AWS CloudOps Engineer - Associate (SOA-C03) — Practice Questions and Mock Exam

Surviving the loss of an Availability Zone needs two things: a copy of the data somewhere else, and something that promotes that copy automatically. Enabling cluster mode with replicas spread across multiple Availability Zones provides the copy, and Multi-AZ auto-failover provides the promotion, detecting that the primary is unreachable and electing a replica in a surviving zone without an operator in the loop. That is why this configuration improves fault tolerance in exactly the failure the scenario describes.

Notice the careful wording about data loss. Replication to replicas is asynchronous, so writes the primary acknowledged an instant before it failed may never have reached a replica. The defensible claim is minimal data loss, not zero, and an answer promising zero loss from asynchronous replication is usually the wrong one.

The distractors miss on availability. Daily snapshots are a backup, useful for restoring after corruption but measured in hours of loss and a manual restore. Independent standalone nodes in different zones share no data, so losing one loses whatever sessions lived there. Append-only persistence on a single node survives a process restart on that node, but the node is still in one zone and there is nothing to fail over to.

Exam tip: separate durability from availability. Snapshots and persistence give durability; replicas plus automatic promotion give availability.

Applying a tag to an instance is an API call, and that call is the hook the whole automation hangs on. Tagging goes through the Amazon EC2 CreateTags action, AWS CloudTrail logs that call as a management event, CloudTrail delivers its logged events to Amazon EventBridge, and an EventBridge rule whose event pattern matches that specific API call and tag key invokes AWS Lambda as its target. The Lambda function then creates the S3 bucket through the SDK. Nothing polls, nothing runs on a timer, and the reaction happens because the API call happened, which is what event-driven means.

The other three combinations break at their first step. Amazon CloudWatch metrics are numeric time series and no metric carries a tag key and value, so nothing in that chain can detect the change, and putting Amazon SNS in front of AWS Lambda only forwards a notification that was never generated. An Amazon EventBridge scheduled rule polling for tags is the opposite of event-driven: it wakes on a timer, adds latency up to the polling interval, and runs constantly when nothing has changed, so AWS Step Functions behind it inherits that delay. The AWS Config option is the closest to plausible, because AWS Config does evaluate resource configuration changes, but routing through AWS Systems Manager and AWS CloudFormation to create one bucket is far heavier machinery than the scenario needs, and it drops the EventBridge pattern matching that does the actual filtering.

Exam tip: for a requirement shaped like when this happens, do that, the default AWS answer is CloudTrail records the API call, EventBridge matches the event pattern, and Lambda performs the action. Recognizing that triple answers most event-driven automation questions on sight.

Read the two constraints together: encryption in transit, and certificates managed by AWS. AWS Certificate Manager, or ACM, provisions public certificates, validates them and renews them automatically, and ACM integrates with Elastic Load Balancing so you can deploy the certificate straight onto the load balancer. You attach the provisioned certificate to the ALB HTTPS listener and the platform handles the rest of the lifecycle, with no key material to copy onto instances and no renewal date to remember.

The distractors each break one of the constraints. Self-signed certificates generated on every instance with OpenSSL are not managed by AWS at all, and clients reject them unless you distribute trust by hand. AWS KMS creates and controls cryptographic keys; it is not a certificate authority and does not generate TLS certificates. Uploading IAM server certificates still works for older setups, but those certificates were obtained somewhere else and you own the renewal, which is precisely the management burden the question tells you to avoid.

Exam tip: certificates managed by AWS plus a load balancer is a fixed pairing. If a question then adds encryption between the load balancer and the instances behind it, treat the back-end connection as a separate decision from the listener certificate.

AWS Global Accelerator gives an application static IP addresses that are announced from AWS edge locations. Traffic enters the AWS global network at the nearest edge and is sent to the best healthy endpoint in one of the configured Regions, based on health, client location, and traffic settings. Endpoints can be Network Load Balancers, Application Load Balancers, EC2 instances, or Elastic IP addresses, and standard accelerators carry TCP and UDP. Because the IP addresses do not change during failover, clients and firewalls do not need DNS updates. CloudFront delivers content that is served over HTTP and HTTPS, which does not match a custom UDP protocol, and DNS-based failover depends on record TTLs and client caching. Exam tip: static IPs plus UDP plus fast multi-Region failover point to Global Accelerator.