매달, 우리는 1000명 이상의 사람들이 시험 준비를 잘하고 시험을 잘 통과할 수 있도록 도와줍니다.
AWS Certified CloudOps Engineer - Associate 온라인 연습
최종 업데이트 시간: 2026년06월04일
당신은 온라인 연습 문제를 통해 Amazon SOA-C03 시험지식에 대해 자신이 어떻게 알고 있는지 파악한 후 시험 참가 신청 여부를 결정할 수 있다.
시험을 100% 합격하고 시험 준비 시간을 35% 절약하기를 바라며 SOA-C03 덤프 (최신 실제 시험 문제)를 사용 선택하여 현재 최신 65개의 시험 문제와 답을 포함하십시오.
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
To ensure users can launch instances only from approved AMIs, the control must be enforced at authorization time, not after the fact. An IAM policy with a condition that evaluates the resource tags on the AMI is the correct method. By using an aws:ResourceTag/ApprovedAMI condition (paired with allowing ec2:RunInstances only when the chosen AMI has the required tag/value), the organization can prevent launches from untagged or unapproved images. This implements preventative control and aligns with least privilege.
Option A (Organizations tag policy) is not an enforcement mechanism for EC2 API authorization; tag policies primarily help standardize tagging and report compliance rather than block API calls.
Option C (AWS Config required-tags) evaluates resources for compliance after creation and cannot reliably prevent a launch at the time of the API call.
Option D is unrelated; GuardDuty detections do not enforce AMI usage policy.
Reference: IAM User Guide C Policy conditions using aws:ResourceTag and authorization decisions
Amazon EC2 User Guide C Controlling instance launches with IAM permissions
AWS SysOps Administrator Study Guide C Preventative vs detective controls
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
CloudFront is a global edge network service, and its performance (latency and data transfer behavior) depends heavily on the geographic location of viewers and the edge locations that serve them. Therefore, a valid load test must generate traffic from multiple geographic regions to reflect real user distribution and to measure end-to-end latency across diverse network paths.
Additionally, CloudFront uses DNS to return multiple possible edge IP addresses and can direct clients to different edge locations based on resolver behavior and network conditions. For a realistic test, each client should make an independent DNS request and distribute traffic across the returned IP addresses, rather than pinning all load to a single IP. Spreading requests across the returned set avoids biasing the test to one edge path and better represents how real browsers and applications resolve and connect to CloudFront.
Options A and B fail to model global viewer behavior because they test from only one region.
Option C introduces an unrealistic constraint by forcing identical DNS resolution and concentrating load on a single IP address, which can distort latency and throughput results.
Option D best matches CloudOps guidance for performance validation of CDN workloads: multi-region testing with realistic DNS resolution and traffic distribution.
Reference: Amazon CloudFront Developer Guide C How CloudFront routes requests and uses edge locations
AWS SysOps Administrator Study Guide C Testing and validating content delivery performance
AWS Well-Architected Framework C Performance Efficiency (testing with representative traffic)
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
AWS Lambda automatically publishes operational metrics to Amazon CloudWatch, including Duration, which represents the time a function invocation takes to run. To alert when processing time exceeds 10 seconds, the most direct and operationally efficient solution is to create a CloudWatch alarm on the Lambda Duration metric and configure the alarm action to publish to an SNS topic. This meets the monitoring requirement without requiring log parsing or additional query mechanisms.
Option B fits best because it uses the built-in metric stream for Lambda observability: CloudWatch metrics are near real-time, require minimal configuration, and alarms are a standard CloudOps practice for proactive notification. The alarm can be configured with the appropriate statistic (for example, Maximum or p99 via metric math where applicable) and a threshold of 10,000 milliseconds, ensuring the operations team is notified before performance degrades further.
Option A is incorrect because PostRuntimeExtensionsDuration is not the primary runtime metric for function execution time, and extracting runtime from logs is unnecessary.
Option C changes the function timeout to 10 seconds, which would cause failures rather than simply notifying on slow executions.
Option D is more operationally complex because it relies on log queries; CloudWatch alarms are more straightforward when a native metric exists.
Reference: AWS Lambda Developer Guide C Monitoring functions with CloudWatch metrics (Duration)
Amazon CloudWatch User Guide C Creating alarms and SNS notifications
AWS SysOps Administrator Study Guide C Monitoring and alerting patterns
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The requirement is to fix performance degradation from predictable peak CPU load without service disruptions. The most reliable and operationally standard approach is horizontal scaling with an Auto Scaling group driven by CloudWatch metrics/alarms (or target tracking). Launching additional instances and distributing traffic (typically behind a load balancer) increases capacity while keeping existing instances serving requests―no reboot or stop/start required.
Option D meets the requirement because Auto Scaling can add capacity when CPU exceeds a threshold and remove capacity when demand falls. This improves performance during peak periods and maintains availability. It is also operationally efficient: scaling actions are automated, consistent, and can be tuned with cooldowns/health checks.
Options A and C describe vertical scaling (instance resize). Resizing an EC2 instance type generally requires stopping the instance, changing the type, and starting it again―this is disruptive for a single-instance web server and often causes downtime.
Option B (restarting the application) directly introduces disruption and does not address underlying capacity constraints; it can also worsen customer impact during peaks.
Reference: Amazon EC2 Auto Scaling User Guide C Scaling policies and CloudWatch integration Amazon CloudWatch User Guide C Alarms triggering Auto Scaling actions AWS Well-Architected Framework C Performance Efficiency and Reliability guidance
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
With the Managed-CachingDisabled policy, CloudFront is configured to minimize edge caching, so the remaining caching behavior users experience often comes from browser (client-side) caching. If users refresh and still see old content, it typically indicates the browser is allowed to reuse a cached copy without revalidating. The correct fix is to control client caching using HTTP response headers on the S3 object.
Adding a Cache-Control: max-age=0 header instructs browsers that the object becomes stale immediately and should be revalidated on subsequent requests (often resulting in conditional requests using If-Modified-Since or ETag behavior). This preserves correctness―users will fetch or revalidate the latest file―without requiring heavier operational actions like frequent CloudFront invalidations or changing to an optimized caching policy that may increase edge caching.
Option B can worsen the issue by increasing caching if object headers permit it.
Option C is unrelated; versioning affects object history and recovery, not browser cache behavior.
Option D affects payload size transfer (gzip/brotli), not cache freshness.
Reference: Amazon CloudFront Developer Guide C Cache policies and cache behavior concepts
Amazon S3 User Guide C Object metadata and HTTP Cache-Control headers
AWS SysOps Administrator Study Guide C Troubleshooting caching and content freshness
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
Amazon EFS encryption at rest is a file system creation attribute; an unencrypted EFS file system cannot be “turned on” for encryption in place. Therefore, meeting the requirement (“encrypt an existing EFS using an existing KMS customer managed key”) requires creating a new encrypted file system and migrating data.
Option A is the most operationally efficient because EFS replication is a managed mechanism that continuously copies data and metadata from a source file system to a destination file system. By specifying the existing KMS customer managed key for the destination, the new file system is encrypted at rest under the required key. After replication has caught up, the administrator can perform a controlled cutover (failover) so applications mount the encrypted destination instead of the original source. This reduces manual copying effort, supports ongoing synchronization during migration, and simplifies the cutover window.
Option B is not possible because encryption-at-rest settings for EFS cannot be modified after creation.
Option C is irrelevant because TLS certificates relate to encryption in transit and are not configured as part of EFS replication in the manner described.
Option D can work functionally, but it requires building and operating a copy workflow, which is more manual and error-prone than managed replication.
Reference: Amazon EFS User Guide C Encryption at rest behavior and limitations
Amazon EFS User Guide C Replication concepts and destination encryption
AWS SysOps Administrator Study Guide C Data protection and migration patterns
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
For users in eu-west-2 transferring large files to/from an S3 bucket in ap-southeast-2 over the public internet, S3 Transfer Acceleration is designed to improve performance by leveraging the AWS global edge network. With Transfer Acceleration enabled, users access the bucket via the acceleration endpoint. Requests enter AWS at the nearest edge location and then traverse the AWS backbone network to the bucket’s Region, which typically reduces latency variability and can improve throughput for long-distance transfers.
Option A is incorrect because access points do not “replicate destinations” in the way described, and an access point in another Region does not move data closer by itself.
Option B is incorrect because Route 53 DNS routing does not accelerate data transfers; it only resolves names and (in this case) also incorrectly references S3 website endpoints (not appropriate for general large file transfer APIs).
Option C is not valid as written because a single S3 access point cannot be “associated with both buckets,” and maintaining two buckets introduces synchronization/consistency overhead; it’s not the least-friction acceleration approach for direct internet users.
Reference: Amazon S3 User Guide C Transfer Acceleration
AWS SysOps Administrator Study Guide C S3 performance optimization
AWS Well-Architected Framework C Performance Efficiency considerations for data transfer
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
To ensure video files are cached at CloudFront edge locations after migrating the files to Amazon S3, CloudFront must be able to fetch those video objects directly from S3 as an origin. The most operationally straightforward pattern is to add S3 as a second origin and create a separate cache behavior that routes requests for video paths (for example, /video/* or /*.mp4) to the S3 origin. With this configuration, CloudFront caches the S3-served objects at edge locations according to the cache policy/headers, while the existing ALB origin continues serving dynamic application paths. This isolates static media delivery from the application tier and improves performance by maximizing cache hits at the edge.
Option A is not how CloudFront origin selection works: CloudFront does not “redirect” to S3 based on headers; it selects an origin per behavior.
Option C (signed URLs) is an access-control mechanism and does not, by itself, ensure the objects are retrieved from S3 or cached correctly.
Option D (origin groups) is for origin failover (primary/secondary) and does not provide path-based routing to ensure videos come from S3.
Reference: Amazon CloudFront Developer Guide C Origins and Cache Behaviors (path pattern routing)
Amazon S3 User Guide C Using S3 as an origin for CloudFront AWS SysOps Administrator Study Guide C Content delivery patterns with CloudFront
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The most operationally efficient approach is A: copy the AMI to each target Region using copy-image and update the CloudFormation template to reference the correct AMI IDs per Region (commonly via Mappings or parameters). AMIs are regional resources, so an AMI built in us-east-1 cannot be launched directly in other Regions without copying. The copy-image operation is the standard, supported method to replicate an AMI across Regions while preserving the image configuration and backing snapshots in the destination Region.
Once AMIs exist in each Region, CloudFormation can be executed in each Region using the same template logic. Adding mappings for AMI IDs keeps the deployment consistent and repeatable, aligning with Infrastructure as Code practices and minimizing manual steps.
Option B is more work than necessary because copying snapshots and re-creating AMIs adds extra steps and increases the chance of inconsistency.
Option C is incomplete because the template will fail or launch incorrect resources if it references an AMI ID that does not exist in the target Region.
Option D is not feasible because an Auto Scaling group is a regional construct and cannot span multiple Regions from a single stack update in us-east-1.
Reference: Amazon EC2 User Guide C Copy an AMI across Regions (copy-image) and AMI regional scope AWS CloudFormation User Guide C Mappings/parameters for Region-specific values AWS SysOps Administrator Study Guide C Multi-Region provisioning and automation best practices
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The most operationally efficient solution is C because AWS Systems Manager Session Manager is purpose-built for secure, auditable interactive access to EC2 instances at scale―without managing bastion hosts or distributing SSH keys. Session Manager can be configured to log session activity, including commands and output, to durable destinations such as Amazon CloudWatch Logs (and optionally Amazon S3). This directly satisfies the requirement to record interactive sessions and store logs durably.
For automated notifications and alarms, CloudWatch Logs supports metric filters that transform matching log patterns into CloudWatch metrics. Those metrics can then drive CloudWatch alarms and notifications (for example, via Amazon SNS). This is a standard CloudOps pattern: centralize logs, derive metrics from security-relevant patterns, and alert automatically.
Option A and D require installing and operating agents and building a more complex analytics path (Athena queries for alerting), which is less efficient and introduces more moving parts across thousands of instances.
Option B adds a bastion host dependency that becomes an operational burden (scaling, patching, hardening, HA) and a potential choke point. Session Manager reduces these burdens by using SSM Agent already installed, IAM-based access control, and centralized logging/monitoring integrations.
Reference: AWS Systems Manager User Guide C Session Manager and session logging to CloudWatch Logs/S3
Amazon CloudWatch Logs User Guide C Metric filters and alarms from log patterns
AWS SysOps Administrator Study Guide C Centralized logging, auditing, and operational monitoring
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The requirement is that traffic from a VPC-connected Lambda to Amazon S3 must not use public IP addresses. The AWS-native way to keep traffic private is to use VPC endpoints, which provide private connectivity to supported AWS services without traversing the public internet. Among the options, creating an S3 VPC endpoint is the only approach that satisfies “no public IP addresses” while allowing access to the bucket.
Option D is the best match because it explicitly configures an S3 endpoint and directs the Lambda function to use the endpoint-specific DNS name for private routing.
Option C (NAT gateway) is incorrect for this requirement because NAT provides outbound internet access from private subnets and typically uses public IP addressing at the NAT gateway. That violates the intent to avoid public IP paths for S3 traffic.
Option A is not applicable because S3 buckets are not placed “inside” a VPC and do not participate in VPC sharing in a way that provides private network paths.
Option B (transit gateway) connects VPCs and on-prem networks, but it does not create private service connectivity to S3 by itself; you would still need the correct service endpoint solution for S3 access.
Using a VPC endpoint also aligns with CloudOps best practices: it reduces exposure, simplifies network egress controls, and supports least-privilege access via endpoint policies (where applicable) alongside IAM policies.
Reference: Amazon VPC User Guide C VPC endpoints for AWS services and private connectivity AWS Lambda Developer Guide C Lambda networking in a VPC Amazon S3 User Guide C Accessing S3 privately using VPC endpoints
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The requirement is classic active-passive (production in us-east-1, DR in us-west-2 “only for failover”). The most operationally efficient and purpose-built solution is Route 53 failover routing combined with health checks. With failover routing, Route 53 designates one record as PRIMARY (us-east-1) and another as SECONDARY (us-west-2). Route 53 continuously evaluates the health check associated with the primary endpoint (commonly the ALB DNS name or a specific health-check path). If the primary fails, Route 53 automatically returns the secondary record, directing client DNS resolution to the DR region. This ensures us-west-2 is used only when us-east-1 is unhealthy, directly matching the requirement.
Latency routing (Option B) is designed to route users to the region with the lowest latency, which can actively send traffic to us-west-2 even when us-east-1 is healthy―violating the “DR only” constraint.
Options C and D introduce custom automation (CloudWatch + Lambda + DNS record updates) that increases operational overhead, adds failure modes, and is unnecessary because Route 53 already provides managed health-check-based failover. Additionally, “EC2 instance terminated” is not a reliable proxy for full application availability, and DNS modification automation is more complex than using native Route 53 failover policies.
Reference: Amazon Route 53 Developer Guide C Health checks and failover routing policy
AWS Well-Architected Framework C Reliability pillar (failover, DR patterns)
AWS SysOps Administrator Study Guide C DNS failover and Route 53 routing policies
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
To meet the requirement to log and audit any principal that publishes to SNS topics and interacts with SQS queues, the correct service is AWS CloudTrail, because CloudTrail records API activity (who did what, when, and from where). Enabling data events (where supported/required for deeper visibility) provides detailed records for operations such as publishing messages and sending/receiving messages. Delivering CloudTrail logs to Amazon S3 provides durable retention and supports querying workflows.
To ensure that communication uses VPC endpoints, the company should configure VPC endpoints for SNS and SQS and then validate usage by inspecting CloudTrail event records. CloudTrail includes endpoint-related context fields (for example, a VPC endpoint identifier) that allow auditors to confirm that the request path used a VPC endpoint rather than traversing the public internet. This directly addresses the “must use VPC endpoints” control with auditable evidence.
The other options do not satisfy both requirements. CloudWatch Logs does not automatically capture SNS/SQS API caller identity for publish/send/receive operations in the same authoritative way CloudTrail does. EventBridge can capture service events but is not the primary audit log of API calls and does not inherently prove VPC endpoint usage per request. Inspecting a VPC endpoint field in CloudWatch Logs is not the standard audit mechanism for these API calls.
Reference: AWS CloudTrail User Guide C Event records, management events, data events, delivery to Amazon S3 Amazon SNS Developer Guide C API actions and logging/auditing considerations Amazon SQS Developer Guide C API actions and logging/auditing considerations Amazon VPC User Guide C Interface VPC endpoints (AWS PrivateLink) and private access to AWS services
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The correct answer is C because selective CloudFront invalidation ensures that only updated JavaScript files are refreshed across edge locations. AWS CloudOps documentation explains that invalidations remove cached objects so that CloudFront fetches the latest version from the origin on the next request.
Invalidating only changed files minimizes cost, reduces operational impact, and avoids unnecessary origin requests. This approach ensures users always receive the latest application assets without degrading backend performance.
Option A is incorrect because setting TTLs to 0 forces CloudFront to query the origin for every request, increasing load on the ALB and EC2 instances.
Option B is inefficient and costly because invalidating all files is unnecessary.
Option D removes the benefits of CloudFront caching and increases latency.
AWS CloudOps best practices recommend targeted invalidations during deployments to balance performance, cost, and correctness.
Reference: Amazon CloudFront Developer Guide C Cache Invalidation
AWS SysOps Administrator Study Guide C Content Delivery
AWS Well-Architected Framework C Performance Efficiency and Reliability
정답:
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
The correct answer is B because cross-account role assumption requires two explicit permissions. AWS CloudOps documentation states that the target role must trust the principal, and the principal must be allowed to call sts:AssumeRole.
In the member account, the role’s trust policy must list the IAM group ARN (or the identity account)
as a trusted principal. In the identity account, the IAM group must have an inline or attached policy that allows the sts:AssumeRole action for the target role ARN. This dual configuration enables secure and controlled cross-account access.
Option A is incorrect because trust policies cannot be attached to IAM groups.
Option C is incorrect because sts:PassRole is used for passing roles to AWS services, not for assuming roles.
Option D is incorrect because roles do not grant permissions via inline policies to principals.
This approach aligns precisely with AWS CloudOps guidance for multi-account IAM design.
Reference: IAM User Guide C Cross-Account Role Access
AWS SysOps Administrator Study Guide C Identity and Access Management
AWS Well-Architected Framework C Security Pillar