15 Free AWS Certified CloudOps Engineer – Associate (SOA-C03) Practice Questions with Answers (2026)

A composite alarm goes into ALARM state only when its rule is true, here when both alarms are in ALARM. Removing the actions from the individual alarms stops the extra pages.

• A is wrong: longer evaluation reduces noise from each alarm but still pages when only one condition is true.
• C is wrong: CPU percentage and response time in seconds are different units, so averaging them is meaningless.
• D is wrong: a scheduled check adds delay and custom logic for something composite alarms do natively.

gp3 lets you set IOPS separately from size, and Elastic Volumes can change the type while the volume stays in use. It is the cheapest way to get a steady 6,000 IOPS here.

• B is wrong: io2 delivers the IOPS but costs more than gp3 for this need.
• C is wrong: gp2 gives 3 IOPS per GiB, so this works but pays for 1,500 GiB of storage the database does not need.
• D is wrong: st1 is a throughput-optimised HDD volume, poor for the random I/O of a database.

Multi-AZ keeps a standby in another Availability Zone and fails over to it automatically, keeping the same endpoint.

• A is wrong: a replica in the same AZ fails with it, and read replicas need manual promotion.
• B is wrong: backups help you restore data, not fail over automatically.
• D is wrong: a bigger instance is still in one AZ.

Target tracking adds and removes instances to keep a metric near the target you set. Auto Scaling creates and manages the alarms for you.

• A is wrong: simple scaling makes one fixed change per alarm and waits out the cooldown, so it reacts slowly.
• C is wrong: a schedule cannot react to load that changes outside the schedule.
• D is wrong: step scaling works but needs the manual tuning the team wants to avoid.

With automated backups, RDS can restore to any second within the retention period, usually up to about five minutes before now. The restore always creates a new instance.

• A is wrong: the snapshot loses more than seven hours of changes.
• B is wrong: the replica already has the deletes replicated to it.
• C is wrong: RDS point-in-time restore cannot overwrite an existing instance. It always creates a new one.

StackSets with service-managed permissions deploy to accounts in your organization or chosen OUs. Automatic deployment adds the stack to new accounts when they join.

• B is wrong: manual deploys to each account do not scale and miss new accounts.
• C is wrong: RAM shares certain resource types, such as subnets, not IAM roles or Config rules.
• D is wrong: SCPs limit permissions. They cannot create resources.

Image Builder pipelines build, test and distribute AMIs on a schedule, including copying them to other Regions.

• A is wrong: Patch Manager patches running instances. It does not build, test or distribute AMIs.
• B is wrong: a launch template only points at an AMI. It does not create one.
• D is wrong: AWS Backup copies an instance as it is. It does not patch or test it.

Run Command executes commands on managed instances without SSH. Rate controls set how many instances run at once and when to stop on errors.

• A is wrong: SSH is not allowed.
• C is wrong: user data runs at launch, not on demand on running instances.
• D is wrong: the EC2 API cannot run shell commands inside an instance.

An SCP sets the maximum permissions for every principal in member accounts, including administrators. A deny on aws:RequestedRegion blocks other Regions. Global services such as IAM must be excluded because their requests use a single Region endpoint.

• A is wrong: boundaries must be added to each role, and anyone who can change them can remove the limit.
• B is wrong: Config detects resources after they are created. It does not prevent them.
• C is wrong: GuardDuty detects threats. It does not restrict Regions.

The policy simulator evaluates a principal's policies against chosen actions and resources and shows which statement allows or denies the request, without making the real call.

• B is wrong: Trusted Advisor gives best-practice checks, not policy evaluation for one action.
• C is wrong: Inspector scans for software vulnerabilities and unintended network exposure.
• D is wrong: Config tracks resource configuration, not IAM policy evaluation results.

ACM public certificates are trusted by browsers, cost nothing to use with an ALB, and renew automatically while the DNS validation record stays in place.

• A is wrong: browsers do not trust self-signed certificates, and they do not renew.
• B is wrong: KMS keys encrypt data at rest. They are not TLS certificates.
• D is wrong: private CA certificates are not trusted by public browsers.

A gateway endpoint routes S3 traffic privately with no hourly or data processing charge, so it skips the NAT gateway.

• A is wrong: another NAT gateway adds cost and still charges for the data.
• C is wrong: instances without public IPs cannot use an internet gateway, and it would expose the subnets.
• D is wrong: an interface endpoint works but has hourly and per-GB charges, so it costs more than a gateway endpoint.

Network ACLs are stateless. Responses to clients go back to the client's ephemeral port, so the ACL must allow outbound traffic on the ephemeral port range.

• A is wrong: security groups are stateful, so responses to allowed inbound traffic are already allowed out.
• B is wrong: inbound ephemeral ports are for responses to connections the server starts, not to client requests.
• C is wrong: a public subnet already routes to an internet gateway, and a NAT gateway is for outbound traffic from private subnets.

Failover routing sends traffic to the primary while it is healthy and switches to the secondary when its health check fails.

• B is wrong: weighted routing sends half the users to the maintenance site even when the ALB is healthy.
• C is wrong: latency routing picks the fastest endpoint, not the healthy one with a fallback.
• D is wrong: geolocation routing splits users by location, not by health.