SOA-C03 — frequently asked questions

Standard health checks only verify basic connectivity and response codes. They do not detect application-level logic errors or statefulness issues that cause random failures.

No. If session affinity is enabled, the ALB routes requests to the same instance regardless of the algorithm. Changing the algorithm does not resolve errors from a single broken instance holding a session.

Route 53 only evaluates health automatically for Alias records with 'Evaluate Target Health' set to Yes. Standard records require explicit health check association.

No. Reducing TTL only affects how quickly clients refresh cached DNS records. It does not make Route 53 aware of endpoint failures or exclude them from responses.

No, ALBs only support HTTP/HTTPS traffic. SMB uses different ports and protocols not supported by standard load balancers.

Storage Gateway primarily caches data locally and stores it in S3; it does not offer native Multi-AZ redundancy for the gateway instance itself.

Slow start applies to targets that are newly registered or that transition to healthy after being unhealthy; a plain reboot leaves the registration unchanged, so you must deregister and register again.

It only controls how long the ALB waits for a health check response before marking a target unhealthy, so it delays failure detection rather than throttling or ramping request volume.

While presigned URLs are secure, managing an EC2 instance to generate them adds administrative overhead. CloudFront OAC is a managed service that handles delivery and caching automatically.

No. OAC ensures that only CloudFront can access the private S3 bucket. End-users download from CloudFront, but the underlying S3 bucket remains completely private and protected by the account-level block.

Yes, you can replicate SSE-S3 encrypted objects across accounts as long as you grant the s3:ObjectOwnerOverrideToBucketOwner permission.

No, SSE-KMS is not required. You can use SSE-S3, but you must configure the ownership override permission in both the IAM role and bucket policy.

SSM Agent enables Session Manager only with an instance profile and private SSM endpoints; option B omits the role and opens inbound SSH unnecessarily.

Yes for this design: placing it in the private subnet lets administrators reach the private instance through the endpoint without an internet gateway or public IP.

IAM roles define what the Lambda function can do internally. Resource policies define who can invoke the function. S3 needs explicit permission via the resource policy.

Yes, if any existing destination fails validation, S3 rejects the entire update. However, missing permissions on the new target is the primary architectural check.

An Internet Gateway allows instances to reach the internet but does not support inbound SSH initiation to private subnets securely.

No, NAT Gateways only support outbound internet traffic from private subnets, not inbound connections.

CloudWatch alarms are event-driven and trigger when a metric crosses a threshold. They cannot be scheduled to fire at a specific time every day.

No. StartInstances starts an instance that is in a stopped state. To reboot a running instance, you must use StopInstances followed by StartInstances, or use the Restart action in SSM.

Vertical scaling adds temporary capacity but leaves the web server and database on one failure domain. It does not provide horizontal elasticity or automatic failover for PostgreSQL.

No. CloudFront can cache and offload some content delivery, but it does not scale the stateless web server or make the single PostgreSQL database highly available.

Creating a role for Lambda requires iam:CreateRole. InvokeFunction only runs an existing function, so option B is not granted by this policy.

No. DescribeLoadBalancers is read-only; deletion needs elasticloadbalancing:DeleteLoadBalancer, which is not in the policy's Action list.

Adding a policy scopes permissions but still requires permanent Access Keys, violating the requirement to avoid them.

Use AssumeRoleWithSAML when integrating with an external Identity Provider (like AD FS or Okta) that issues SAML assertions, not for direct SaaS SDK usage.

Route 53 health checks support DNS failover, not per-target routing inside the application tier. An ALB's target-group health checks remove individual unhealthy application servers from traffic.

A CloudWatch alarm can trigger notifications or a Lambda action, but it does not automatically deregister the instance from a load balancer's healthy target pool. The ALB health check performs that routing decision.

EventBridge can react to RunInstances events, but it cannot inject an installer step into the instance launch or reboot the instance to install software. It also does not cover existing instances automatically.

Systems Manager associations are Regional resources, so each Region needs its own association to target managed instances there. A single association does not automatically span all Regions.

A NAT gateway must sit in a public subnet with a route to an internet gateway; in a private subnet it has no outbound path and cannot translate traffic.

No. Public instances use the internet gateway directly; only the private subnet's route table needs 0.0.0.0/0 pointing at the NAT gateway.

Latency records are chosen by measured resolver-to-Region latency, not by an operator-set percentage, so you cannot dial a deliberate 5% ramp toward the green ALB.

Each weighted alias record carries a health check; an unhealthy green record is excluded from answers, so all DNS responses go to the healthy blue ALB without manual intervention.

Cost categories group costs using existing tags or accounts, but they do not activate user-defined tags or apply Project tags, so they cannot replace the initial tagging setup.

No. The tag key must be activated in the Billing console first, and activation can take up to 24 hours before tag data appears in Cost Explorer.

A distributed template can be modified or skipped by teams, and the parameter allows either tag; only Service Catalog products constrain the input and policy at provisioning.

AWS Config evaluates buckets after they exist, so a noncompliant bucket can be created and used before remediation runs; it is detective, not preventive.

CloudFront requires each alternate domain name to be unique across distributions, so the existing association must be removed before the new stack can use it.

No, CloudFront allows up to 100 CNAMEs per distribution; the limit is unrelated to the uniqueness conflict in the error.

AWS WAF protects supported entry points such as CloudFront distributions and load balancers; an S3 bucket is not a direct WAF association target, so the web ACL must attach to CloudFront.

A web ACL associated with CloudFront is global-scoped, even though the console and API resources are created in us-east-1.

A NAT gateway translates IPv4 addresses only. IPv6 egress uses an egress-only internet gateway, which allows outbound connections and their return traffic but blocks inbound initiation.

Add a ::/0 destination targeting the egress-only internet gateway, then associate that route table with the IPv6-only subnets so all IPv6 traffic follows it.

The primary workgroup is shared, and a user-set result location is a client-side setting that workgroup enforcement can override, so per-team isolation is not guaranteed.

No. Glue databases organize table metadata for Athena; the query result S3 path is configured on the Athena workgroup, not on the Glue database.

ALB listeners only support HTTP, HTTPS and gRPC protocols, so a generic TCP service on port 1028 cannot be terminated or forwarded by an ALB.

A GWLB distributes traffic to third-party virtual appliances using GENEVE on port 6081; it is not used to load balance application traffic to EC2 web/app servers.

CloudFront handles cookies as a separate cache-behavior setting; forwarding headers does not guarantee the application's session cookie reaches the ALB and backend instance.

No, it only changes how the ALB chooses a target for new requests; it does not pin a returning user to the same EC2 instance holding their session state.

IAM policies only authorize or deny API actions; they do not monitor resource tags or run remediation, so an IAM policy cannot terminate instances on its own.

Yes. AWS Config can evaluate required tags and trigger remediation through an SSM Automation runbook such as AWS-TerminateInstance when an EC2 instance is noncompliant.

That approach adds manual launch and volume-restore steps. AWS Backup can create the new EC2 instance directly from the EC2 recovery point, which is faster.

EC2 restores create a new instance from the recovery point rather than overwriting the original instance, so the DR test uses a separate restored instance.

Scheduled scaling handles the predictable 09:00–17:00 load pattern but cannot react to unexpected bursts, so the fleet could lose its required 50% CPU headroom.

A 90% target leaves only about 10% CPU headroom, which violates the requirement to keep 50% CPU available for bursts.

Transfer Acceleration optimizes transfers into S3, not edge caching for viewers; CloudFront serves cached images and videos from locations near US and European users.

No, CloudFront can access a private S3 bucket through Origin Access Control, so the static content stays protected while edge locations serve it.

CloudTrail records API calls such as RequestSpotInstances, not internal Spot status transitions like instance-stopped-no-capacity; CloudWatch Events/EventBridge emits those status events.

A Lambda function can cancel and recreate the request or modify a Spot Fleet request configuration to include the additional instance family.

The legacy cross-account cross-Region console setting is enabled in the account that views the dashboard, not in each application account, and it does not give the unified source-account link that cross-account observability provides.

Yes. A source account in any Region can be linked to the monitoring account, so a single dashboard in one Region can show metrics and alarms from all of them.

GuardDuty analyzes flow logs, DNS logs, and CloudTrail events for malicious activity. It detects behavior such as port scanning but does not inventory security group ingress rules.

No. An SCP is a permissions guardrail that allows or denies API actions across an organization; it does not scan or report existing security group rules.

Macie discovers sensitive data in Amazon S3, not in SNS message payloads; it cannot sit in the Lambda-to-SNS path and redact messages.

It can audit, deny, or redact based on the policy action and data identifiers you configure, so it can enforce protection rather than only report findings.

AWS KMS does not let you export standard customer managed key material for import into another account; cross-account use is granted through the key policy, not by moving the key.

Encrypted AMIs cannot be made public, and public sharing would not give the second account the KMS decrypt permissions required to launch an instance.

SNS pushes messages to subscribers rather than being polled, and Systems Manager does not publish EC2 launch events to SNS, so option B adds cost and delay without a real trigger.

No. An instance event window defines time ranges that suppress disruptive events such as reboots or migrations; it is not a notification target for launch events.

Amazon EventBridge has no native Site-to-Site VPN tunnel-state event in this scenario; a CloudWatch alarm on tunnel state can directly trigger SNS instead.

No. CloudTrail records API activity such as CreateVpnConnection, not data-plane tunnel state; Athena queries over CloudTrail logs are not an immediate outage alert.

A metric filter converts matching log events into CloudWatch metrics; the searchable raw events and their retention live in the CloudWatch Logs log group, which must be kept for 365 days.

No. SQS message retention is capped at 14 days, so an SQS and Lambda design cannot provide a one-year archive for searching.

It reacts only after a backup job has already failed and adds custom code, logs, and alarms to maintain; Tape Gateway auto-create prevents the shortage natively.

You specify a minimum number of virtual tapes, a barcode prefix, and a tape pool so new tapes are created and assigned before jobs run out of capacity.

AWS Config records and aggregates resource compliance data; it does not deploy or modify resources, so it cannot enforce the baseline configuration itself.

A Lambda-based deployment needs custom cross-account roles, event detection, retries, and maintenance; StackSets automatic deployments provides this natively for organization accounts.

Restoring a 5 TB snapshot creates a new cluster and requires endpoint or DNS changes, so it is too slow and disruptive for frequent uninterrupted micro updates.

Backtrack rewinds the existing cluster in place to a point before the bad update, avoiding a full 5 TB restore and endpoint reconfiguration.

Security group referencing does not work across Regions, so the database's inbound rule must use the eu-central-1 VPC or instance private CIDR instead.

A VPN adds tunnel and gateway management overhead, while VPC peering gives direct private routing between the two VPCs for this cross-Region database connection.

Data Lifecycle Manager creates EBS snapshots for EC2 volumes, not RDS database backups. RDS automated backups also cannot enforce 11-month or 7-year retention.

Each rule defines its own frequency and lifecycle, so daily, weekly, monthly, and yearly retention can be enforced independently within a single tagged backup plan.

Container Insights reports container and cluster metrics and logs, but it does not trace one request across services or generate an X-Ray-style service dependency map.

No. VPC Flow Logs capture network flow metadata, not application transaction spans, so they cannot show per-request latency between microservices.

S3 only supports SNS, SQS, Lambda, and EventBridge as notification destinations. API Gateway is not on that list, so the event must be relayed by EventBridge.

ObjectAcl:Put fires only when an object's ACL changes, not when a new feedback item is uploaded. Uploads generate ObjectCreated events instead.

Route 53 health checks test endpoint reachability, not scripted multi-step user journeys. They cannot replay the same routes and actions that a CloudWatch Synthetics canary script performs.

No. SuccessPercent is the percentage of canary runs that succeeded; an alarm below 95% fires when more than 5% of runs fail, matching the fewer-than-95%-error-free requirement.

An SCP can deny new 0.0.0.0/0 rules, but it does not modify existing security groups. Remediation requires AWS Config with an action such as SSM Automation or Lambda.

Yes, with a delegated administrator and an organization aggregator, AWS Config can evaluate member accounts and run remediation actions centrally.

When the DB instance exhausts its allocated storage, RDS cannot write the backup data and enters STORAGE_FULL, so automated backup creation is blocked until space is recovered or storage is increased.

No. Multi-AZ improves availability and failover, but single-AZ RDS instances can still have automated backups as long as retention is nonzero and the instance is healthy.

GuardDuty is a threat-detection service that analyzes activity and produces security findings, not resource configuration compliance; it does not evaluate S3 versioning settings.

The SSM Automation runbook is an AWS-managed remediation that enables versioning without custom code, while a Lambda function requires you to build and maintain the logic.

Cross-zone load balancing is enabled by default on ALBs and only redistributes traffic among targets in the AZs enabled for the load balancer. It does not add a missing subnet or AZ to the ALB.

No. Route 53 alias records are the recommended way to point DNS at an ALB, and changing to a CNAME does not affect which Availability Zones the load balancer uses.

No. The instance must be stopped (not terminated) before the type can be modified; the new type takes effect when you start it again.

Hibernation only preserves RAM contents to the EBS root volume across a stop/start; the instance still must be stopped to change its type, so hibernation adds no benefit here.

EBS publishes volume I/O metrics only; filesystem occupancy is a guest-OS value that must be collected by the CloudWatch agent and published as disk_used_percent.

D restates the role setup already covered by option A and never actually describes installing the agent, so it cannot serve as one of the three required distinct steps.

disk_used_percent, reported with dimensions such as path, device, and fstype; disk_used and disk_free in option F are not agent metric names.

Yes. Versioning must be enabled on the source bucket and on the destination bucket, otherwise S3 will not save the replication configuration.

It works but adds custom code, retries, IAM setup, and monitoring to maintain, which is exactly the operational overhead the question asks you to avoid.

CloudFormation resolves a dependency graph and provisions resources without dependencies in parallel; the order resources appear in the template file has no effect on creation order.

If the EC2 resource already references the DB with Ref or GetAtt (for example in UserData), CloudFormation infers an implicit dependency and still creates the database first.

S3 event notifications to SNS are native and near-real-time for DeleteObject, while CloudWatch alarms require additional CloudTrail data-event and metric-filter setup to observe object deletes.

No; server access logging records requests to the bucket, but log delivery is not a real-time push. The risk team needs S3 event notifications to SNS filtered to DeleteObject for immediate alerts.

EventBridge is a supported S3 destination, but it adds bus rules and routing configuration. Direct S3-to-Lambda invocation is simpler for this single 2-minute processing workflow.

No. S3 natively targets Lambda, SNS, SQS, and EventBridge, not Step Functions, so option D requires an intermediary and more setup.

ACM certificates are account-scoped; a certificate in the shared account cannot be attached to the development account's application resources. The shared account only supplies the Route 53 validation records.

No. ACM DNS validation only needs a CNAME record in the public hosted zone; the zone can belong to a different account, as long as the validation record is created there.

Latency routing sends users to the lowest-latency Region, not a standby, and changing weights through EventBridge is custom automation rather than Route 53's built-in failover behavior.

No. Resolver DNS Firewall filters outbound DNS queries from VPCs; it does not control answers for a public hosted zone or perform health-based failover.

CloudFront serves users from many edge locations, so a single-region test measures only one path and cannot reveal global latency or data-transfer behavior.

Identical DNS requests can pin all clients to one returned edge IP, so the test measures a single IP instead of exercising CloudFront's full set of edge addresses.

Setting Encrypted=False leaves the destination snapshot unencrypted; to encrypt a copy, the copy operation must specify Encrypted=True and a KMS key in the destination Region.

A custom Lambda workflow requires maintaining code, IAM permissions, scheduling, and error handling, while DLM is a managed service built for snapshot lifecycle and cross-Region copy.

A NAT gateway routes traffic through a public NAT IP address, so the Lambda function would still use public IPs to reach S3 and would violate the no-public-IP requirement.

Yes. Interface endpoints provide endpoint-specific DNS names, so the Lambda function must use the new S3 DNS name to resolve to the private endpoint ENI.

RDS Proxy only pools and manages connections; it needs an already highly available database behind it. Without Multi-AZ, the Single-AZ instance remains a single point of failure.

No. Auto Scaling groups scale EC2 instances, not RDS databases. Failover for RDS comes from Multi-AZ deployments, not scaling groups.

It leaves a plaintext path open, so viewers can still reach CloudFront over HTTP. Only the Redirect HTTP to HTTPS policy guarantees every request is encrypted in transit.

CloudFront only presents a custom certificate for hostnames listed as alternate domain names; otherwise it serves the default cloudfront.net certificate and the browser shows a name mismatch.

Recover is designed for StatusCheckFailed_System host failures; instance-level failures such as an OS hang usually require a reboot instead.

StatusCheckFailed_Instance is published per instance ID, so an AMI ID dimension would never match a datapoint and the alarm would never fire.

No. SecureString parameters are encrypted but not rotated natively; you must build and schedule your own Lambda rotation, which is less operationally efficient than Secrets Manager.

You would own the rotation code, RDS password change call, retries, and error handling, while Secrets Manager provides a managed RDS rotation function out of the box.

It must be attached and maintained in each account, does not cover every principal such as the account root user, and needs updating for each new account. A root-level SCP is inherited automatically.

Yes. SCPs attached at the root are inherited by all OUs and member accounts, so newly created accounts are restricted without any per-account IAM work.

Access keys are long-lived secrets that must be rotated and can leak; STS temporary credentials from role assumption expire automatically and are scoped to the role.

It limits who can invoke the Lambda function to principals in the organization, but it does not grant the function permission to list EC2 instances and Principal "*" is still broad.

Inbound endpoints accept DNS queries from on-premises into the VPC; they do not forward the VPC's own queries out to the on-premises DNS server that knows mssql.example.com.

No. System rules are AWS-managed rules for private hosted zones; forwarding example.com to on-premises DNS requires a forwarding rule used with an outbound Resolver endpoint.

A timeout ends the invocation with an error instead of sending a threshold notification, so you would break processing rather than observe slowness. You also need an alarm on the Duration metric to trigger SNS.

No. CloudWatch alarms evaluate metrics, so log data must first be converted with a metric filter or Contributor Insights rule. Logs Insights query results cannot serve as an alarm source.

CloudWatch alarm actions publish to Amazon SNS, not SQS, and SQS does not send email; an SNS topic with an email subscription is needed.

No; AWS Budgets provides Savings Plans budgets with utilization thresholds, and those alerts can publish to an SNS topic for email delivery.

EC2 status checks only verify instance and host reachability, not the application. An instance can pass them while its web server still returns 500 errors to the ALB.

Session affinity only pins a user to one target. If that target is serving 500 errors, stickiness keeps sending the customer to the same broken instance instead of replacing it.

Origin groups only fail over between primary and secondary origins based on HTTP status codes; they do not create path-based routing or cache settings for video requests.

No. Signed URLs and custom policies control who can access content; caching is determined by the cache behavior's path pattern, origin, and TTL settings.

CloudFront edge caches keep serving an object until its cache time-to-live (TTL) expires, so a change at the S3 origin is not visible immediately. The cached copies must be removed or bypassed before users see the new content.

An invalidation removes cached objects from CloudFront edge locations before their TTL expires, so the next viewer request is fetched from the S3 origin and returns the current version.

No. Versioning keeps previous object versions in S3 for recovery, and ACLs control permissions; neither purges CloudFront's edge caches, so users would still receive the outdated cached content.

No, AWS does not allow you to modify the CIDR block of an existing subnet. You must create a new subnet with a different CIDR range.

Subnet CIDR ranges are fixed at creation time. To get more IPs, you must associate a secondary CIDR block to the VPC and create a new subnet within that new block.

A CloudWatch alarm transitions to an ALARM state when a metric crosses the threshold and publishes a notification to an Amazon SNS topic. Subscribers to that topic with an email protocol receive the alert.

AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports and agreements. It hosts AWS's PCI DSS Attestation of Compliance and the associated compliance matrix showing which requirements AWS operates under the shared responsibility model, plus historical versions.

Only for controls inside your own account, such as demonstrating monitored change activity. They cannot prove AWS's infrastructure-level PCI DSS compliance, so they never substitute for the Artifact reports.

No. Granting administrative access violates least privilege and PCI DSS Requirement 7. Provide scoped, time-limited read-only evidence or screenshots instead, obtained through your own access-provisioning process.