AWS CloudOps Engineer - Associate (SOA-C03) — Practice Questions and Mock Exam

Work backwards from what the scenario already rules out. General internet access proves routing works. The network access control lists are open, so the subnet is not filtering. The S3 bucket policy allows access from the VPC, and that is the clue, because a policy written that way is satisfied only when the request actually arrives over the private endpoint path. Traffic leaving through a NAT gateway reaches the public S3 endpoint and carries no endpoint context, so the policy denies it even though the packets arrive.

That makes the VPC endpoint for S3 the thing to check. Does a gateway endpoint for S3 exist in this VPC, and does its route table association include the private subnet? Creating the endpoint is only half the job; you then add it as a target in the route table for traffic destined for S3, and a subnet whose route table was never associated keeps using the internet path.

The other three do not fit the symptoms. NAT gateway bandwidth would cause slowness rather than a flat denial. Bucket versioning is a data-protection setting with no bearing on access. The instance role permission is a plausible-sounding trap, but the stem tells you the bucket policy is the control in play.

Exam tip: when connectivity works generally and one service fails, look for a condition in the resource policy that constrains the path, not just the principal.

Surviving the loss of an Availability Zone needs two things: a copy of the data somewhere else, and something that promotes that copy automatically. Enabling cluster mode with replicas spread across multiple Availability Zones provides the copy, and Multi-AZ auto-failover provides the promotion, detecting that the primary is unreachable and electing a replica in a surviving zone without an operator in the loop. That is why this configuration improves fault tolerance in exactly the failure the scenario describes.

Notice the careful wording about data loss. Replication to replicas is asynchronous, so writes the primary acknowledged an instant before it failed may never have reached a replica. The defensible claim is minimal data loss, not zero, and an answer promising zero loss from asynchronous replication is usually the wrong one.

The distractors miss on availability. Daily snapshots are a backup, useful for restoring after corruption but measured in hours of loss and a manual restore. Independent standalone nodes in different zones share no data, so losing one loses whatever sessions lived there. Append-only persistence on a single node survives a process restart on that node, but the node is still in one zone and there is nothing to fail over to.

Exam tip: separate durability from availability. Snapshots and persistence give durability; replicas plus automatic promotion give availability.

Applying a tag to an instance is an API call, and that call is the hook the whole automation hangs on. Tagging goes through the Amazon EC2 CreateTags action, AWS CloudTrail logs that call as a management event, CloudTrail delivers its logged events to Amazon EventBridge, and an EventBridge rule whose event pattern matches that specific API call and tag key invokes AWS Lambda as its target. The Lambda function then creates the S3 bucket through the SDK. Nothing polls, nothing runs on a timer, and the reaction happens because the API call happened, which is what event-driven means.

The other three combinations break at their first step. Amazon CloudWatch metrics are numeric time series and no metric carries a tag key and value, so nothing in that chain can detect the change, and putting Amazon SNS in front of AWS Lambda only forwards a notification that was never generated. An Amazon EventBridge scheduled rule polling for tags is the opposite of event-driven: it wakes on a timer, adds latency up to the polling interval, and runs constantly when nothing has changed, so AWS Step Functions behind it inherits that delay. The AWS Config option is the closest to plausible, because AWS Config does evaluate resource configuration changes, but routing through AWS Systems Manager and AWS CloudFormation to create one bucket is far heavier machinery than the scenario needs, and it drops the EventBridge pattern matching that does the actual filtering.

Exam tip: for a requirement shaped like when this happens, do that, the default AWS answer is CloudTrail records the API call, EventBridge matches the event pattern, and Lambda performs the action. Recognizing that triple answers most event-driven automation questions on sight.

Read the two constraints together: encryption in transit, and certificates managed by AWS. AWS Certificate Manager, or ACM, provisions public certificates, validates them and renews them automatically, and ACM integrates with Elastic Load Balancing so you can deploy the certificate straight onto the load balancer. You attach the provisioned certificate to the ALB HTTPS listener and the platform handles the rest of the lifecycle, with no key material to copy onto instances and no renewal date to remember.

The distractors each break one of the constraints. Self-signed certificates generated on every instance with OpenSSL are not managed by AWS at all, and clients reject them unless you distribute trust by hand. AWS KMS creates and controls cryptographic keys; it is not a certificate authority and does not generate TLS certificates. Uploading IAM server certificates still works for older setups, but those certificates were obtained somewhere else and you own the renewal, which is precisely the management burden the question tells you to avoid.

Exam tip: certificates managed by AWS plus a load balancer is a fixed pairing. If a question then adds encryption between the load balancer and the instances behind it, treat the back-end connection as a separate decision from the listener certificate.