10 beginner questions on all five SOA-C03 domains: monitoring and performance (CloudWatch agent, detailed monitoring), Reliability and Business Continuity (target tracking scaling, AWS Backup), Deployment, Provisioning, and Automation (Run Command, EC2 Image Builder), Security and Compliance (CloudTrail, Secrets Manager rotation) and Networking and Content Delivery (internet access, Route 53 failover).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. An administrator needs memory utilization and free disk space metrics for EC2 instances in Amazon CloudWatch. These metrics do not appear by default. What should the administrator do?

    • A. Turn on detailed monitoring for the instances
    • B. Install and configure the CloudWatch agent on the instances ✔ correct
    • C. Turn on VPC Flow Logs for the instances' subnets
    • D. Create an AWS CloudTrail trail for data events

    Answer: B. The CloudWatch agent collects system-level metrics from inside the operating system, such as memory and disk usage, plus logs. Detailed monitoring only sends the default EC2 metrics more often.

    Source: docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/metrics-collected-by-Clou · Domain: Monitoring, Logging, Analysis, Remediation, and Performance Optimization

  2. With basic monitoring, most Amazon EC2 metrics arrive in 5-minute periods; turning on detailed monitoring makes them available in 1-minute periods.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Basic monitoring is free and sends most metrics every 5 minutes (status checks every minute). Detailed monitoring is charged and provides 1-minute metrics for faster alarms and scaling.

    Source: docs.aws.amazon.com/AWSEC2/latest/UserGuide/manage-detailed-monitoring.html · Domain: Monitoring, Logging, Analysis, Remediation, and Performance Optimization

  3. A team wants its Auto Scaling group to add and remove instances automatically so that average CPU utilization stays close to 50%. Which scaling option fits?

    • A. A scheduled action at 09:00 each day
    • B. A manual change to the desired capacity
    • C. A target tracking scaling policy ✔ correct
    • D. A lifecycle hook on instance launch

    Answer: C. A target tracking policy keeps a metric, such as average CPU utilization, near a target value and adjusts capacity automatically. Scheduled actions change capacity at fixed times, whatever the load.

    Source: docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html · Domain: Reliability and Business Continuity

  4. A company wants one central place to schedule backups of its EBS volumes, RDS databases and DynamoDB tables, with retention rules. Which service should a CloudOps engineer use?

    • A. AWS Backup ✔ correct
    • B. Amazon Data Lifecycle Manager
    • C. S3 Lifecycle configuration
    • D. AWS Elastic Disaster Recovery

    Answer: A. AWS Backup centralizes and automates backups across services, including EBS, RDS, DynamoDB, EFS and S3, using backup plans with schedules and retention. Data Lifecycle Manager covers only EBS snapshots and AMIs.

    Source: docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html · Domain: Reliability and Business Continuity

  5. An EC2 instance in a VPC must be reachable from the internet over IPv4. Which two things does it need? (Select TWO)

    • A. A route to an internet gateway in its subnet's route table ✔ correct
    • B. An egress-only internet gateway attached to the VPC
    • C. A public IPv4 address or an Elastic IP address ✔ correct
    • D. A VPC peering connection to another VPC
    • E. A gateway VPC endpoint for Amazon S3

    Answer: A, C. Internet access needs an internet gateway attached to the VPC, a subnet route to it, and a public IPv4 or Elastic IP address on the instance (plus allowing security rules). Egress-only gateways are for IPv6 outbound only.

    Source: docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html · Domain: Networking and Content Delivery

  6. An administrator must run the same shell script on 200 managed EC2 instances at once, without opening SSH or signing in to each instance. Which AWS Systems Manager capability should be used?

    • A. Parameter Store
    • B. Inventory
    • C. Run Command ✔ correct
    • D. Explorer

    Answer: C. Run Command lets you remotely and securely manage managed nodes, running commands or scripts on many of them at scale without signing in to each one. Parameter Store stores configuration data; Inventory collects metadata.

    Source: docs.aws.amazon.com/systems-manager/latest/userguide/run-command.html · Domain: Deployment, Provisioning, and Automation

  7. A company wants an automated pipeline that builds, tests and distributes patched, hardened AMIs every month. Which service fits best?

    • A. AWS Backup
    • B. Amazon Inspector
    • C. AWS Elastic Beanstalk
    • D. EC2 Image Builder ✔ correct

    Answer: D. EC2 Image Builder automates creating, testing and distributing up-to-date virtual machine and container images on a schedule. Inspector can scan images for vulnerabilities but does not build them.

    Source: docs.aws.amazon.com/imagebuilder/latest/userguide/what-is-image-builder.html · Domain: Deployment, Provisioning, and Automation

  8. An S3 bucket was deleted yesterday and the team must find out which IAM identity made the request. Where should the administrator look first?

    • A. VPC Flow Logs for the account's VPCs
    • B. AWS CloudTrail event history ✔ correct
    • C. Amazon S3 Storage Lens dashboards
    • D. Amazon Inspector findings

    Answer: B. CloudTrail records management events such as DeleteBucket, including who made the call, when and from where; event history shows the last 90 days. Flow Logs show IP traffic, not API identities.

    Source: docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html · Domain: Security and Compliance

  9. A company stores database credentials for its applications and must rotate them automatically on a schedule. Which service is designed for this?

    • A. AWS Key Management Service
    • B. AWS Certificate Manager
    • C. AWS Secrets Manager ✔ correct
    • D. IAM Access Analyzer

    Answer: C. Secrets Manager stores secrets and can rotate them automatically on a schedule, updating both the secret and the database credentials. AWS KMS rotates encryption key material, not database passwords.

    Source: docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html · Domain: Security and Compliance

  10. A website should send users to a backup site only when Amazon Route 53 health checks show that the primary site is unhealthy. Which routing policy should be used?

    • A. Failover routing ✔ correct
    • B. Weighted routing
    • C. Geolocation routing
    • D. Simple routing

    Answer: A. Failover routing sends traffic to the primary resource while it is healthy and to the secondary resource when its health check fails. Weighted routing splits traffic by ratio, whatever the health state.

    Source: docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy-failover.html · Domain: Networking and Content Delivery

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public AWS exam objectives (SOA-C03 exam guide version 1.1 (2026-06-01)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by AWS; exam names are trademarks of their owners. Official exam page: aws.amazon.com/certification/certified-cloudops-engineer-associate/.

Last modified: Sunday, 25 October 2026, 9:57 PM