Amazon SOA-C03 Exam Dumps

Route 53 alias records are designed to map custom domain names to AWS resources such as ALBs, CloudFront distributions, and S3 website endpoints. Alias records behave like A records but point to AWS-managed resources instead of IP addresses.

Alias records are preferred over CNAME records because they can be used at the zone apex (example.com), do not incur additional DNS query charges, and automatically track changes to the underlying AWS resource.

A and AAAA records require fixed IP addresses, which ALBs do not provide. CNAME records cannot be used at the root domain.

Therefore, an alias record is the correct solution.

For cross-account access, the Lambda function in Account A needs an execution role that permits it to call sts:AssumeRole on a role in Account B. The role in Account B must trust the Lambda execution role from Account A and must have permissions to read the target S3 bucket objects. This follows the standard AWS cross-account access model: the resource-owning account creates a role with permissions to the resource, and the external workload assumes that role. Option B is incomplete because permissions granted only in Account A do not automatically grant access to resources in Account B. Options C and D reverse the trust relationship incorrectly. The secure CloudOps model is cross-account role assumption with least privilege: Lambda execution role in Account A assumes a read-only S3 access role in Account B.

According to AWS Cloud Operations and VPC Networking documentation, when VPCs are peered, security groups can reference peer account security groups directly to restrict traffic between them.

This feature allows specifying the security group ID (sg-1234abcd) from the source account (111122223333) in the target database's security group inbound rule. AWS automatically validates that the VPCs are connected through an existing VPC peering connection and that mutual permissions are properly configured.

You do not prefix the security group ID with the account or peering connection (Options A and B), and using the destination account ID (Option D) is incorrect because it represents the database side, not the source.

Hence, the correct configuration is Option C, which references the application servers' security group directly for precise, least-privilege access control.

According to AWS Cloud Operations and Systems Manager documentation, Session Manager requires that each managed instance be associated with an IAM instance profile that grants Systems Manager core permissions. The required permissions are provided by the AmazonSSMManagedInstanceCore AWS-managed policy.

If this policy is missing or misconfigured, the Systems Manager Agent (SSM Agent) cannot communicate with the Systems Manager service, causing connection failures even if the agent is installed and running. This explains why other instances work---those instances likely have the correct IAM role attached.

Enabling port 22 (Option A) violates the company's security policy, while configuring user names (Option C) and key pairs (Option D) are irrelevant because Session Manager operates over secure API channels, not SSH keys.

Therefore, the correct resolution is to attach or update the instance profile with the AmazonSSMManagedInstanceCore policy, restoring Session Manager connectivity.

Comprehensive and Detailed Explanation From Exact Extract of AWS CloudOps Documents:

The most operationally efficient approach is A: copy the AMI to each target Region using copy-image and update the CloudFormation template to reference the correct AMI IDs per Region (commonly via Mappings or parameters). AMIs are regional resources, so an AMI built in us-east-1 cannot be launched directly in other Regions without copying. The copy-image operation is the standard, supported method to replicate an AMI across Regions while preserving the image configuration and backing snapshots in the destination Region.

Once AMIs exist in each Region, CloudFormation can be executed in each Region using the same template logic. Adding mappings for AMI IDs keeps the deployment consistent and repeatable, aligning with Infrastructure as Code practices and minimizing manual steps.

Option B is more work than necessary because copying snapshots and re-creating AMIs adds extra steps and increases the chance of inconsistency. Option C is incomplete because the template will fail or launch incorrect resources if it references an AMI ID that does not exist in the target Region. Option D is not feasible because an Auto Scaling group is a regional construct and cannot span multiple Regions from a single stack update in us-east-1.

Amazon EC2 User Guide -- Copy an AMI across Regions (copy-image) and AMI regional scope

AWS CloudFormation User Guide -- Mappings/parameters for Region-specific values

AWS SysOps Administrator Study Guide -- Multi-Region provisioning and automation best practices