SOA-C02 Practice Test 29 — 15 Questions

Question 1

A SysOps administrator is automating the creation of Amazon RDS instances using AWS CloudFormation. The template includes a DBInstance resource with a DBSubnetGroupName property referencing a subnet group created in the same template. The stack creation fails with the error 'DBSubnetGroup not found'. What is the MOST likely reason?

Accepted Answer

A DependsOn clause is missing between the DBInstance and the DBSubnetGroup.. Option C is correct because CloudFormation creates resources in parallel by default, and the DBSubnetGroup may not be created before the DBInstance if there is no DependsOn clause. Option A is wrong because subnet groups can be created in the same template. Option B is wrong because the VPC exists. Option D is wrong because the database subnet group is not required to be public.

Answer

The VPC ID is incorrect or does not exist.

Answer

The DBSubnetGroup is not associated with a public subnet.

Answer

The DBSubnetGroup is defined in a different CloudFormation stack.

Question 2

A SysOps administrator is automating the creation of an Amazon ECS cluster with Fargate launch type using AWS CloudFormation. The template must define the task definition, service, and cluster. Which THREE resources are required to be in the template? (Choose THREE.)

Accepted Answer

AWS::ECS::TaskDefinition. Options A, B, and D are correct. An ECS cluster (A) is required to run tasks. A task definition (B) defines the container specification. A service (D) manages the desired count and scheduling. Option C is wrong because a VPC is not a resource within ECS; it's an EC2 resource but is required for Fargate; however, the question asks for resources that must be in the template, and VPC is typically created separately. Option E is wrong because a load balancer is optional.

Answer

AWS::EC2::VPC

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Question 3

An organization uses AWS CloudFormation to manage infrastructure. They have a stack that includes an Amazon RDS DB instance. The administrator wants to update the DB instance's allocated storage without downtime. The DB instance is currently using gp2 storage. Which action should the administrator take?

Accepted Answer

Modify the storage size in the CloudFormation template and update the stack.. RDS allows modifying allocated storage for gp2 volumes. If the modification does not require a reboot (e.g., increasing storage), it can be applied immediately. However, some modifications might require a reboot. To avoid downtime, the administrator should apply the change during the maintenance window. Option D is correct. Option A is wrong because snapshots are not required for storage changes. Option B is wrong because read replicas are not needed for storage modification. Option C is wrong because stopping the DB instance causes downtime.

Answer

Create a read replica with the new storage size and promote it.

Answer

Stop the DB instance, modify the storage, and start it.

Answer

Take a manual snapshot and restore it with the new storage size.

Question 4

A company wants to ensure that its Amazon S3 data is resilient to an accidental deletion of an entire bucket. Which two actions should the company take? (Choose TWO.)

Accepted Answer

Configure Cross-Region Replication to replicate objects to a bucket in another AWS Region.. Options A and D are correct. Cross-Region Replication (A) copies objects to another bucket, ensuring data survives regional issues. S3 Versioning (D) allows recovery of deleted objects within the same bucket. Option B is wrong because MFA Delete requires multi-factor authentication to delete objects, but does not protect against bucket deletion. Option C is wrong because lifecycle policies delete objects, not protect them. Option E is wrong because Transfer Acceleration is for speed, not durability.

Answer

Configure a lifecycle policy to transition objects to S3 Glacier after 30 days.

Answer

Enable MFA Delete on the bucket.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 5

A company uses AWS OpsWorks for configuration management of EC2 instances. The administrator needs to ensure that a custom recipe runs on all instances after the instance is fully configured. Which lifecycle event should the recipe be associated with?

Accepted Answer

Configure. Option C is correct because the Configure lifecycle event occurs after the instance is fully set up and runs whenever the instance enters a new state. Option A is wrong because Setup runs only once when the instance boots. Option B is wrong because Deploy runs when a deploy command is issued. Option D is wrong because Undeploy runs when the instance is removed.

Answer

Undeploy

Answer

Deploy

Answer

Setup

Question 6

A SysOps administrator is creating an IAM policy for automation. The policy is attached to an IAM role used by an automated deployment script. The script needs to launch EC2 instances of type t2.micro and describe all EC2 resources. However, the script fails when trying to launch instances. What is the MOST likely reason?

Accepted Answer

The policy does not grant permissions for additional resources required by RunInstances, such as images, network interfaces, and security groups.. Option B is correct because the RunInstances action requires additional permissions for resources such as images (AMI), network interfaces, security groups, etc. The policy only grants permission for the instance resource. Option A is wrong because the Condition is correct. Option C is wrong because Describe* is allowed. Option D is wrong because the Resource ARN is for instances, but other resources like images need to be allowed separately.

Answer

The Resource ARN for the instance is incorrect.

Answer

The policy does not include the 'ec2:DescribeInstances' action.

Answer

The Condition key 'ec2:InstanceType' is misspelled.

Question 7

A SysOps administrator is using AWS OpsWorks to manage a stack of web servers. The administrator wants to automate the installation of custom software on all new instances that are added to the layer. What is the best approach?

Accepted Answer

Assign a custom Chef recipe to the layer's Setup lifecycle event.. Custom Chef recipes can be assigned to a layer's lifecycle events, such as Setup, to run on new instances. Option A is correct. Option B is wrong because user data is for EC2 instances directly, not OpsWorks. Option C is wrong because custom AMIs require manual management and do not integrate with OpsWorks automation. Option D is wrong because CloudFormation is not part of OpsWorks instance lifecycle.

Answer

Use AWS CloudFormation to install software on new instances.

Answer

Create a custom AMI with the software pre-installed and use that in the layer.

Answer

Use EC2 user data scripts in the layer configuration.

Question 8

A SysOps administrator needs to deploy a microservices application using AWS Elastic Beanstalk. The application consists of multiple services that need to communicate with each other. Which Elastic Beanstalk environment type should the administrator choose?

Accepted Answer

Load-balanced environment. A load-balanced environment provides an ELB for distributing traffic and is suitable for microservices that need to communicate via HTTP/HTTPS. Option C is correct. Option A is wrong because a single-instance environment does not provide load balancing. Option B is wrong because a web server environment is for web applications, but the question is about environment type (single vs load-balanced). Option D is wrong because worker environments are for background tasks.

Answer

Worker environment

Answer

Web server environment

Answer

Single-instance environment

Question 9

An organization needs to enforce that all Amazon EC2 instances launched in a specific AWS account are created from a baseline Amazon Machine Image (AMI) that includes required security patches. The AMI ID is ami-0abcdef1234567890. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use an IAM policy that denies the ec2:RunInstances action unless the AMI ID matches the approved one.. Option C is correct because using an IAM policy with a condition that denies launching instances unless the specified AMI ID is used is the most efficient way to enforce the requirement. Option A is incorrect because CloudTrail logs after the fact and does not prevent launches. Option B is incorrect because Config rules can detect non-compliance but do not block the action. Option D is incorrect because Lambda would need to be triggered and could delay the launch.

Answer

Use an AWS Config rule to mark non-compliant instances and automatically terminate them.

Answer

Use an AWS Lambda function that is triggered by EC2 launch events to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor and alert on any instance launched with a different AMI.

Question 10

A company is using AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) that includes specific software. The administrator creates a custom AMI and configures the Elastic Beanstalk environment to use it. However, new instances launched during scaling use the default platform AMI instead. What is the MOST likely cause?

Accepted Answer

The custom AMI is configured in the environment's launch configuration, but the environment has not been updated to replace existing instances.. Option D is correct because the custom AMI must be specified in the launch configuration or launch template used by the Auto Scaling group, and if the environment is updated, the existing instances may not be replaced. Option A is wrong because the Elastic Beanstalk platform version determines the base AMI, but custom AMIs can override it. Option B is wrong because the AMI ID must be specified in the launch configuration, not the environment properties. Option C is wrong because encryption does not prevent the custom AMI from being used.

Answer

The custom AMI ID is specified in the environment properties instead of the launch configuration.

Answer

The custom AMI is encrypted, and the instance profile does not have permissions to decrypt it.

Answer

The Elastic Beanstalk platform version is incompatible with the custom AMI.

Question 11

A SysOps administrator is tasked with automating the creation of IAM roles and policies using AWS CloudFormation. The template includes an IAM role and a managed policy. The stack creation fails with the error 'Policy arn:aws:iam::123456789012:policy/MyManagedPolicy not found'. The policy is created in the same template. What is the MOST likely solution?

Accepted Answer

Add a 'DependsOn' clause to the IAM role resource for the managed policy, and reference the policy ARN using the 'Ref' intrinsic function.. Option A is correct because the IAM role has a DependsOn the policy, but the policy ARN is not known until the policy is created; referencing the policy by its logical name in the role's ManagedPolicyArns property resolves this. Option B is wrong because the policy document is not the issue. Option C is wrong because the role name can be specified. Option D is wrong because the role can be created in the same stack.

Answer

Remove the policy document from the template and create the policy separately.

Answer

Use a custom resource to create the policy before the role.

Answer

Create the IAM role in a separate stack.

Question 12

A company uses AWS CodeDeploy to automate deployments to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero exit code.. Option B is correct because the BeforeInstall hook script failed, causing the instance to fail deployment. Option A is wrong because Agent log errors indicate agent issues, not script failures. Option C is wrong because the instance is unhealthy, but the specific error is a script exit code. Option D is wrong because the IAM role would cause a different error.

Answer

The instance does not have the required permissions to download the application revision.

Answer

The instance is not healthy according to the Elastic Load Balancer health checks.

Answer

The CodeDeploy agent is not running on the instance.

Question 13

A SysOps administrator uses AWS Systems Manager Run Command to install software on a fleet of EC2 instances. The command fails on some instances with the error 'Instance ID not found'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not installed or configured on the instances, or the instances lack the required IAM role.. Option D is correct because Run Command requires the SSM Agent to be installed and running, and the instance must have an IAM role that allows communication with Systems Manager. Option A is wrong because the command can target instances by tags. Option B is wrong because the SSM Agent is separate from the user data script. Option C is wrong because the instances are likely running.

Answer

The user data script has overridden the SSM Agent.

Answer

The instances are not tagged with the correct key-value pair.

Answer

The instances are in a stopped state.

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an AWS::RDS::DBInstance resource. The administrator wants to ensure that the database is not deleted when the stack is deleted. Which CloudFormation resource property should be set?

Accepted Answer

Set the 'DeletionPolicy' attribute to 'Retain' on the DBInstance resource.. Option C is correct because the DeletionPolicy attribute with value Retain prevents the database from being deleted when the stack is deleted. Option A is wrong because the deletion policy is not a property of the DBInstance; it's a top-level attribute. Option B is wrong because the DBInstance does not have a 'DeletionProtection' property in CloudFormation for RDS; that's a separate RDS feature. Option D is wrong because there is no 'RetainOnDeletion' property.

Answer

Set the 'DeletionPolicy' attribute to 'Snapshot' on the DBInstance.

Answer

Set the 'RetainOnDeletion' property to 'true' on the DBInstance.

Answer

Set the 'DeletionProtection' property to 'true' on the DBInstance.

Question 15

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

Accepted Answer

Perform a rolling update based on health.. Option B is correct because a rolling update replaces instances in batches, minimizing downtime. Option A is wrong because an immutable update launches new instances in a separate Auto Scaling group and swaps them, which can be faster but may cause brief downtime. Option C is wrong because terminating all instances causes downtime. Option D is wrong because environment cloning creates a separate environment, not an update.

Answer

Terminate all instances and let the Auto Scaling group launch new ones.

Answer

Perform an immutable update.

Answer

Clone the environment with the new configuration and swap URLs.