
Get all 130 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.