SOA-C03 sample questions, mock-exam practice, and simulator access with detailed explanations in the IT Mastery on web, iOS, and Android.
SOA-C03 is AWS’s CloudOps Engineer Associate certification for candidates who need strong operational judgment across monitoring, remediation, reliability, automation, security, and networking. If you are searching for SOA-C03 sample questions, a practice test, mock exam, or exam simulator, this is the main IT Mastery page to start on web and continue on iOS or Android with the same account.
Start a practice session for AWS Certified CloudOps Engineer - Associate (SOA-C03) below, or open the full app in a new tab. For the best experience, open the full app in a new tab and navigate with swipes/gestures or the mouse wheel—just like on your phone or tablet.
Open Full App in a New TabA small set of questions is available for free preview. Subscribers can unlock full access by signing in with the same account they use on web and mobile.
Prefer to practice on your phone or tablet? Download the IT Mastery – AWS, Azure, GCP & CompTIA exam prep app for iOS or IT Mastery app on Google Play (Android) and use the same account across web and mobile.
SOA-C03 questions usually reward the option that improves observability, reduces operational risk, and applies the lowest-risk remediation path rather than a broad redesign.
| Domain | Weight |
|---|---|
| Monitoring, Logging, Analysis, Remediation, and Performance Optimization | 22% |
| Reliability and Business Continuity | 22% |
| Deployment, Provisioning, and Automation | 22% |
| Security and Compliance | 16% |
| Networking and Content Delivery | 18% |
These sample questions include the same mix of single-answer and multiple-response items you should practice for SOA-C03. Use them to check your readiness here, then move into the full IT Mastery question bank for broader timed coverage.
Topic: Content Domain 5: Networking and Content Delivery
An AWS Site-to-Site VPN shows both tunnels as UP. Instances in a private subnet still cannot reach an on-premises network (10.20.0.0/16). Security groups and network ACLs allow the traffic.
Which VPC configuration is required for the subnet’s traffic to be sent through the VPN?
Best answer: D
Explanation: A VPN tunnel being UP only indicates the tunnel’s control plane is established. The VPC still needs an explicit route (static route or propagated route) that points the on-premises CIDR to the virtual private gateway so the data plane traffic is forwarded over the VPN.
For Site-to-Site VPN connectivity, VPC routing determines whether traffic ever enters the VPN. Even with both VPN tunnels UP, instances will not reach on-premises networks unless the subnet-associated route table has a matching route for the on-prem CIDR that targets the VPN attachment (for example, a virtual private gateway), either as a static route or via route propagation (BGP/propagation).
If that route is missing, traffic follows the remaining best match (often the NAT gateway or no route), so connectivity fails despite a healthy tunnel state. DNS settings and logging features can help with name resolution troubleshooting and visibility, but they do not control VPC packet forwarding to the VPN.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
An operations engineer needs to improve an Amazon EC2 instance’s EBS storage performance with minimal downtime. Which statement is INCORRECT about safely modifying EBS volume size, IOPS, and throughput?
Best answer: A
Explanation: Amazon EBS Elastic Volumes supports online increases to volume size and performance settings, and gp3 decouples IOPS/throughput from size for tuning with minimal disruption. However, EBS does not support reducing a volume’s size in place. To get a smaller volume, you must migrate data to a newly created smaller volume (for example, via snapshot/restore).
The core concept is using EBS Elastic Volumes (ModifyVolume) to tune storage performance safely while the volume remains attached and available. You can typically increase volume size and adjust performance characteristics (IOPS and, for supported types, throughput) with little or no downtime, then complete any required OS-level steps to realize the change.
Key operational steps are:
A crucial limitation is that EBS volumes cannot be shrunk in place; downsizing requires creating a new smaller volume and migrating data to it.
Topic: Content Domain 5: Networking and Content Delivery
An operations team uses Amazon CloudWatch Internet Monitor to detect internet connectivity degradation to an ALB endpoint. The monitor publishes two CloudWatch metrics for a 5-minute period: PacketsSent (count) and PacketsLost (count). For the most recent 5-minute datapoint, PacketsSent is 12,000 and PacketsLost is 420.
The team wants a CloudWatch alarm based on a metric math expression that outputs packet loss as a percentage (0-100%). Which metric math expression correctly produces the packet loss percentage for this datapoint (round to 1 decimal place)?
Best answer: B
Explanation: To alarm on connectivity degradation, you often need packet loss in percent rather than raw counts. For this datapoint, packet loss percentage is computed as lost packets divided by sent packets, multiplied by 100. Using that formula yields a 3.5% loss rate for 420 lost out of 12,000 sent.
CloudWatch network monitoring often provides raw counters (for example, packets sent and packets lost) that you convert into a rate to detect degradation consistently. A metric math expression can transform the two count metrics into a percentage that you can alarm on.
Compute packet loss percent for the datapoint:
An expression of the form 100 * (lost / sent) produces a 0-100 value that directly represents packet loss percentage; subtracting from 100 instead produces success percentage.
Topic: Content Domain 5: Networking and Content Delivery
An operations team uses AWS WAF on an Application Load Balancer (ALB) to protect a public web application. After enabling a new AWS Managed Rules rule group, users report intermittent 403 responses. The team must validate whether the rule group is effective and support an investigation by identifying exactly which WAF rule matched and what action WAF took for each request.
Which solution best meets this requirement?
UpdateWebACL events during the incidentBest answer: D
Explanation: The deciding factor is needing per-request visibility into which AWS WAF rule matched and the resulting WAF action. AWS WAF full logs provide rule identifiers and request context for each evaluated request, which supports both effectiveness validation and incident investigation.
To validate and investigate a network protection control like AWS WAF, you often need request-by-request evidence of enforcement (which rule matched and what action was applied). CloudWatch metrics can show counts (allowed/blocked), but they do not provide the detailed request record needed to attribute a specific 403 to a specific WAF rule.
Enable AWS WAF logging and send the logs to a destination such as Amazon S3 via Kinesis Data Firehose. These logs contain fields that identify the terminating/matched rule and the action taken, allowing you to confirm whether the managed rule group is blocking the intended traffic and to troubleshoot false positives. The closest alternative, ALB access logs, shows the 403 at the load balancer but not the WAF rule decision.
Topic: Content Domain 3: Deployment, Provisioning, and Automation
A company maintains a “golden” Amazon Linux AMI in a tooling account in us-east-1. Operations must distribute each approved AMI release to two production accounts and to two Regions (us-east-1 and us-west-2).
Requirements:
Which TWO actions should the engineer AVOID?
current and previous AMI IDs in SSM Parameter Store and update Auto Scaling launch templates to roll back by repointing to previousBest answers: A, C
Explanation: To distribute AMIs safely across accounts and Regions, the process must preserve encryption and control access through explicit sharing and KMS permissions. Rollback depends on keeping prior AMI versions available for a defined retention window. Any action that exposes the AMI publicly or removes the previous image artifacts breaks these stated requirements.
For cross-account and cross-Region AMI distribution, the safe operational pattern is to keep images private, share them only with required accounts, and ensure any encrypted AMI can be used/copied by granting the destination accounts the necessary KMS permissions (or by distributing encrypted copies with appropriate keys). Rollback requires that the prior AMI still exists (and its snapshots, if EBS-backed) so Auto Scaling can be reverted to a known-good image.
Actions to avoid are those that directly violate the explicit constraints:
Everything else is compatible with controlled distribution and operational rollback by keeping versioned AMIs and switching launch template/parameter references as needed.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
An application runs on an Auto Scaling group behind an ALB. Users report intermittent 503 errors and slow responses. You must restore performance quickly, and Security requires keeping CloudWatch Logs for at least 90 days for investigations.
Exhibit: CloudWatch (last 15 minutes)
1ALB TargetResponseTime (p95): 0.4s -> 6.8s
2ALB HTTPCode_Target_5XX_Count: 0 -> 1,200
3ALB HealthyHostCount: 8 -> 3
4EC2 CPUUtilization (avg): 20% to 30%
5CWAgent mem_used_percent: 94% to 97%
6App logs: "java.lang.OutOfMemoryError" then "Health check failed"
Which TWO actions should you AVOID during remediation? (Select TWO.)
Best answers: C, F
Explanation: The metrics show a drop in healthy targets and a spike in target 5XXs, while logs indicate OutOfMemoryError events. Remediation should preserve health-based routing and retain logs for investigation. Actions that keep unhealthy instances serving traffic or delete log evidence directly violate the stated availability and retention requirements.
CloudWatch metrics and logs together indicate the ALB is sending traffic to fewer healthy targets (HealthyHostCount drops) while target 5XXs and p95 latency spike, and the instances are memory-exhausted (mem_used_percent ~97% with OutOfMemoryError). Safe remediation focuses on identifying impacted instances and restoring healthy capacity while preserving observability and required evidence.
Any step that bypasses health checks or removes CloudWatch Logs undermines availability or violates the explicit log-retention requirement.
Topic: Content Domain 5: Networking and Content Delivery
A company runs the same public HTTPS API in two AWS Regions (us-east-1 and eu-west-1) behind Application Load Balancers (ALBs). Users are primarily in North America and Europe.
Requirements:
Which Route 53 configuration best meets these requirements?
Best answer: A
Explanation: Latency-based routing is the Route 53 policy that targets the lowest-latency endpoint for users in different geographies. Pairing it with Route 53 health checks driven by CloudWatch alarms removes unhealthy Regions from DNS responses to achieve automatic failover. Using CloudWatch-alarm health checks also avoids creating a new unauthenticated internet-facing health-check path.
Use Route 53 latency-based routing when the primary goal is best client performance across Regions. Create two latency records (alias to each ALB) for the same name and associate each record with a Route 53 health check that is based on an existing CloudWatch alarm (for example, ALB HTTPCode_ELB_5XX or UnHealthyHostCount). When an alarm breaches, Route 53 treats that endpoint as unhealthy and stops returning it, effectively shifting traffic to the remaining healthy Region while still preferring the lowest-latency Region during normal operation. This approach is fully managed, integrates with existing monitoring, and avoids exposing a new public health-check endpoint just for DNS probing.
Topic: Content Domain 5: Networking and Content Delivery
You are configuring Route 53 private hosted zones (PHZs) to implement split-horizon DNS for example.internal. Select THREE statements that are true.
Best answers: D, E, F
Explanation: Split-horizon DNS with Route 53 relies on how Route 53 selects between public and private hosted zones of the same name based on the source of the DNS query. Private hosted zone visibility is controlled strictly by explicit VPC associations (including cross-account associations via authorization), and Route 53 enforces uniqueness to avoid conflicting private zones per VPC.
The core mechanism is that Route 53 answers from a private hosted zone only when the DNS query originates from within a VPC that is explicitly associated with that private hosted zone. This enables split-horizon DNS by using the same domain name in both a public hosted zone and a private hosted zone, with Route 53 returning different answers depending on whether the resolver is inside an associated VPC.
Operationally, keep these association rules in mind:
The key takeaway is that DNS visibility for private hosted zones does not “inherit” through networking constructs like VPC peering; it is controlled by Route 53 associations.
Topic: Content Domain 4: Security and Compliance
An operations engineer reviews AWS Trusted Advisor security checks for an AWS account and must choose the first remediation to reduce the highest account-wide risk.
Trusted Advisor: Security
0.0.0.0/0)Which remediation should be prioritized first?
0.0.0.0/0 inbound rules from security groupsBest answer: A
Explanation: Trusted Advisor’s “MFA on Root Account” check is meant to prevent full account takeover because the root user cannot be constrained by IAM policies and has unrestricted access. Enabling MFA on the root user is the fastest way to reduce the highest blast-radius risk before addressing resource-level exposure and hygiene items.
Trusted Advisor security checks are best prioritized by blast radius and privilege level. The AWS account root user is a highly privileged identity that can perform any action in the account, and its credentials are not governed by IAM permission boundaries or SCPs. If root MFA is not enabled, a compromised password can lead to immediate, complete account compromise.
After root MFA is enabled, prioritize other findings based on exposure (for example, which ports are open to the internet and whether they are required) and identity hygiene (such as access key rotation). The key fact is that root MFA directly protects the highest-privilege principal in the account.
Topic: Content Domain 4: Security and Compliance
A company stores customer documents in three Amazon S3 buckets. The operations team currently runs a nightly workflow that copies all new objects to an EC2 instance and uses custom scripts to search for PII (for example, passport numbers). This workflow is slow, requires frequent script updates, and adds compute and data transfer cost.
The security team wants an AWS-native way to continuously discover and classify sensitive data in these S3 buckets and produce auditable findings, with minimal ongoing operational effort and no application changes.
Which change is the best optimization?
Best answer: D
Explanation: Amazon Macie is purpose-built to discover and classify sensitive data in Amazon S3 using managed and custom data identifiers and to produce findings for audit and response workflows. Enabling Macie and running scheduled discovery jobs removes the need for a custom EC2-based scanning pipeline. The tradeoff is ongoing Macie scanning cost, but operational effort and fragility are significantly reduced.
The core need is automated sensitive data discovery and classification for S3 objects with auditable findings and low operational overhead. Amazon Macie natively scans S3 buckets (without copying data into custom scanners), uses managed data identifiers for common PII types, and generates findings that can be routed to downstream systems (for example, Security Hub, EventBridge, and SNS) for triage and remediation.
A practical operational approach is:
This replaces ongoing maintenance of custom scripts and scanning infrastructure; the main tradeoff is paying for Macie’s analysis based on what you choose to scan and how often.
Topic: Content Domain 2: Reliability and Business Continuity
An application’s EC2 Auto Scaling group (ASG) is “thrashing” (frequent scale out and scale in) after load spikes, creating operational noise. The ASG uses scaling policies.
Which TWO statements are UNSAFE guidance for tuning cooldowns and stabilization windows to reduce thrashing? (Select TWO.)
Best answers: D, E
Explanation: Cooldowns and stabilization windows are meant to give metrics time to reflect the last scaling action and to ignore short-lived metric fluctuations. Guidance that removes that “settling time” (for example, zero cooldown or overly aggressive scale-in stabilization) commonly causes oscillation, repeated scaling events, and alert noise. The safer guidance adds controlled delay aligned to instance warm-up and metric behavior.
To prevent scaling thrash, you want scaling decisions to be based on stable signals, not on metrics that haven’t yet “caught up” to the last scaling action.
Cooldowns (commonly for step/simple scaling) and instance warm-up help by delaying additional scaling until new instances are actually contributing to the metric. Target tracking uses a scale-in stabilization window to avoid scaling in due to temporary metric dips right after a spike.
Practical tuning approach:
The unsafe guidance is the advice that shortens or removes these delays, which makes scaling react to noise instead of steady demand.
Topic: Content Domain 4: Security and Compliance
Select THREE statements that are true about AWS resource-based policies (for example, Amazon S3 bucket policies and AWS KMS key policies) and high-level policy evaluation.
Best answers: A, B, D
Explanation: Resource-based policies (like S3 bucket policies and KMS key policies) are evaluated together with identity-based policies, and explicit denies always win. Cross-account access commonly requires permission both on the calling principal (IAM) and on the target resource (bucket/key). KMS additionally relies on the key policy as the resource control point for the key.
Resource-based policies attach to a specific resource (for example, an S3 bucket or a KMS key) and can grant permissions directly to principals, including principals from other AWS accounts. For most requests, AWS evaluates all applicable policy types together (identity-based policies, resource-based policies, session policies, permission boundaries, SCPs), and an explicit Deny anywhere overrides any Allows.
For cross-account access, you typically need:
Key takeaway: resource-based policies don’t replace IAM evaluation; they participate in it, and conditions are supported to scope access safely.
Topic: Content Domain 2: Reliability and Business Continuity
A DynamoDB table named Orders has point-in-time recovery (PITR) enabled. During quarterly DR tests, operators restore the table to a timestamp from earlier that day and must validate the restore within 15 minutes while keeping read costs low. The current validation step runs a full table Scan on the restored table, which is slow and expensive.
Which change is the best optimization to the restore-and-validate procedure without breaking the constraints?
Scan, but use strongly consistent readsBatchGetItem a canary key setBest answer: C
Explanation: PITR restores a DynamoDB table to a specific timestamp by creating a new table, so validation should focus on quickly proving data and access paths work. Using a small, predefined canary dataset and targeted reads (for example, BatchGetItem) validates the restore outcome within the time window and with minimal read cost. The tradeoff is that it’s sampling-based rather than a full-data verification.
The core PITR workflow is to restore to a new table at a chosen timestamp, wait until the restored table is ACTIVE, and then validate that the expected data is present and readable. For a large table, a full Scan is a poor fit for time- and cost-constrained DR tests because it consumes many RCUs and can exceed the 15-minute objective.
A practical validation approach is:
RestoreTableToPointInTime to a new table name.DescribeTable to show ACTIVE.BatchGetItem for known order IDs) plus a basic application smoke test.This reduces operational effort and cost while still providing strong evidence the PITR restore succeeded; full-table verification is the closest alternative but is not operationally efficient here.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
You are configuring Amazon EventBridge rules to route Amazon EC2 instance state-change events to operational targets.
Select THREE statements that are FALSE.
source: aws.ec2 and an EC2 state-change detail-type to match events.events:PutEvents.events.amazonaws.com to invoke it.Best answers: B, C, F
Explanation: EventBridge service events are scoped to the Region where they occur, and EC2 state-change notifications are published directly to EventBridge without requiring CloudTrail. Also, EventBridge rules don’t “take EC2 actions” by themselves; they route events to targets that perform actions, such as Lambda or SSM Automation, with the required permissions in place.
The core concept is how EventBridge service events are matched and routed. EC2 instance state changes are published as native EventBridge events in the same Region as the instance, and you match them with an event pattern (commonly source: aws.ec2 plus the EC2 state-change detail-type, and optionally detail.state).
The false statements are incorrect because:
Key takeaway: configure the right event pattern and choose an operational target that can perform the remediation action.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
Which statement best defines the high-level way the Amazon CloudWatch agent is configured for ECS/EKS to collect container logs and metrics?
Best answer: A
Explanation: In ECS and EKS, the CloudWatch agent is commonly run as a container on each node so it can read host/container telemetry locally and publish it to CloudWatch. You provide an agent configuration (for example, for Container Insights) and the required IAM permissions so the agent can write metrics and logs to CloudWatch.
The CloudWatch agent is software that you deploy and configure to collect metrics and logs from the compute environment and publish them to CloudWatch. In container orchestrators, the typical pattern is to run the agent on every worker node (for example, as a DaemonSet in EKS or as a per-instance daemon/agent task in ECS on EC2) so it can collect node and container telemetry locally. You supply the CloudWatch agent configuration (what metrics/log files to collect, and where to send them) and ensure the agent has IAM permissions to call CloudWatch and CloudWatch Logs APIs. This is different from CloudTrail (API auditing) and from CloudWatch Logs subscription filters (log streaming/processing), which do not replace the need to deploy the agent for metrics collection.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
You are tuning Amazon CloudWatch alarm notifications for a service to reduce alert fatigue while still reflecting dependent conditions across multiple metrics.
Select TWO true statements about CloudWatch composite alarms.
AlarmRule with AND/OR over other alarm states.treatMissingData.INSUFFICIENT_DATA from the alarms it references.Best answers: B, E
Explanation: CloudWatch composite alarms don’t watch metrics directly; they combine the states of other alarms by using an AlarmRule expression. This lets you represent dependent conditions (for example, multiple alarms must be ALARM) and reduce alert fatigue by notifying only when the composite’s rule evaluates to ALARM.
The core concept is that a composite alarm is a “state aggregator”: it changes state based on an AlarmRule that references other CloudWatch alarms (typically metric alarms) and uses Boolean logic such as AND, OR, and NOT. This is useful operationally when you want one actionable page that represents a dependent condition across multiple metrics, instead of multiple redundant notifications.
A common pattern is:
Key takeaway: composite alarms evaluate other alarms’ states; metric evaluation and missing-data treatment are handled by the underlying metric alarms.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
When creating Amazon CloudWatch dashboards to summarize key service metrics and alarm states for an application fleet, which TWO statements are INCORRECT?
SEARCH expression in a widget to aggregate fleet-level KPIs.Best answers: C, E
Explanation: CloudWatch dashboards visualize data but do not generate alarm evaluations on their own. To summarize alarm states, you must create CloudWatch alarms and then add an Alarm widget to display their current state alongside key metrics (including aggregated fleet KPIs).
The core concept is that CloudWatch dashboards are for visualization and operational summarization, while CloudWatch alarms are separate resources that evaluate metrics and produce an alarm state.
In practice, fleet dashboards commonly:
SEARCH) to roll up KPIs across many resources.A dashboard widget cannot replace an alarm by “defining a threshold” in the dashboard, and adding a metric to a dashboard does not create an alarm for it.
Topic: Content Domain 3: Deployment, Provisioning, and Automation
A company manages 300 Amazon EC2 Linux instances across multiple Auto Scaling groups. The instances are already managed by AWS Systems Manager (SSM) and are tagged with Baseline=Prod.
Operations must ensure a configuration baseline: the Amazon CloudWatch agent package must be installed, a standard agent config file must be present, and the agent service must be running. Today, the team uses an ad hoc SSM Run Command “once after launch” plus occasional manual re-runs, and drift keeps reappearing after instance replacements and human changes.
Which change is the best way to reduce operational effort and continuously remediate configuration drift without rebuilding AMIs?
Baseline=Prod and periodically enforces CloudWatch agent installation, config, and service stateBest answer: B
Explanation: SSM State Manager is purpose-built to define and enforce configuration baselines over time. By using an association that targets instances by tag and runs on a schedule, it automatically detects and remediates drift and applies the baseline to newly launched instances. The tradeoff is additional scheduled association executions (minor overhead) in exchange for consistent, auditable enforcement.
The core need is continuous baseline enforcement, not a one-time setup step. SSM State Manager uses associations to apply a desired configuration (packages, files/scripts, and service state) to a dynamic set of managed instances (for example, by tag) on a schedule, and it provides execution history and compliance visibility.
A practical approach is:
Baseline=Prod instances with an associationLaunch-time hooks, AMI baking, and cron can help initially, but they do not provide the same ongoing drift remediation and centralized auditing that State Manager provides.
Topic: Content Domain 4: Security and Compliance
A security team wants to ensure that no Amazon EC2 security group allows inbound SSH (port 22) from 0.0.0.0/0. The team uses AWS Config to detect noncompliant security groups and automatically trigger remediation workflows with an audit trail.
Which action should the team NOT take?
0.0.0.0/0 ingress on port 22restricted-ssh AWS Config managed ruleBest answer: B
Explanation: AWS Config rules should detect noncompliant configurations and trigger remediation that reduces risk. A remediation workflow for unrestricted SSH must remove or restrict the offending rule, using an auditable mechanism such as Systems Manager Automation. Adding an internet-open SSH rule is the opposite of remediation and increases exposure.
The core pattern is: AWS Config evaluates resources against a rule, and a remediation workflow responds to noncompliance to bring the resource back into the desired (secure) state. For security groups, compliant remediation typically revokes overly permissive ingress or restricts it to approved CIDRs. AWS Config can trigger remediation directly (remediation actions) or indirectly by emitting compliance change events that start an SSM Automation runbook, both of which are auditable through AWS API activity logs.
A workflow that intentionally opens SSH to 0.0.0.0/0 is an operations anti-pattern because it expands the attack surface and undermines the control Config is meant to enforce.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
A production web service runs on an EC2 Auto Scaling group (6 instances) behind an ALB. The service must remain available during changes and must keep at least 90% of desired capacity in service. The team has a 1-hour weekly change window.
AWS Compute Optimizer shows this for the Auto Scaling group:
1Current: m5.xlarge
2Avg CPU: 12% Avg mem: 28%
3Recommendation: m6i.large
4Estimated monthly savings: 38%
5Performance risk: Very low
Which change best reduces cost while managing operational risk and the change-window constraint?
Best answer: B
Explanation: Compute Optimizer indicates the fleet is overprovisioned and that moving to m6i.large has very low performance risk with significant savings. Using an Auto Scaling instance refresh applies the recommendation gradually while enforcing the 90% healthy-capacity constraint. This approach fits the 1-hour change window and limits blast radius.
The core concept is to implement Compute Optimizer right-sizing recommendations in a way that preserves availability. For an Auto Scaling group, the safest operational pattern is to update the launch template (or launch configuration) to the recommended instance type and then use an instance refresh (or controlled rolling update) with a minimum healthy percentage that matches the business constraint.
A practical sequence is:
m6i.large.This achieves the savings projected by Compute Optimizer while minimizing downtime risk compared to a stop/start approach or deviating to an unvalidated instance family.
Topic: Content Domain 5: Networking and Content Delivery
A company uses an Amazon Route 53 private hosted zone api.corp.local that points to EC2 instances by private IP in a VPC. There is a warm-standby set of instances in another AWS Region. The instances are not behind a load balancer and are not reachable from the internet.
The operations team must implement DNS failover so that Route 53 returns the standby IPs only when the primary API is unhealthy.
Which solution meets this requirement?
Best answer: C
Explanation: Route 53 failover routing returns the primary record only while its associated health check is healthy; otherwise it answers with the secondary record. Because the API endpoints are private IPs, Route 53’s external health checkers cannot probe them directly. A health check that references a CloudWatch alarm lets an internal probe publish health and still control Route 53 failover.
The deciding factor is that the endpoints are reachable only inside the VPC. Standard Route 53 HTTP/HTTPS/TCP health checks are performed by AWS health checkers on the public internet, so they cannot directly check private IPs in a private hosted zone.
To make DNS failover work, you can:
api.corp.local, associating the health check with the primary record.This way, the health check state controls whether Route 53 answers with the primary or secondary IPs, without requiring public reachability.
Topic: Content Domain 5: Networking and Content Delivery
Select THREE statements that are INCORRECT about Amazon Route 53 routing policies.
Best answers: A, C, E
Explanation: Simple routing does not return all values in one response, even if you configure multiple values. Failover routing does not universally require a separate Route 53 health check because alias records can use Evaluate Target Health. Latency routing is compatible with alias records for supported AWS endpoints.
Route 53 routing policies control which record value is returned in response to a DNS query.
Simple routing can be configured with multiple values, but Route 53 generally returns a single value per query (often treated like basic round robin), not every value at once. Failover routing uses primary/secondary records and can determine health either from a Route 53 health check (commonly for non-alias targets) or from the AWS target’s health when using an alias with Evaluate Target Health. Latency routing is available for both alias and non-alias records (for supported alias targets) and returns the record associated with the lowest-latency AWS Region for the DNS resolver.
The key operational takeaway is to choose the routing policy based on the control you need (distribution, lowest latency, or automated failover) and how health is evaluated for the target type.
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
In Amazon CloudWatch metric alarms, what does the Evaluation periods setting control?
Best answer: C
Explanation: Evaluation periods defines the number of back-to-back periods CloudWatch considers when comparing a metric to an alarm threshold. Increasing it generally reduces alert noise by requiring the unhealthy condition to persist longer before actions (such as an SNS notification or Auto Scaling action) occur.
A CloudWatch metric alarm evaluates a metric as a series of fixed-duration “periods” (for example, 1 minute each) and compares each period’s statistic (Average, Sum, etc.) to the threshold. Evaluation periods is the number of those consecutive periods CloudWatch looks at when deciding whether to change the alarm state (OK, ALARM, INSUFFICIENT_DATA).
For example, with a 1-minute period and 5 evaluation periods, CloudWatch evaluates the last 5 one-minute datapoints against the threshold. Separately, Datapoints to alarm controls how many of those evaluation periods must be breaching to trigger ALARM (useful for allowing occasional spikes).
Topic: Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
An AWS Systems Manager Automation execution is failing intermittently with errors such as AccessDenied during role assumption and step failures when targeting EC2 instances.
When troubleshooting Automation execution failures, which TWO statements are false or unsafe? (Select TWO.)
PassRole/execution-denied events.sts:AssumeRole to fix AssumeRole errors.assumeRole trust allows ssm.amazonaws.com.Best answers: A, C
Explanation: Systems Manager Automation failures commonly come from role assumption problems, bad/invalid parameters, or unmet resource preconditions (for example, instances not being managed by SSM). The two unsafe statements misidentify who must be allowed to assume the role and incorrectly imply an existing execution can be re-run to pick up environment changes.
To troubleshoot Automation execution failures, separate permission failures from parameter and resource readiness issues. With Automation, the service assumes the specified assumeRole, so the role’s trust policy must allow ssm.amazonaws.com, and the user starting the execution commonly needs iam:PassRole for that role. Next, validate that all document parameters match the document schema and reference real resources in the correct Region/account. Finally, for steps that use Run Command, the target instances must be managed instances (SSM Agent running, instance profile permissions, and network reachability to SSM endpoints).
assumeRole trust and iam:PassRole/CloudTrail denialsThe key is to fix the role trust/PassRole chain and the resource preconditions rather than changing unrelated operator permissions or expecting an old execution to re-run.