SOA-C02 Practice Test 36 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk for a Java application. The environment uses a custom platform. The SysOps administrator wants to update the environment's configuration to use a larger instance type to handle increased load. What is the correct way to perform this change with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to update the instance type and choose a rolling update strategy.. The correct answer is C because Elastic Beanstalk supports rolling updates or immutable updates that update instances gradually, minimizing downtime. Option A is wrong because terminating all instances causes downtime. Option B is wrong because manually updating each instance is not recommended and may not persist. Option D is wrong because creating a new environment and swapping URLs can work but is more complex than necessary.

Answer

SSH into each instance and modify the instance type manually.

Answer

Terminate all instances and launch new ones with the larger instance type.

Answer

Create a new environment with the larger instance type and swap the environment URLs.

Question 2

Which THREE steps are required to deploy a serverless application using AWS CloudFormation? (Choose three.)

Accepted Answer

Use the AWS::Serverless::Transform to enable SAM. Options A, C, and E are correct. Option B is incorrect because it is not a step; it is a prerequisite. Option D is incorrect because a VPC is optional.

Answer

Define a VPC and subnets for the Lambda function

Answer

Create an S3 bucket for the deployment artifact

Question 3

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error 'CREATE_FAILED - Resource handler returned message: 'Invalid instance type specified'. The template uses a parameter for InstanceType. What is the most likely cause of this failure?

Accepted Answer

The InstanceType parameter is set to a value that is not allowed in the parameter's AllowedValues list.. The error indicates the instance type is invalid. Checking the allowed values in the parameter definition is the correct first step. Option A is wrong because Auto Scaling groups don't directly cause this error. Option B is wrong because the error is about instance type, not VPC. Option D is wrong because the error is not about template syntax or permissions.

Answer

The VPC specified in the template does not have internet access.

Answer

The Auto Scaling group's desired capacity exceeds the instance limit.

Answer

The template uses a DependsOn clause that creates a circular dependency.

Question 4

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with Multi-AZ enabled. During a stack update, the database engine version is changed. The update fails with a rollback. What is the most likely cause?

Accepted Answer

The engine version upgrade is not supported for Multi-AZ deployments.. Option C is correct because modifying the DB engine version on a Multi-AZ instance requires a reboot of both the primary and standby, and if the upgrade is not supported, it fails. Option A is wrong because the storage type is not changed. Option B is wrong because the DB instance class is not changed. Option D is wrong because the subnet group is not changed.

Answer

The DB instance class is not available for the new engine version.

Answer

The storage type is not compatible with the new engine version.

Answer

The DB subnet group does not have enough IP addresses.

Question 5

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must include a build stage, a test stage, and a deployment stage. The administrator wants to ensure that if the build stage fails, the pipeline stops and notifies the team. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure the pipeline to stop on failure in the build stage.. The correct answers are A and D. CodePipeline automatically stops on failure (A). Amazon SNS can be used to send notifications (D). Option B is wrong because CodeBuild does not stop the pipeline; it only runs the build. Option C is wrong because CloudWatch Events can trigger notifications but are not the only way; SNS is simpler. Option E is wrong because manual approval is not automatic.

Answer

Set up an Amazon CloudWatch Events rule to detect build failures and send an email.

Answer

Add a manual approval action after the build stage to review results.

Answer

Use AWS CodeBuild as the build provider and configure it to stop the pipeline on failure.

Question 6

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target instances are not passing the health checks. The administrator reviews the CodeDeploy deployment logs and finds that the application installation succeeded but the built-in health check failed. What should the administrator do to resolve this issue?

Accepted Answer

Modify the AppSpec file to include a script in the 'Validate Service' lifecycle event that performs a custom health check.. The Validate Service lifecycle hook is used to run health checks after installation. Option B is correct. Option A is wrong because the ApplicationStop hook runs before installation. Option C is wrong because AfterInstall runs before validation. Option D is wrong because the AppSpec file is not used to skip health checks.

Answer

Modify the AppSpec file to set the 'healthCheckGracePeriod' to a higher value.

Answer

Modify the AppSpec file to include a script in the 'AfterInstall' lifecycle event that restarts the web server.

Answer

Modify the AppSpec file to run a script in the 'ApplicationStop' lifecycle event.

Question 7

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all new S3 buckets created in any account have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes the x-amz-server-side-encryption header with a valid encryption algorithm.. Option A is correct because SCPs can be applied to all accounts in the organization to deny creation of S3 buckets without encryption. Option B is wrong because IAM roles are per account and not centrally enforced. Option C is wrong because CloudTrail is for logging, not enforcement. Option D is wrong because Config rules detect non-compliance but do not prevent creation.

Answer

Create an IAM role in each member account with a policy that denies s3:CreateBucket without encryption, and require all users to assume that role.

Answer

Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' to detect non-compliant buckets and automatically remediate.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers a Lambda function to delete any bucket created without encryption.

Question 8

Which TWO actions should a SysOps administrator take to automate the deployment of a multi-tier application with AWS CloudFormation? (Choose two.)

Accepted Answer

Use nested stacks to separate concerns such as network, app, and database. Options B and D are correct. Option A is incorrect because nested stacks are not always necessary. Option C is incorrect because hardcoding CIDR blocks reduces flexibility. Option E is incorrect because parameters should be used for dynamic values.

Answer

Hardcode CIDR blocks and instance types to avoid parameter input

Answer

Use AWS::Include to reuse snippets instead of parameters

Answer

Define all resources in a single template to simplify management

Question 9

A SysOps administrator is troubleshooting a CloudFormation stack that failed to create. The stack includes an Amazon RDS DB instance. The error message indicates that the DB instance name already exists. The stack uses a parameter for the DB instance identifier. What should the administrator do to resolve this issue and create the stack?

Accepted Answer

Delete the failed stack, change the DB instance identifier parameter to a unique name, and recreate the stack.. Option D is correct because the stack creation failed due to a naming conflict. Updating the stack is not possible since it failed. The best approach is to delete the failed stack, change the parameter value to a unique name, and recreate the stack. Option A is incorrect because updating a failed stack requires a different approach and the parameter change might not be allowed. Option B is incorrect because continuing update rollback does not change the parameter. Option C is incorrect because the stack failed creation; there is no existing resource to update.

Answer

Manually delete the DB instance from the AWS Management Console and then retry the stack creation.

Answer

Use the AWS CLI command aws cloudformation update-stack with a new parameter value.

Answer

Execute ContinueUpdateRollback on the stack to retry the creation.

Question 10

A company needs to deploy a new version of a Lambda function. The deployment must be gradual, shifting 10% of traffic to the new version every 10 minutes until all traffic is served by the new version. If errors occur, the deployment should roll back immediately. Which deployment strategy should be used?

Accepted Answer

Canary deployment with AWS Lambda. Option C is correct because Lambda canary deployments allow specifying traffic shifting and automatic rollback. Option A is wrong because blue/green is not natively supported for Lambda without additional services. Option B is wrong because rolling is for EC2/ECS. Option D is wrong because all-at-once is immediate, not gradual.

Answer

Blue/green deployment with AWS CodeDeploy

Answer

All-at-once deployment

Answer

Rolling deployment with Amazon ECS

Question 11

An administrator attempts to deploy an application using AWS CodeDeploy. The deployment fails with 'Access Denied' when trying to download the revision from the S3 bucket 'example-bucket'. The IAM policy attached to the instance profile is shown in the exhibit. What is the cause of the failure?

Accepted Answer

The policy is missing the s3:GetObjectVersion action for the bucket. Option A is correct because the policy grants s3:GetObject on the bucket contents, but CodeDeploy also needs s3:GetObjectVersion for versioned buckets or the deployment may be using a specific version. However, the exhibit shows only s3:GetObject, not s3:GetObjectVersion. Additionally, the policy does not include s3:GetObjectTagging or other actions that might be required. But the most common issue is that the policy is missing s3:GetObjectVersion. Option B is wrong because the policy does have s3:ListBucket. Option C is wrong because the policy is attached to the instance profile. Option D is wrong because s3:ListBucket is present.

Answer

The policy does not include s3:ListBucket

Answer

The policy grants s3:ListBucket but not s3:GetObject

Answer

The policy is attached to the wrong IAM role

Question 12

A SysOps administrator is troubleshooting a failed AWS Elastic Beanstalk environment update. The update changed the configuration of the EC2 instances in the Auto Scaling group, but the new instances fail to launch. The administrator checks the Auto Scaling group's scaling activities and sees a 'Failed' status with the message: 'Instance failed to reach the desired state.' What should the administrator check next?

Accepted Answer

Check the CloudWatch logs for the failed instance to identify application or configuration errors.. The error 'failed to reach desired state' often indicates an issue with the instance's health checks, such as ELB health check failures. Checking the CloudWatch logs for the instance's application is the most direct way to diagnose why the instance is not passing health checks. Option A is wrong because IAM roles would cause a different error. Option B is wrong because the error is not about termination protection. Option D is wrong because the error is not about scaling limits.

Answer

Check the IAM role attached to the environment's EC2 instances for missing permissions.

Answer

Check the account service quotas for EC2 instances.

Answer

Check the termination protection setting on the Auto Scaling group.

Question 13

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator wants to update a stack that contains an Amazon RDS DB instance. The update involves changing the DB instance class. Which THREE steps should the administrator take to perform this update with minimal downtime? (Choose three.)

Accepted Answer

Update the CloudFormation stack with a new parameter value for the DB instance class.. The correct answers are B, C, and E. Using a snapshot ensures data is backed up (B). Modifying the DB instance class with Multi-AZ enabled allows a rolling update (C). Updating the CloudFormation stack with the new instance class triggers the change (E). Option A is wrong because deleting the stack is not necessary. Option D is wrong because modifying the DB instance directly outside CloudFormation may cause drift.

Answer

Modify the RDS instance class directly in the RDS console and then update the CloudFormation template.

Answer

Delete the existing stack and create a new one with the updated instance class.

Question 14

A SysOps administrator needs to automate the creation of an Amazon S3 bucket with versioning enabled and default encryption using AWS CloudFormation. Which CloudFormation resource type should the administrator use?

Accepted Answer

AWS::S3::Bucket. AWS::S3::Bucket is the resource type for creating S3 buckets. Option B is correct. Option A is wrong because AWS::S3::BucketPolicy is for bucket policies. Option C is wrong because AWS::S3::BucketVersioning is not a valid resource type; versioning is a property of AWS::S3::Bucket. Option D is wrong because AWS::KMS::Key is for KMS keys, not S3 buckets.

Answer

AWS::S3::BucketPolicy

Answer

AWS::KMS::Key

Answer

AWS::S3::BucketVersioning

Question 15

A SysOps administrator is deploying a CloudFormation stack that includes an Amazon EC2 instance. The instance needs to have the latest patch level at launch. Which TWO methods can accomplish this? (Choose TWO.)

Accepted Answer

Create a custom AMI with the latest patches.. Options B and D are correct. Using a Systems Manager patch baseline with the AWS-RunPatchBaseline document in a CloudFormation creation policy allows patching at launch. Alternatively, using a custom AMI that already includes the latest patches ensures the instance is patched from the start. Option A (user data script) might not run before the instance becomes available. Option C (AWS Config rules) is for compliance, not patching during deployment. Option E (CodeDeploy) is for application deployment, not OS patching.

Answer

Include a user data script that runs the patch command.

Answer

Use AWS CodeDeploy to run a patch script.

Answer

Configure an AWS Config rule to enforce patching.