SOA-C03 Free Practice Test

A company needs to log and audit any principal that publishes messages to Amazon Simple Notification Service (Amazon SNS) topics and Amazon Simple Queue Service (Amazon SQS) queues. The company wants to ensure that all communication with these services uses VPC endpoints.
Which combination of solutions will meet these requirements? (Select TWO.)

1. A. Use Amazon CloudWatch Logs to collect message content from Amazon SNS and Amazon SQ
2. B. Deliver logs to an Amazon S3 bucket for querying.
3. C. Set up AWS CloudTrai
4. D. Enable tracking of data events for Amazon SNS and Amazon SQ
5. E. Deliver logs to an Amazon S3 bucket for querying.
6. F. Create Amazon EventBridge rules to gather Amazon SNS and Amazon SQS event
7. G. Store the events in an Amazon S3 bucket.
8. H. Configure VPC endpoints for Amazon SNS and Amazon SQ
9. I. Inspect the vpcEndpointId field in the AWS CloudTrail logs.
10. J. Configure VPC endpoints for Amazon SNS and Amazon SQ
11. K. Inspect the vpcEndpoint field in the Amazon CloudWatch logs.

Correct Answer: BD

A CloudOps engineer must ensure that all of a company's current and future Amazon S3 buckets have logging enabled. If an S3 bucket does not have logging enabled, an automated process must enable logging for the S3 bucket.
Which solution will meet these requirements?

1. A. Use AWS Trusted Advisor to perform a check for S3 buckets that do not have logging enable
2. B. Configure the check to enable logging for S3 buckets that do not have logging enabled.
3. C. Configure an S3 bucket policy that requires all current and future S3 buckets to have logging enabled.
4. D. Use the s3-bucket-logging-enabled AWS Config managed rul
5. E. Add a remediation action that uses an AWS Lambda function to enable logging.
6. F. Use the s3-bucket-logging-enabled AWS Config managed rul
7. G. Add a remediation action that uses the AWS-ConfigureS3BucketLogging AWS Systems Manager Automation runbook.

Correct Answer: D

A company's AWS accounts are in an organization in AWS Organizations. The organization has all features enabled. The accounts use Amazon EC2 instances to host applications. The company manages the EC2 instances manually by using the AWS Management Console. The company applies updates to the EC2 instances by using an SSH connection to each EC2 instance.
The company needs a solution that uses AWS Systems Manager to manage all the organization's current and future EC2 instances. The latest version of Systems Manager Agent (SSM Agent) is running on the EC2 instances.
Which solution will meet these requirements?

1. A. Configure a home AWS Region in Systems Manager Quick Setup in the organization's management accoun
2. B. Deploy the Systems Manager Default Host Management Configuration Quick Setup from the management account.
3. C. Configure a home AWS Region in Systems Manager Quick Setup in the organization's management accoun
4. D. Create a Systems Manager Run Command that attaches the AmazonSSMServiceRolePolicy IAM policy to every IAM role that the EC2 instances us
5. E. Invoke the command in every account in the organization.
6. F. Create an AWS CloudFormation stack set that contains a Systems Manager parameter to define the Default Host Management Configuration rol
7. G. Use the organization's management account to deploy the stack set to every account in the organization.
8. H. Create an AWS CloudFormation stack set that contains an EC2 instance profile with the AmazonSSMManagedEC2InstanceDefaultPolicy IAM policy attache
9. I. Use the organization's management account to deploy the stack set to every account in the organization.

Correct Answer: A

An environment consists of 100 Amazon EC2 Windows instances. The Amazon CloudWatch agent is deployed and running on all EC2 instances with a baseline configuration file to capture log files. There is a new requirement to capture DHCP log files that exist on 50 of the instances.
What is the MOST operationally efficient way to meet this new requirement?

1. A. Create an additional CloudWatch agent configuration file to capture the DHCP log
2. B. Use AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option.
3. C. Log in to each EC2 instance with administrator rights and create a PowerShell script to push logs to CloudWatch.
4. D. Run the CloudWatch agent configuration wizard on each EC2 instance and add DHCP logs manually.
5. E. Run the CloudWatch agent configuration wizard on each EC2 instance and select the advanced detail level.

Correct Answer: A

A medical research company uses an Amazon Bedrock powered AI assistant with agents and knowledge bases to provide physicians quick access to medical study protocols. The company needs to generate audit reports that contain user identities, usage data for Bedrock agents, access data for knowledge bases, and interaction parameters.
Which solution will meet these requirements?

1. A. Use AWS CloudTrail to log API events from generative AI workload
2. B. Store the events in CloudTrail Lak
3. C. Use SQL-like queries to generate reports.
4. D. Use Amazon CloudWatch to capture generative AI application log
5. E. Stream the logs to Amazon OpenSearch Servic
6. F. Use an OpenSearch dashboard visualization to generate reports.
7. G. Use Amazon CloudWatch to log API events from generative AI workload
8. H. Send the events to an Amazon S3 bucke
9. I. Use Amazon Athena queries to generate reports.
10. J. Use AWS CloudTrail to capture generative AI application log
11. K. Stream the logs to Amazon Managed Service for Apache Flin
12. L. Use SQL queries to generate reports.

Correct Answer: A