Practice Exam SOA-C03: AWS Certified CloudOps Engineer – Associate (ex-SysOps)

Question bank: 115 · timed mock exam: 130 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Exam guide: format, domains and how to prepare

Compare: SAA-C03 vs SOA-C03

  • Monitoring, Logging, Analysis, Remediation, and Performance Optimization 25 questions
  • Reliability and Business Continuity 25 questions
  • Deployment, Provisioning, and Automation 25 questions
  • Security and Compliance 20 questions
  • Networking and Content Delivery 20 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 115 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for AWS Certified CloudOps Engineer – Associate (ex-SysOps) with InfraPrep

The 115 questions cover 5 domains: Monitoring, Logging, Analysis, Remediation, and Performance Optimization, Reliability and Business Continuity, Deployment, Provisioning, and Automation, Security and Compliance, Networking and Content Delivery. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 130 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Monitoring, Logging, Analysis, Remediation, and Performance Optimization

A CloudOps engineer built two composite alarms, AlarmA and AlarmB, where AlarmA's AlarmRule references the state of AlarmB and AlarmB's AlarmRule references the state of AlarmA. The engineer now wants to remove both alarms, but the console refuses the deletion because each alarm still depends on the other. What is the simplest way to unblock the deletion?

  1. Open a support case and ask AWS to force-delete both composite alarms
  2. Change one alarm's AlarmRule expression to a fixed value such as false
  3. Convert both composite alarms into simple metric alarms first
  4. Suspend both alarms' actions and wait a full day before retrying
Show the answer and the explanation

Correct answer: B

When two composite alarms reference each other, AWS documents that the easiest way to break this cyclic dependency is to change the AlarmRule of one of them to a fixed value such as false, which removes the reference and allows both alarms to be deleted.

Source: official documentation

Question 2 Reliability and Business Continuity

A CloudOps engineer wants an EC2 Auto Scaling group to automatically add or remove instances so that average CPU utilization stays close to a single target value, without the engineer having to define specific step thresholds. Which scaling policy type fits this requirement?

  1. Manual scaling
  2. Scheduled scaling
  3. Predictive scaling only, with target tracking disabled
  4. Target tracking scaling policy
Show the answer and the explanation

Correct answer: D

A target tracking scaling policy automatically scales the capacity of an Auto Scaling group based on a single target metric value, which matches the requirement of keeping utilization near one target without manually defined step thresholds.

Source: official documentation

Question 3 Deployment, Provisioning, and Automation

A platform team needs to create, update, and delete the same CloudFormation template across dozens of AWS accounts and multiple Regions, ideally with a single operation instead of running the template separately in each account and Region. Which CloudFormation capability is designed for this?

  1. Drift detection
  2. CloudFormation StackSets
  3. A stack policy
  4. A single stack with nested stacks
Show the answer and the explanation

Correct answer: B

CloudFormation StackSets extends the capability of stacks by allowing you to create, update, or delete stacks across multiple accounts and AWS Regions with a single operation, which is exactly the multi-account, multi-Region deployment described.

Source: official documentation

Question 4 Security and Compliance

An IAM administrator has a virtual MFA device that is not yet assigned to any user, and needs to attach it to an existing IAM user through the AWS CLI. What does the administrator need in order to complete this attachment?

  1. Nothing beyond the device serial number; no authentication code is required
  2. A support case, because virtual MFA devices cannot be attached through the CLI
  3. The IAM user's console password reset first
  4. The authentication code generated by the device, used with the enable-mfa-device CLI command or API call
Show the answer and the explanation

Correct answer: D

AWS documents that to attach an unassigned virtual MFA device to a root user or IAM user, you need the authentication code generated by the device, together with either the enable-mfa-device CLI command or the equivalent API call.

Source: official documentation

Question 5 Networking and Content Delivery

A CloudOps engineer wants applications inside a VPC to reach Amazon S3 without traversing the internet gateway or a NAT gateway, and wants to avoid the cost and management of AWS PrivateLink for this specific case. Which type of VPC endpoint fits this requirement?

  1. A gateway endpoint, which sends traffic to S3 or DynamoDB and does not use AWS PrivateLink
  2. An interface endpoint using AWS PrivateLink
  3. An internet gateway restricted by a security group
  4. A NAT gateway configured with a route to S3 only
Show the answer and the explanation

Correct answer: A

AWS documents gateway endpoints as a distinct VPC endpoint type that sends traffic to Amazon S3 or DynamoDB, and explicitly states that gateway endpoints do not use AWS PrivateLink, unlike the other VPC endpoint types.

Source: official documentation

Question 6 Monitoring, Logging, Analysis, Remediation, and Performance Optimization

A CloudOps engineer notices that the default EC2 console metrics for a fleet of instances do not include memory usage or disk-space usage from inside the operating system. Which action lets the engineer collect these in-guest metrics in CloudWatch?

  1. Create a CloudWatch composite alarm on the existing EC2 metrics
  2. Enable detailed monitoring on the EC2 instances
  3. Create a CloudTrail trail that logs EC2 API calls
  4. Install and configure the CloudWatch agent on the EC2 instances
Show the answer and the explanation

Correct answer: D

The CloudWatch agent is the component documented to collect internal system-level metrics, including in-guest metrics, from EC2 instances, on top of the metrics that AWS already publishes for the instances.

Source: official documentation

Question 7 Reliability and Business Continuity

A read-heavy reporting workload is pushing a single RDS DB instance beyond its compute and I/O capacity, even though write volume is low. A CloudOps engineer wants to scale out read capacity without changing the primary instance's write path. Which approach directly addresses this?

  1. Deploy one or more read replicas for the reporting queries
  2. Enable automated backups with a longer retention period
  3. Enable a Multi-AZ synchronous standby for the primary instance
  4. Increase the allocated storage size of the primary instance
Show the answer and the explanation

Correct answer: A

AWS documents read replicas as the way to scale beyond the compute or I/O capacity of a single DB instance for read-heavy workloads, by directing the excess read traffic to one or more replicas.

Source: official documentation

Question 8 Deployment, Provisioning, and Automation

An update to a CloudFormation stack fails, the automatic rollback also fails, and the stack becomes stuck in the UPDATE_ROLLBACK_FAILED state because one resource can't return to its original configuration. What does AWS document as the way to recover the stack so it can be updated again?

  1. Wait for CloudFormation to automatically retry the rollback after 24 hours
  2. Manually fix the underlying error for the resource that can't roll back, then continue the rollback to return the stack to UPDATE_ROLLBACK_COMPLETE
  3. Delete the stack immediately and recreate it from scratch
  4. Disable termination protection and rerun the same update
Show the answer and the explanation

Correct answer: B

AWS documents that when a dependent resource can't return to its original state and the stack enters UPDATE_ROLLBACK_FAILED, you can manually fix the error and continue the rollback, which returns the stack to the working UPDATE_ROLLBACK_COMPLETE state so you can try the update again.

Source: official documentation

Question 9 Security and Compliance

Before rolling out a new IAM policy to production, a CloudOps engineer wants to test what a set of identity-based policies, permission boundaries, SCPs, and resource-based policies would actually allow or deny for a given principal, without touching the live environment. Which tool is documented for this purpose, and what caveat does AWS give about trusting its output alone?

  1. CloudTrail Insights, which predicts future permission changes
  2. AWS Config; its results are always identical to the live environment
  3. IAM Access Analyzer, which enforces policies directly in production during the test
  4. The IAM policy simulator; but its results can differ from the live AWS environment, so live testing is still recommended
Show the answer and the explanation

Correct answer: D

The IAM policy simulator is documented as the tool to test identity-based policies, permissions boundaries, SCPs, and resource-based policies, but AWS explicitly warns that its results can differ from the live AWS environment, recommending a check against the live environment afterward.

Source: official documentation

Question 10 Networking and Content Delivery

Two teams in different AWS accounts want their VPCs to communicate privately, without their traffic crossing the public internet, and without deploying a VPN gateway or any additional physical hardware. Which VPC networking feature is documented to meet this requirement?

  1. A NAT gateway shared between the two VPCs
  2. A VPC peering connection between the two VPCs
  3. A Site-to-Site VPN connection between the two VPCs
  4. An internet gateway shared between the two VPCs
Show the answer and the explanation

Correct answer: B

VPC peering is documented as using the existing VPC infrastructure to connect two VPCs, across accounts or Regions, without requiring a gateway, an AWS Site-to-Site VPN, or any additional physical hardware.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.