Free Amazon SOA-C03 Exam Questions

Question 1

A company moves workloads from public subnets to private subnets to improve security. During testing, the company discovers that servers in the private subnets cannot reach an external API. The VPC has a CIDR block of 10.0.0.0. The VPC contains two public subnets and two private subnets. The VPC has one internet gateway and has a NAT gateway in each of the private subnets. The company must ensure that workloads that run in the private subnets can reach the external API. Which solution will meet this requirement?

A : Deploy an outbound-only internet gateway to allow traffic from private subnets to the internet. Edit the route tables to direct outbound traffic through the outbound-only internet gateway.

B : Create and configure an Amazon API Gateway HTTP API as a proxy for the external API. Edit the route tables to direct outbound traffic to the HTTP API.

C : Deploy a new NAT gateway that has an Elastic IP address in each public subnet. Edit the route tables to direct outbound traffic through the NAT gateways.

D : Create a VPC interface endpoint. Edit the route tables to direct outbound traffic through the endpoint.

Answer: C

Question 2

A CloudOps engineer is maintaining a web application that uses an Amazon CloudFront webdistribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All serviceshave logging enabled. The CloudOps engineer needs to investigate HTTP Layer 7 status codes fromthe web application.Which log sources contain the status codes? (Select TWO.)

A : VPC Flow Logs

B : AWS CloudTrail logs

C : ALB access logs

D : CloudFront access logs

E : RDS logs

Answer: C,D

Question 3

A company has a VPC that contains a public subnet and a private subnet. The company deploys an AmazonEC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems ManagerAgent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows onlyoutbound traffic.A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instancethrough SSH without exposing the instance to the internet.Which solution will meet this requirement?

A : Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allowinbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccessmanaged policy to the IAM group.

B : Create a Systems Manager endpoint in the private subnet. Update the security group to allow SSHtraffic from the private network where the Systems Manager endpoint is connected. Create an IAMgroup for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.

C : Create an EC2 Instance Connect endpoint in the public subnet. Update the security group to allow SSHtraffic from the private network. Create an IAM group for privileged administrators. Assign thePowerUserAccess managed policy to the IAM group.

D : Create a Systems Manager endpoint in the public subnet. Create an IAM role that has theAmazonSSMManagedInstanceCore permission for the EC2 instance. Create an IAM group forprivileged administrators. Assign the AmazonEC2ReadOnlyAccess IAM policy to the IAM group.

Answer: A

Question 4

A CloudOps engineer is maintaining a web application that uses an Amazon CloudFront webdistribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All serviceshave logging enabled. The CloudOps engineer needs to investigate HTTP Layer 7 status codes fromthe web application.Which log sources contain the status codes? (Select TWO.)

A : VPC Flow Logs

B : AWS CloudTrail logs

C : ALB access logs

D : CloudFront access logs

E : RDS logs

Answer: C,D

Question 5

A company has a stateful web application that is hosted on Amazon EC2 instances in an Auto Scalinggroup. The instances run behind an Application Load Balancer (ALB) that has a single target group.The ALB is configured as the origin in an Amazon CloudFront distribution. Users are reporting randomlogouts from the web application.Which combination of actions should a CloudOps engineer take to resolve this problem? (SelectTWO.)

A : Change to the least outstanding requests algorithm on the ALB target group.

B : Configure cookie forwarding in the CloudFront distribution cache behavior.

C : Configure header forwarding in the CloudFront distribution cache behavior.

D : Enable group-level stickiness on the ALB listener rule.

E : Enable sticky sessions on the ALB target group.

Answer: B,E