SOA-C03 AWS Certified CloudOps Engineer - Associate Question and Answers

In the AWS Cloud Operations and Aurora documentation, when data loss occurs due to human error such as dropped tables, Point-in-Time Recovery (PITR) is the recommended method for restoration. PITR creates a new Aurora cluster restored to a specific time before the failure.

The restored cluster has a new endpoint that must be reconfigured in the application to resume normal operations. AWS does not support performing PITR directly on an existing production database because that would overwrite current data.

Aurora Backtrack (Option A) applies only to Aurora MySQL, not PostgreSQL. Option B is incorrect because PITR cannot be executed in place. Option D refers to an import process from S3, which is unrelated to time-based recovery.

Hence, Option C is correct and follows the AWS CloudOps standard recovery pattern for PostgreSQL workloads.

EC2 instances in private subnets cannot send traffic directly to the internet gateway because private subnets do not have a direct 0.0.0.0/0 route to the internet gateway. Instead, outbound IPv4 internet access from private subnets is typically provided by a NAT gateway that is deployed in a public subnet. Private subnet route tables then send default internet-bound traffic (0.0.0.0/0) to the NAT gateway as the target. The NAT gateway uses its Elastic IP address and the public subnet’s route to the internet gateway to enable outbound connectivity while still preventing inbound internet-initiated connections to the private instances.

When the company reduced multiple NAT gateways to a single NAT gateway, the routing design likely became inconsistent across Availability Zones. In multi-AZ architectures, it is common to have one NAT gateway per AZ and have each private subnet route to the NAT gateway in the same AZ to maintain zonal resiliency and avoid cross-AZ dependencies. If NAT gateways were removed, some private subnets may still have route table entries that point to NAT gateways that no longer exist. Those subnets would immediately lose outbound internet connectivity. The fix is to update the route tables associated with the affected private subnets so that their 0.0.0.0/0 route targets the remaining NAT gateway.

Option C would violate the requirement that instances must be in private subnets; routing private subnet traffic directly to an internet gateway effectively makes the subnet public. Option A is unnecessary and adds operational burden; NAT instances require patching, scaling, and availability management. Option D does not address the routing target problem and is not how NAT gateway egress is restored for multiple subnets.

Therefore, correcting the private subnet route tables to send internet-bound traffic to the existing NAT gateway is the appropriate solution.

=================

AMI IDs are Region-specific. An AMI ID that exists in us-east-1 does not automatically exist in us-west-2, and even copied AMIs receive different AMI IDs in the destination Region. The correct CloudFormation pattern is to define Region-specific AMI IDs in the Mappings section and use Fn::FindInMap with AWS::Region to select the correct AMI for the deployment Region. Option A is wrong because you cannot assign the same AMI ID in another Region. Option B is invalid because AMI IDs are not globally qualified by adding a Region code. Option C can help users select an AMI manually, but it does not ensure the template automatically works in every Region. Therefore, mappings are the correct infrastructure-as-code solution.

===============

Per the AWS Cloud Operations and EventBridge documentation, when events are sent across AWS accounts — particularly from multiple accounts in an AWS Organization — the target event bus in the receiver account must include a resource-based policy that explicitly allows events:PutEvents API calls from the sender accounts or the organization ID.

Even if the sender accounts have IAM permissions to call PutEvents, the receiving event bus must trust those accounts via a resource policy. Without this configuration, EventBridge automatically rejects incoming cross-account events, and those events never reach the target Lambda function for processing.

AWS guidance states that “Cross-account event delivery requires a resource-based policy on the event bus that grants permissions to the source accounts or organization.” The policy can include either individual AWS account IDs or the organization’s root ID.

In this scenario, because the events originate from multiple accounts and there is no resource policy on the target event bus to authorize those sender accounts, the events are not delivered.

Therefore, the correct cause is C – the resource-based policy on the target event bus must be modified to allow PutEvents API calls from the sender accounts.

For cross-account access, the Lambda function in Account A needs an execution role that permits it to call sts:AssumeRole on a role in Account B. The role in Account B must trust the Lambda execution role from Account A and must have permissions to read the target S3 bucket objects. This follows the standard AWS cross-account access model: the resource-owning account creates a role with permissions to the resource, and the external workload assumes that role. Option B is incomplete because permissions granted only in Account A do not automatically grant access to resources in Account B. Options C and D reverse the trust relationship incorrectly. The secure CloudOps model is cross-account role assumption with least privilege: Lambda execution role in Account A assumes a read-only S3 access role in Account B.

===============

The DNS record must point users to the CloudFront distribution domain name, not directly to the S3 bucket URL or S3 ARN. CloudFront acts as the public content delivery endpoint, while the S3 bucket remains the origin. AWS CloudFront documentation states that when using alternate domain names, DNS CNAME records should route queries to the CloudFront distribution. If Route 53 is used, an alias record can point to the distribution; with external DNS, a CNAME points to the CloudFront domain name. Disabling S3 Block Public Access is unnecessary and weakens security. Pointing DNS to the S3 ARN is invalid because ARNs are identifiers, not DNS targets. S3 access points do not replace the CloudFront distribution endpoint for public website routing. Therefore, the CNAME must be updated to d111111abcdef8.cloudfront.net.

===============

AWS Transit Gateway supports security group referencing across VPCs, but this feature must be explicitly enabled on each transit gateway attachment. Once enabled, security groups in one VPC can reference security groups in another VPC attached to the same transit gateway, simplifying rule management and improving security posture.

Enabling the feature on the transit gateway itself is not sufficient; it must be enabled per attachment to allow traffic evaluation based on security group IDs. This approach avoids brittle CIDR-based rules and allows dynamic scaling without rule updates.

Option A removes the transit gateway, which contradicts the existing architecture. Option B is incomplete. Option D does not address security group referencing.

Thus, enabling security group referencing on each transit gateway attachment is the correct solution.

EC2 Image Builder is a managed service that automates the creation, testing, vulnerability scanning, and distribution of AMIs. It supports scheduled image pipelines, which makes it ideal for weekly application updates.

Image Builder integrates with Amazon Inspector to perform vulnerability scans during image creation, fulfilling the security requirement. Custom image recipes define application dependencies and installation steps, ensuring consistency across deployments.

Manual AMI creation, cron-based scripts, or direct API calls require ongoing maintenance and do not natively support vulnerability scanning.

Therefore, EC2 Image Builder is the most operationally efficient solution.

The number of AWS Trusted Advisor checks available to an account depends on the AWS Support plan associated with the account. The Basic and Developer support plans provide access to a limited set of Trusted Advisor checks, primarily focused on security and service limits.

The Business and Enterprise support plans provide full access to all Trusted Advisor checks, including cost optimization, performance, fault tolerance, and security categories.

Running EC2 instances, SCPs, or MFA settings do not affect the availability of Trusted Advisor checks.

Therefore, the AWS Support plan determines the quantity of available Trusted Advisor checks.

Amazon EC2 Instance Connect enables secure SSH access to EC2 instances without requiring a traditional SSH key pair. However, although authentication is handled through IAM and the Instance Connect endpoint, the underlying network requirements for SSH still apply.

For EC2 Instance Connect to function, the EC2 instance’s security group must allow inbound traffic on TCP port 22 from the network where the Instance Connect endpoint resides. In this case, both the endpoint and the EC2 instance are in the private subnet, so the security group must explicitly allow SSH traffic from that subnet or from the security group associated with the endpoint.

Allowing HTTPS traffic on port 443 does not enable SSH access. Systems Manager Session Manager is a separate access mechanism and does not resolve an EC2 Instance Connect failure. Recreating the instance with an SSH key pair is unnecessary because EC2 Instance Connect does not rely on key pairs.

Therefore, enabling inbound SSH traffic on port 22 from the private subnet resolves the connection issue.

According to the AWS Cloud Operations and Security documentation, AWS CloudTrail is the authoritative service for recording API activity across all AWS services within an account.

When an access key is compromised, CloudTrail logs all API requests made using that key, including details such as:

The user identity (access key ID) that made the request,

The service, operation, resource, and timestamp affected, and

The source IP address and region of the request.

By searching the CloudTrail event history for the specific access key ID, the CloudOps engineer can identify every action performed by that key during the suspected breach window.

Other options are incorrect:

EventBridge (A) is event-driven, not historical.

CloudWatch Logs (B) monitors system logs, not AWS API activity.

VPC Flow Logs (D) track network-level traffic, not API calls.

Therefore, the correct solution is Option C — using AWS CloudTrail event history to audit and trace all actions executed via the compromised access key.

In cross-account S3 replication, a common cause of “Access Denied” when reading replicated objects is object ownership. By default, the replicated objects can remain owned by the source account (the account that originally wrote the objects). Even though the objects are physically stored in the destination bucket, the destination account’s users can be blocked from accessing them unless the correct ACLs or ownership controls are in place. This becomes especially visible in disaster recovery or nonproduction copy scenarios where the destination account expects to independently read and manage replicated data.

Amazon S3 provides an option in replication configuration to change the replica object ownership to the destination bucket owner. When enabled, the destination account becomes the owner of the replicated objects, which aligns access control with the bucket ownership and the destination account’s IAM policies. This removes the common cross-account ownership mismatch and resolves Access Denied errors for legitimate users in the destination account who have permissions on the destination bucket.

Option B relates to which objects are included in replication (prefix scoping). If replication were scoped incorrectly, the symptom would typically be missing objects rather than Access Denied on objects that are present. Option C (S3 RTC) is about replication time guarantees and monitoring; elapsed time does not change ownership or permissions and therefore does not resolve Access Denied. Option D (storage class changes) affects cost and retrieval characteristics, not authorization; it would not typically produce Access Denied for standard reads solely because the storage class differs.

Therefore, updating the replication configuration to ensure replicated objects are owned by the destination bucket owner is the correct fix to restore access.

=================

Blue/green deployment with AWS CodeDeploy is the correct strategy for Amazon ECS when zero downtime and fast rollback are required. In a blue/green deployment, the current production task set remains active while a new task set is created and validated. Traffic can then be shifted safely to the new version. If the new version causes performance degradation, CodeDeploy can roll back by redirecting traffic to the previous task set. AWS ECS documentation describes blue/green deployment as a method that reduces downtime and risk by running two production environments and validating revisions before routing production traffic. Rolling updates do not provide the same immediate one-step rollback. Canary or linear traffic shifting gradually moves traffic but does not match the requirement for immediate rollback as directly as blue/green. Manual scaling is operationally weak.

===============

According to CloudOps automation and monitoring best practices, CloudWatch dashboards should be provisioned as infrastructure-as-code (IaC) resources using AWS CloudFormation to ensure consistency, repeatability, and version control. AWS CloudFormation supports the AWS::CloudWatch::Dashboard resource, where the DashboardBody property accepts a JSON object describing widgets, metrics, and layout.

By exporting the existing dashboard configuration as JSON and embedding it into the CloudFormation template, every deployment of the application automatically creates its corresponding dashboard. This method aligns with the CloudOps requirement for automated deployment and operational visibility within the same stack lifecycle.

AWS documentation explicitly states:

“Use the AWS::CloudWatch::Dashboard resource to create a dashboard from your template. You can include the same JSON you use to define a dashboard in the console.”

Option A requires manual execution. Options C and D incorrectly reference or reuse existing dashboards, failing to produce unique, deployment-specific dashboards.

VPC Flow Logs require permissions to create log groups and log streams in Amazon CloudWatch Logs. If the IAM role associated with the flow log lacks the logs:CreateLogGroup permission, CloudWatch Logs cannot be created and no logs will appear.

Option B is unrelated because CreateExportTask is used for exporting logs, not publishing them. IPv6 configuration and VPC peering do not prevent flow logs from being delivered.

Ensuring the IAM role has the correct CloudWatch Logs permissions resolves the issue.

Aurora Auto Scaling can automatically add or remove Aurora Replicas based on target metrics, including average connections across Aurora Replicas. AWS documentation lists “Average connections of Aurora Replicas” as a target metric when adding an auto scaling policy to an Aurora DB cluster. Because performance degrades above 200 connections and baseline usage is around 180, setting a target near 195 allows scaling to begin before the connection count crosses the problem threshold. Option A is vertical scaling and does not automatically respond to fluctuating demand. Option B is not how Aurora switches between provisioned and serverless modes during spikes. Option C is unnecessary and does not address read scaling with replicas. Therefore, an Aurora auto scaling policy using the database connections metric is correct.

===============

Amazon RDS encryption at rest cannot be enabled directly on an existing unencrypted DB instance. AWS guidance states that encryption for an RDS DB instance is enabled when the DB instance is created, not after creation. To convert an unencrypted RDS database to encrypted, the CloudOps engineer must take a snapshot, copy the snapshot while enabling encryption with an AWS KMS key, and then restore a new DB instance from the encrypted snapshot. Restoring from a snapshot creates a new DB instance; it does not overwrite the existing DB instance. Option C is invalid because Multi-AZ standby replicas cannot be independently encrypted and promoted for this purpose. Therefore, creating an encrypted snapshot copy and restoring it as a new DB instance is correct.

===============

Instances in private subnets do not have direct routes to an internet gateway, so they cannot reach public internet endpoints unless the VPC provides a managed egress path. The standard AWS architecture for private-subnet outbound internet access is to use a NAT device (typically a NAT gateway) placed in a public subnet, with an Elastic IP address and a route from the private subnet to that NAT gateway for 0.0.0.0/0 traffic. The NAT gateway then forwards traffic to the internet through the VPC’s internet gateway while preventing unsolicited inbound connections to the private instances.

The scenario states that the VPC has a NAT gateway in each private subnet. That placement prevents proper egress because a NAT gateway itself must be in a public subnet with a route to the internet gateway to function for internet-bound traffic. Without that, private instances will fail to reach external services such as a third-party API, exactly as observed.

Option C corrects the architecture by deploying NAT gateways in the public subnets with Elastic IPs and updating the private subnet route tables so that outbound internet traffic targets the NAT gateways. This enables private workloads to initiate outbound connections while remaining unreachable from the public internet directly, maintaining the intended security posture.

Option A is incorrect because an outbound-only internet gateway is designed for IPv6 egress, not IPv4 internet access. Option B misunderstands routing: API Gateway is an application-layer proxy service and is not a target for VPC route tables to provide generic internet access. Option D is not applicable because VPC interface endpoints provide private connectivity to supported AWS services via PrivateLink, not to arbitrary external public APIs.

Therefore, deploying NAT gateways in the public subnets and routing private subnet egress through them is the correct solution.

According to the AWS Cloud Operations and Cost Management documentation, AWS Budgets is the recommended service to track and alert on cost thresholds across all AWS accounts and resources. It allows users to define cost, usage, or reservation budgets, and configure notifications to trigger when usage or cost reaches defined percentages of the budgeted value (e.g., 75%, 90%, 100%).

The AWS Budgets system integrates natively with Amazon Simple Notification Service (SNS) to deliver alerts to an email distribution list or SNS topic subscribers. AWS Budgets supports granular cost filters, including specific service categories such as data transfer, regions, or linked accounts, ensuring precise visibility into inter-Region transfer costs.

By contrast, CloudWatch billing alarms (Option B) monitor total account charges only and do not allow detailed service-level filtering, such as data transfer between Regions. Cost and Usage Reports (Option A) are for detailed cost analysis, not real-time alerting, and VPC Flow Logs (Option D) capture traffic data, not billing or cost-based metrics.

Thus, using AWS Budgets with a 75% alert threshold best satisfies the operational and notification requirements.

According to the AWS Cloud Operations and Auto Scaling documentation, scaling applications that consume Amazon SQS messages should be driven by queue backlog per instance, not by general system metrics such as network traffic or CPU.

The correct approach is to calculate a custom metric using CloudWatch metric math that divides the SQS metric ApproximateNumberOfMessagesVisible by the number of active EC2 instances in the Auto Scaling group. This “backlog per instance” value represents the average number of messages waiting to be processed by each instance.

Then, the CloudOps engineer can create a target tracking policy that automatically scales out or in based on maintaining a desired backlog threshold. This approach ensures dynamic, workload-driven scaling behavior that reacts in near real time to message volume.

Step and simple scaling (Options C and D) require manual thresholds and do not automatically balance the load per instance.

Thus, Option B—using CloudWatch metric math to define queue backlog per instance for target tracking—is the most effective and AWS-recommended CloudOps practice.

AWS Systems Manager provides a built-in capability to automatically update the SSM Agent on managed instances. Enabling Auto update SSM Agent ensures that instances receive the latest agent version without manual intervention or custom automation.

This setting is centrally managed and applies across the fleet, making it the most scalable and operationally efficient solution. It eliminates the need for external notifications, custom Lambda functions, or scheduled automation workflows.

Options B and D introduce unnecessary complexity and operational burden. Option C is incorrect because Patch Manager is designed for operating system patching, not for managing SSM Agent updates.

Therefore, enabling automatic SSM Agent updates is the best solution.

Per the AWS Cloud Operations and S3 Data Management documentation, Cross-Region Replication (CRR) automatically replicates new objects between S3 buckets across Regions. However, CRR alone does not retroactively replicate existing objects created before replication configuration. To include such objects, AWS introduced S3 Batch Replication.

S3 Batch Replication scans the source bucket and replicates all existing objects that were not copied previously. Additionally, it can retry failed replication tasks automatically, ensuring regulatory compliance for complete dataset replication.

S3 Replication Time Control (S3 RTC) guarantees predictable replication times for new objects only—it does not cover previously stored data. S3 Lifecycle rules (Option D) move or transition objects between storage classes or buckets, but not in a replication context.

Therefore, the correct solution is to use S3 Cross-Region Replication (CRR) combined with S3 Batch Replication to ensure all current and future data is synchronized across Regions with retry capability.

Amazon S3 event notifications are the native mechanism for invoking processing when objects are uploaded to an S3 bucket. The CloudOps engineer can configure the bucket to send ObjectCreated events to an AWS Lambda function, and the Lambda function can process each new log file by using the bucket name and object key from the event payload. This is serverless, event-driven, and has the least operational overhead. CodePipeline is intended for software delivery workflows, not generic log-file processing. Step Functions is useful for orchestrating multi-step workflows, but polling or waiting for S3 uploads is unnecessary here. EventBridge can receive some S3 events, but the direct S3 event notification to Lambda is simpler and more targeted for this requirement.

CloudWatch Logs Insights is purpose-built for interactive querying and analysis across log data that is stored in CloudWatch Logs. It supports selecting multiple log groups at once (including many Lambda log groups), filtering events to match error patterns, extracting fields, and aggregating results. The requirement is to produce a count of application errors grouped by type across all log groups, which aligns directly with Logs Insights capabilities.

With Logs Insights, a CloudOps engineer can query all relevant Lambda log groups, parse or extract an “error type” field from structured JSON logs (or use pattern parsing for unstructured logs), and then aggregate using the stats command with count() grouped by the parsed error type field. This approach is fast to implement, requires no data pipeline, and scales well for large volumes because Logs Insights is optimized for CloudWatch Logs data. It also supports time-range selection so the security team can request daily or incident-window reporting.

Option B is incorrect because CloudWatch Logs “search” is a basic filtering feature and does not provide the same structured aggregation and grouping features as Logs Insights for large-scale, cross-log-group analytics. Option C (Athena) would require exporting logs to Amazon S3 (for example, via subscription filters, Kinesis Data Firehose, or scheduled exports) and maintaining a schema and partitions, which adds operational overhead not required here. Option D is not applicable because CloudWatch log data is not queried through Amazon RDS, and using an RDS database for log analytics would introduce significant ingestion and operational complexity.

Therefore, running a CloudWatch Logs Insights query using stats and count() to group errors by type across all Lambda log groups is the correct solution.

Layer 7 (application-layer) HTTP status codes such as 200, 404, and 500 are generated by web-facing services that process HTTP requests. In this architecture, both CloudFront and the Application Load Balancer (ALB) operate at Layer 7 and record HTTP response information in their access logs.

ALB access logs include detailed request and response data such as client IP address, request path, target response status code, and latency. These logs are essential for analyzing how backend EC2 instances respond to client requests.

CloudFront access logs record viewer requests and responses at the edge locations. These logs also include HTTP status codes returned to the client, making them critical for understanding end-user experience and edge-level behavior.

VPC Flow Logs capture network-level (Layer 3 and 4) traffic metadata such as source IP, destination IP, ports, and protocol. They do not contain HTTP status codes. AWS CloudTrail logs API calls to AWS services and does not capture application response codes. RDS logs contain database-related information, not HTTP responses.

Therefore, the correct sources for HTTP Layer 7 status codes are ALB access logs and CloudFront access logs.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

Amazon EFS encryption at rest is a file system creation attribute; an unencrypted EFS file system cannot be “turned on” for encryption in place. Therefore, meeting the requirement (“encrypt an existing EFS using an existing KMS customer managed key”) requires creating a new encrypted file system and migrating data.

Option A is the most operationally efficient because EFS replication is a managed mechanism that continuously copies data and metadata from a source file system to a destination file system. By specifying the existing KMS customer managed key for the destination, the new file system is encrypted at rest under the required key. After replication has caught up, the administrator can perform a controlled cutover (failover) so applications mount the encrypted destination instead of the original source. This reduces manual copying effort, supports ongoing synchronization during migration, and simplifies the cutover window.

Option B is not possible because encryption-at-rest settings for EFS cannot be modified after creation. Option C is irrelevant because TLS certificates relate to encryption in transit and are not configured as part of EFS replication in the manner described. Option D can work functionally, but it requires building and operating a copy workflow, which is more manual and error-prone than managed replication.

AWS Trusted Advisor publishes service quota metrics to Amazon CloudWatch. These metrics can be monitored using CloudWatch alarms, which support threshold-based alerting. By creating a CloudWatch alarm for each service quota metric, the CloudOps engineer can trigger alerts when usage exceeds 60%.

Amazon SNS is the AWS-native service for email notifications. CloudWatch alarms integrate directly with SNS, making this the most straightforward solution. SNS supports email subscriptions without additional infrastructure.

Options B and C incorrectly use SQS for email notifications, which requires additional processing and does not natively send emails. Option D relies on the AWS Health Dashboard, which does not support configurable threshold-based alerts for service quotas.

Therefore, CloudWatch alarms combined with SNS provide the correct and most efficient solution.

CloudWatch Logs metric filters allow log data to be converted into CloudWatch metrics in near real time. This enables continuous monitoring without custom code or scheduled queries. Metric filters are ideal when log events have a consistent structure and specific patterns, such as HTTP response codes.

By defining a metric filter that matches HTTP 404 responses, CloudWatch can increment a metric each time a 404 occurs. This metric can then be used for dashboards, alarms, and trend analysis. This approach is fully managed, scalable, and requires minimal operational effort.

Options B, C, and D rely on subscription filters or periodic queries, which introduce unnecessary complexity, latency, and maintenance overhead. Therefore, metric filters are the most efficient solution.

ALB access logs contain request-level records that include byte counts and target information. To report bytes sent to and received from each target group member, the CloudOps engineer should enable ALB access logging and store the logs in Amazon S3. Then Amazon Athena can query the log files and aggregate received_bytes and sent_bytes by the target address and port fields. AWS Athena documentation provides table definitions for ALB access logs and supports querying those logs directly from S3. Installing the CloudWatch agent on targets is unnecessary because the required data is in ALB logs, not instance OS metrics. The ProcessedBytes CloudWatch metric is useful for aggregate load balancer traffic but does not provide per-target member reporting. Grouping by client port is also wrong because the requirement is per target member.

===============

According to the AWS Cloud Operations and Elastic Load Balancing documentation, Application Load Balancer (ALB) supports multiple routing algorithms to distribute requests among targets:

Round robin (default)

Least outstanding requests (LOR)

Weighted random

When applications require session affinity, AWS recommends using “least outstanding requests” as the load balancing algorithm because it reduces latency, distributes load evenly, and ensures consistent target responsiveness during high traffic.

Using weighted random routing with sticky sessions can cause sessions to be routed inconsistently if one target’s capacity fluctuates, leading to session mismatches and application errors — especially when user sessions rely on instance-specific state.

Disabling cross-zone balancing (Option C) or adjusting deregistration delay (Option D) does not address routing inconsistency. Anomaly mitigation (Option B) protects against target performance degradation, not sticky-session misrouting.

Therefore, the correct solution is Option A — changing the target group’s routing algorithm to least outstanding requests ensures smoother, predictable session handling and resolves random application errors.

An Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and supports advanced routing features, including HTTP-to-HTTPS redirection. To meet the requirement of protecting traffic with ACM certificates and automatically redirecting HTTP requests, the ALB must be configured with two listeners.

The correct design is to create an HTTP listener on port 80 and an HTTPS listener on port 443. The SSL/TLS certificate from AWS Certificate Manager is attached to the HTTPS listener. A listener rule on port 80 redirects incoming HTTP requests to HTTPS on port 443, ensuring all client connections are encrypted.

Option A is invalid because HTTPS cannot operate on port 80. Option C uses TCP listeners, which do not support HTTP-level redirects. Option D uses a Network Load Balancer, which operates at Layer 4 and does not support HTTP redirects.

Therefore, Option B is the only solution that satisfies all requirements using AWS-native features with minimal complexity.

When a CloudFormation stack is deleted, CloudFormation’s default behavior is to delete the resources it created, including EC2 instances and attached resources defined in the template. The requirement is explicit: the company must keep the instances and all of the instances’ data even if someone deletes the stack. The CloudFormation mechanism intended for this outcome is the DeletionPolicy attribute, which controls what happens to a resource when the stack is deleted or when the resource is replaced during an update.

Setting DeletionPolicy: Retain on the EC2 instance resource instructs CloudFormation to preserve that resource instead of deleting it during stack deletion. With Retain, CloudFormation removes the resource from stack management but leaves the instance running (and therefore keeps the data that remains on the instance and its configured storage). This directly satisfies the requirement because the instance is not terminated as part of stack deletion.

Option A is incorrect for EC2 instances because Snapshot is applicable to certain resource types (commonly storage and database resources where snapshot semantics exist), not as a general “keep my instance” control for EC2 instance resources. Options B and C (DLM and AWS Backup) are valuable for backup and recovery strategies, but they do not prevent CloudFormation from terminating the instances when the stack is deleted. Backups could help restore later, but the requirement is to keep the original instances and their data even after deletion of the stack.

Therefore, the correct solution is to set DeletionPolicy to Retain for the EC2 instance resource in the CloudFormation template.

The PrivateDnsName attribute of an EC2 instance is automatically assigned by AWS at launch time and is a read-only property. CloudFormation does not allow users to specify this value manually.

Including PrivateDnsName in the EC2 instance properties causes validation to fail during stack creation. Outputs and Parameters sections are optional, and the VPC is implicitly defined through the subnet ID.

Therefore, attempting to set PrivateDnsName results in stack creation failure.

CloudFormation StackSets are designed specifically to deploy and manage the same CloudFormation stack across multiple AWS accounts and Regions from a centralized administration point. When accounts are managed under AWS Organizations, StackSets can integrate directly with Organizations to target Organizational Units (OUs) or specific accounts, which minimizes operational overhead. This removes the need to manually assume roles and deploy stacks one-by-one, and avoids building custom automation (Lambda + cross-account role assumption + account enumeration + error handling + retries + idempotency).

With StackSets, you define the template once and then create stack instances across many accounts in a controlled and consistent manner. StackSets provide built-in features for: (1) centralized rollout and updates, (2) drift detection, (3) automatic deployment to new accounts (when using Organizations integration), and (4) standardized execution roles. This is operationally simpler and safer than scripting because StackSets handle orchestration and track deployment state per account/Region.

Option A increases manual work and is error-prone at scale. Options B and C require custom Lambda orchestration, cross-account permissions, and ongoing maintenance for failure modes and change management. StackSets provide the native “least ops” approach to multi-account CloudFormation deployments under Organizations.

The CloudWatch agent procstat plugin is specifically designed to collect per-process metrics such as CPU usage by process ID. It allows continuous, automated monitoring without manual intervention and integrates directly with CloudWatch.

Default CloudWatch metrics provide only instance-level CPU utilization and do not expose process-level details. Manual logins and Lambda-based polling introduce unnecessary operational overhead and are not scalable.

Therefore, configuring the procstat plugin is the most efficient solution.

AWS Config is designed to continuously evaluate AWS resource configurations and detect noncompliance. The s3-bucket-logging-enabled managed rule specifically checks whether server access logging is enabled on S3 buckets. This directly meets the detection requirement for both current and future buckets.

To satisfy the remediation requirement, AWS Config supports automatic remediation actions. Using the AWS-provided AWS-ConfigureS3BucketLogging Systems Manager Automation runbook enables logging without custom code. This reduces operational overhead, avoids Lambda function maintenance, and aligns with AWS best practices.

Option A is incorrect because Trusted Advisor does not support automatic remediation. Option B cannot enforce logging at creation time through bucket policies alone. Option C works but introduces unnecessary Lambda maintenance compared to using an AWS-managed automation runbook.

Thus, combining AWS Config managed rules with Systems Manager Automation provides continuous compliance with minimal operational effort.

The AWS Cloud Operations and Storage documentation confirms that S3 Transfer Acceleration is designed to increase upload speed for objects transferred to S3 buckets over long distances.

It uses AWS Global Edge Network and Amazon CloudFront edge locations to route data through optimized network paths, reducing latency and achieving higher throughput compared to standard S3 uploads.

After enabling Transfer Acceleration on the bucket, users upload files to the accelerated endpoint (e.g., bucketname.s3-accelerate.amazonaws.com). This feature requires no changes to application logic besides endpoint modification and provides immediate performance improvement.

CloudFront (Option A) is for content delivery, not uploads. ElastiCache (Option B) and Global Accelerator (Option C) are unrelated to S3 upload performance.

Thus, Option D is correct — enable S3 Transfer Acceleration for faster, optimized file uploads.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Doocuments:

Amazon Aurora supports up to 15 Aurora Replicas that share the same storage volume and provide read scaling and improved availability. Official guidance states that replicas “offload read traffic from the writer” and that you should direct read-only workloads to the reader endpoint, reducing CPU pressure and connection counts on the primary. Aurora also supports Replica Auto Scaling through Application Auto Scaling policies using metrics such as CPU utilization or connections to add or remove replicas automatically. This design addresses both high CPU and maximum connections by moving reporting traffic to read replicas while keeping a single write primary for OLTP. Option B creates a separate cluster with independent storage, increasing operational overhead and data synchronization complexity. Options C and D introduce application-layer caching changes that may not guarantee data freshness or relieve the write node directly. Therefore, adding read replicas and routing reporting to the reader endpoint, with auto scaling based on load, is the least intrusive, CloudOps-aligned way to stabilize performance.

S3 Lifecycle policies are the correct managed mechanism for automatically expiring objects after a defined age. Because the company never accesses data older than 30 days, an expiration rule can delete objects after 30 days and reduce storage growth without custom code. This has the least operational overhead because S3 performs the expiration automatically. Option A introduces Lambda code, scheduling, permissions, retries, and edge-case handling, which is unnecessary. S3 Storage Lens can identify usage trends and aging objects, but it does not itself delete objects or enforce retention. Option C is vague and not an AWS-managed configuration as written. For CloudOps cost optimization, lifecycle expiration is the standard approach when objects have a predictable retention period and no long-term access requirement.

===============

Amazon Route 53 Resolver outbound endpoints enable Amazon VPC resources to forward DNS queries to DNS servers that are outside of AWS, such as on-premises DNS servers. Because the company already has AWS Direct Connect in place, DNS queries can be routed privately from the VPC to the on-premises DNS infrastructure without using the public internet.

By creating an outbound endpoint and configuring forwarding rules for the on-premises domains, EC2 instances in the VPC can resolve DNS names dynamically using the existing authoritative DNS servers. This approach requires minimal ongoing maintenance because DNS records continue to be managed centrally in the on-premises DNS system.

Manually populating a private hosted zone or /etc/hosts files would require constant updates and does not scale. Reverse DNS forwarding alone does not solve forward name resolution.

Therefore, using Route 53 Resolver outbound endpoints is the correct solution.

Auto Scaling groups with target tracking scaling policies automatically adjust capacity based on real-time demand. This solution is ideal for handling unpredictable and random traffic spikes.

Target tracking scaling maintains a metric, such as average CPU utilization or request count per target, at a defined target value. The Auto Scaling group automatically launches or terminates instances as traffic fluctuates.

Manual scaling, EventBridge-based scaling, or scheduled scaling do not respond dynamically to random traffic patterns.

Therefore, an Auto Scaling group with a target tracking scaling policy is the correct solution.

The correct design is to use a VPC endpoint/private connectivity model for Quick Suite access and grant the service controlled access to the S3 source data. The requirement is not only to access S3 privately; it says all data access and connections to Quick Suite must remain within the VPC network boundary. Option A best satisfies that by using an interface VPC endpoint with AWS PrivateLink for private service connectivity and a manifest that points Quick Suite to the S3 data. Option C covers only private access to S3 through a gateway endpoint, but it does not address private connectivity to Quick Suite itself. Option D sends traffic through a NAT gateway, which still uses public internet egress semantics. Option B adds an unnecessary EC2 proxy and increases operational risk.

===============

For IPv4 traffic, private subnets require a NAT gateway in a public subnet to access the internet. NAT gateways must be deployed in public subnets and associated with an Elastic IP address. Private subnet route tables must direct 0.0.0.0/0 traffic to the NAT gateway.

The question states that NAT gateways are incorrectly placed in private subnets, which cannot provide internet access. Deploying NAT gateways in public subnets resolves this issue and restores outbound connectivity to external APIs.

Option A applies only to IPv6. Option B adds unnecessary complexity. Option D is not applicable because external APIs are not AWS services.

The AWS Cloud Operations and Governance documentation specifies that AWS Config can be paired with AWS Systems Manager Automation runbooks for automatic remediation of noncompliant resources.

For SSH restrictions, the restricted-ssh managed rule detects any security group allowing inbound traffic on port 22. To automatically remediate these findings, AWS provides the AWS-DisableIncomingSSHOnPort22 runbook. This runbook programmatically removes inbound rules that allow port 22 traffic from affected security groups.

This approach achieves continuous compliance with minimal human intervention. By contrast, sending notifications (Option A) does not enforce remediation, API-based scripts (Option C) add operational overhead, and manual remediation (Option D) violates automation best practices.

Therefore, the most efficient CloudOps solution is Option B, using AWS Config with the AWS-DisableIncomingSSHOnPort22 automation runbook for automatic, scalable enforcement.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

To ensure users can launch instances only from approved AMIs, the control must be enforced at authorization time, not after the fact. An IAM policy with a condition that evaluates the resource tags on the AMI is the correct method. By using an aws:ResourceTag/ApprovedAMI condition (paired with allowing ec2:RunInstances only when the chosen AMI has the required tag/value), the organization can prevent launches from untagged or unapproved images. This implements preventative control and aligns with least privilege.

Option A (Organizations tag policy) is not an enforcement mechanism for EC2 API authorization; tag policies primarily help standardize tagging and report compliance rather than block API calls. Option C (AWS Config required-tags) evaluates resources for compliance after creation and cannot reliably prevent a launch at the time of the API call. Option D is unrelated; GuardDuty detections do not enforce AMI usage policy.

According to AWS Cloud Operations and Systems Manager documentation, Session Manager requires that each managed instance be associated with an IAM instance profile that grants Systems Manager core permissions. The required permissions are provided by the AmazonSSMManagedInstanceCore AWS-managed policy.

If this policy is missing or misconfigured, the Systems Manager Agent (SSM Agent) cannot communicate with the Systems Manager service, causing connection failures even if the agent is installed and running. This explains why other instances work—those instances likely have the correct IAM role attached.

Enabling port 22 (Option A) violates the company’s security policy, while configuring user names (Option C) and key pairs (Option D) are irrelevant because Session Manager operates over secure API channels, not SSH keys.

Therefore, the correct resolution is to attach or update the instance profile with the AmazonSSMManagedInstanceCore policy, restoring Session Manager connectivity.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

With the Managed-CachingDisabled policy, CloudFront is configured to minimize edge caching, so the remaining caching behavior users experience often comes from browser (client-side) caching. If users refresh and still see old content, it typically indicates the browser is allowed to reuse a cached copy without revalidating. The correct fix is to control client caching using HTTP response headers on the S3 object.

Adding a Cache-Control: max-age=0 header instructs browsers that the object becomes stale immediately and should be revalidated on subsequent requests (often resulting in conditional requests using If-Modified-Since or ETag behavior). This preserves correctness—users will fetch or revalidate the latest file—without requiring heavier operational actions like frequent CloudFront invalidations or changing to an optimized caching policy that may increase edge caching.

Option B can worsen the issue by increasing caching if object headers permit it. Option C is unrelated; versioning affects object history and recovery, not browser cache behavior. Option D affects payload size transfer (gzip/brotli), not cache freshness.

DynamoDB point-in-time recovery continuously backs up table data and can restore the table to a selected second within the recovery window. AWS documentation states that a PITR restore restores the data to a new table, not in place on the existing table. Therefore, the correct process is to restore the table to the timestamp two minutes before the corruption and then update the application to use the newly restored table. Option A is wrong because PITR does not update the existing table in place. Option C uses an on-demand snapshot, which might not meet the 2-minute RPO. Option D is unsafe because DynamoDB Streams are not a managed reverse-transaction rollback mechanism. PITR to a new table is the reliable recovery method.

===============

Per the AWS Cloud Operations and Service Catalog documentation, when a portfolio is shared across AWS accounts, the recipient account imports the shared portfolio.

The recipient CloudOps engineer cannot modify the original products or their configurations but can:

Add products from the imported portfolio into their local portfolios for deployment,

Control end-user access in the recipient account, and

Manage local constraints or permissions.

However, the recipient cannot edit, delete, or reconfigure the shared products (Options B, C, and D). The source (owner) account retains full administrative control over products, launch roles, and lifecycle policies.

This model aligns with AWS CloudOps principles of centralized governance with distributed self-service deployment across multiple accounts.

Thus, Option A is correct—imported portfolios allow the recipient to add products to a local portfolio but not alter the shared configuration.

As per AWS Cloud Operations, Bedrock, and Governance documentation, AWS CloudTrail is the authoritative service for capturing API activity and audit trails across AWS accounts. For Amazon Bedrock, CloudTrail records all user-initiated API calls, including interactions with agents, knowledge bases, and generative AI model parameters.

Using CloudTrail Lake, organizations can store, query, and analyze CloudTrail events directly without needing to export data. CloudTrail Lake supports SQL-like queries for generating audit and compliance reports, enabling the company to retrieve information such as user identity, API usage, timestamp, model or agent ID, and invocation parameters.

In contrast, CloudWatch focuses on operational metrics and log streaming, not API-level identity data. OpenSearch or Flink would add unnecessary complexity and cost for this use case.

Thus, the AWS-recommended CloudOps best practice is to leverage CloudTrail with CloudTrail Lake to maintain auditable, queryable API activity for Bedrock workloads, fulfilling governance and compliance requirements.

AWS Compute Optimizer analyzes historical utilization metrics and provides rightsizing recommendations for EBS volumes, including IOPS and throughput. It is fully managed, continuously updated, and requires minimal operational effort.

Manual reviews and benchmarking do not scale. Changing instance types does not address EBS overprovisioning.

Therefore, AWS Compute Optimizer is the best solution.

Per the AWS Cloud Operations and Data Protection documentation, S3 Object Lock enforces write-once-read-many (WORM) protection on objects for a defined retention period.

There are two modes:

Compliance mode: Even the root user cannot delete or modify objects during the retention period.

Governance mode: Privileged users with special permissions can override lock settings.

For regulatory or audit requirements that prohibit deletion, Compliance mode is the correct choice. When configured with a 3-month retention period, all backup objects are protected from deletion until expiration, ensuring compliance with data retention mandates.

Versioning (Option C) alone does not prevent deletion. IAM-based restrictions (Option A) lack time-based enforcement and require manual intervention. Governance mode (Option D) is less strict and unsuitable for regulatory retention.

Thus, Option B is the correct CloudOps solution for immutable S3 backups.

The least-effort, most scalable approach to ensure consistent software installation and ongoing updates across tagged Windows instances is to use AWS Systems Manager’s native software distribution and desired-state capabilities. Systems Manager Distributor lets you package third-party software as an “SSM package,” version it, and publish updates in a controlled way. This directly supports the requirement to install a third-party agent and deploy periodic updates when new versions are available.

State Manager Associations let you enforce configuration continuously or on a schedule across a fleet, targeting instances by tags (which the scenario explicitly says are in place). By creating an association that runs AWS-ConfigureAWSPackage, you instruct Systems Manager to install (and optionally update) a specific SSM package on all instances that match the Windows tag criteria. This provides ongoing compliance: newly launched instances that receive the tag will automatically get the agent installed, and existing instances will receive updates according to the association’s frequency and the package version strategy.

Option C (custom Lambda that logs in) is high operational overhead and poor practice (credentials, connectivity, error handling, scaling, and security concerns). Option D (RunRemoteScript) can work but is more brittle than ConfigureAWSPackage because it shifts lifecycle management (versioning, state, idempotency) into scripts. Option B (OpsItem + Inventory) is not an enforcement mechanism for installation/updating; it’s for operations tracking and visibility.

Therefore, Distributor (A) + State Manager association using AWS-ConfigureAWSPackage targeted by tags (E) is the cleanest and lowest-ops solution.

According to the AWS Cloud Operations and Deployment documentation, EC2 Image Builder is the AWS-managed service for automating the creation, maintenance, validation, and deployment of secure and compliant Amazon Machine Images (AMIs).

It allows CloudOps teams to define image pipelines that include only approved software modules and configuration scripts. EC2 Image Builder automatically tests and verifies these AMIs for compliance before deployment.

This process ensures configuration consistency, eliminates manual installation errors, and simplifies ongoing patch management. The service integrates with AWS Systems Manager, Amazon Inspector, and AWS CloudFormation for end-to-end automation.

In contrast:

Amazon Detective and GuardDuty (Options A & B) are security monitoring tools, not image management solutions.

Run Command (Option C) applies ad-hoc updates but does not create standard, reusable AMIs.

Therefore, Option D is correct—EC2 Image Builder provides the most operationally efficient and compliant way to create an approved baseline AMI for future deployments.

The important clue is that the new Lambda function and its IAM role are already correctly configured. When S3 validates event notification configurations, it can validate not only the newly added destination but also existing destinations on the bucket. If the bucket already has a stale notification that points to a deleted Lambda function, deleted queue, deleted topic, or destination without the correct resource policy, the validation can fail with “Unable to validate the following destination configurations.” Option C would be plausible if the new Lambda permission were missing, but the question rules out a problem with the new function configuration. Option A is not the best cause because the error refers to destination validation, not a quota breach. Therefore, the stale existing event notification is the likely root cause.

===============

Cluster placement groups are specifically designed for workloads that require extremely low latency and high network throughput, such as HPC applications. Instances are placed physically close together within the same Availability Zone, enabling high-bandwidth, low-latency networking.

Partition placement groups are optimized for fault isolation, not network performance. Spread placement groups prioritize availability by distributing instances across distinct hardware, which increases latency.

Because the requirement is performance rather than fault isolation or high availability, a cluster placement group is the optimal choice.

The most secure way for an EC2 instance to access AWS services is by using an IAM role attached to the instance. IAM roles eliminate the need for long-term credentials, which reduces the risk of credential leakage and simplifies credential rotation.

Following the principle of least privilege, the IAM policy attached to the role should grant only the permissions required: sqs:SendMessage, sqs:ReceiveMessage, and sqs:DeleteMessage. Granting broader permissions such as sqs:* violates least privilege and increases security risk.

Options A and B rely on IAM users and static credentials, which are not recommended for applications running on EC2. Option C grants excessive permissions.

Therefore, attaching an EC2 IAM role with only the required SQS permissions is the most secure solution.

The AWS Cloud Operations and Security documentation confirms that AWS WAF (Web Application Firewall) is designed to protect web applications from application-layer threats, including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities.

When integrated with an Application Load Balancer, AWS WAF inspects incoming traffic using rule groups. The AWS Managed Rules for SQL Injection Protection provide preconfigured, continuously updated filters that detect and block malicious SQL patterns.

AWS Shield (Standard or Advanced) defends against DDoS attacks, not application-layer SQL attacks, and vulnerability scanners (Option C) only detect, not prevent, exploitation.

Thus, Option D provides the correct, managed, and automated protection aligned with AWS best practices.

Amazon CloudWatch Synthetics heartbeat canaries actively test a website by sending periodic requests from AWS-managed locations, closely simulating real user access. This provides an accurate measurement of availability from an end-user perspective, which is a key requirement.

The SuccessPercent metric represents the percentage of successful executions over time and directly maps to website uptime. Creating a CloudWatch alarm on this metric allows the CloudOps engineer to receive SNS notifications when availability drops below the 99% threshold.

Log-based or anomaly-detection approaches do not reliably represent user experience, and broken link checkers focus on content integrity rather than availability. Therefore, a heartbeat canary is the correct solution.

When an Amazon EBS volume is resized, the new storage capacity is immediately available to the attached EC2 instance. However, EBS does not automatically extend the file system. The CloudOps engineer must manually extend the file system within the operating system to utilize the additional space.

AWS documentation for EC2 and EBS specifies:

“After you increase the size of an EBS volume, use file system–specific tools to extend the file system so that the operating system can use the new storage capacity.”

On Windows instances, this can be achieved through Disk Management or diskpart commands. On Linux systems, utilities such as growpart and resize2fs are used.

Options B and C do not modify file system metadata and are ineffective. Option D unnecessarily replaces the volume, which adds risk and downtime. Thus, Option A aligns with the Monitoring and Performance Optimization practices of AWS CloudOps by properly extending the file system to recognize the new capacity.

CloudWatch Synthetics canaries require connectivity to both CloudWatch and Amazon S3 to function correctly. In a private VPC without internet access, AWS service access must be provided through VPC endpoints.

The canary needs to send metrics, logs, and execution data to CloudWatch, which requires an interface VPC endpoint for CloudWatch. It also needs to store artifacts such as screenshots and HAR files in Amazon S3, which requires a gateway VPC endpoint for S3. Without these endpoints, the canary cannot communicate with required AWS services and will fail to start.

DNS resolution and DNS hostnames must be enabled so the canary can resolve AWS service endpoints to the private IP addresses exposed by the VPC endpoints. This is a mandatory prerequisite for PrivateLink-based service access.

Option B and C incorrectly disable DNS functionality, which breaks service endpoint resolution. Option A includes invalid or irrelevant permissions and does not address private connectivity requirements.

Therefore, enabling DNS support and creating both the CloudWatch interface endpoint and the S3 gateway endpoint is the correct and complete solution.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

To secure inbound web traffic over HTTPS when using an Application Load Balancer, AWS CloudOps best practices recommend terminating TLS at the load balancer. This is achieved by attaching an SSL/TLS certificate directly to the ALB listener. Therefore, option B is required. By terminating HTTPS at the ALB, traffic between clients and the load balancer is encrypted, and the ALB can then forward traffic to backend EC2 instances using HTTP or HTTPS based on design requirements.

The certificate used for a public-facing retail website must be trusted by internet browsers. AWS Certificate Manager (ACM) public certificates are specifically designed for this purpose and are trusted by common browsers and operating systems. Therefore, option D is required. ACM manages certificate provisioning, renewal, and deployment automatically, which significantly reduces operational overhead.

Option A is incorrect because attaching certificates to each EC2 instance is unnecessary and does not scale well. Option C is incorrect because private certificates are intended for internal use cases and are not trusted by public browsers. Option E is incorrect because ACM-managed public certificates cannot be exported; they must be attached directly to supported AWS services such as ALBs.

This approach aligns with AWS CloudOps guidance for secure, scalable, and highly available HTTPS architectures.