Implement strategies to protect data and infrastructure.
10 practice questions under this official exam objective (SOA-C03) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
How to Provide SSH Access to a Private EC2 Instance Without Internet Exposure?
This question tests how to provide SSH access to a private EC2 instance without an internet gateway by using an EC2 Instance Connect endpoint. The pag
How Can Lambda Securely List EC2 Instances in Another Account?
This question tests how an AWS Lambda function in one account can securely read EC2 instance data from another account. The page establishes that scop
How to Block EC2 Launches in Unauthorized Regions Across an Organization?
An AWS Organizations service control policy attached at the root is the most operationally efficient way to deny ec2:RunInstances in unauthorized Regi
How Do You Enforce HTTPS for a CloudFront Custom Domain on AWS?
CloudFront encrypts viewer traffic only when the distribution serves a valid certificate for www.example.com and every cache behavior refuses plain HT
How to Encrypt Cross-Region EBS Backups with Least Overhead?
Cross-Region EBS snapshot backups must be encrypted even when some source volumes are unencrypted. This page establishes that an Amazon Data Lifecycle
How to Launch a Cross-Account Encrypted AMI from CloudFormation?
Copying an encrypted AMI into a second account requires updating CloudFormation to the destination AMI ID and granting that account KMS key access; th
How to Prevent Sensitive Data in Amazon SNS Messages?
This question tests how to stop sensitive data from reaching an Amazon SNS topic that external stakeholders subscribe to. The answer is A: an SNS data
How Do You Find Security Groups Open to the Internet on Port 3389?
AWS Trusted Advisor's security group check reports security groups whose inbound rules allow unrestricted access on ports such as 22 and 3389. This pa
How to Store Each Team's Athena Results in Separate S3 Buckets?
Amazon Athena workgroups define a per-workgroup query result location, so creating one workgroup per team routes each team's output to its own S3 buck
How to Rate-Limit DDoS Protection for a CloudFront-Hosted S3 Website?
This question tests how to apply AWS WAF rate-based rules through CloudFront to control DDoS throttling for an S3-backed public website. The correct d