Free AWS Certified CloudOps Engineer - Associate (SOA-C03) Sample Questions

Correct answers: A, B — Attach the `CloudWatchAgentServerPolicy` managed policy to the instance's IAM role so the agent can publish metrics and logs to CloudWatch.; Attach the `AmazonSSMManagedInstanceCore` managed policy to the same role so the instance can communicate with Systems Manager and retrieve stored parameters.

• A. Attaching `CloudWatchAgentServerPolicy` is correct because it grants exactly the permissions the agent needs to publish metrics and logs to CloudWatch from the instance.
• B. Attaching `AmazonSSMManagedInstanceCore` is correct because it lets the instance register with Systems Manager and read its stored configuration parameter from Parameter Store.
• C. Granting full `AdministratorAccess` is incorrect because it far exceeds the least-privilege permissions the agent needs and is not a requirement for the agent to start.
• D. Embedding a long-term access key is incorrect because instance roles do supply temporary credentials to the agent automatically, making a hardcoded key both unnecessary and a security risk.
• E. Skipping the IAM role is incorrect because the CloudWatch agent authenticates using AWS SDK credentials from the instance role, not the instance's public IP address.
• F. Sharing an IAM user's console password is incorrect because the agent uses programmatic credentials from an attached role, not interactive console login credentials.

Correct answer: A — Configure the alarm's "datapoints to alarm" setting to 3 out of an evaluation period count of 5, enabling M-out-of-N evaluation instead of requiring every period to breach.

• A. Setting "datapoints to alarm" to 3 out of 5 evaluation periods is correct because this is the native M-out-of-N feature that lets an alarm require only a subset of recent periods to breach before entering ALARM.
• B. Just setting a period and evaluation-period count is incorrect because those values alone define the total lookback window, not the fraction of periods within it that must breach before alarming.
• C. Building five separate alarms with a custom counting Lambda is incorrect because it recreates, with far more complexity, functionality that the native datapoints-to-alarm setting already provides directly.
• D. Enabling anomaly detection is incorrect because anomaly detection bands flag statistically unusual behavior relative to historical patterns; they are not the mechanism for configuring an M-out-of-N breach requirement.

Correct answer: A — CloudWatch does not validate that an action target exists when an alarm is created, so an alarm with a nonexistent SNS topic ARN saves successfully but never delivers a notification.

• A. This is correct because CloudWatch explicitly does not test or validate that alarm action targets, such as an SNS topic ARN, actually exist, so a save succeeds while notifications for that action silently fail to deliver.
• B. This is incorrect because CloudWatch does not perform this kind of existence validation at save time, which is precisely why the mistyped, nonexistent ARN was accepted in the first place.
• C. This is incorrect because CloudWatch has no behavior that auto-creates a placeholder SNS topic to match a misconfigured action; a nonexistent target simply results in a failed delivery attempt.
• D. This is incorrect because CloudWatch has no fallback mechanism that redirects failed alarm action deliveries to a root account email address.

Correct answers: A, B — Migrate the low-activity, tagged archive volumes from their current SSD type to sc1 Cold HDD, which is priced for exactly this infrequently accessed access pattern.; Identify and delete the unattached leftover volumes after confirming with tags that they are no longer needed, since unattached volumes still incur storage charges.

• A. sc1 is priced for infrequently accessed, throughput-oriented data and is far cheaper per gigabyte than SSD tiers, so moving genuinely idle archive volumes there directly reduces their ongoing storage cost while keeping them attachable.
• B. EBS volumes continue to incur storage charges whether or not they are attached to a running instance, so removing confirmed-unneeded leftover volumes stops unnecessary spend.
• C. Detaching a volume from an instance does not stop its billing; EBS charges for provisioned storage regardless of attachment state, so leaving unattached volumes in place keeps accruing cost.
• D. io2 Block Express is priced for the highest sustained IOPS and lowest latency tier and costs more than general-purpose or HDD types; it is not a cost-efficient choice for rarely accessed archive data.
• E. EBS Multi-Attach lets multiple Nitro instances share one io1/io2 volume concurrently for clustering use cases; it has no effect on the per-gigabyte storage price and does not apply to sc1 volumes at all.

Correct answers: A, B — Create an S3 Lifecycle rule that transitions objects from S3 Standard to S3 Standard-IA after 30 days, matching the drop-off in access frequency.; Add a second lifecycle transition rule that moves objects from S3 Standard-IA to S3 Glacier Deep Archive after 120 days, ahead of the 7-year retention window.

• A. Transitioning to Standard-IA after the 30-day period of frequent access matches the described drop-off in access and reduces storage cost for objects that are only occasionally read afterward.
• B. Moving to Glacier Deep Archive at day 120 (after the 30-day plus 90-day active-and-occasional window) fits data that must be retained for years but is almost never retrieved, minimizing long-term storage cost automatically.
• C. A manual monthly process requires ongoing engineer effort and human judgment, which is exactly what the team wants to avoid by asking for an automatic, hands-off solution.
• D. Keeping all data in S3 Standard for 7 years guarantees fast retrieval but is the most expensive option and ignores the described access pattern entirely, defeating the cost-minimization goal.
• E. Versioning preserves prior object versions when objects are overwritten or deleted; it does not move current data between storage classes on its own and must be paired with a lifecycle rule to do so.

Correct answer: A — Amazon EFS using Elastic throughput mode, which automatically scales throughput up or down with workload activity and supports concurrent multi-instance NFS access.

• A. EFS is a managed, elastic NFS file system built for exactly this pattern: many instances across a Region can mount it concurrently with standard file locking, and Elastic throughput mode is designed for unpredictable, spiky performance needs without manual provisioning.
• B. EBS Multi-Attach lets multiple Nitro instances attach the same io1/io2 volume, but it does not provide a file system or coordinate POSIX file locking between instances; the instances would need their own cluster-aware file system layered on top.
• C. S3 is an object store, not a POSIX file system; third-party FUSE drivers can approximate file access but do not provide true POSIX file locking or the concurrent read/write semantics this rendering workload needs.
• D. FSx for Windows File Server uses the SMB protocol and is designed for Windows-based workloads; it is not the natural fit for a fleet of Linux instances that need standard NFS file-locking semantics.

Correct answer: A — A composite alarm with a rule expression that requires both underlying alarms to be in ALARM state before it changes state

• A. Composite alarms evaluate the alarm states of other alarms using a rule expression such as AND, so the composite only enters ALARM when every referenced alarm is also in ALARM, which is exactly the noise-reduction behavior described.
• B. Averaging a percentage metric with a binary pass/fail status check metric produces a meaningless blended value and cannot represent the logical AND of two independent alarm states.
• C. Matching on either alarm's event is a logical OR, so a page would still fire on a single alarm going into ALARM state, which does not achieve the requirement.
• D. Dashboards only visualize data and never evaluate conditions or send notifications, so this cannot replace an automated combined alarm.

Correct answers: A, B — The event pattern JSON does not match the structure of the incoming events, so EventBridge quietly skips routing them to the target; The Lambda function's resource-based policy does not grant the events.amazonaws.com principal permission to invoke the function

• A. If the pattern's field values or structure do not align with the actual event content, EventBridge silently does not match the event, so the target is never invoked even though the source events exist.
• B. EventBridge needs an explicit invoke permission on the Lambda function's resource policy; without it, delivery to the target fails even when the rule matches, which is a common misconfiguration.
• C. Missing logging permissions would prevent the function from writing log output, but it does not prevent EventBridge from invoking the function in the first place, so this would not explain zero invocations.
• D. Rules and their targets are created within the same standard partition as the account by default, and cross-partition rule creation is not a realistic misconfiguration for this scenario.
• E. A positive reserved concurrency value simply guarantees capacity for the function; it does not block invocations, so this would not cause the function to never be invoked.

Correct answers: A, B — Create a CloudWatch Logs metric filter that increments a custom metric each time the error string appears in the log group; Create a CloudWatch alarm on that metric that invokes the Lambda function through an SNS topic once the threshold is breached

• A. A metric filter scans incoming log events for a pattern and increments a custom metric whenever it finds a match, turning an unstructured log string into a numeric CloudWatch metric that can be alarmed on.
• B. Once the filter produces a metric, a CloudWatch alarm on that metric can invoke the Lambda function through an SNS topic as soon as the threshold is breached, closing the loop from log event to remediation within minutes.
• C. CloudTrail data events record data-plane API activity such as object-level S3 access; they do not scan or capture application log line content, so this does not help detect the error string.
• D. A daily Config rule evaluation runs far too infrequently to trigger remediation within minutes of the error occurring, and Config rules evaluate resource configuration rather than log content.
• E. VPC Flow Logs capture network traffic metadata such as source, destination, and port; they do not contain application log content and cannot be used to detect an error string in the logs.

Correct answer: A — Lower the health check interval to 10 seconds and keep the unhealthy threshold at 2 consecutive failed checks before marking the target out of service.

• A. Shortening the interval means each consecutive failure is detected sooner, so two consecutive failures at 10-second spacing are confirmed in roughly 20 seconds instead of 60, cutting detection time without removing the requirement for repeated failures.
• B. A TCP check only verifies the port accepts a connection; it would not detect application-layer 500 responses at all, so unhealthy instances serving errors could remain in service indefinitely.
• C. Lengthening the timeout gives a struggling target more time to respond before a check counts as failed, which slows detection of a genuinely broken instance rather than speeding it up.
• D. Requiring five consecutive failures before removal extends the time an error-returning instance stays in rotation, worsening the exact symptom the engineer is trying to fix.

Correct answer: A — Increase the target group's deregistration delay so the load balancer stops sending new requests to the target but keeps existing connections open long enough to finish.

• A. Deregistration delay (connection draining) controls how long a target that is being deregistered continues to complete existing in-flight requests before the connection is forcibly closed, which is exactly the gap causing dropped checkouts here.
• B. The unhealthy threshold governs how many failed health checks are needed before a target is flagged unhealthy; it does not affect what happens to in-flight requests during a planned deregistration triggered by scale-in.
• C. The scaling cooldown period only delays additional scaling actions after one completes; it has no effect on whether an already-terminating instance finishes requests already in progress.
• D. Idle timeout closes connections that have been inactive for too long; it does not keep a deregistering target reachable for active requests, so it would not prevent the described drops.

Correct answer: A — Deploy one NAT gateway per Availability Zone, each in its own public subnet, and route each private subnet's outbound traffic through the NAT gateway in the same zone.

• A. A NAT gateway is a zonal resource, so the resilient pattern is one NAT gateway per Availability Zone with each private subnet's route table pointing at the NAT gateway in its own zone, ensuring a single zone's failure only affects that zone's outbound traffic.
• B. A NAT instance is a single EC2 instance in one Availability Zone regardless of its size, so it does not gain cross-zone resilience and would still be a single point of failure for that zone.
• C. Cross-zone load balancing is a setting on Elastic Load Balancing target distribution; it has no meaning for a NAT gateway, which is inherently scoped to a single Availability Zone.
• D. Attaching an internet gateway directly to a private subnet would expose its instances to inbound internet traffic and remove the private subnet's isolation, which is the opposite of the intended design and not how internet gateways are used with private subnets.

Correct answer: A — Create one or more RDS read replicas and point the reporting dashboard at a replica instead of at the primary DB instance directly.

• A. A read replica is a read-only copy kept in sync asynchronously, and directing reporting queries at it offloads that read load from the primary without touching the write path.
• B. A Multi-AZ standby exists for failover and does not accept application read traffic, so redirecting reporting queries there is not a valid way to offload reads.
• C. Storage autoscaling increases available disk space when free space runs low, but it has no effect on query throughput or the read contention described here.
• D. DynamoDB auto scaling is a DynamoDB-specific Application Auto Scaling integration and does not apply to relational RDS engines like PostgreSQL.

Correct answer: A — The target utilization can be set to any value between 20 and 90 percent of the provisioned read or write capacity.

• A. DynamoDB auto scaling accepts a target utilization value between 20 and 90 percent, which bounds how aggressively the target-tracking policy reacts to changing capacity consumption.
• B. The valid range tops out at 90 percent, not 100, and the lower bound is 20 percent rather than 50, so this range does not match the actual configurable boundaries.
• C. 70 percent is a commonly used example target in AWS documentation, but it is a configurable value the customer chooses, not a value DynamoDB fixes automatically.
• D. DynamoDB enforces both a floor of 20 percent and a ceiling of 90 percent on target utilization, so an unbounded 0 to 100 percent range is not accurate.

Correct answer: A — Point-in-time restore, because RDS uploads transaction logs to Amazon S3 every five minutes, allowing a restore to any point within the backup retention window.

• A. Automated backups combined with transaction logs uploaded to Amazon S3 roughly every five minutes let RDS reconstruct the database up to a very recent point, which is exactly the five-minute recovery point objective the compliance requirement describes.
• B. A daily automated snapshot alone only represents the database state at the time that snapshot was taken, so relying on it without transaction log replay could lose up to a full day of committed transactions rather than five minutes.
• C. A manual snapshot only captures the database at the moment it was created; unless one happened to be taken within five minutes of the failure, it cannot guarantee the required recovery point, and manual snapshots are not created automatically on that cadence.
• D. A Multi-AZ standby protects against instance or Availability Zone failure through synchronous replication, but it is a high-availability mechanism, not a restore method, and it does not help recover from logical data corruption that has already replicated to the standby.

Correct answer: A — Add the FSx for Windows File Server file system as a resource in an AWS Backup plan, since AWS Backup natively supports scheduled backups and restores for that FSx deployment type.

• A. AWS Backup includes native, first-class support for Amazon FSx for Windows File Server, so adding the file system as a resource in a backup plan provides scheduled, automated backups and a supported restore-to-new-file-system workflow without custom scripting.
• B. Using guest-level Volume Shadow Copy Service and manually shipping the results to S3 reintroduces custom scripting and operational overhead that AWS Backup's native FSx integration is designed to eliminate.
• C. FSx File Gateway is a mechanism for on-premises access to Amazon FSx, not a Region-to-Region backup or replication feature for an existing FSx for Windows File Server deployment.
• D. FSx for Windows File Server does support built-in daily automatic backups, but they are retained for a limited period rather than indefinitely, and they still benefit from being centrally scheduled and managed through AWS Backup for consistency with other resources.

Correct answers: A, B — Use AWS Backup's cross-account management within AWS Organizations to apply a single backup policy that enforces the schedule across every member account automatically.; Apply AWS Backup Vault Lock in compliance mode on the backup vaults so retention periods cannot be shortened or backups deleted early, even by the root user.

• A. AWS Backup's cross-account management feature, built on AWS Organizations, lets an administrator define one backup policy that automatically applies consistent scheduling to DynamoDB, RDS, and other supported resources across every member account, which is exactly the consistent, org-wide enforcement being asked for.
• B. Backup Vault Lock in compliance mode makes a vault's retention settings immutable and prevents recovery points from being deleted before their retention period expires, even by an account's own administrators, which satisfies the requirement that backups cannot be deleted early.
• C. Manual, console-driven snapshot scheduling by each account administrator depends on individual follow-through rather than an enforced policy, so it does not guarantee a consistent schedule across every account the way an organization-wide backup policy does.
• D. Choosing a storage class for long-term retention addresses cost, not whether a consistent backup schedule is enforced across accounts or whether early deletion is prevented.
• E. Email reminders about missed backups are a monitoring aid after the fact; they do not enforce that backups are actually taken on schedule or block early deletion the way a policy and vault lock do.

Correct answer: A — A pattern matching the CodePipeline state-change source and detail type, with `detail.state` set to `FAILED` and a filter on the pipeline name for production.

• A. EventBridge event patterns can match specific fields within the event detail, so filtering on the pipeline state-change source, the `FAILED` value for `detail.state`, and a production-specific identifier such as pipeline name or tag ensures the rule only matches the exact failures the team cares about.
• B. Matching only the source without detail-level filtering would invoke the state machine for every CodePipeline state change across every pipeline, pushing filtering work into the state machine that EventBridge's pattern matching is built to handle upfront.
• C. Polling every five minutes for failed executions reintroduces latency and API calls that a native state-change event and precise pattern match avoid, and it still requires writing logic to filter to only production pipelines.
• D. Matching CloudTrail API call events for any CodePipeline action captures far more than failure state transitions, such as start or update calls, and filtering by IAM caller does not correspond to filtering by pipeline tag or execution outcome.

Correct answers: A, B — Confirm the IAM role assumed by the remediation action has permissions for the specific API calls the runbook's steps perform.; Confirm the runbook's input parameters correctly reference the non-compliant resource identifier that Config passes to it.

• A. An access-denied error during remediation execution most directly points to the IAM role the remediation assumes lacking permission for the API calls its runbook steps actually make, so verifying and correcting that role's policy is a primary diagnostic step.
• B. If the runbook's parameters do not correctly map to the resource identifier Config supplies (for example, an incorrect resource ID reference), the runbook can fail on the wrong resource or with a malformed request, so checking the parameter mapping is a reasonable next diagnostic step.
• C. Config rule evaluation frequency controls how often compliance is checked; it has no relationship to whether the remediation role has the IAM permissions needed to modify a resource, so this is not a cause of access-denied errors.
• D. Config's snapshot bucket permissions govern who can read stored configuration history exports; the remediation role does not need public read access to that bucket to modify the actual non-compliant resource, so this is not relevant to the described failure.
• E. Conformance packs are a deployment and grouping mechanism for rules and remediations; they do not override or block IAM permissions granted to a remediation role, so disabling them would not resolve an access-denied error.

Correct answers: A, B — AWS Config lets you attach a Systems Manager Automation remediation action to a custom rule using the identical mechanism used for managed rules.; A CloudFormation StackSet can deploy the same Config rule and remediation action to every account in the organization from one central template.

• A. Config remediation actions attach the same way to custom rules as to managed rules, so this is an accurate statement about the platform's capability.
• B. Deploying via a StackSet is the documented way to roll the same rule and remediation configuration out to every account in an organization from a central template.
• C. Automatic remediation is available on custom rules just as it is on managed rules, so this claim about a hard restriction is incorrect.
• D. Remediation actions are independent of how the rule evaluates compliance; an Automation runbook can remediate a Lambda-backed custom rule without needing a second function.
• E. AWS Config rules are a supported CloudFormation resource type and can be deployed through StackSets, so this exclusion claim is incorrect.

Correct answer: A — Create a change set for the stack update and review the proposed add, modify, or replace actions before executing it.

• A. A change set previews exactly which resources CloudFormation will add, modify, or replace, and flags replacements that could cause data loss, before any change is applied.
• B. Drift detection compares live resource state against the template for resources already deployed; it does not preview the effect of a pending update.
• C. Event history only records what happened during past stack operations, so it cannot show the impact of an update that has not run yet.
• D. Stack outputs are values exported after a successful deployment and do not describe which resources a pending update would add, modify, or replace.

Correct answer: A — Share resources that the account owns with specific other accounts, an organizational unit, or an entire Organization.

• A. AWS RAM lets a resource owner create a resource share that grants other accounts, an OU, or the whole organization access to use resources the owner already created, without duplicating them.
• B. RAM shares existing resources for other accounts to use; it does not automatically copy or replicate resources into every member account of an organization.
• C. Creating IAM users in another account still requires that account's own administrative permissions; RAM has no mechanism to bypass another account's IAM controls.
• D. Joining an AWS Organization is managed through AWS Organizations invitations and account management, which is unrelated to what AWS RAM does with resource sharing.

Correct answers: A, B, E — Service-managed permissions require the StackSet administrator account to have trusted access enabled with AWS Organizations.; Automatic deployment can create stack instances in new accounts as soon as they join a targeted organizational unit.; Service-managed permissions remove the need to manually create an execution role in each target account.

• A. Service-managed StackSets depend on trusted access being enabled between the StackSet administrator and AWS Organizations so CloudFormation can manage permissions across the organization on the customer's behalf.
• B. With automatic deployment enabled, a new account that joins a targeted OU automatically receives a stack instance without any manual per-account action, matching the future-account requirement.
• C. Self-managed and service-managed are alternative permission models; self-managed setup in every account is not a prerequisite for choosing service-managed mode.
• D. Service-managed StackSets are designed to target member accounts across an organization or specific OUs, not only the management account itself.
• E. Service-managed permissions rely on the Organizations trust relationship instead of a manually created execution role in each target account, removing that per-account setup step.

Correct answer: A — Configure the identity provider as a SAML provider in IAM, create a role that trusts it, and let `sts:AssumeRoleWithSAML` issue temporary console credentials.

• A. Registering the SAML provider in IAM and creating a role that trusts it is the standard federation pattern; the provider's assertion is exchanged via `AssumeRoleWithSAML` for temporary, role-scoped credentials.
• B. Creating an IAM user per employee is exactly the long-term-credential overhead federation is meant to avoid, and SAML assertions are not designed to auto-fill IAM console passwords.
• C. An S3 bucket policy governs access to objects in that bucket; it has no role in authenticating console sign-ins or issuing temporary credentials to federated users.
• D. AWS Config aggregates configuration and compliance data across accounts; it has no function for authenticating external identities or granting console access.

Correct answer: A — Connect IAM Identity Center to the on-premises Active Directory as an external identity source, so existing users and groups are used for sign-in and access assignment.

• A. IAM Identity Center supports connecting to an external identity source, including Active Directory, so that existing users and groups continue to be the source of truth instead of duplicating identities.
• B. A one-time CSV import followed by manual quarterly re-syncs does not keep identities current, defeats the goal of using the existing directory live, and is not how Identity Center's directory integration is designed to work.
• C. Creating IAM users in every account is exactly the long-term-credential, per-account overhead that Identity Center and federation are meant to eliminate, and Identity Center does not authenticate against individual IAM users this way.
• D. SCPs are permission guardrails for IAM users and roles in member accounts; they have no mechanism for referencing or synchronizing an external directory's identities.

Correct answers: A, B — A Config rule, such as the managed `S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED` rule, that evaluates each bucket's configuration and marks it compliant or noncompliant.; A remediation configuration that targets an SSM document (or similar automation) and is set to trigger automatically whenever the rule reports noncompliance.

• A. The Config rule is the detection half of the pipeline: it evaluates each bucket against the encryption requirement and produces the compliance status that triggers any remediation.
• B. A remediation configuration linking the rule to an automation document, with automatic triggering enabled, is what turns a noncompliant finding into a corrective action without manual intervention.
• C. A remediation an engineer must invoke by hand is manual, not automatic, which is the opposite of what the team is asking for in this scenario.
• D. Disabling Block Public Access has nothing to do with enabling encryption remediation, and automatic remediation does not require public access to be permitted during the fix.
• E. Blocking new bucket creation with an SCP does not correct existing noncompliant buckets and is not what AWS Config remediation configurations refer to as automatic remediation.

Correct answers: A, B — Inspector automatically discovers and continuously rescans eligible EC2 instances, ECR container images, and Lambda functions as changes and new CVEs appear.; Inspector calculates a risk score for each finding by adjusting the base CVSS score using details of the specific environment the vulnerable resource runs in.

• A. Inspector's continuous scanning model automatically rescans resources in response to changes, new packages, patches, and newly published CVEs, without manual scheduling.
• B. Inspector produces a risk score tailored to the resource's actual network exposure and environment, adjusting the base CVSS score rather than reporting it unmodified.
• C. This contradicts Inspector's continuous, automatic rescanning model, which does not require an administrator to manually trigger scans per instance per CVE.
• D. Inspector explicitly supports EC2 instances, ECR container images, and Lambda functions, so this description of EC2-only support is incorrect.
• E. Inspector reports findings for review and remediation; it does not automatically delete or modify the vulnerable resource itself.

Correct answers: A, B — Designate a delegated administrator account for AWS Security Hub and configure cross-Region aggregation so findings from every linked account and Region roll up centrally.; Enable AWS Config with an aggregator configured in the designated account so configuration and compliance data from every member account and Region is collected centrally.

• A. A Security Hub delegated administrator with cross-Region aggregation is the designed mechanism for centrally viewing findings across an organization's accounts and Regions.
• B. A Config aggregator in the delegated account centralizes configuration and compliance data across the organization, complementing Security Hub's findings aggregation.
• C. Manual weekly email exports do not scale, are error-prone, and do not provide the near-real-time centralized visibility the security team needs.
• D. Locally scoped, per-account CloudTrail buckets that only local administrators can read work against the goal of centralized, organization-wide visibility.
• E. Disabling Security Hub everywhere except one account would stop findings from being generated in every other account, the opposite of aggregating all accounts' findings.

Correct answer: A — The new subnet is still associated with the main route table, which lacks a route to the internet gateway; associate a route table that has one.

• A. New subnets are implicitly associated with the VPC's main route table unless explicitly assigned elsewhere, and if that route table has no route to the internet gateway, traffic to the internet is dropped; creating or updating a route table with a default route to the gateway resolves it.
• B. Public IP addresses assigned at launch are attached immediately and do not require a separate reassignment step through Elastic IP allocation, so this is not the cause of the connectivity failure.
• C. Internet gateways are not attached to security groups and do not filter traffic themselves; access control for instance traffic is handled by the instance's own security group and the subnet's network ACL, not the gateway.
• D. An internet gateway attached to a VPC serves every subnet in that VPC that is routed to it, regardless of whether the VPC is the account's default VPC or a custom VPC created later.

Correct answers: A, B, C — A public subnet with a route table that sends default traffic to an internet gateway, used for the load balancers.; Private subnets for the application tier with a route table that sends default outbound traffic to a NAT gateway in the public subnet.; Isolated private subnets for the database tier with a route table that contains only the local VPC route and no default route.

• A. A public subnet routed to an internet gateway is the correct place for internet-facing load balancers, since they must accept inbound connections from clients on the internet.
• B. Application servers need outbound-only internet access for tasks like patching, so a private subnet routing default traffic to a NAT gateway matches the stated requirement of no direct internet route while still allowing egress.
• C. The database tier should sit in isolated private subnets whose route table has no path to the internet at all, which satisfies the requirement that this tier never routes to or from the internet.
• D. Collapsing all three tiers into one subnet removes the network-level segmentation the scenario requires; security groups alone do not stop the database tier's route table from having internet reachability if one is added later.
• E. Adding an internet gateway route to the database tier's route table directly violates the stated requirement that the database tier never routes to or from the internet, regardless of the intended use case.
• F. Placing a NAT gateway in the database subnet gives that tier an outbound path to the internet, which again contradicts the requirement that the database tier have no internet route in either direction.

Correct answer: A — The network ACL associated with the subnet lacks an inbound rule that permits the ephemeral port range used for the return traffic

• A. Network ACLs are stateless, so the return traffic on high-numbered ephemeral ports must be explicitly permitted inbound even though the original request was allowed outbound; a missing ephemeral rule blocks the reply while the outbound request still succeeds. This matches the described symptom exactly.
• B. A missing NAT gateway route would prevent the outbound request from leaving the subnet at all, so the request would never reach the external API in the first place, which contradicts the scenario where the request is sent successfully.
• C. Security groups are stateful, so they automatically allow the return traffic for a connection that was permitted outbound; no explicit inbound ephemeral rule is needed at the security group layer, so this is not the cause.
• D. Source/destination checking only affects whether an instance can forward traffic not addressed to itself, such as for NAT or router configurations, and has no bearing on ephemeral port handling for the instance's own connections.

Correct answer: A — Create a CloudFront invalidation for the object's path so that cached copies at edge locations are removed before the TTL expires

• A. An invalidation request explicitly removes the specified object from CloudFront edge caches before its TTL naturally expires, which is the documented way to force edge locations to fetch the updated version from the origin immediately.
• B. CloudFront caches objects at edge locations for the duration of the configured TTL and does not automatically re-check the origin for a fresher version before that TTL expires, so simply waiting on the browser side would not bypass the edge cache.
• C. Increasing the max-age value makes CloudFront cache the object for longer, which is the opposite of what is needed here and would make stale content persist even further past the current one-hour setting.
• D. CloudFront distributions do not have a restart action, and there is no console operation called a distribution restart; clearing cached content at scale is done specifically through invalidations or cache-key changes, not a restart.

Correct answer: A — Share the Resolver rule with the application accounts using AWS Resource Access Manager, then have each application account associate the shared rule with its own VPCs.

• A. AWS Resource Access Manager lets a Resolver rule created in one account be shared and then associated with VPCs in other accounts, so a single outbound endpoint can serve every application account without duplication.
• B. Deploying an independent copy of the endpoint into every application account duplicates infrastructure and the Direct Connect or VPN path instead of reusing the endpoint that already exists.
• C. VPC peering forwards IP traffic between VPCs but does not by itself change which Resolver an instance uses for DNS; associating a shared Resolver rule is still required.
• D. shared-services.internal is a private, non-public domain, so publishing it in a public hosted zone would expose internal names and still would not deliver the private forwarding behavior the on-premises server provides.

Correct answers: A, B — The DNS response code Route 53 returned for the query, such as NOERROR or NXDOMAIN, which helps identify repeated failed lookups.; The Route 53 edge location that responded to the query, letting the analyst see which geographic locations are receiving the traffic.

• A. Each log entry includes the DNS response code returned, such as NOERROR or NXDOMAIN, so an analyst can spot bursts of failed lookups that often indicate scanning or misconfigured clients.
• B. Each entry records which Route 53 edge location answered the query, giving the analyst geographic insight into where the spike in traffic is originating from.
• C. Public hosted zone query logs record the resolver's IP address that submitted the query, not the originating EC2 instance's identity or AWS account, since DNS queries do not carry that information.
• D. Route 53 query logs capture only DNS query and response metadata; they contain no visibility into any subsequent HTTP requests a client makes after resolving a name.
• E. DNS queries are not authenticated with IAM credentials, so no such credential information exists to be recorded in a query log entry.
• F. Route 53 query logs are raw structured log entries; they do not include any built-in machine-learning threat scoring for individual queries.

Correct answers: A, B — The workload uses a non-HTTP TCP or UDP protocol that needs network-layer acceleration and failover, which CloudFront's HTTP/HTTPS model does not address.; The application needs fixed static IP addresses at the entry point because downstream clients or firewalls allow-list specific IP addresses rather than domain names.

• A. Global Accelerator operates at the network layer and can accelerate and fail over any TCP or UDP traffic, which fits a non-HTTP protocol that CloudFront's HTTP and HTTPS caching model was not designed to serve.
• B. Global Accelerator provides fixed static anycast IP addresses for its accelerator, which is exactly what a client or firewall relying on IP allow-listing needs instead of a domain name that can change.
• C. Caching static images and video for nearby delivery is CloudFront's core use case; Global Accelerator does not cache content at all, so it would not help with this goal.
• D. Reducing origin load through edge caching of cacheable HTTP content is a CloudFront strength, not something Global Accelerator provides since it forwards traffic rather than caching it.
• E. Signed URLs and signed cookies are CloudFront features for restricting access to cached private content; Global Accelerator has no equivalent per-file, time-limited access control mechanism.
• F. AWS WAF web ACLs attach to CloudFront distributions, Application Load Balancers, and API Gateway to inspect HTTP traffic; Global Accelerator does not integrate with WAF for HTTP-layer filtering.