How are AWS CloudOps Engineer Associate questions generated?

dotCreds builds AWS CloudOps Engineer Associate practice questions from public exam objectives and AWS certification and documentation references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start AWS CloudOps Engineer Associate practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free AWS CloudOps Engineer Associate Practice Test

AWS CloudOps Engineer Associate Practice Test

Start today's 10-question AWS CloudOps Engineer Associate set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 150 Verified Questions

Questions updated at Jul 18, 2026, 1:30 PM CDT

Unlock the full SOA-C03 bank

150 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Unlock the full SOA-C03 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

150 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 140 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Why candidates miss this

Operators frequently conflate volume size and IOPS in `gp2` volumes, assuming a direct correlation. They believe increasing the volume size will automatically increase IOPS. However, `gp2` IOPS are tied to volume size, and this approach wastes storage capacity. The correct answer, migrating to `gp3`, allows independent IOPS provisioning. Likely wrong answer: Increase the volume size of the `gp2` volumes to 1,000 GiB to double the baseline IOPS to 3,000 Review focus: Amazon EBS gp3 Volumes

Interview question

Q: Our team is experiencing performance bottlenecks with an EC2 workload. We need to increase IOPS on the EBS volume without increasing its size. How would you approach this, and what are the tradeoffs involved? Strong answer: The first thing I'd do is evaluate whether switching to a `gp3` volume would meet the requirements. `gp3` allows independent scaling of IOPS and throughput, so we can provision exactly 3,000 IOPS without increasing the volume size. The tradeoff is that `gp3` volumes can be slightly more expensive than `gp2` volumes, but the ability to optimize performance without increasing capacity often makes it worthwhile. We'd also monitor the volume performance after the change to ensure it's meeting the needs of the application.

Understanding of EBS volume types and their performance characteristics
Ability to identify and evaluate tradeoffs between cost and performance
Problem-solving approach to performance bottlenecks
Awareness of monitoring and optimization

Caution: Recommending increasing the volume size as the default solution. Candidates who don't mention the tradeoffs or monitoring are missing key considerations.

Question 1 A production EC2 workload requires 3,000 IOPS for baseline performance. The current EBS volumes are provisioned as `gp2`. What is the most efficient volume change to meet this requirement without increasing the overall volume size?

Answer choices

A. Modify the volumes from `gp2` to `gp3`. Provision the exact IOPS and throughput required (e.g., 3,000 IOPS) independently of the volume size
B. Increase the volume size of the `gp2` volumes to 1,000 GiB to double the baseline IOPS to 3,000
C. Modify the volumes to Provisioned IOPS SSD (`io2`) and specify 3,000 IOPS
D. Attach a secondary `gp2` volume to the instance and configure software RAID 0 inside the operating system

Correct answer

Modify the volumes from `gp2` to `gp3`. Provision the exact IOPS and throughput required (e.g., 3,000 IOPS) independently of the volume size

Modify the volumes from `gp2` to `gp3`. Provision the exact IOPS and throughput required (e.g., 3,000 IOPS) independently of the volume size. gp3 separates size from provisioned performance, which avoids increasing capacity only to gain IOPS. Larger gp2 volumes, io2, or RAID can add cost or complexity beyond the stated need.

Wrong-answer review

B. Increase the volume size of the `gp2` volumes to 1,000 GiB to double the baseline IOPS to 3,000: Growing gp2 just for IOPS adds unnecessary capacity.
C. Modify the volumes to Provisioned IOPS SSD (`io2`) and specify 3,000 IOPS: io2 can provision IOPS but may be more than needed for the stated gp2-to-gp3 optimization.
D. Attach a secondary `gp2` volume to the instance and configure software RAID 0 inside the operating system: RAID across extra gp2 volumes adds operational complexity and is not the direct gp3 optimization.

Extra learning features

Objective/domain: Cost and Capacity

Source: Amazon EBS gp3 Volumes

Question 2 A production team needs to address an instance failure requiring diagnostics collection, service restart, and final instance reboot with administrator approval. To ensure consistent and auditable remediation, what documentation should the team create and maintain?

A. A spreadsheet that tells operators to improvise commands
B. A Systems Manager Automation runbook with the required actions and approval step
C. A CloudWatch dashboard with no action procedure
D. An S3 bucket policy that grants administrator access to everyone

A Systems Manager Automation runbook with the required actions and approval step

Objective/domain: Automation and Remediation

Source: AWS Systems Manager Automation

Question 3 An application role is denied when attempting to decrypt data with a customer-managed KMS key. The IAM role policy allows decrypt. Which KMS key policy configuration could be preventing the role from accessing the key?

A. The KMS Key Policy does not explicitly grant permission to the IAM role or delegate authority to the AWS account IAM policies
B. The application IAM role has not been registered in the KMS client side cache config file on the EC2 instance
C. The key's alias has not been mapped to the application's local environmental variable configuration
D. KMS customer managed keys do not support decryption privileges outside of the AWS root account

The KMS Key Policy does not explicitly grant permission to the IAM role or delegate authority to the AWS account IAM policies

Objective/domain: Security Operations

Source: AWS KMS Key Policies

Question 4 A network administrator is configuring two peered VPCs to allow private DNS name resolution across the peering connection. The administrator wants to ensure that instances in both VPCs can resolve internal hostnames using private DNS. Which setting within the VPC peering connection configuration must be verified to enable this functionality?

A. The VPC Peering connection settings must have 'Allow active resolution of DNS queries' (enableDnsHostnames/enableDnsSupport) enabled for both the requester and accepter VPCs
B. An active Route 53 Resolver outbound endpoint must be deployed in both subnets to forward peering DNS traffic
C. The DNS server addresses in the DHCP options set of VPC A must be updated to include the IP address of the VPC B DNS server
D. VPC Peering does not support private DNS hostname resolution; clients must use public Route 53 zones

The VPC Peering connection settings must have 'Allow active resolution of DNS queries' (enableDnsHostnames/enableDnsSupport) enabled for both the requester and accepter VPCs

Objective/domain: Networking Operations

Source: VPC Peering DNS Resolution

Question 5 During a canary deployment, the release team needs a single view to monitor new 5xx errors, p95 latency, and alarm states for the service. Which CloudWatch design best enables this on-call review process?

A. Purchase Reserved Instances for the application servers
B. Store the application source branch in a CloudWatch log group
C. Build a CloudWatch dashboard that combines relevant metrics, log-derived metrics, and alarms
D. Replace the application IAM role with a metric filter

Build a CloudWatch dashboard that combines relevant metrics, log-derived metrics, and alarms

Objective/domain: Monitoring and Logging

Source: Amazon CloudWatch documentation

Question 6 During an audit, management requests evidence that the CloudOps team implements controls for access restriction, change tracking, and managed instance maintenance. Which combination of practices best demonstrates compliance with this request?

A. Least privilege, audit logging, patch management, and controlled access
B. One shared password for every administrator
C. Manual deletion of logs before handoff
D. Ignoring operating system updates on customer-managed instances

Least privilege, audit logging, patch management, and controlled access

Source: AWS Identity and Access Management documentation

Question 7 A production service currently relies on a single EC2 instance. The team has not previously tested failover procedures. Which action most directly enhances the service's operational resilience?

A. Remove monitoring to reduce operational noise
B. Keep the single instance and add only a name tag
C. Introduce health checks, alarms, tested recovery steps, and Multi-AZ design where justified
D. Disable scaling because failures should be handled manually

Introduce health checks, alarms, tested recovery steps, and Multi-AZ design where justified

Objective/domain: Reliability

Source: AWS Well-Architected Reliability Pillar

Question 8 Traffic is failing to return to an application running in a private subnet after a custom route table change. Diagnostic troubleshooting is required. Which set of controls is most directly relevant to identifying the root cause of this issue?

A. Check route symmetry, security groups, network ACLs, and endpoint or gateway configuration
B. Check whether budgets are named after the subnet
C. Check whether Route 53 registered the instance password
D. Check whether CloudTrail stores packet payloads

Check route symmetry, security groups, network ACLs, and endpoint or gateway configuration

Source: Amazon VPC documentation

Question 9 An ECS service publishes error-rate and memory-utilization metrics. Operations teams require a single alarm notification that triggers only when *both* the error rate and memory utilization are simultaneously in the ALARM state. What is the optimal configuration to achieve this?

A. An EventBridge schedule that runs every five minutes regardless of alarm state
B. A Cost Anomaly Detection monitor for the ECS service
C. A Route 53 health check that ignores CloudWatch alarm state
D. A CloudWatch composite alarm based on the two underlying CloudWatch alarms

A CloudWatch composite alarm based on the two underlying CloudWatch alarms

Question 10 A workload experiences daily spikes in demand alongside a consistent baseline. The team is evaluating Savings Plans to optimize costs while maintaining sufficient capacity for peak periods. Which operational practice best aligns with this scenario?

A. Disable alarms and hope fewer notifications reduce cost
B. Analyze usage, right-size the baseline, use scaling for spikes, and apply budget or Savings Plans guardrails where appropriate
C. Run peak capacity permanently on every workload
D. Use only a support case to decide sizing

Analyze usage, right-size the baseline, use scaling for spikes, and apply budget or Savings Plans guardrails where appropriate

Source: AWS Cost Management documentation

AWS CloudOps Engineer Associate Practice Test

Unlock the full SOA-C03 bank

Practice with explanations that teach.

What you get with free practice

A production EC2 workload requires 3,000 IOPS for baseline performance. The current EBS volumes are provisioned as `gp2`. What is the most efficient volume change to meet this requirement without increasing the overall volume size?

A production team needs to address an instance failure requiring diagnostics collection, service restart, and final instance reboot with administrator approval. To ensure consistent and auditable remediation, what documentation should the team create and maintain?

An application role is denied when attempting to decrypt data with a customer-managed KMS key. The IAM role policy allows decrypt. Which KMS key policy configuration could be preventing the role from accessing the key?

During a canary deployment, the release team needs a single view to monitor new 5xx errors, p95 latency, and alarm states for the service. Which CloudWatch design best enables this on-call review process?

During an audit, management requests evidence that the CloudOps team implements controls for access restriction, change tracking, and managed instance maintenance. Which combination of practices best demonstrates compliance with this request?

A production service currently relies on a single EC2 instance. The team has not previously tested failover procedures. Which action most directly enhances the service's operational resilience?

Traffic is failing to return to an application running in a private subnet after a custom route table change. Diagnostic troubleshooting is required. Which set of controls is most directly relevant to identifying the root cause of this issue?

An ECS service publishes error-rate and memory-utilization metrics. Operations teams require a single alarm notification that triggers only when *both* the error rate and memory utilization are simultaneously in the ALARM state. What is the optimal configuration to achieve this?

A workload experiences daily spikes in demand alongside a consistent baseline. The team is evaluating Savings Plans to optimize costs while maintaining sufficient capacity for peak periods. Which operational practice best aligns with this scenario?

You are viewing today’s free 10. Unlock 140 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full SOA-C03 bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why candidates miss this

Interview question

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are AWS CloudOps Engineer Associate questions generated?

How are explanations sourced?

What score do I get?

Why use this site?

An ECS service publishes error-rate and memory-utilization metrics. Operations teams require a single alarm notification that triggers only when both the error rate and memory utilization are simultaneously in the ALARM state. What is the optimal configuration to achieve this?