Amazon SOA-C03 - Questions & Answers

Per the AWS Cloud Operations and Service Catalog documentation, when a portfolio is shared across AWS accounts, the recipient account imports the shared portfolio.
The recipient CloudOps engineer cannot modify the original products or their configurations but can:

Add products from the imported portfolio into their local portfolios for deployment, Control end-user access in the recipient account, and Manage local constraints or permissions. However, the recipient cannot edit, delete, or reconfigure the shared products (Options B, C, and D). The source (owner) account retains full administrative control over products, launch roles, and lifecycle policies. This model aligns with AWS CloudOps principles of centralized governance with distributed self-service deployment across multiple accounts.
Thus, Option A is correct-imported portfolios allow the recipient to add products to a local portfolio but not alter the shared configuration.

References:
AWS Cloud Operations & Governance Guide - Managing Shared AWS Service Catalog
Portfolios Across Multiple Accounts

AWS Cloud Operations, Bedrock, and Governance documentation AWS CloudTrail is the authoritative service for capturing API activity and audit trails across AWS accounts. For Amazon Bedrock, CloudTrail records all user-initiated API calls, including interactions with agents knowledge bases, and, generative AI model parameters.
Using CloudTrail Lake, organizations can store, query, and analyze CloudTrail events directly without needing to export data. CloudTrail Lake supports SQL-like queries for generating audit and compliance reports, enabling the company to retrieve information such as user identity, API usage, timestamp, model or agent ID, and invocation parameters.
In contrast, CloudWatch focuses on operational metrics and log streaming, not API-level identity data.
OpenSearch or Flink would add unnecessary complexity and cost for this use case.
Thus, the AWS-recommended CloudOps best practice is to leverage CloudTrail with CloudTrail Lake to maintain auditable, queryable API activity for Bedrock workloads, fulfilling governance and compliance requirements.

References:
AWS Cloud Operations & Governance Guide - Section: Auditing and Governance for
Generative AI Workloads Using AWS CloudTrail and CloudTrail Lake

AWS CloudOps automation best practices recommend using AWS Systems Manager Quick Setup for organization-wide management and configuration of EC2 instances. The Default Host Management Configuration Quick Setup automatically enables Systems Manager capabilities such as Patch Manager, and AutomationInventory Session Manager across all managed instances within the organization.
When deployed from the management account, Quick Setup automatically integrates with AWS Organizations to propagate configuration and permissions to existing and future accounts. This meets the requirement for organization-wide management with no manual configuration or SSH access. AWS documentation notes: "You can use Quick Setup in the management account of an organization in AWS Organizations to configure Systems Manager capabilities for all accounts and Regions. Quick Setup automatically keeps configurations up to date."
Options B, C, and D require custom deployments or manual IAM updates, lacking centralized automation.
Therefore, Option A fully satisfies CloudOps standards for automated provisioning and ongoing management of EC2 instances across an organization.

References (AWS CloudOps Documents / Study Guide):
AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 3: Deployment, Provisioning and Automation AWS Systems Manager - Quick Setup and Default Host Management Configuration AWS Organizations Integration with Systems Manager
AWS Well-Architected Framework - Operational Excellence Pillar

AWS Cloud Operations and Security documentation AWS CloudTrail is the authoritative service for recording API activity across all AWS services within an account.
When an access key is compromised, CloudTrail logs all API requests made using that key, including details such as:

The user identity (access key ID) that made the request, The service operation, resource, and timestamp affected, and The source IP address and region of the request.
By searching the CloudTrail event history for the specific access key ID, the CloudOps engineer can identify every action performed by that key during the suspected breach window.
Other options are incorrect:

EventBridge (A) is event-driven, not historical.
CloudWatch Logs (B) monitors system logs, not AWS API activity.
VPC Flow Logs (D) track network-level traffic, not API calls.
Therefore, the correct solution is Option C - using AWS CloudTrail event history to audit and trace all actions executed via the compromised access key.

References:
AWS Cloud Operations & Security Management Guide - Investigating Compromised Access
Keys Using AWS CloudTrail

AWS Cloud Operations and Governance documentation AWS Trusted Advisor provides automated checks for security group rules across all accounts, including identifying ports open to 0.0.0.0/0.
When viewed in organizational mode, Trusted Advisor integrates with AWS Organizations, allowing administrators to access organization-wide security findings from a central management account. This approach requires no custom code, additional infrastructure, or manual inspection, providing immediate visibility and the lowest operational overhead.

AWS CLI scripts (Option A) or Lambda automation (Option C) introduce additional maintenance, and Amazon Inspector (Option D) is focused on instance-level vulnerabilities, not network access rules.
Therefore, Option B is the AWS-recommended CloudOps best practice for centralized and low-effort open-port auditing.

References:
AWS Cloud Operations & Governance Guide - Using Trusted Advisor Organizational View for
Security Group Port Checks

The AWS Cloud Operations and Security documentation confirms that AWS WAF (Web Application Firewall) is designed to protect web applications from application-layer threats, including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities.
When integrated with an Application Load Balancer, AWS WAF inspects incoming traffic using rule groups.
The AWS Managed Rules for SQL Injection Protection provide preconfigured, continuously updated filters that detect and block malicious SQL patterns.
AWS Shield (Standard or Advanced) defends against DDoS attacks, not application-layer SQL attacks, and vulnerability scanners (Option C) only detect, not prevent, exploitation.
Thus, Option D provides the correct, managed, and automated protection aligned with AWS best practices.

References:
AWS Cloud Operations & Security Guide - Protecting Applications from SQL Injection with
AWS WAF Managed Rules

CloudWatch Logs data protection provides native redaction/masking of sensitive data at ingestion and query. AWS documentation states it can "detect and protect sensitive data in logs" using data identifiers, and that authorized users can "use the unmask action to view the original data." Creating a data protection policy on the log group masks PII by default for all viewers, satisfying the requirement to redact personal information. Granting only the security team permission to invoke the unmask API operation ensures that unredacted content is restricted. Option B (KMS) encrypts at rest but does not redact fields; encryption
alone does not prevent plaintext visibility to authorized readers. Options A and D add complexity and latency, move data out of CloudWatch, and do not provide default inline redaction/unmask controls in CloudWatch itself. Therefore, the CloudOps-aligned, managed solution is to use CloudWatch Logs data protection with appropriate data identifiers and unmask permissions limited to the security team.

References (AWS CloudOps Documents / Study Guide):
AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Monitoring & Logging
Amazon CloudWatch Logs - Data Protection (masking/redaction with data identifiers)
CloudWatch Logs - Permissions for masking and unmasking sensitive data AWS Well-Architected Framework - Security and Operational Excellence (sensitive data handling)

AWS Cloud Operations and Cost Management documentation, AWS Budgets is the recommended service to track and alert on cost thresholds across all AWS accounts and resources. It allows users to define cost, usage, or reservation budgets, and configure notifications to trigger when usage or cost reaches defined percentages of the budgeted value (e.g., 75%, 90%, 100%).
The AWS Budgets system integrates natively with Amazon Simple Notification Service (SNS) to deliver alerts to an email distribution list or SNS topic subscribers. AWS Budgets supports granular cost filters, including specific service categories such as data transfer, regions, or linked accounts, ensuring precise visibility into inter-Region transfer costs.
By contrast, CloudWatch billing alarms (Option B) monitor total account charges only and do not allow detailed service-level filtering, such as data transfer between Regions. Cost and Usage Reports (Option A) are for detailed cost analysis, not real-time alerting, and VPC Flow Logs (Option D) capture traffic data, not billing or cost-based metrics.
Thus, using AWS Budgets with a 75% alert threshold best satisfies the operational and notification requirements.

References:
AWS CloudOps and Cost Management Guide - Section: AWS Budgets for Cost Monitoring and
Alerts

AWS Cloud Operations and EC2 Connectivity documentation EC2 Instance Connect Endpoint allows access to instances without internet exposure or open SSH ports. However, for successful connectivity, the EC2 instance must have Systems Manager permissions through an IAM instance profile.
If no IAM instance profile is attached, the instance cannot establish a control channel with the Systems Manager service, and EC2 Instance Connect cannot authenticate the session.
Opening port 22 (Option B) is unnecessary and contradicts the private subnet design. HTTPS rules (Option A) are irrelevant because EC2 Instance Connect communicates through AWS APIs, not direct HTTPS connections. Recreating the instance with a key pair (Option D) bypasses the intended keyless connection mechanism.
Therefore, Option C - attaching an IAM instance profile with Systems Manager permissions - enables secure, private access through EC2 Instance Connect Endpoint.

References:
AWS Cloud Operations & EC2 Connectivity Guide - Enabling EC2 Instance Connect Endpoint
Access via Systems Manager Permissions

In the AWS Cloud Operations and Aurora documentation, when data loss occurs due to human error such as dropped tables, Point-in-Time Recovery (PITR) is the recommended method for restoration. PITR creates a new Aurora cluster restored to a specific time before the failure.
The restored cluster has a new endpoint that must be reconfigured in the application to resume normal operations. AWS does not support performing PITR directly on an existing production database because that would overwrite current data.
Aurora Backtrack (Option A) applies only to Aurora MySQL, not PostgreSQL.
Option B is incorrect because PITR cannot be executed in place.
Option D refers to an import process from S3, which is unrelated to time-based recovery.
Hence, Option C is correct and follows the AWS CloudOps standard recovery pattern for PostgreSQL workloads.

References:
AWS Cloud Operations & Aurora Guide - Section: Performing Point-in-Time Recovery for
Aurora PostgreSQL Clusters