Free Amazon SOA-C03 Exam Questions

Question 1

A companys security policy prohibits connecting to Amazon EC2 instances through SSH and RDP.Instead, staff must use AWS Systems Manager Session Manager. Users report they cannot connect toone Ubuntu instance, even though they can connect to others.What should a CloudOps engineer do to resolve this issue?

A : Add an inbound rule for port 22 in the security group associated with the Ubuntu instance.

B : Assign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.

C : Configure the SSM Agent to log in with a user name of "ubuntu".

D : Generate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.

Answer: B

Question 2

A company hosts a database on an Amazon RDS Multi-AZ DB instance. The database is not encrypted. The companys new security policy requires all AWS resources to be encrypted at rest and in transit. What should a CloudOps engineer do to encrypt the database?

A : Configure encryption on the existing DB instance.

B : Take a snapshot of the DB instance. Encrypt the snapshot. Restore the snapshot to the same DB instance.

C : Encrypt the standby replica in a secondary Availability Zone. Promote the standby replica to the primary DB instance.

D : Take a snapshot of the DB instance. Copy and encrypt the snapshot. Create a new DB instance by restoring the encrypted copy

Answer: D

Question 3

A company made a configuration change to an Amazon EC2 Auto Scaling group that hosts a production application. The change affected the number of available EC2 instances and caused the application to be slow to respond. The company needs a solution to provide an email notification when a management change occurs to the Auto Scaling group. The company has already set up a trail in AWS CloudTrail to log management write changes. A CloudOps engineer creates an Amazon SNS topic that has the appropriate subscribers. What should the CloudOps engineer do next to meet this requirement?

A : Use AWS Config to monitor the trail for changes to the Auto Scaling group. Configure AWS Config to publish a message to the SNS topic when a change is detected.

B : Use AWS Security Hub to monitor the trail for changes to the Auto Scaling group. Configure Security Hub to publish a message to the SNS topic when a change is detected.

C : Create an Amazon EventBridge rule to run in response to CloudTrail management write events that involve the Auto Scaling group. Configure the EventBridge rule to publish a message to the SNS topic when a change is detected.

D : Store all CloudTrail management events in an Amazon S3 bucket. Use S3 Event Notifications to publish a message to the SNS topic when a change to the Auto Scaling group is detected.

Answer: C

Question 4

A company has an AWS CloudFormation template that creates an Amazon S3 bucket. A user authenticates to the corporate AWS account with their Active Directory credentials and attempts to deploy the CloudFormation template. However, the stack creation fails. Which factors could cause this failure? (Select TWO.)

A : The users IAM policy does not allow the cloudformation:CreateStack action.

B : The users IAM policy does not allow the cloudformation:CreateStackSet action.

C : The users IAM policy does not allow the s3:CreateBucket action.

D : The users IAM policy explicitly denies the s3:ListBucket action.

E : The users IAM policy explicitly denies the s3:PutObject action.

Answer: A,C

Question 5

A company uses AWS Organizations to manage its AWS environment. The company implements a processthat uses prebuilt Amazon Machine Images (AMIs) to launch instances as a security measure. All AMIs aretagged automatically with a key named ApprovedAMI.The company wants to ensure that employees can use only the approved prebuilt AMIs to launch newinstances.Which solution will meet this requirement?

A : Implement a tag policy for the company's organization to require users to set the ApprovedAMI tag tolaunch new EC2 instances.

B : Implement an IAM policy that includes an aws:ResourceTag/ApprovedAMI condition.

C : Set up an AWS Config required-tags rule to prevent users from launching any nonapproved AMIs.

D : Use Amazon GuardDuty to constantly monitor DefenseEvasion:EC2/UnusualDoHActivity findings.

Answer: B