Free Amazon SOA-C03 Practice Test Questions

Question 1

A company hosts an FTP server on EC2 instances. AWS Security Hub sends findings to AmazonEventBridge when the FTP port becomes publicly exposed in attached security groups.A CloudOps engineer needs an automated, event-driven remediation solution to remove public access fromsecurity groups.Which solution will meet these requirements?

A : Configure the existing EventBridge event to stop the EC2 instances that have the exposed port.

B : Create a cron job for the FTP server to invoke an AWS Lambda function. Configure the Lambdafunction to modify the security group of the identified EC2 instances and to remove the instances thatallow public access.

C : Create a cron job for the FTP server that invokes an AWS Lambda function. Configure the Lambdafunction to modify the server to use SFTP instead of FTP.

D : Configure the existing EventBridge event to invoke an AWS Lambda function. Configure the functionto remove the security group rule that allows public access.

Answer: D

Question 2

Optimization]A companys architecture team must receive immediate email notifications whenever new AmazonEC2 instances are launched in the companys main AWS production account.What should a CloudOps engineer do to meet this requirement?

A : Create a user data script that sends an email message through a smart host connector. Include the architecture team's email address in the user data script as the recipient. Ensure that all new EC2 instances include the user data script as part of a standardized build process.

B : Create an Amazon Simple Notification Service (Amazon SNS) topic and a subscription that uses the email protocol. Enter the architecture team's email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched. Specify the SNS topic as the rule's target.

C : Create an Amazon Simple Queue Service (Amazon SQS) queue and a subscription that uses the email protocol. Enter the architecture team's email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched. Specify the SQS queue as the rule's target.

D : Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure AWS Systems Manager to publish EC2 events to the SNS topic. Create an AWS Lambda function to poll the SNS topic. Configure the Lambda function to send any messages to the architecture team's email address.

Answer: B

Question 3

A company runs an application on Amazon EC2 that connects to an Amazon Aurora PostgreSQLdatabase. A developer accidentally drops a table from the database, causing application errors. Twohours later, a CloudOps engineer needs to recover the data and make the application functionalagain.Which solution will meet this requirement?

A : Use the Aurora Backtrack feature to rewind the database to a specified time, 2 hours in the past.

B : Perform a point-in-time recovery on the existing database to restore the database to a specified point in time, 2 hours in the past.

C : Perform a point-in-time recovery and create a new database to restore the database to a specified point in time, 2 hours in the past. Reconfigure the application to use a new database endpoint.

D : Create a new Aurora cluster. Choose the Restore data from S3 bucket option. Choose log files up to the failure time 2 hours in the past.

Answer: C

Question 4

A medical research company uses an Amazon Bedrock powered AI assistant with agents andknowledge bases to provide physicians quick access to medical study protocols. The company needsto generate audit reports that contain user identities, usage data for Bedrock agents, access data forknowledge bases, and interaction parameters.Which solution will meet these requirements?

A : Use AWS CloudTrail to log API events from generative AI workloads. Store the events in CloudTrail Lake. Use SQL-like queries to generate reports.

B : Use Amazon CloudWatch to capture generative AI application logs. Stream the logs to Amazon OpenSearch Service. Use an OpenSearch dashboard visualization to generate reports.

C : Use Amazon CloudWatch to log API events from generative AI workloads. Send the events to an Amazon S3 bucket. Use Amazon Athena queries to generate reports.

D : Use AWS CloudTrail to capture generative AI application logs. Stream the logs to Amazon Managed Service for Apache Flink. Use SQL queries to generate reports.

Answer: A

Question 5

A company that uses AWS Organizations recently implemented AWS Control Tower. The company nowneeds to centralize identity management. A CloudOps engineer must federate AWS IAM Identity Center withan external SAML 2.0 identity provider (IdP) to centrally manage access to all AWS accounts and cloudapplications.Which prerequisites must the CloudOps engineer have so that the CloudOps engineer can connect to theexternal IdP? (Select TWO.)

A : A copy of the IAM Identity Center SAML metadata

B : The IdP metadata, including the public X.509 certificate

C : The IP address of the IdP

D : Root access to the management account

E : Administrative permissions to the member accounts of the organization

Answer: A,B

Free Amazon SOA-C03 Exam Practice Questions 2026