SOA-C02 Practice Test 34 — 15 Questions

Question 1

A SysOps administrator is using AWS System Manager Automation to patch a fleet of Amazon EC2 instances. The administrator wants to ensure that instances are patched during a maintenance window and that they are rebooted only if required. Which TWO steps should the administrator include in the automation document? (Choose two.)

Accepted Answer

Set the 'RebootIfNeeded' parameter to 'True' or 'False' as appropriate.. The correct answers are A and B. The 'AWS-RunPatchBaseline' document applies patches (A). The 'RebootIfNeeded' parameter controls reboot behavior (B). Option C is wrong because the maintenance window is scheduled separately, not in the document. Option D is wrong because CloudWatch alarms are not part of the patching document. Option E is wrong because the document does not handle snapshot creation.

Answer

Create an Amazon EBS snapshot of each instance before patching.

Answer

Schedule a maintenance window in the Systems Manager console.

Answer

Configure an Amazon CloudWatch alarm to detect failed patches.

Question 2

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances in the Auto Scaling group are not registered with the target group of an Application Load Balancer. The SysOps administrator needs to ensure that new instances launched by the Auto Scaling group are automatically registered with the target group. What should the administrator do?

Accepted Answer

Attach the target group to the Auto Scaling group.. The correct answer is B because when an Auto Scaling group is attached to a target group, the Auto Scaling group automatically registers new instances with the target group. This ensures that CodeDeploy can deploy to registered instances. Option A is wrong because instance metadata does not affect registration. Option C is wrong because lifecycle hooks do not perform registration automatically. Option D is wrong because Amazon Inspector is a security assessment tool, not related to target group registration.

Answer

Use Amazon Inspector to automatically register instances with the target group.

Answer

Create a lifecycle hook in the Auto Scaling group to register instances with the target group.

Answer

Configure the Auto Scaling group to launch instances with a user data script that registers the instance with the target group.

Question 3

A company wants to deploy a new version of a web application to an Auto Scaling group of EC2 instances behind an Application Load Balancer. The deployment should be automated and must not cause downtime. Which AWS service should be used?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy integrates with Auto Scaling groups and supports rolling updates to minimize downtime. CloudFormation can manage infrastructure but not application deployment directly. OpsWorks and Elastic Beanstalk are options but CodeDeploy is the dedicated service for application deployment.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 4

A company uses AWS CloudFormation to manage infrastructure. A developer accidentally deletes a resource from the stack template, and the next stack update attempts to delete the resource. The SysOps administrator wants to prevent accidental deletion of critical resources. Which CloudFormation feature should be used?

Accepted Answer

Set a DeletionPolicy attribute to 'Retain' on the resource.. The correct answer is C because DeletionPolicy: Retain preserves the resource when the stack is deleted or the resource is removed from the template. Option A is incorrect because StackPolicy controls updates, not deletions. Option B is incorrect because TerminationProtection is for EC2 instances, not CloudFormation. Option D is incorrect because ResourcePolicy is not a CloudFormation feature.

Answer

Enable termination protection on the stack.

Answer

Stack policy to deny delete actions.

Answer

Attach an IAM policy that denies cloudformation:DeleteStack.

Question 5

A SysOps administrator is implementing an automated backup solution for Amazon RDS databases. The solution must support point-in-time recovery and cross-region disaster recovery. Which TWO AWS services or features should be used?

Accepted Answer

Automated backups with a retention period.. The correct answers are A and E. A is correct because automated backups enable point-in-time recovery. E is correct because cross-region snapshot copy allows DR in another region. B is incorrect because manual snapshots do not automate. C is incorrect because Read Replicas are for read scaling, not backups. D is incorrect because S3 is not used for RDS backups natively.

Answer

Manual DB snapshots.

Answer

Cross-region read replicas.

Answer

Amazon S3 lifecycle policies.

Question 6

A company uses AWS CloudFormation to manage infrastructure. The administrator wants to update a stack that contains an RDS DB instance. The update requires replacing the DB instance. What should the administrator do to minimize downtime?

Accepted Answer

Use a CloudFormation stack update with a Replacement update policy and a snapshot. Option C is correct because using CloudFormation's update policy with a snapshot and replacement can minimize downtime. Option A is wrong because deletion will cause downtime. Option B is wrong because modifying the endpoint manually is not automated. Option D is wrong because disabling deletion protection is not enough.

Answer

Delete the stack and create a new one with the updated template

Answer

Disable deletion protection on the DB instance before the update

Answer

Modify the DB instance endpoint in the application configuration after update

Question 7

A SysOps administrator is troubleshooting a failed Auto Scaling group launch. The group uses a launch template that specifies an Amazon Linux 2 AMI. The instances fail to pass the EC2 health check and are terminated. The administrator checks the system log and finds that the instance boots but the cloud-init script fails due to a missing package repository. What is the most likely cause?

Accepted Answer

The AMI used by the launch template is outdated and the repositories are no longer valid.. If the AMI is outdated, the package repository URLs may be deprecated, causing cloud-init failures. The launch template version is not directly related to repository access. User data script problems could cause failures but the log points to a missing repository, which is often due to an outdated AMI. IAM role issues would affect API calls, not package repos.

Answer

The launch template is using an incorrect version.

Answer

The IAM instance profile does not have sufficient permissions.

Answer

The Auto Scaling group is in a private subnet without a NAT gateway.

Question 8

A SysOps administrator is deploying a new version of an application using AWS CodeDeploy. The deployment to an Auto Scaling group fails, and the instances are rolled back. What is the most likely reason for the failure?

Accepted Answer

The IAM instance profile does not have permission to download the revision from S3.. The correct answer is B because CodeDeploy requires the IAM instance profile to have permissions to read from the S3 bucket where the revision is stored. Option A is incorrect because CodeDeploy agent does not need internet access if using VPC endpoints. Option C is incorrect because the application's load balancer health check is separate. Option D is incorrect because CodeDeploy does not require the instance to be in a public subnet.

Answer

The instances are in a private subnet without a NAT gateway.

Answer

The instances do not have internet access.

Answer

The application's health check is failing on the target group.

Question 9

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an EC2 instance, an RDS database, and an Application Load Balancer. The SysOps administrator wants to ensure that the database is not replaced during an update if the administrator accidentally changes a property that requires replacement. Which THREE actions should the administrator take?

Accepted Answer

Use a custom resource backed by a Lambda function to manage the database.. The correct answers are A, C, and E. A is correct because a stack policy can prevent updates to critical resources. C is correct because DeletionPolicy: Retain preserves the database if the resource is deleted. E is correct because using a custom resource to manage the database allows more control. B is incorrect because enabling termination protection on the stack prevents stack deletion, not resource replacement. D is incorrect because the database should not be in a nested stack just for protection; it might be anyway.

Answer

Place the RDS instance in a separate nested stack.

Answer

Enable termination protection on the CloudFormation stack.

Question 10

A SysOps administrator is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. What should the administrator check FIRST?

Accepted Answer

The ApplicationStop lifecycle event hook script in the AppSpec file. Option D is correct because the most common cause is that the ApplicationStop lifecycle hook script exits with a non-zero code. Option A is wrong because the health check is on the load balancer. Option B is wrong because the Auto Scaling group must be healthy. Option C is wrong because the error suggests issues with the instances themselves.

Answer

The CodeDeploy agent version on the instances

Answer

The Auto Scaling group's minimum size

Answer

The load balancer health check configuration

Question 11

A company is using AWS CloudFormation to deploy a multi-tier web application. After updating the stack template, the update fails with a stack creation rollback in progress error. The SysOps administrator needs to identify the specific resource that caused the failure. What is the MOST efficient way to accomplish this?

Accepted Answer

Run the AWS CLI command aws cloudformation describe-stack-events --stack-name <stack-name> and review the resource status reason.. Option B is correct because the describe-stack-events command lists stack events in reverse chronological order, showing the specific resource failure reason. Option A is incorrect because it only shows the overall status not details. Option C is incorrect because viewing the stack will not show event details. Option D is incorrect because the change set was not used for the update.

Answer

Use the AWS Management Console to view the stack status and check the stack policy.

Answer

Use the aws cloudformation describe-change-set command to review the proposed changes.

Answer

Check the CloudTrail logs for the UpdateStack API call to see the error message.

Question 12

A company is using Lambda functions to process data from an S3 bucket. The SysOps administrator needs to update the Lambda function code with a new version. The administrator wants to ensure that during the deployment, any in-flight requests are completed with the old code, and new requests use the new code. Which deployment strategy should the administrator use?

Accepted Answer

Create a new Lambda version and update the alias to gradually shift traffic from the old version to the new version using weighted routing.. Option B is correct because Lambda aliases with weighted routing allow gradual traffic shifting. Option A is incorrect because updating the function directly immediately changes all invocations. Option C is incorrect because a new version can be created but without alias routing, all traffic goes to the new version. Option D is incorrect because canary deployments are not native to Lambda; weighted routing is the correct method.

Answer

Update the Lambda function code directly using the AWS CLI.

Answer

Use AWS CodeDeploy with a canary deployment configuration on the Lambda function.

Answer

Create a new Lambda function and update the S3 event notification to trigger the new function.

Question 13

A company uses AWS CodePipeline with AWS CodeBuild to build and deploy a static website to an S3 bucket. The website is served via Amazon CloudFront. The deployment fails intermittently because the S3 bucket policy does not allow CloudFront access after the bucket is updated. What is the BEST way to automate the bucket policy update during the deployment?

Accepted Answer

Use AWS CloudFormation to manage the S3 bucket and its policy, and update the stack as part of the pipeline.. The correct answer is D because AWS CloudFormation can manage the S3 bucket and its policy as part of the infrastructure. Using CloudFormation, the bucket policy can be updated automatically when the stack is updated. Option A is wrong because manually adding statements is error-prone and not automated. Option B is wrong because updating the bucket policy in the buildspec may work but is less robust than using CloudFormation. Option C is wrong because CloudFront origin access identity (OAI) can be configured in the bucket policy, but the policy must be updated accordingly; CloudFormation handles this automatically.

Answer

Include an AWS CLI command in the buildspec to update the bucket policy after the build.

Answer

Add a bucket policy statement in the S3 management console to grant CloudFront access.

Answer

Use a CloudFront origin access identity (OAI) and configure it in the bucket policy.

Question 14

A company uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. During a deployment, the pipeline fails at the Deploy stage with an error indicating that the CodeDeploy agent is not responding. The instances are in an Auto Scaling group. What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed on the EC2 instances.. The CodeDeploy agent must be installed and running on the EC2 instances to receive deployment instructions. If the agent is not installed or is not running, the deployment will fail. Option B is correct because the agent is required for CodeDeploy to deploy to EC2. Option A is wrong because CodePipeline does not require a VPC endpoint. Option C is wrong because IAM roles are assigned to the instance profile, not directly to instances. Option D is wrong because CodeDeploy can deploy to instances without an Application Load Balancer.

Answer

The pipeline does not have a VPC endpoint to connect to the instances.

Answer

The IAM role attached to the instances does not have permissions for CodeDeploy.

Answer

The Application Load Balancer is not configured with a target group.

Question 15

A company has a mission-critical application running on EC2 instances in an Auto Scaling group. The application stores state locally on the instance. The company wants to update the application to a new version with minimal downtime. The update requires a change to the instance configuration. What deployment strategy should be used?

Accepted Answer

Blue/green deployment. A blue/green deployment creates a new environment (green) with the new version and then switches traffic. This minimizes downtime and allows state to be handled by offloading to an external service. Rolling updates would cause downtime and state loss if instances are replaced. Immutable updates replace instances, causing state loss. Canary deployments are for testing, not full production updates.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update