Free Preparation Discussions
MENU
Amazon SOA-C03 Exam Questions
- Amazon Associate Certifications
- Amazon AWS Certified SysOps Administrator Associate SysOps Associate Certifications
Free Amazon SOA-C03 Exam Actual Questions
Note: Premium Questions for SOA-C03 were last updated On May. 31, 2026 (see below)
A company runs an application on Amazon EC2 that connects to an Amazon Aurora PostgreSQL database. A developer accidentally drops a table from the database, causing application errors. Two hours later, a CloudOps engineer needs to recover the data and make the application functional again.
Which solution will meet this requirement?
In the AWS Cloud Operations and Aurora documentation, when data loss occurs due to human error such as dropped tables, Point-in-Time Recovery (PITR) is the recommended method for restoration. PITR creates a new Aurora cluster restored to a specific time before the failure.
The restored cluster has a new endpoint that must be reconfigured in the application to resume normal operations. AWS does not support performing PITR directly on an existing production database because that would overwrite current data.
Aurora Backtrack (Option A) applies only to Aurora MySQL, not PostgreSQL. Option B is incorrect because PITR cannot be executed in place. Option D refers to an import process from S3, which is unrelated to time-based recovery.
Hence, Option C is correct and follows the AWS CloudOps standard recovery pattern for PostgreSQL workloads.
A company applies user-defined tags to AWS resources. Twenty days after applying the tags, the company notices that the tags cannot be used to filter views in the AWS Cost Explorer console.
What is the reason for this issue?
User-defined tags must be explicitly activated as cost allocation tags in the AWS Billing and Cost Management console before they can be used in Cost Explorer. Simply applying tags to resources is not sufficient.
Once activated, cost allocation tags can take up to 24 hours to appear in Cost Explorer, but they will not appear at all if activation is not performed. The 30-day delay applies only to historical reporting after activation, not to visibility itself.
Cost and Usage Reports and Budgets are not prerequisites for Cost Explorer filtering.
Therefore, the issue occurs because the tags were not activated for cost allocation.
A CloudOps engineer launches an Amazon EC2 Linux instance in a public subnet. When the instance is running, the CloudOps engineer obtains the public IP address and attempts to remotely connect to the instance multiple times. However, the CloudOps engineer always receives a timeout error.
Which action will allow the CloudOps engineer to remotely connect to the instance?
SSH access to a Linux EC2 instance requires inbound TCP port 22 to be allowed by the instance's security group from the administrator's source IP address. A timeout usually indicates that network traffic is being blocked before the SSH service can respond. Since the instance is in a public subnet and has a public IP address, the most likely missing control is an inbound security group rule. Security groups are stateful, so return traffic is automatically allowed after inbound SSH is permitted. Adding a route for the engineer's IP address is not needed because public subnets use a default route to the internet gateway. An outbound-only NACL or security group rule does not allow inbound SSH initiation. Therefore, the correct remediation is to allow inbound SSH from the engineer's public IP.
Optimization]
A company uses an Amazon Simple Queue Service (Amazon SQS) queue and Amazon EC2 instances in an Auto Scaling group with target tracking for a web application. The company collects the ASGAverageNetworkIn metric but notices that instances do not scale fast enough during peak traffic. There are a large number of SQS messages accumulating in the queue.
A CloudOps engineer must reduce the number of SQS messages during peak periods.
Which solution will meet this requirement?
According to the AWS Cloud Operations and Auto Scaling documentation, scaling applications that consume Amazon SQS messages should be driven by queue backlog per instance, not by general system metrics such as network traffic or CPU.
The correct approach is to calculate a custom metric using CloudWatch metric math that divides the SQS metric ApproximateNumberOfMessagesVisible by the number of active EC2 instances in the Auto Scaling group. This ''backlog per instance'' value represents the average number of messages waiting to be processed by each instance.
Then, the CloudOps engineer can create a target tracking policy that automatically scales out or in based on maintaining a desired backlog threshold. This approach ensures dynamic, workload-driven scaling behavior that reacts in near real time to message volume.
Step and simple scaling (Options C and D) require manual thresholds and do not automatically balance the load per instance.
Thus, Option B---using CloudWatch metric math to define queue backlog per instance for target tracking---is the most effective and AWS-recommended CloudOps practice.
A SysOps administrator needs to implement a solution that protects credentials for an Amazon RDS for MySQL DB instance. The solution must rotate the credentials automatically one time every week.
Which combination of steps will meet these requirements? (Select TWO.)
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The correct answers are B and D. AWS CloudOps documentation clearly states that AWS Secrets Manager is the recommended service for storing and managing database credentials securely. Secrets Manager integrates natively with Amazon RDS and supports automatic, scheduled secret rotation.
To rotate credentials weekly, Secrets Manager requires a Lambda rotation function. AWS provides managed rotation templates for Amazon RDS for MySQL that update the database password and the stored secret atomically. This combination ensures credentials are protected, rotated automatically, and audited with minimal operational effort.
Option A is incorrect because RDS Proxy does not store or rotate credentials; it only retrieves them from Secrets Manager. Option C is incorrect because Systems Manager Parameter Store does not support native automatic rotation. Option E is incorrect because Automation runbooks are not the recommended mechanism for secrets rotation and add unnecessary complexity.
AWS CloudOps best practices strongly recommend Secrets Manager with Lambda-based rotation for database credential protection and compliance.
AWS Secrets Manager User Guide -- Automatic Rotation
Amazon RDS User Guide -- Credential Management
AWS SysOps Administrator Study Guide -- Secrets and Key Management
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Richard Gonzalez
2 days agoDaniel Edwards
8 days agoDonna Wilson
10 days agoCharles Nguyen
10 days agoAnthony Green
10 days agoAndrew Jackson
10 days agoCrystal Young
10 days agoGary Campbell
10 days agoCharles Green
21 days agoHeather Taylor
27 days agoAmanda Perez
1 month agoMelissa Hernandez
1 month agoStephen Anderson
1 month agoMichelle Stewart
22 days agoEric Wilson
17 days agoPaul Anderson
16 days agoBrenda Baker
1 month agoJohnna
2 months agoJoseph
2 months agoBeckie
2 months agoWilliam
3 months agoPrecious
3 months agoLetha
3 months agoFatima
3 months agoMozell
4 months agoEvette
4 months agoDell
4 months agoDesmond
4 months agoGiovanna
5 months agoFredric
5 months agoRozella
5 months agoCordell
5 months agoTammara
6 months agoGlory
6 months agoLatanya
6 months agoVerdell
6 months agoDean
7 months agoAugustine
7 months agoSommer
7 months agoSalome
7 months ago