SOA-C02 Practice Test 35 — 15 Questions

Question 1

A company is deploying a serverless application using AWS SAM. The SysOps administrator wants to automate the build and deployment process whenever code is pushed to the main branch of an AWS CodeCommit repository. Which service should be used to trigger the pipeline?

Accepted Answer

AWS CodePipeline.. The correct answer is C because CodePipeline can be configured to start on changes to a CodeCommit repository. Option A is incorrect because CloudWatch Events can trigger but is not the primary service for CI/CD pipelines. Option B is incorrect because CodeBuild is a build service, not a trigger. Option D is incorrect because Lambda would require custom integration.

Answer

AWS Lambda.

Answer

AWS CodeBuild.

Answer

Amazon CloudWatch Events.

Question 2

A SysOps administrator needs to deploy a new version of a Lambda function while minimizing downtime. The function is behind an API Gateway endpoint. What is the MOST effective approach?

Accepted Answer

Create a new Lambda version, then use an alias with weighted routing to shift traffic gradually. Option C is correct because Lambda aliases allow traffic shifting between versions, enabling gradual deployment. Option A is wrong because updating the function code directly with a new version would cause a brief outage. Option B is wrong because it would cause a complete cutover. Option D is wrong because it adds complexity and latency.

Answer

Update the Lambda function code in-place and publish a new version

Answer

Create a new Lambda version and update the API Gateway integration to point to it

Answer

Deploy a new Lambda function and use an Amazon Route 53 weighted record set to distribute traffic

Question 3

A SysOps administrator is designing an automated deployment pipeline using AWS CodePipeline. The pipeline must include a manual approval step before deploying to production. Which TWO actions are required to implement this?

Accepted Answer

Create an Amazon SNS topic for approval notifications.. The correct answers are A and D. A is correct because a manual approval action requires an SNS topic to send notifications. D is correct because the IAM role used by CodePipeline needs permission to publish to SNS. B is incorrect because CloudWatch Logs is not for notifications. C is incorrect because Lambda is not required. E is incorrect because the approval action is configured in the pipeline, not as a separate stage.

Answer

Add a separate stage for approval in the pipeline.

Answer

Configure an AWS Lambda function to approve automatically.

Answer

Enable CloudWatch Logs for the pipeline.

Question 4

An organization uses AWS OpsWorks to manage a stack of application servers. The stack uses a custom cookbook that is stored in a private GitHub repository. When deploying new instances, the cookbook download fails. What should the administrator do to resolve this?

Accepted Answer

Configure an SSH key in the OpsWorks stack to access the private repository. Option B is correct because OpsWorks can use a deploy key or SSH key for private repository access. Option A is wrong because OpsWorks does not support HTTPS authentication easily. Option C is wrong because making the cookbook public is a security risk. Option D is wrong because S3 is for static content, not dynamic cookbook versions.

Answer

Upload the cookbook to Amazon S3 and reference the S3 URL

Answer

Make the GitHub repository public

Answer

Store the GitHub credentials in the OpsWorks stack settings

Question 5

An administrator deploys a CloudFormation template that includes the snippet shown in the exhibit. Later, the administrator deletes the stack. What happens to the S3 bucket?

Accepted Answer

The bucket is retained but no longer managed by CloudFormation. Option B is correct because DeletionPolicy: Retain preserves the bucket even after stack deletion. Option A is wrong because the bucket is retained. Option C is wrong because the bucket is not deleted. Option D is wrong because the bucket is retained, not emptied.

Answer

The bucket is deleted only if it contains no objects

Answer

The bucket is emptied and then deleted

Answer

The bucket is deleted along with the stack

Question 6

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance. The database is in a VPC with public and private subnets. The DB instance is in a private subnet. When the stack is created, the DB instance is not accessible from an EC2 instance in the same VPC. What is the most likely cause?

Accepted Answer

The security group for the DB instance does not allow inbound traffic from the EC2 instance.. Option D is correct because the DB instance's security group must allow inbound traffic from the EC2 instance's security group. Option A is wrong because the DB instance is in a private subnet, so it doesn't have a public IP. Option B is wrong because the DB subnet group is configured correctly. Option C is wrong because the VPC has a route to the internet, but that's not needed for internal communication.

Answer

The DB subnet group does not include the correct subnets.

Answer

The VPC does not have an internet gateway attached.

Answer

The DB instance does not have a public IP address.

Question 7

Refer to the exhibit. A SysOps administrator creates this CloudFormation template. The stack creation fails with the error: 'The security group 'default' does not exist'. What is the most likely cause?

Accepted Answer

The instance is launched in a VPC, but the security group is specified by name instead of group ID.. The correct answer is B because the default security group exists in a VPC, but the EC2 instance is launched in EC2-Classic (default) which uses the 'default' security group name. However, if the instance is launched in a VPC, the security group must be specified by GroupId, not by name. The template uses a name, which is only valid for EC2-Classic. Since most AWS accounts now use VPC, the security group name 'default' is not recognized. Option A is incorrect because the VPC does have a default security group, but it's identified by ID. Option C is incorrect because the default group exists. Option D is incorrect because the instance is launched in the default VPC, but the security group reference is incorrect.

Answer

The VPC does not have a default security group.

Answer

The instance is launched in EC2-Classic, which does not support security groups.

Answer

The 'default' security group is not present in the account.

Question 8

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource that depends on an AWS::IAM::Role. The error message is 'Resource handler returned message: "The role defined for the function cannot be assumed by Lambda" (Service: Lambda, Status Code: 400).' What is the most likely cause?

Accepted Answer

The trust policy of the IAM role does not include 'lambda.amazonaws.com' as a trusted entity. Option C is correct because the role's trust policy must allow the Lambda service principal to assume the role. Option A is wrong because permissions are about actions, not trust. Option B is wrong because resource-based policies are for the function, not the role. Option D is wrong because the function name is not the issue.

Answer

The Lambda function name conflicts with an existing function

Answer

The IAM role does not have sufficient permissions to execute the Lambda function

Answer

The Lambda function has a resource-based policy that denies access

Question 9

An administrator uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error: "The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems." The deployment group has a minimum of 2 instances. What should the administrator check first?

Accepted Answer

The deployment logs on the individual EC2 instances.. Option D is correct because the deployment logs on the instances will show specific failure reasons. Option A is wrong because the issue is not necessarily the deployment group configuration. Option B is wrong because the Auto Scaling group health checks are for instance health, not deployment success. Option C is wrong because the application revision might be valid for other environments.

Answer

The application revision's compatibility with the instance operating system.

Answer

The Auto Scaling group's health check settings.

Answer

The deployment group's deployment configuration settings.

Question 10

A SysOps administrator wants to automate the creation of an Amazon RDS database instance using AWS CloudFormation. The database must be created in a specific VPC and must be Multi-AZ. Which CloudFormation resource property should the administrator configure to meet these requirements?

Accepted Answer

DBSubnetGroupName and MultiAZ. The correct answer is D because the AWS::RDS::DBInstance resource has properties for DBSubnetGroupName (to specify VPC subnets) and MultiAZ (to enable Multi-AZ). Option A is wrong because the DBInstanceIdentifier is just a name. Option B is wrong because the DBInstanceClass determines the instance type, not the VPC or Multi-AZ. Option C is wrong because the Engine property specifies the database engine type.

Answer

Engine

Answer

DBInstanceClass

Answer

DBInstanceIdentifier

Question 11

A company uses AWS Elastic Beanstalk to deploy a web application. During a deployment, the environment's health turns from Green to Red, and the deployment fails. The logs show 'ERROR: Failed to download the application version from Amazon S3.' What is the MOST likely cause?

Accepted Answer

The EC2 instance profile does not have an IAM policy granting s3:GetObject on the application version. Option D is correct because the instance profile must have permissions to read the application version from S3. Option A is wrong because the S3 bucket is internal. Option B is wrong because the service role is for Elastic Beanstalk service, not instances. Option C is wrong because S3 is highly durable.

Answer

The Elastic Beanstalk service role does not have permissions to access S3

Answer

The S3 bucket is in a different AWS Region

Answer

The S3 bucket containing the application version has public read access disabled

Question 12

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an Amazon RDS DB instance with a custom DB parameter group. The error message states: 'The following resource(s) failed to create: [DBParameterGroup].' The administrator checks the CloudFormation template and sees that the DBParameterGroup resource has a property 'Parameters' with a list of parameters. What is the MOST likely reason for the failure?

Accepted Answer

The parameter group is configured with parameters that are not compatible with the DB engine version.. Custom DB parameter groups must be associated with an engine version that matches the DB instance. A mismatch can cause creation failure. Option D is correct. Option A is wrong because the DB subnet group is not involved. Option B is wrong because RDS does not require a VPC endpoint. Option C is wrong because the parameter group name can be any valid name.

Answer

The parameter group name contains invalid characters.

Answer

The DB subnet group specified for the DB instance does not exist.

Answer

The VPC does not have an RDS VPC endpoint enabled.

Question 13

An administrator is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS Elastic Beanstalk. The build succeeds, but the deployment fails with 'Access Denied' when Elastic Beanstalk tries to read the artifact from S3. What should the administrator check?

Accepted Answer

The IAM role assumed by the Elastic Beanstalk environment. Option A is correct because the Elastic Beanstalk service role needs permissions to read the artifact bucket. Option B is wrong because the CodeBuild role is for building, not deploying. Option C is wrong because S3 bucket policies are not the most likely issue. Option D is wrong because the artifact bucket is internal.

Answer

The IAM role used by CodeBuild

Answer

Whether the artifact bucket is in the same region as the pipeline

Answer

The S3 bucket policy for the artifact bucket

Question 14

A SysOps administrator needs to deploy an application to a fleet of EC2 instances in an Auto Scaling group. The application code is stored in an S3 bucket. The administrator wants to automate the deployment so that new instances automatically download the latest code on launch. Which approach should the administrator use?

Accepted Answer

Create a lifecycle hook in the Auto Scaling group that triggers a Lambda function or runs a Systems Manager command to download the code.. Option C is correct because a lifecycle hook can execute a custom script via EC2 Run Command to download code from S3. Option A is incorrect because CloudFormation does not run scripts on instances. Option B is incorrect because OpsWorks Stacks is not being used. Option D is incorrect because Systems Manager Automation runs remotely but not automatically on instance launch without a lifecycle hook.

Answer

Use AWS CloudFormation with a user data script that downloads the code from S3.

Answer

Use AWS Systems Manager Automation to run a document that downloads the code each time the instance is started.

Answer

Use AWS OpsWorks Stacks with a custom layer and a Chef recipe that downloads the code.

Question 15

A company is using AWS Elastic Beanstalk with a Blue/Green deployment strategy. After deploying a new version to the green environment and verifying it, the administrator wants to swap the CNAMEs to route production traffic to the green environment. However, the swap operation fails due to a CNAME already in use error. What is the MOST likely cause?

Accepted Answer

The CNAME prefix for the green environment is already in use by another environment in the same region.. Option D is correct because Elastic Beanstalk environment CNAMEs must be unique within a region. If the green environment's CNAME is the same as the blue environment's CNAME, the swap fails. Option A is incorrect because health checks are not directly related to CNAME swap. Option B is incorrect because load balancer health checks do not prevent CNAME swap. Option C is incorrect because the environment URL is not used for swap; it's the CNAME prefix that matters.

Answer

The green environment is using the same environment URL as the blue environment.

Answer

The load balancer is not configured to handle the traffic.

Answer

The green environment has failing health checks.