Free Amazon Web Services SOA-C03 Practice Exam with Questions & Answers | Set: 2

RDS read replicas offload read traffic from the primary database, improving performance and availability. By directing reporting queries to the reader endpoint, the primary instance is freed from heavy read workloads.

ElastiCache is unsuitable for complex SQL reporting. CloudFront cannot front a database. Increasing instance size does not address inefficient read scaling.

Thus, read replicas are the correct solution.

According to the AWS Cloud Operations and Networking documentation, instances in a private subnet do not have a direct route to the internet gateway and thus require a NAT gateway for outbound internet access.

The correct configuration is to create a NAT gateway in the public subnet, associate an Elastic IP address, and then update the private subnet’s route table to send all 0.0.0.0/0 traffic to the NAT gateway. This enables instances in the private subnet to initiate outbound connections while keeping inbound traffic blocked for security.

Placing the NAT gateway inside the private subnet (Options C or D) prevents connectivity because it would not have a route to the internet gateway. Configuring routes from the public subnet to the NAT gateway (Option B) does not serve private subnet traffic.

Hence, Option A follows AWS best practices for enabling secure, managed, outbound-only internet access from private resources.

The symptoms point to two common database pressure sources: inefficient queries (driving high CPU and latency) and excessive concurrent connections (driving connection management overhead, read contention, and timeouts). The most effective remediation is to address both the SQL workload and the connection surge behavior.

Amazon RDS Performance Insights (Option A) is designed to help identify which SQL statements and wait events contribute most to database load. It provides a database-centric view of performance that highlights top SQL, top waits, and the relative impact of sessions on CPU and other resources. By using Performance Insights to pinpoint the highest-impact SQL and then tuning those queries (for example, improving indexes, reducing full scans, and optimizing query patterns), the company can lower CPU utilization and reduce query latency during peak hours.

Connection surges are best addressed with a managed connection pooling layer. RDS Proxy (Option E) provides connection pooling and multiplexing between application connections and the database, which reduces the overhead of establishing and maintaining a large number of database connections. During spikes, the proxy can smooth bursty connection behavior, improve failover handling, and reduce the risk of overwhelming the database with too many concurrent connections. This directly targets the observed timeouts and read performance degradation tied to surges.

Option B is not the best fit because CloudWatch Logs Insights is a log analytics tool; it is not the primary mechanism for deep SQL performance attribution in RDS and typically requires extensive logging configurations that add overhead. Option C would reduce availability and does not improve performance. Option D would make the problem worse: disabling pooling increases connection churn and overhead, amplifying timeouts and latency during peak traffic.

Therefore, combining Performance Insights query analysis/tuning with RDS Proxy connection pooling best resolves both root causes.

=================

When an AWS Lambda function is configured to run inside a VPC, it loses default internet access. All outbound traffic must be explicitly routed. In this scenario, the Lambda function resides in a private subnet and successfully connects to Amazon RDS, but it times out when attempting to publish messages to Amazon SQS. This indicates a lack of network connectivity to the SQS service endpoint.

There are two valid AWS-supported ways to restore connectivity. The first is to deploy a NAT gateway in a public subnet and update the private subnet route table to send outbound internet-bound traffic (0.0.0.0/0) to the NAT gateway. This allows the Lambda function to reach public AWS service endpoints, including SQS.

The second option is to create an interface VPC endpoint (AWS PrivateLink) for Amazon SQS. This enables private, secure connectivity to SQS directly within the AWS network without traversing the internet. This approach is often preferred for security-sensitive workloads and removes dependency on NAT gateways.

Option A would break database connectivity because the Lambda function must remain in the VPC to access the private RDS instance. Option B does not address outbound connectivity to SQS. Option E is incorrect because Amazon SQS does not support gateway endpoints; only interface endpoints are supported.

Therefore, deploying a NAT gateway or creating an SQS interface endpoint resolves the timeout issue.

High availability for an EC2-based web application behind an ALB is primarily achieved by eliminating single points of failure at the infrastructure layer. A single Availability Zone (AZ) deployment is vulnerable to AZ-level impairment (power/network issues, facility events, or service disruptions). The most direct and standard AWS approach is to distribute the Auto Scaling group across multiple AZs within the same Region.

Updating the Auto Scaling group to use subnets in at least two AZs allows instances to be launched across AZs automatically. The ALB is built to route traffic across targets in multiple AZs, and Auto Scaling can replace unhealthy instances in any enabled AZ. This provides resilience without the complexity of multi-Region architectures.

Options A and B address capacity for peak load but do not address the core availability requirement. Even with more instances, a full AZ outage would still take the entire application down if all instances are in the same AZ.

Option D (multi-Region) can improve resilience further, but it introduces significantly more operational overhead: cross-Region traffic routing, data replication, DNS failover strategy, application state handling, and potentially active-active or active-passive designs. For “make the application highly available” from a single-AZ baseline, multi-AZ in the same Region is the standard, least-overhead improvement.

The CloudWatch agent procstat plugin is specifically designed to collect per-process metrics such as CPU usage by process ID. It allows continuous, automated monitoring without manual intervention and integrates directly with CloudWatch.

Default CloudWatch metrics provide only instance-level CPU utilization and do not expose process-level details. Manual logins and Lambda-based polling introduce unnecessary operational overhead and are not scalable.

Therefore, configuring the procstat plugin is the most efficient solution.

AWS Systems Manager Run Command includes a built-in rate control feature that allows administrators to control the maximum number of concurrent executions across target instances. This directly addresses the requirement to limit downloads to 30 at a time without custom orchestration or additional services.

By targeting instances using tags, the solution automatically scales as new instances are added, which aligns with future growth expectations. Rate control ensures controlled concurrency and protects the private repository from overload.

Option A is manual and does not scale operationally. Option B introduces unnecessary complexity with Lambda and concurrency management that does not map cleanly to instance execution concurrency. Option D significantly increases architectural complexity without added value.

Run Command with rate control is the simplest, most native, and most scalable solution.

The requirement is to produce cost optimization recommendations for EBS volumes based on IOPS and throughput, and to do so with the most operational efficiency across potentially many instances and volumes. AWS Compute Optimizer is the most suitable service because it analyzes historical utilization metrics and configuration characteristics to generate rightsizing recommendations. When enabled, Compute Optimizer evaluates EBS volume performance patterns (including throughput and IOPS consumption) and can recommend more appropriate volume types or settings to reduce cost while meeting performance needs.

Option C is operationally efficient because it centralizes analysis. Instead of manually inspecting per-volume graphs, Compute Optimizer aggregates and evaluates data over time, reducing human effort and improving consistency. After sufficient observation time, the CloudOps engineer can review the findings and translate them into concrete actions such as reducing provisioned IOPS on io1/io2, selecting gp3 with tuned IOPS/throughput, or resizing volumes that are over-provisioned relative to actual demand.

Option A is manual and does not directly address IOPS/throughput rightsizing; it also incorrectly focuses on consumed space versus provisioned space, which is more relevant to capacity than performance provisioning. Option B is unrelated: EBS-optimized is an EC2 feature for dedicated EBS bandwidth and does not rightsize EBS volume performance or reduce over-provisioned IOPS/throughput. Option D introduces significant operational overhead by installing benchmarking tools and running synthetic tests, which is not scalable, can affect production performance, and still may not reflect real workload patterns.

Therefore, enabling AWS Compute Optimizer and using its EBS volume recommendations is the most operationally efficient approach.

The Instance Scheduler on AWS is an AWS-provided solution designed specifically to start and stop AWS resources such as Amazon RDS instances on a defined schedule. This directly aligns with the requirement to automatically manage RDS instances during predictable idle periods, such as weekends, to reduce costs.

RDS instances incur compute charges while running, even if idle. Stopping them during weekends eliminates those charges while retaining storage and backups. Instance Scheduler supports tag-based scheduling, centralized management, and automated start/stop workflows without custom scripting.

Option A introduces custom automation and ongoing maintenance overhead. Option C (Reserved Instances) is unsuitable because the databases are idle for long, predictable periods and Reserved Instances charge regardless of usage. Option D is incorrect because RDS does not support auto scaling of DB instance classes based on utilization.

Instance Scheduler is the most cost-effective and operationally efficient solution for this use case.

According to AWS Cloud Operations and VPC Networking documentation, when VPCs are peered, security groups can reference peer account security groups directly to restrict traffic between them.

This feature allows specifying the security group ID (sg-1234abcd) from the source account (111122223333) in the target database’s security group inbound rule. AWS automatically validates that the VPCs are connected through an existing VPC peering connection and that mutual permissions are properly configured.

You do not prefix the security group ID with the account or peering connection (Options A and B), and using the destination account ID (Option D) is incorrect because it represents the database side, not the source.

Hence, the correct configuration is Option C, which references the application servers’ security group directly for precise, least-privilege access control.