AWS SOA-C03 Management, Governance, and Billing Exam Scenarios

Purpose of This Lesson

This lesson focuses on recognizing the correct AWS management, governance, monitoring, compliance, and billing service for common SOA-C03 scenario patterns. The most important skill is matching the requirement to the service that owns the relevant data or control point—for example, using SCPs for organization-wide guardrails, CloudTrail for API activity, Config for resource compliance, and Cost Explorer for cost analysis.

Key Concepts

• AWS Organizations: Centralizes multiple AWS accounts, supports invitations for existing standalone accounts, and applies organization-level governance.
• Service control policies (SCPs): Set permission guardrails for accounts or organizational units. An SCP can deny an action or restrict what is usable, but it does not grant permissions by itself. IAM policies must still grant the required access.
• IAM Identity Center: After configuring the organization’s directory, create permission sets and associate them with directory users or groups.
• Amazon CloudWatch: Provides metrics, alarms, dashboards, and log collection. The unified CloudWatch agent can collect logs from many EC2 instances.
• AWS CloudTrail: Records API activity and can identify the caller, including federated identity information. Data events are required for detailed S3 object-level activity.
• AWS Config: Evaluates resource configuration against rules, produces compliance findings, and can trigger remediation.
• AWS Service Catalog: Packages approved configurations as products in portfolios and supports sharing portfolios between accounts.
• Cost Explorer and cost allocation tags: Analyze spending by time, service, resource, user-created tag, or other available dimensions.
• AWS Budgets: Alerts when actual or forecasted spending reaches a configured threshold.
• Trusted Advisor: Includes checks for account and root-user security practices.
• AWS Health API: Integrates AWS maintenance and service events affecting resources into operational tooling.

Organization Governance and Identity Administration

Auditing account creation by federated users

To determine who requested the creation of AWS Organizations accounts, use CloudTrail and inspect the Federated identity user name associated with the event. This is an audit question about the identity that made an Organizations API call.

Bringing standalone accounts under central control

If employees created independent AWS accounts, the central organization can send each account an invitation. The account must accept the invitation before it becomes part of the organization.

Restricting services and instance types with SCPs

SCPs are appropriate when the restriction must apply at the account or organizational level. Examples include:

• Denying EC2 launches unless the requested instance type is an approved type, such as t2.micro or another explicitly permitted type.
• Denying the s3:DeleteBucket action in a production account.
• Preventing use of unauthorized AWS services across accounts.
• Restricting developers who can modify IAM policies or roles from using selected services.

A common design combines an SCP with IAM permissions. For example, the SCP can establish the allowed EC2 boundary, while an IAM group grants relevant users permission to use approved T2-family instances. Remember that an SCP does not grant permission to launch instances.

IAM Identity Center permission sets

When the organization’s directory has been created and full access has been enabled, the next administrative step is to create a permission set and associate it with the appropriate directory users or groups.

Monitoring, Logging, and Audit Workflows

CloudWatch metrics and dashboards

Use CloudWatch standard metrics to investigate resource behavior such as high CPU utilization on EC2 or RDS. For custom metrics, install the CloudWatch agent where appropriate, create metric filters when log data must be converted into metrics, and then use those custom metrics in a dashboard.

CloudWatch accepts custom metric data even when the submitting instance’s clock is incorrectly offset by 30 minutes, so the data is recorded rather than rejected in the scenario described. In production, clock accuracy remains operationally important because timestamps affect interpretation and correlation.

To test an alarm notification path that uses Amazon SNS, use the CloudWatch set-alarm-state CLI command to force the alarm into a test state.

For CloudFront and S3 content-access problems, inspect the CloudWatch 4xx error rate metric. It helps quantify requests for missing content or content the requester is not authorized to access.

CloudTrail investigation patterns

Use CloudTrail when the scenario asks who performed an API operation or when an API call must be reconstructed. Examples include:

• Finding who created Elastic IP addresses and did not use them.
• Identifying the source of a sudden increase in SQS API requests.
• Auditing changes made to an AWS account.
• Determining the federated identity behind an Organizations account-creation request.

CloudTrail logs can be queried with Amazon Athena when the logs are stored in S3 and a query-based investigation is useful.

For S3 objects containing sensitive data, enable data event logging to capture object-level uploads and downloads, including the caller and API-call time. Management events alone do not provide the same object-level coverage.

For stronger protection of CloudTrail logs stored in S3, enable CloudTrail log file integrity validation and enable MFA Delete on the destination bucket. These controls address detection or prevention of unauthorized modification and deletion of log files.

For an external auditor, create an IAM user with a policy granting read access to the CloudTrail logs in S3. The scenario’s requirement is read-only audit access, not broad administrative access.

Configuration Compliance with AWS Config

AWS Config is the primary choice when the requirement is continuous or point-in-time evaluation of resource configuration, compliance reporting, or automated remediation.

Relevant managed-rule patterns include:

• S3 bucket logging enabled: Checks whether S3 bucket logging is configured. Config can identify noncompliant buckets and support remediation without preventing users from creating buckets.
• Restricted common ports: Evaluates security groups for risky common ports. Add port 80 to the restricted-port criteria when HTTP access must not be present.
• Approved AMIs: Checks whether EC2 instances use approved AMIs.
• Access keys: Identifies keys older than 90 days; Systems Manager Automation can be used to remediate noncompliant keys by disabling them.
• Public S3 buckets: Identifies buckets exposed publicly so the security team can be notified, including through an SMS notification workflow.
• CloudFormation changes: Tracks configuration changes associated with CloudFormation deployments for governance.
• Encrypted volumes: Verifies that EBS volumes are encrypted with the specified KMS key ID.

The key distinction is that Config evaluates and reports resource state. It is generally preferable to an SCP when the goal is compliance visibility and remediation rather than preventing an action outright.

Service Catalog for Approved Infrastructure

Use AWS Service Catalog when users need to launch a specialized, preapproved configuration without manually configuring all EC2 settings.

A CloudFormation template can define the specialized EC2 product. Place the product in a Service Catalog portfolio and grant users access to the portfolio. Users can then launch and terminate the approved product according to the permissions granted, while the product controls the configuration.

For an existing infrastructure pattern that must be made available in another account, share the portfolio with the target account. The target account can import the shared portfolio. An administrator in the receiving account can add products from the imported portfolio to a local portfolio.

Cost Management and Billing Analysis

Cost Explorer

Cost Explorer is the primary tool in these scenarios for analyzing and explaining spending:

• Analyze cost per user with the createdBy tag.
• Investigate why a bill is increasing over time.
• Generate resource-optimization recommendations for underutilized EC2 instances.
• Break down project costs in one account after activating and applying cost allocation tags.

User-defined tags are created and applied through the Tag Editor in the relevant account. In the payer account, use Billing and Cost Management to activate the desired tags as cost allocation tags before using them for billing analysis.

Budgets and consolidated billing

Use AWS Budgets when the requirement is an alert based on actual or forecasted spending exceeding a defined limit.

Use the AWS Cost and Usage Report when a company needs to track reserved-instance allocation within a consolidated bill. This is a detailed billing-data requirement rather than a simple trend or forecast question.

Exam- or Assessment-Relevant Takeaways

• Choose SCPs for organization-wide preventive permission guardrails, especially cross-account service or action restrictions.
• Do not confuse an SCP with an IAM permission grant; effective access still requires an applicable IAM policy.
• Choose CloudTrail for API identity, caller, and event-history investigations.
• Enable CloudTrail data events for S3 object-level activity.
• Choose CloudWatch for metrics, dashboards, alarms, and operational performance monitoring.
• Choose AWS Config for compliance evaluation, managed rules, configuration history, and remediation workflows.
• Choose Service Catalog when users need controlled, repeatable, preapproved infrastructure products.
• Choose Cost Explorer for cost trends, dimensions, and resource-optimization analysis; choose Budgets for threshold alerts.
• Choose the Cost and Usage Report for detailed consolidated billing and reserved-instance allocation analysis.
• Choose Trusted Advisor for root-user security best-practice checks and AWS Health API for maintenance-event integration.

Tool / Feature Decision Guide

Requirement	Best-fit service or feature	Decisive reason
Restrict services or actions across accounts	AWS Organizations SCP	Applies an organization-level permission boundary or denial
Grant users access to approved EC2 launches	IAM group or policy, alongside an SCP if needed	IAM grants permissions; the SCP only limits the maximum allowed access
Identify who made an API call	CloudTrail	Records API activity and caller identity
Capture S3 uploads and downloads	CloudTrail data events	Provides object-level data activity logging
Query historical CloudTrail logs	Athena with CloudTrail logs in S3	Supports SQL-style investigation of stored logs
Monitor CPU, 4xx errors, or custom metrics	CloudWatch	Provides operational metrics, dashboards, and alarms
Collect logs from many EC2 instances	Unified CloudWatch agent	Centralizes EC2 log and metric collection
Test an SNS alarm notification path	CloudWatch set-alarm-state	Forces an alarm state for testing
Evaluate configuration compliance	AWS Config	Uses rules, compliance status, and remediation
Deliver approved EC2 configurations	Service Catalog	Publishes controlled CloudFormation-backed products
Analyze rising costs or costs by dimension	Cost Explorer	Provides interactive cost breakdown and trends
Alert on forecasted spending	AWS Budgets	Supports actual and forecast threshold alerts
Detailed consolidated billing allocation	Cost and Usage Report	Supplies granular billing and reservation data
Review root-user security practices	Trusted Advisor security checks	Provides account-level best-practice checks
Integrate AWS maintenance events	AWS Health API	Supplies events for operational dashboards

Common Traps / Misconceptions

• Assuming SCPs grant access: They do not. An SCP can deny or limit permissions, but IAM must grant the action.
• Using CloudTrail management events for S3 object activity: Uploads and downloads require data event logging.
• Using Config to prevent resource creation: Config is primarily for evaluation and remediation. An SCP is the stronger choice for preventive organization-level denial.
• Confusing CloudWatch with CloudTrail: CloudWatch answers “how is the resource behaving?” CloudTrail answers “which identity called which API?”
• Using Cost Explorer for every billing requirement: Cost Explorer is ideal for analysis and recommendations; Budgets is for threshold alerts, and the Cost and Usage Report is for detailed billing data.
• Assuming a shared Service Catalog portfolio is automatically a local portfolio: The receiving administrator can add products from the imported portfolio to a local portfolio.
• Forgetting tag activation: Applying a user-defined tag is not enough for billing analysis; it must be activated as a cost allocation tag in Billing and Cost Management.
• Treating CloudWatch custom metrics as a substitute for logs: Logs may need the unified agent and metric filters before they can be represented as custom metrics.
• Ignoring log-protection controls: CloudTrail log file integrity validation and MFA Delete address different aspects of protecting logs from tampering and deletion.

Real-World Engineer / Analyst Notes

• Design SCPs conservatively and test their effect on required administrative and operational workflows. A broad deny can affect automation and recovery procedures.
• Separate prevention from detection. SCPs can prevent selected actions, while Config identifies noncompliant state after configuration changes.
• Centralize CloudTrail logs in a protected S3 location and use least-privilege read access for auditors and investigators.
• Use CloudTrail event history or Athena queries to establish an actor-and-time timeline during incident analysis.
• Treat cost allocation tags as part of a governance process: define a naming convention, apply tags consistently, and activate only the tags needed for reporting.
• When designing CloudWatch alarms, test the complete notification path rather than only checking that the alarm exists.
• Use Service Catalog to reduce configuration drift when teams need repeatable infrastructure but should not directly manage every underlying setting.
• A maintenance event dashboard should combine AWS Health information with the organization’s operational context so affected resources and owners can be identified quickly.

Quick Reference Summary

• Organizations and SCPs: Central account governance and preventive restrictions.
• IAM Identity Center: Permission sets assigned to directory users and groups.
• CloudWatch: Metrics, dashboards, alarms, custom metrics, and EC2 log collection.
• CloudTrail: API activity, caller identity, audit trails, and data events.
• Athena: Query CloudTrail logs stored in S3.
• AWS Config: Rules, compliance reporting, configuration tracking, and remediation.
• Service Catalog: Approved, repeatable infrastructure products and cross-account portfolios.
• Cost Explorer: Cost trends, tag-based analysis, and optimization recommendations.
• Budgets: Actual or forecast spending alerts.
• Cost and Usage Report: Detailed consolidated billing and reserved-instance allocation.
• Trusted Advisor: Root-user security checks.
• AWS Health API: Maintenance-event integration.

Flashcards

Q: An organization must prevent a production account from deleting S3 buckets. Which control is most appropriate?
A: Use an SCP that denies s3:DeleteBucket for the production account or OU. The SCP is a preventive organization-level guardrail.

Q: What is the key limitation of an SCP when granting EC2 access?
A: An SCP does not grant permissions. An IAM policy or group must grant the user permission, while the SCP limits the maximum actions that can be performed.

Q: A security team needs to identify the federated user who requested a new Organizations account. What should they inspect?
A: Inspect the relevant CloudTrail event and its Federated identity user name.

Q: When should CloudTrail data events be enabled for S3?
A: Enable them when object-level uploads, downloads, or other data activity must be recorded, including the caller and API-call time.

Q: Which service should investigate a sudden increase in SQS API requests?
A: CloudTrail, because the question asks for the source of API calls and caller activity rather than queue performance metrics.

Q: When would Athena be used with CloudTrail?
A: Use Athena to query CloudTrail logs stored in S3 when an investigation requires searching or analyzing many historical events.

Q: Which CloudWatch metric helps assess missing or unauthorized CloudFront and S3 content requests?
A: The CloudFront 4xx error rate metric, because missing or unauthorized requests commonly produce 4xx responses.

Q: How can a CloudWatch alarm notification path using SNS be tested?
A: Use the CloudWatch set-alarm-state CLI command to force the alarm into a test state.

Q: Which service evaluates whether S3 logging, approved AMIs, security-group ports, or EBS encryption requirements are satisfied?
A: AWS Config, using appropriate managed rules and, where needed, remediation.

Q: When should Service Catalog be chosen over direct EC2 configuration?
A: Choose Service Catalog when users need to launch a specialized, preapproved configuration without manually setting every EC2 option.

Q: How can a Service Catalog portfolio be made available in another AWS account?
A: Share the portfolio with the target account, import it there, and allow the receiving administrator to add products from the imported portfolio to a local portfolio.

Q: What is required before user-defined tags can support cost allocation analysis?
A: Create and apply the tags with Tag Editor, then activate them as cost allocation tags in the payer account’s Billing and Cost Management console.

Q: Which AWS billing tool should alert when forecasted spending will exceed a limit?
A: AWS Budgets, because it supports alerts based on actual or forecasted spending thresholds.

Q: Which services address root-user security checks and AWS maintenance-event integration?
A: Trusted Advisor provides root-user security checks, while the AWS Health API provides maintenance and service events for operational dashboards.

Practice Questions

Question 1

A company wants every account in an organizational unit to use only approved AWS services. Developers still need IAM policies to grant access to those approved services. Which design best fits the requirement?

A. Create a CloudWatch dashboard for each account
B. Apply an SCP to the organizational unit and use IAM policies for grants
C. Create an AWS Config rule that prevents all unapproved API calls
D. Use Cost Explorer to identify unauthorized services after use

Correct answer: B

Explanation: An SCP provides the organization-level guardrail, while IAM policies grant the permissions users actually need. Config and Cost Explorer are primarily detection and analysis tools, not the preventive control described.

Question 2

An auditor must determine which IAM identity downloaded sensitive objects from an S3 bucket and when each download occurred. Which configuration is required?

A. CloudWatch standard metrics only
B. CloudTrail management events only
C. CloudTrail data event logging for the S3 bucket
D. AWS Config with the approved AMIs rule

Correct answer: C

Explanation: S3 object-level activity such as downloads requires CloudTrail data events, which record the relevant caller and API-call timing.

Question 3

A platform team wants to let users launch a specialized EC2 configuration and terminate it, but users should not manually configure the instance settings. What should the team implement?

A. A Service Catalog product backed by a CloudFormation template
B. An SCP that grants users EC2 launch permission
C. A Cost Explorer recommendation
D. A CloudTrail data event trail

Correct answer: A

Explanation: Service Catalog exposes an approved, repeatable product while the CloudFormation template defines the specialized configuration. IAM permissions can then control who may use the product.

Question 4

A finance team sees a steadily increasing bill and needs to determine which services and projects caused the change. It also wants an alert if next month’s forecast exceeds a spending limit. Which combination is appropriate?

A. CloudTrail and AWS Health API
B. Cost Explorer and AWS Budgets
C. Trusted Advisor and AWS Config
D. Service Catalog and IAM Identity Center

Correct answer: B

Explanation: Cost Explorer analyzes trends and dimensions such as services and activated cost allocation tags. AWS Budgets provides actual or forecast threshold alerts.

WordPress Metadata

Suggested Slug:
aws-soa-c03-management-governance-billing-exam-scenarios

Meta Description:
Study guide to AWS Organizations, SCPs, CloudWatch, CloudTrail, AWS Config, Service Catalog, Cost Explorer, Budgets, Trusted Advisor, and AWS Health scenarios for the SOA-C03 exam.

Tags:
AWS Organizations, Service Control Policies, AWS CloudTrail, Amazon CloudWatch, AWS Config, AWS Service Catalog, AWS Cost Explorer, AWS Budgets, AWS Trusted Advisor, AWS Health API, IAM Identity Center