SOA-C02 Practice Test 32 — 15 Questions

Question 1

A SysOps administrator is troubleshooting a CodeDeploy deployment that uploads artifacts to an S3 bucket. The deployment fails with an 'AccessDenied' error. The IAM policy for the CodeDeploy service role includes the statement shown in the exhibit. What is the most likely cause of the failure?

Accepted Answer

The upload does not set the ACL to 'bucket-owner-full-control'.. The policy requires that the object's ACL be set to 'bucket-owner-full-control'. If the upload does not specify this ACL, the request fails. Option C is correct. Option A is wrong because the action is allowed. Option B is wrong because the resource includes the bucket. Option D is wrong because the condition is about ACL, not encryption.

Answer

The resource ARN does not include the bucket itself.

Answer

The policy does not allow encryption headers.

Answer

The policy does not allow the s3:PutObject action.

Question 2

A company is using AWS OpsWorks for configuration management. They have a stack with multiple layers, and they want to automate the deployment of a custom configuration file to all instances in a specific layer. What is the MOST efficient way to achieve this?

Accepted Answer

Create a custom cookbook and assign it to the layer.. Option B is correct because OpsWorks custom cookbooks allow you to run recipes that can deploy files to instances in a layer. Option A is incorrect because user data scripts run at boot time, not on demand. Option C is incorrect because AWS Systems Manager Run Command can execute commands but is not specific to OpsWorks layers. Option D is incorrect because the AWS::OpsWorks::App resource is for deploying applications, not configuration files.

Answer

Define the file in an AWS CloudFormation template using the AWS::OpsWorks::App resource.

Answer

Use AWS Systems Manager Run Command to execute a script on each instance.

Answer

Add the configuration file as user data in the layer's Auto Scaling group.

Question 3

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. Option C is correct because the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' checks that the specific KMS key is used, and the condition 's3:x-amz-server-side-encryption' ensures encryption is enforced. Option A is wrong because it allows SSE-S3. Option B is wrong because it allows SSE-KMS but does not restrict to a specific key. Option D is wrong because it denies all uploads without encryption, but does not require the specific KMS key.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 4

A SysOps administrator sees the deployment failure shown in the exhibit. The deployment group has a minimum of 1 healthy instance. The Auto Scaling group has 2 instances. What is the most likely cause of the failure?

Accepted Answer

The deployment configuration only deploys to one instance at a time, and that instance failed.. With CodeDeployDefault.OneAtATime, only one instance is deployed at a time. If that instance fails, the deployment fails because there are no other instances to deploy (the other instance is not deployed yet). Option A is correct. Option B is wrong because the deployment configuration is correct. Option C is wrong because the health check grace period is not relevant. Option D is wrong because the deployment group has 2 instances, which is enough.

Answer

The Auto Scaling group's health check grace period is too long.

Answer

The deployment group does not have enough instances.

Answer

The deployment configuration is set to deploy to all instances at once.

Question 5

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running in a VPC with public and private subnets. The SysOps administrator needs to update the environment to use a new platform version. Which TWO steps should be taken to ensure a smooth update with minimal downtime? (Select TWO.)

Accepted Answer

Take a snapshot of the attached Amazon RDS database before starting the update.. Options B and C are correct. Option B: Performing a blue/green deployment creates a new environment and swaps CNAMEs, minimizing downtime. Option C: Taking a snapshot of the RDS database ensures data backup before the update. Option A: Immutable updates are not supported for all platforms. Option D: Updating the security groups is not necessary for the update. Option E: Manually draining connections is not needed if using blue/green.

Answer

Update the security groups to allow traffic from the new environment.

Answer

Enable immutable updates in the environment configuration.

Answer

Manually drain connections from the current environment before swapping.

Question 6

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The deployment uses AWS CodeDeploy with an in-place update. During a deployment, the new application version fails health checks, and CodeDeploy automatically rolls back. However, the rollback also fails. What is the MOST likely cause?

Accepted Answer

The health check path specified in the AppSpec file is not valid for the previous application version.. Option D is correct because if the health check configuration in the CodeDeploy AppSpec file points to a path that is not valid in the previous version, the rollback will also fail health checks. Option A is incorrect because insufficient capacity would cause a different error. Option B is incorrect because CodeDeploy does not use Elastic Beanstalk. Option C is incorrect because the issue is with health checks, not with the agent.

Answer

The Auto Scaling group's minimum size is too low for a rollback.

Answer

The load balancer is configured with an incorrect target group for the Elastic Beanstalk environment.

Answer

The CodeDeploy agent on the EC2 instances is not running the latest version.

Question 7

A DevOps engineer needs to automate the creation of an Amazon RDS for MySQL DB instance in a VPC. The solution must use infrastructure as code. Which AWS service should be used to provision the database?

Accepted Answer

AWS CloudFormation. Option B is correct because AWS CloudFormation can define and provision AWS infrastructure, including RDS instances, as code. Option A is incorrect because AWS OpsWorks uses Chef/Puppet but is not the primary choice for simple RDS provisioning. Option C is incorrect because AWS Elastic Beanstalk is a PaaS service that manages application deployment, not infrastructure provisioning directly. Option D is incorrect because EC2 Auto Scaling manages EC2 instances, not RDS.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

EC2 Auto Scaling

Question 8

A company is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The SysOps administrator wants to ensure that the RDS instance is created before the EC2 instance and that the EC2 instance receives the database endpoint as a user data parameter. Which THREE steps should be taken? (Select THREE.)

Accepted Answer

Add a DependsOn attribute to the EC2 instance resource referencing the RDS instance.. Options A, C, and D are correct. Option A: Using DependsOn ensures the RDS instance is created first. Option C: Using Fn::GetAtt retrieves the endpoint. Option D: Using CloudFormation helper scripts (cfn-init) can process the metadata and write user data. Option B: Not necessary because DependsOn is used. Option E: Not necessary because DependsOn ensures order.

Answer

Use the AWS::CloudFormation::Init metadata to set the creation order.

Answer

Add a DependsOn attribute to the RDS instance resource referencing the EC2 instance.

Question 9

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CloudFormation). The deploy stage uses a change set. Recently, the deploy stage fails with the error 'No updates are to be performed.' What is the MOST likely cause?

Accepted Answer

The source code in the S3 bucket has not changed since the last successful deployment.. Option A is correct because if the source code hasn't changed, CloudFormation detects no changes and reports 'No updates are to be performed.' Option B is incorrect because IAM permissions would cause access denied errors. Option C is incorrect because stack deletion would cause a different error. Option D is incorrect because the change set name is not relevant to this error.

Answer

The AWS CloudFormation stack was manually deleted outside of the pipeline.

Answer

The IAM role for the pipeline does not have sufficient permissions to update the stack.

Answer

The change set name specified in the pipeline configuration is incorrect.

Question 10

A company uses AWS Elastic Beanstalk to deploy a web application. After updating the environment configuration, the deployment fails and the environment health turns red. The SysOps administrator checks the logs and finds a permission error related to the EC2 instance profile. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM instance profile associated with the environment to include the required permissions.. The correct answer is B because Elastic Beanstalk uses an IAM instance profile for the EC2 instances. The instance profile must have the necessary permissions to access resources like S3 buckets or DynamoDB tables. Updating the instance profile with the required permissions resolves the issue. Option A is wrong because updating the application version does not fix permission issues. Option C is wrong because rebuilding the environment from scratch is unnecessary and time-consuming. Option D is wrong because the security group controls network access, not IAM permissions.

Answer

Rebuild the environment from scratch using a saved configuration template.

Answer

Modify the security group attached to the environment to allow outbound traffic.

Answer

Update the application version to the latest build.

Question 11

A SysOps administrator is troubleshooting a failed AWS CodeBuild build. The build project uses an Amazon S3 source. The buildspec.yml file includes commands that require internet access to download dependencies. The build is failing with a timeout error when trying to download from an external repository. The VPC configuration for the build project uses a private subnet with no NAT gateway. What change should be made to resolve the issue?

Accepted Answer

Attach a NAT gateway to the private subnet's route table.. Option B is correct because a NAT gateway or NAT instance is required to allow instances in a private subnet to access the internet. Option A is incorrect because a public subnet would provide internet access directly, but the question implies the build must be in a private subnet. Option C is incorrect because VPC endpoints are for accessing AWS services, not the internet. Option D is incorrect because a proxy is not the standard solution; NAT is.

Answer

Configure an HTTP proxy in the build project.

Answer

Create a VPC endpoint for the external repository.

Answer

Move the build project to a public subnet with an internet gateway.

Question 12

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to a stack. What is the recommended way to update the application on the instances?

Accepted Answer

Update the custom cookbook and run the 'deploy' recipe on the stack.. The correct answer is D because OpsWorks uses recipes and custom cookbooks to manage application deployment. By updating the custom cookbook and running the appropriate recipe, the administrator can deploy the new version. Option A is wrong because the built-in deploy command may not support custom application logic. Option B is wrong because SSH access is not recommended for automation. Option C is wrong because CloudFormation is a separate service; OpsWorks has its own deployment mechanism.

Answer

Create a new CloudFormation stack to replace the OpsWorks stack.

Answer

Use the OpsWorks built-in 'deploy' command on each instance.

Answer

SSH into each instance and manually update the application files.

Question 13

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template references the secret using a dynamic reference. However, the stack creation fails with an error that the secret cannot be retrieved. What is the most likely cause?

Accepted Answer

The CloudFormation service role lacks permissions to read the secret.. To use dynamic references, the CloudFormation service role must have permission to read the secret. The stack name and parameters are not related to secret retrieval. The secret must be in the same region. The template syntax might be incorrect, but the most common issue is missing permissions.

Answer

The secret is in a different AWS Region.

Answer

The stack name does not match the secret name.

Answer

The template uses the wrong dynamic reference syntax.

Question 14

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?

Accepted Answer

Use Run Command with a target based on the tag.. The correct answer is D because Run Command allows immediate execution of commands on targeted instances by tag. Option A is incorrect because State Manager is for recurring configurations. Option C is incorrect because Patch Manager is for patching. Option B is incorrect because Automation is for multi-step workflows, not simple script execution.

Answer

Use Patch Manager to apply the script as a patch baseline.

Answer

Create an Automation document and execute it.

Answer

Create a State Manager association with the script.

Question 15

A company uses AWS CloudFormation to deploy EC2 instances. The stack creation fails with the error 'Resource creation cancelled' after 20 minutes. What is the most likely cause?

Accepted Answer

The EC2 instance creation exceeded the CloudFormation timeout. Option B is correct because CloudFormation has a default timeout of 20 minutes for EC2 instance creation. Option A is wrong because missing permissions would cause an API error, not a timeout. Option C is wrong because a short instance type would not cause a timeout. Option D is wrong because CloudFormation supports YAML.

Answer

The CloudFormation template uses an unsupported template format

Answer

The instance type specified is not available in the chosen Availability Zone

Answer

Insufficient IAM permissions for CloudFormation to create EC2 instances

SOA-C02 Practice Test 32 — 15 Questions

Exhibit

SOA-C02 Practice Test 32 — 15 Questions

Exhibit