Pass the Amazon Web Services AWS Certified Associate SOA-C03 Questions and answers with CertsForce

Per the AWS Cloud Operations, Networking, and Security documentation, the best practice for serving private S3 content securely to end users is to use Amazon CloudFront with Origin Access Control (OAC).

OAC enables CloudFront to access S3 buckets privately, even when Block Public Access settings are enabled at the account level. This allows content to be delivered globally and securely without making the S3 bucket public. The bucket policy explicitly allows access only from the CloudFront distribution, ensuring that users can retrieve PDF files only via CloudFront URLs.

This configuration offers:

Automatic scalability through CloudFront caching,

Improved security via private access control,

Minimal administration effort with fully managed services.

Other options require manual handling or make the bucket public, violating AWS security best practices.

Therefore, Option B—using CloudFront with Origin Access Control and a restrictive bucket policy—provides the most secure, efficient, and low-maintenance CloudOps solution.

Network ACLs are stateless, meaning both inbound and outbound rules must explicitly allow traffic. While inbound HTTP traffic (port 80) was allowed, the return traffic from the EC2 instance uses ephemeral ports (typically 1024–65535). If outbound rules do not allow this ephemeral port range, the response traffic is dropped, preventing the website from loading.

Security groups are stateful and automatically allow return traffic, but network ACLs do not. This commonly causes connectivity issues when custom ACLs are applied without matching outbound rules.

Option B is incorrect because security groups allow all outbound traffic by default. Option C is irrelevant. Option D is incorrect because only one network ACL can be associated with a subnet at a time.

Thus, the missing outbound ephemeral port rule in the network ACL is the root cause.

The AWS Cloud Operations and Infrastructure-as-Code documentation specifies that when using AWS CloudFormation, resources are created in parallel by default unless explicitly ordered using DependsOn.

If a custom resource (Lambda) depends on another resource (like an EC2 instance) to exist before execution, a DependsOn attribute must be added to enforce creation order. This ensures the EC2 instance is launched and available before the custom resource executes its automation logic.

Updating the service token (Option B) doesn’t affect order of execution. The cfn-response module (Option C) handles callback communication but not sequencing. Fn::If (Option D) is for conditional creation, not dependency control.

Therefore, Option A is correct — adding a DependsOn attribute guarantees that CloudFormation provisions the EC2 instance before executing the Lambda custom resource.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Doocuments:

Use Amazon S3 Event Notifications with AWS Lambda to trigger image processing on object creation. S3 natively supports invoking Lambda for events such as s3:ObjectCreated:*, providing a serverless, low-latency pipeline without managing additional services. AWS operational guidance states that “Amazon S3 can directly invoke a Lambda function in response to object-created events,” allowing you to pass event metadata (bucket/key) to the function for resizing and writing results back to S3. This approach minimizes operational overhead, scales automatically with upload volume, and integrates with standard retry semantics. SNS or SQS can be added for fan-out or buffering patterns, but they are not required when the requirement is simply “invoke the Lambda function on upload.” CloudWatch alarms do not detect individual S3 object uploads and cannot directly satisfy per-object triggers. Therefore, configuring S3 → Lambda event notifications meets the requirement most directly and aligns with CloudOps best practices for event-driven, serverless automation.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The correct answers are B and D. AWS CloudOps documentation clearly states that AWS Secrets Manager is the recommended service for storing and managing database credentials securely. Secrets Manager integrates natively with Amazon RDS and supports automatic, scheduled secret rotation.

To rotate credentials weekly, Secrets Manager requires a Lambda rotation function. AWS provides managed rotation templates for Amazon RDS for MySQL that update the database password and the stored secret atomically. This combination ensures credentials are protected, rotated automatically, and audited with minimal operational effort.

Option A is incorrect because RDS Proxy does not store or rotate credentials; it only retrieves them from Secrets Manager. Option C is incorrect because Systems Manager Parameter Store does not support native automatic rotation. Option E is incorrect because Automation runbooks are not the recommended mechanism for secrets rotation and add unnecessary complexity.

AWS CloudOps best practices strongly recommend Secrets Manager with Lambda-based rotation for database credential protection and compliance.

AWS Organizations service control policies (SCPs) are designed to enforce permission guardrails across accounts. SCPs define the maximum available permissions for IAM principals in member accounts, regardless of the permissions granted by IAM policies. Because the requirement is to prevent EC2 instance launches without a required tag and to apply the restriction only to accounts within a specific organizational unit, SCPs are the correct control mechanism.

By creating an SCP that denies the ec2:RunInstances action when the CostCenter-Project tag is missing, the CloudOps engineer ensures that no EC2 instance can be launched without the required tag. Attaching the SCP directly to the application OU limits the scope of enforcement to only the accounts that belong to that OU, which satisfies the requirement precisely.

IAM-based solutions such as user groups or roles cannot enforce controls across multiple accounts consistently and can be bypassed by users with sufficient permissions. Attaching the SCP to the root OU would incorrectly apply the restriction to all accounts in the organization, which violates the requirement.

Therefore, attaching a tag-enforcing SCP to the application OU is the correct and least operationally complex solution.

For IPv4 traffic, private subnets require a NAT gateway in a public subnet to access the internet. NAT gateways must be deployed in public subnets and associated with an Elastic IP address. Private subnet route tables must direct 0.0.0.0/0 traffic to the NAT gateway.

The question states that NAT gateways are incorrectly placed in private subnets, which cannot provide internet access. Deploying NAT gateways in public subnets resolves this issue and restores outbound connectivity to external APIs.

Option A applies only to IPv6. Option B adds unnecessary complexity. Option D is not applicable because external APIs are not AWS services.

Per the AWS Cloud Operations and Service Catalog documentation, when a portfolio is shared across AWS accounts, the recipient account imports the shared portfolio.

The recipient CloudOps engineer cannot modify the original products or their configurations but can:

Add products from the imported portfolio into their local portfolios for deployment,

Control end-user access in the recipient account, and

Manage local constraints or permissions.

However, the recipient cannot edit, delete, or reconfigure the shared products (Options B, C, and D). The source (owner) account retains full administrative control over products, launch roles, and lifecycle policies.

This model aligns with AWS CloudOps principles of centralized governance with distributed self-service deployment across multiple accounts.

Thus, Option A is correct—imported portfolios allow the recipient to add products to a local portfolio but not alter the shared configuration.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The correct answer is A because AWS KMS symmetric customer managed keys with automatic key rotation provide encryption, access control, and compliance with minimal operational effort. AWS CloudOps documentation states that Amazon EBS encryption supports AWS KMS symmetric keys only, and customer managed keys allow administrators to define custom key policies to control access.

Automatic key rotation is supported for symmetric customer managed keys and rotates the backing key material once every year, fully satisfying the company’s rotation requirement without manual intervention. This approach minimizes operational overhead while maintaining strong security controls and auditability.

Option B is incorrect because AWS owned keys do not allow custom key policies and therefore cannot meet the access control requirement. Option C is incorrect because asymmetric KMS keys are not supported for EBS encryption. Option D is incorrect because imported key material requires manual rotation and re-import, increasing operational complexity and risk.

AWS CloudOps security best practices strongly recommend customer managed symmetric keys with automatic rotation when organizations need fine-grained access control, regulatory compliance, and low maintenance overhead.

EC2 instances in private subnets cannot send traffic directly to the internet gateway because private subnets do not have a direct 0.0.0.0/0 route to the internet gateway. Instead, outbound IPv4 internet access from private subnets is typically provided by a NAT gateway that is deployed in a public subnet. Private subnet route tables then send default internet-bound traffic (0.0.0.0/0) to the NAT gateway as the target. The NAT gateway uses its Elastic IP address and the public subnet’s route to the internet gateway to enable outbound connectivity while still preventing inbound internet-initiated connections to the private instances.

When the company reduced multiple NAT gateways to a single NAT gateway, the routing design likely became inconsistent across Availability Zones. In multi-AZ architectures, it is common to have one NAT gateway per AZ and have each private subnet route to the NAT gateway in the same AZ to maintain zonal resiliency and avoid cross-AZ dependencies. If NAT gateways were removed, some private subnets may still have route table entries that point to NAT gateways that no longer exist. Those subnets would immediately lose outbound internet connectivity. The fix is to update the route tables associated with the affected private subnets so that their 0.0.0.0/0 route targets the remaining NAT gateway.

Option C would violate the requirement that instances must be in private subnets; routing private subnet traffic directly to an internet gateway effectively makes the subnet public. Option A is unnecessary and adds operational burden; NAT instances require patching, scaling, and availability management. Option D does not address the routing target problem and is not how NAT gateway egress is restored for multiple subnets.

Therefore, correcting the private subnet route tables to send internet-bound traffic to the existing NAT gateway is the appropriate solution.

=================