SOA-C03 Exam Preparation Material | AWS Certified CloudOps Engineer - Associate

Explanation:
For cross-account access, the Lambda function in Account A needs an execution role that permits it to call sts:AssumeRole on a role in Account B. The role in Account B must trust the Lambda execution role from Account A and must have permissions to read the target S3 bucket objects. This follows the standard AWS cross-account access model: the resource-owning account creates a role with permissions to the resource, and the external workload assumes that role.
Option B is incomplete because permissions granted only in Account A do not automatically grant access to resources in Account B.
Options C and D reverse the trust relationship incorrectly. The secure CloudOps model is cross-account role assumption with least privilege: Lambda execution role in Account A assumes a read-only S3 access role in Account B.

Explanation:
The symptom of users seeing old versions for several days points directly to CloudFront caching. If the file is updated daily but the object key remains the same, CloudFront edge locations may continue serving the cached object until the TTL expires. Setting cache TTL values to 0 forces CloudFront to revalidate with the origin instead of serving stale content for long periods. This is the best option from the choices because it resolves delayed visibility of new versions. Removing S3 lifecycle rules does not affect CloudFront cache freshness. Updating the behavior path pattern does not solve stale object delivery if the cache behavior already applies. Extending the signed URL
expiration only solves authorization timing; it does not force CloudFront to fetch the latest object version. For production, versioned object names or invalidations would also be strong designs.

Explanation:
AWS Backup is the correct centrally managed service for backup policies across AWS accounts. When integrated with AWS Organizations, AWS Backup can apply backup policies from a management or delegated administrator account to member accounts. This provides centralized scheduling, lifecycle configuration, monitoring, and compliance visibility without deploying custom Lambda code into every account. AWS documentation describes AWS Backup as a fully managed service that centralizes and automates data protection across AWS services and removes the need for custom scripts and manual processes. CloudFormation StackSets can deploy tags or supporting resources, but tagging alone does not create a complete backup strategy. SCPs define permission guardrails; they do not run backup jobs or snapshots. Therefore, AWS Backup organization-wide policies are the most operationally efficient solution.

Explanation:
Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:
To secure inbound web traffic over HTTPS when using an Application Load Balancer, AWS CloudOps best practices recommend terminating TLS at the load balancer. This is achieved by attaching an SSL/TLS certificate directly to the ALB listener. Therefore, option B is required. By terminating HTTPS at the ALB, traffic between clients and the load balancer is encrypted, and the ALB can then forward traffic to backend EC2 instances using HTTP or HTTPS based on design requirements.
The certificate used for a public-facing retail website must be trusted by internet browsers. AWS Certificate Manager (ACM) public certificates are specifically designed for this purpose and are trusted by common browsers and operating systems. Therefore, option D is required. ACM manages certificate provisioning, renewal, and deployment automatically, which significantly reduces operational overhead.
Option A is incorrect because attaching certificates to each EC2 instance is unnecessary and does not scale well.
Option C is incorrect because private certificates are intended for internal use cases and are not trusted by public browsers.
Option E is incorrect because ACM-managed public certificates cannot be exported; they must be attached directly to supported AWS services such as ALBs.
This approach aligns with AWS CloudOps guidance for secure, scalable, and highly available HTTPS architectures.
Reference: Elastic Load Balancing User Guide C HTTPS listeners for Application Load Balancers
AWS Certificate Manager User Guide C Public certificates
AWS SysOps Administrator Study Guide C Securing applications with ALB and ACM

Explanation:
According to the AWS Cloud Operations and Database Reliability documentation, Amazon RDS Multi-AZ deployments provide high availability and automatic failover by maintaining a synchronous standby replica in a different Availability Zone.
In the event of instance failure, planned maintenance, or Availability Zone outage, Amazon RDS automatically promotes the standby to primary with minimal downtime (typically less than 60 seconds). The failover is transparent to applications because the DB endpoint remains the same.
By contrast, read replicas (Option B) are asynchronous and do not provide automated failover. Auto Scaling (Option C) applies to EC2, not RDS. RDS Proxy (Option D) improves connection management but does not add redundancy.
Thus, Option A ― converting the RDS instance into a Multi-AZ deployment ― delivers the required high availability and business continuity with minimal operational effort.
Reference: AWS Cloud Operations & Database Continuity Guide C Implementing Multi-AZ Deployments for Automatic RDS Failover