SOA-C03 Exam Questions 2026 – Real Practice Test with Verified Answers

Explanation:
Because S3 Versioning is enabled, each object update creates additional object versions. If old versions are never removed, storage costs keep increasing even when only the latest version is needed operationally. The lowest-overhead solution is to configure an S3 Lifecycle rule to expire noncurrent object versions after the required 90-day compliance retention period. This preserves object changes for the required window and then automatically removes older versions to reduce cost.
Option A is not ideal because creating delete markers affects current object visibility and does not clean up old noncurrent versions efficiently.
Option C adds unnecessary backup complexity.
Option D creates excessive event scheduling and Lambda management overhead. S3 Lifecycle is the native cost-optimization control for versioned-object retention.

Explanation:
CloudFormation drift detection compares the actual configuration of stack resources with the expected configuration defined in the CloudFormation template. This directly satisfies the requirement to find resources that do not match the expected configuration. Scheduling drift detection with Amazon EventBridge automates the audit and avoids manual CLI checks or repository reviews. Repository reviews only validate desired template code, not the real deployed state. EventBridge notifications about resource creation do not prove that resources remain compliant after deployment. AWS CLI scripts could work, but they would require custom logic and ongoing maintenance. For CloudOps, the best approach is to use the native drift detection capability and automate it on a schedule, then capture the drift results for operational review and remediation planning.

Explanation:
EC2 Image Builder is a managed service that automates the creation, testing, vulnerability scanning, and distribution of AMIs. It supports scheduled image pipelines, which makes it ideal for weekly application updates.
Image Builder integrates with Amazon Inspector to perform vulnerability scans during image creation, fulfilling the security requirement. Custom image recipes define application dependencies and installation steps, ensuring consistency across deployments.
Manual AMI creation, cron-based scripts, or direct API calls require ongoing maintenance and do not natively support vulnerability scanning.
Therefore, EC2 Image Builder is the most operationally efficient solution.

Explanation:
CloudFront caches content at edge locations to reduce origin requests and improve performance. When a static website is updated by overwriting existing object keys (for example, updating index.html in the same S3 path), CloudFront may continue to serve the cached versions of those objects until the cache’s time-to-live (TTL) expires. This behavior commonly produces a delay where some viewers still receive the old site version, sometimes for many hours, depending on the configured TTLs and any cache headers that CloudFront is honoring.
A CloudFront invalidation (Option D) is designed to address exactly this situation: it removes cached objects from CloudFront edge caches so that the next request for those objects forces CloudFront to retrieve the latest versions from the S3 origin and cache them again. By invalidating key objects such as /index.html (and potentially additional paths if needed), the company can ensure users see the newest deployment quickly without waiting for TTL expiration.
Option A is not the best answer because “adding a Cache-Control header to requests” does not immediately clear content already cached at edge locations; it primarily influences caching behavior for future fetches and can still leave existing cached objects in place until they expire.
Option B only enforces HTTPS and does not affect cache freshness or object replacement visibility.
Option C (CachingOptimized) is intended to improve caching efficiency and performance for typical workloads; it does not provide immediate propagation of updated objects and can result in CloudFront serving cached responses until TTLs expire.
Therefore, the most direct solution to display the updated website as quickly as possible is to create
a CloudFront invalidation.

Explanation:
The AWS Cloud Operations and Systems Manager documentation states that to use Session Manager privately within a VPC (without internet access), three interface VPC endpoints must be configured:
com.amazonaws.<region>.ssm C enables Systems Manager core API communication.
com.amazonaws.<region>.ec2messages C allows the agent to send and receive messages between EC2 and Systems Manager.
com.amazonaws.<region>.ssmmessages C enables real-time interactive communication for Session Manager connections.
These endpoints ensure secure, private connectivity over the AWS network, eliminating the need for public internet routing.
Endpoints for S3, Step Functions, or EC2 API (Options C, E, F) are not required for Session Manager functionality.
Thus, the correct combination is A, B, and D, aligning with AWS CloudOps best practices for secure, private Systems Manager access.
Reference: AWS Cloud Operations & Systems Manager Guide C Configuring VPC Endpoints for Session Manager Private Connectivity