Free AWS Certified CloudOps Engineer - Associate SOA-C03 Exam braindumps download (AWS Certified CloudOps Engineer - Associate SOA-C03 exam dumps Free)

QUESTION: 71

A SysOps administrator needs to implement a solution that protects credentials for an Amazon RDS for MySQL DB instance. The solution must rotate the credentials automatically one time every week.

Which combination of steps will meet these requirements? (Select TWO.)

Configure an RDS proxy to store the credentials.
Add the credentials to AWS Secrets Manager.
Add the credentials to AWS Systems Manager Parameter Store.
Create an AWS Lambda function to rotate the credentials.
Create an AWS Systems Manager Automation runbook to rotate the credentials.

Answer(s): B,D

Explanation:

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The correct answers are B and D. AWS CloudOps documentation clearly states that AWS Secrets Manager is the recommended service for storing and managing database credentials securely. Secrets Manager integrates natively with Amazon RDS and supports automatic, scheduled secret rotation.

To rotate credentials weekly, Secrets Manager requires a Lambda rotation function. AWS provides managed rotation templates for Amazon RDS for MySQL that update the database password and the stored secret atomically. This combination ensures credentials are protected, rotated automatically, and audited with minimal operational effort.

Option A is incorrect because RDS Proxy does not store or rotate credentials; it only retrieves them from Secrets Manager. Option C is incorrect because Systems Manager Parameter Store does not support native automatic rotation. Option E is incorrect because Automation runbooks are not the recommended mechanism for secrets rotation and add unnecessary complexity.

AWS CloudOps best practices strongly recommend Secrets Manager with Lambda-based rotation for database credential protection and compliance.

Reference:

AWS Secrets Manager User Guide Automatic Rotation

Amazon RDS User Guide Credential Management

AWS SysOps Administrator Study Guide Secrets and Key Management

Show Answer Next Question

QUESTION: 72

A company has a multi-account AWS environment that includes the following:

· A central identity account that contains all IAM users and groups

· Several member accounts that contain IAM roles

A SysOps administrator must grant permissions for a particular IAM group to assume a role in one of the member accounts. How should the SysOps administrator accomplish this task?

In the member account, add sts:AssumeRole permissions to the role's policy. In the identity account, add a trust policy to the group that specifies the account number of the member account.
In the member account, add the group Amazon Resource Name (ARN) to the role's trust policy. In the identity account, add an inline policy to the group with sts:AssumeRole permissions.
In the member account, add the group Amazon Resource Name (ARN) to the role's trust policy. In the identity account, add an inline policy to the group with sts:PassRole permissions.
In the member account, add the group Amazon Resource Name (ARN) to the role's inline policy. In the identity account, add a trust policy to the group with sts:AssumeRole permissions.

Answer(s): B

Explanation:

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The correct answer is B because cross-account role assumption requires two explicit permissions. AWS CloudOps documentation states that the target role must trust the principal, and the principal must be allowed to call sts:AssumeRole.

In the member account, the role's trust policy must list the IAM group ARN (or the identity account) as a trusted principal. In the identity account, the IAM group must have an inline or attached policy that allows the sts:AssumeRole action for the target role ARN. This dual configuration enables secure and controlled cross-account access.

Option A is incorrect because trust policies cannot be attached to IAM groups. Option C is incorrect because sts:PassRole is used for passing roles to AWS services, not for assuming roles. Option D is incorrect because roles do not grant permissions via inline policies to principals.

This approach aligns precisely with AWS CloudOps guidance for multi-account IAM design.

Reference:

IAM User Guide Cross-Account Role Access

AWS SysOps Administrator Study Guide Identity and Access Management

AWS Well-Architected Framework Security Pillar

Show Answer Next Question

QUESTION: 73

A company is performing deployments of an application at regular intervals. Users report that the application sometimes does not work properly. The company discovers that some users' browsers are fetching previous versions of the JavaScript files. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is the origin for an Amazon CloudFront distribution.

A SysOps administrator must implement a solution to ensure that CloudFront serves the latest version of the JavaScript files. The solution must not affect application server performance.

Which solution will meet these requirements?

Reduce the maximum TTL and default TTL of the CloudFront distribution behavior to 0.
Add a final step in the deployment process to invalidate all files in the CloudFront distribution.
Add a final step in the deployment process to invalidate only the changed JavaScript files in the CloudFront distribution.
Remove CloudFront from the path of serving JavaScript files. Serve the JavaScript files directly through the ALB.

Answer(s): C

Explanation:

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The correct answer is C because selective CloudFront invalidation ensures that only updated

JavaScript files are refreshed across edge locations. AWS CloudOps documentation explains that invalidations remove cached objects so that CloudFront fetches the latest version from the origin on the next request.

Invalidating only changed files minimizes cost, reduces operational impact, and avoids unnecessary origin requests. This approach ensures users always receive the latest application assets without degrading backend performance.

Option A is incorrect because setting TTLs to 0 forces CloudFront to query the origin for every request, increasing load on the ALB and EC2 instances. Option B is inefficient and costly because invalidating all files is unnecessary. Option D removes the benefits of CloudFront caching and increases latency.

AWS CloudOps best practices recommend targeted invalidations during deployments to balance performance, cost, and correctness.

Reference:

Amazon CloudFront Developer Guide Cache Invalidation

AWS SysOps Administrator Study Guide Content Delivery

AWS Well-Architected Framework Performance Efficiency and Reliability

Show Answer Next Question

QUESTION: 74

A company needs to log and audit any principal that publishes messages to Amazon Simple Notification Service (Amazon SNS) topics and Amazon Simple Queue Service (Amazon SQS) queues. The company wants to ensure that all communication with these services uses VPC endpoints.

Which combination of solutions will meet these requirements? (Select TWO.)

Use Amazon CloudWatch Logs to collect message content from Amazon SNS and Amazon SQS.
Deliver logs to an Amazon S3 bucket for querying.
Set up AWS CloudTrail. Enable tracking of data events for Amazon SNS and Amazon SQS. Deliver logs to an Amazon S3 bucket for querying.
Create Amazon EventBridge rules to gather Amazon SNS and Amazon SQS events. Store the events in an Amazon S3 bucket.
Configure VPC endpoints for Amazon SNS and Amazon SQS. Inspect the vpcEndpointId field in the AWS CloudTrail logs.
Configure VPC endpoints for Amazon SNS and Amazon SQS. Inspect the vpcEndpoint field in the Amazon CloudWatch logs.

Answer(s): B,D

Explanation:

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

To meet the requirement to log and audit any principal that publishes to SNS topics and interacts with SQS queues, the correct service is AWS CloudTrail, because CloudTrail records API activity (who did what, when, and from where). Enabling data events (where supported/required for deeper visibility) provides detailed records for operations such as publishing messages and sending/receiving messages. Delivering CloudTrail logs to Amazon S3 provides durable retention and supports querying workflows.

To ensure that communication uses VPC endpoints, the company should configure VPC endpoints for SNS and SQS and then validate usage by inspecting CloudTrail event records. CloudTrail includes endpoint-related context fields (for example, a VPC endpoint identifier) that allow auditors to confirm that the request path used a VPC endpoint rather than traversing the public internet. This directly addresses the "must use VPC endpoints" control with auditable evidence.

The other options do not satisfy both requirements. CloudWatch Logs does not automatically capture SNS/SQS API caller identity for publish/send/receive operations in the same authoritative way CloudTrail does. EventBridge can capture service events but is not the primary audit log of API calls and does not inherently prove VPC endpoint usage per request. Inspecting a VPC endpoint field in CloudWatch Logs is not the standard audit mechanism for these API calls.

Reference:

AWS CloudTrail User Guide Event records, management events, data events, delivery to Amazon S3

Amazon SNS Developer Guide API actions and logging/auditing considerations

Amazon SQS Developer Guide API actions and logging/auditing considerations

Amazon VPC User Guide Interface VPC endpoints (AWS PrivateLink) and private access to AWS services

Show Answer Next Question

QUESTION: 75

A web application runs on Amazon EC2 instances in the us-east-1 Region and the us-west-2 Region. The instances run behind an Application Load Balancer (ALB) in each Region. An Amazon Route 53 hosted zone controls DNS records.

The instances in us-east-1 are production resources. The instances in us-west-2 are for disaster recovery. EC2 Auto Scaling groups are configured based on the ALBRequestCountPerTarget metric in both Regions.

A SysOps administrator must implement a solution that provides failover from us-east-1 to us-west-
2. The instances in us-west-2 must be used only for failover.

Which solution will meet these requirements?

Implement a Route 53 health check and a failover routing policy for the hosted zone. Configure the failover routing policy to automatically redirect traffic to the resources in us-west-2.
Implement a Route 53 health check and a latency routing policy for the hosted zone. Configure the latency routing policy to automatically redirect traffic to the resources in us-west-2.
In us-east-1, create an Amazon CloudWatch alarm that enters ALARM state when an EC2 instance is terminated. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.
In us-west-2, create an Amazon CloudWatch alarm that enters ALARM state when resources in us- east-1 cannot be resolved. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.

Answer(s): A

Explanation:

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The requirement is classic active-passive (production in us-east-1, DR in us-west-2 "only for failover"). The most operationally efficient and purpose-built solution is Route 53 failover routing combined with health checks. With failover routing, Route 53 designates one record as PRIMARY (us- east-1) and another as SECONDARY (us-west-2). Route 53 continuously evaluates the health check associated with the primary endpoint (commonly the ALB DNS name or a specific health-check path). If the primary fails, Route 53 automatically returns the secondary record, directing client DNS resolution to the DR region. This ensures us-west-2 is used only when us-east-1 is unhealthy, directly matching the requirement.

Latency routing (Option B) is designed to route users to the region with the lowest latency, which can actively send traffic to us-west-2 even when us-east-1 is healthy--violating the "DR only" constraint. Options C and D introduce custom automation (CloudWatch + Lambda + DNS record updates) that increases operational overhead, adds failure modes, and is unnecessary because Route 53 already provides managed health-check-based failover. Additionally, "EC2 instance terminated" is not a reliable proxy for full application availability, and DNS modification automation is more complex than using native Route 53 failover policies.

Reference:

Amazon Route 53 Developer Guide Health checks and failover routing policy

AWS Well-Architected Framework Reliability pillar (failover, DR patterns)

AWS SysOps Administrator Study Guide DNS failover and Route 53 routing policies

Show Answer Next Question

Free AWS Certified CloudOps Engineer - Associate SOA-C03 Exam Braindumps AWS Certified CloudOps Engineer - Associate Questions 71–75 (page: 16)

QUESTION: 71

Explanation:

Reference:

QUESTION: 72

Explanation:

Reference:

QUESTION: 73

Explanation:

Reference:

QUESTION: 74

Explanation:

Reference:

QUESTION: 75

Explanation:

Reference:

Free AWS Certified CloudOps Engineer - Associate SOA-C03 Exam Braindumps
AWS Certified CloudOps Engineer - Associate Questions 71–75 (page: 16)