SOA-C02 Practice Test 38 — 15 Questions

Question 1

A company wants to automatically start and stop an EC2 instance on a schedule to reduce costs. The instance runs a critical application that must be available from 8 AM to 6 PM weekdays. Which AWS service should be used to implement this scheduling?

Accepted Answer

AWS Instance Scheduler. Option C is correct because AWS Instance Scheduler is a solution that allows you to configure start and stop schedules for EC2 and RDS instances. Option A is wrong because Systems Manager Automation is for automating maintenance tasks, not scheduling instance start/stop. Option B is wrong because OpsWorks is for configuration management. Option D is wrong because CloudFormation is for infrastructure as code, not scheduling.

Answer

AWS OpsWorks

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation

Question 2

A SysOps administrator is investigating a failed CloudFormation stack creation. The describe-stack-events output shows that the stack creation failed with the reason 'Resource creation cancelled'. What is the most likely cause of this failure?

Accepted Answer

A WaitCondition resource did not receive the required signal within the specified timeout period.. Option C is correct because the WaitCondition timed out before receiving the required signal, causing CloudFormation to cancel the stack creation. Option A is incorrect because there is no indication of missing IAM permissions. Option B is incorrect because a parameter validation error would appear as a different reason. Option D is incorrect because the stack creation was cancelled due to the wait condition timeout, not a nested stack failure.

Answer

The stack template contains an invalid parameter value.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to create the resources.

Answer

A nested stack within the parent stack failed to create.

Question 3

A company has a CloudFormation stack that creates an Amazon EC2 instance with a user data script that installs software from the internet. The stack creation is failing with a timeout. The SysOps administrator suspects that the user data script is taking too long or failing. How can the administrator configure the stack to wait for the user data script to complete successfully before marking the instance as CREATE_COMPLETE?

Accepted Answer

Add a CreationPolicy with a resource signal to the EC2 instance resource and have the user data script send a success signal using cfn-signal.. Use a CreationPolicy with a resource signal on the EC2 instance. The user data script must send a success signal (e.g., via cfn-signal) to CloudFormation. Option B is wrong because WaitCondition is used for external signals but requires a separate wait handle. Option C is wrong because UpdatePolicy is for updates, not creation. Option D is wrong because DependsOn only waits for resource creation, not for user data completion.

Answer

Add a DependsOn attribute to the EC2 instance resource to wait for another resource.

Answer

Add an UpdatePolicy with a resource signal to the EC2 instance resource.

Answer

Add a WaitCondition resource and a WaitHandle, and have the user data script send a signal to the WaitHandle.

Question 4

A SysOps administrator is creating a CloudFormation stack that requires an IAM role to be passed to EC2 instances. The administrator is using the IAM policy shown in the exhibit. The stack creation fails with an error indicating insufficient permissions to pass the role. What is the most likely cause?

Accepted Answer

The iam:PassRole permission is restricted to a specific role ARN that does not match the role the administrator is trying to pass.. Option B is correct because the iam:PassRole action is allowed only for the role 'Admin', but the stack may be using a different role. Option A is incorrect because the cloudformation:* action allows all CloudFormation operations. Option C is incorrect because the policy allows cloudformation:* which includes creating stacks. Option D is incorrect because the policy allows ec2:RunInstances and ec2:Create*.

Answer

The cloudformation:* action does not include permission to create stacks.

Answer

The policy does not include the cloudformation:CreateStack action.

Answer

The ec2:RunInstances permission is missing from the policy.

Question 5

A SysOps administrator needs to deploy a new version of an application that runs on Amazon EC2 instances in an Auto Scaling group. The deployment should minimize downtime and roll back automatically if health checks fail. Which deployment method should the administrator use?

Accepted Answer

Blue/green deployment using a new Auto Scaling group and an Application Load Balancer. Blue/green deployment with an Auto Scaling group and an Application Load Balancer allows switching traffic to the new version and rolling back if health checks fail. Option A is wrong because in-place deployments update existing instances and can cause downtime. Option C is wrong because rolling update is an in-place method. Option D is wrong because canary deployment is a type of blue/green but typically used for canary testing, not automatic rollback based on health checks.

Answer

Canary deployment

Answer

Rolling update via an Auto Scaling group

Answer

In-place deployment

Question 6

A company is using AWS CodeDeploy to deploy a new version of an application to an Amazon ECS service. The deployment must be gradual to minimize impact. Which deployment type should be used?

Accepted Answer

Rolling update deployment. Option B is correct because ECS supports rolling update deployment, which gradually replaces tasks. Option A is wrong because blue/green is also supported but is not gradual in the same sense (it shifts all traffic at once after testing). Option C is wrong because canary is for Lambda. Option D is wrong because linear is for CodeDeploy Lambda deployments.

Answer

Linear deployment

Answer

Canary deployment

Answer

Blue/green deployment

Question 7

A SysOps administrator wants to deploy a new version of an application to an existing Elastic Beanstalk environment. The administrator runs the command shown in the exhibit and sees that the environment is healthy. What should the administrator do next to deploy the new version?

Accepted Answer

Run aws elasticbeanstalk update-environment --environment-name my-env --version-label v2.0. Option B is correct because the deploy command uploads the source bundle and updates the environment. Option A is incorrect because it only creates a new version without deploying it. Option C is incorrect because it creates a new environment, not deploys to existing. Option D is incorrect because there is no 'update-version' command in Elastic Beanstalk.

Answer

Run aws elasticbeanstalk create-application-version --application-name my-app --version-label v2.0 --source-bundle S3Bucket="my-bucket",S3Key="app-v2.zip"

Answer

Run aws elasticbeanstalk update-application-version --application-name my-app --version-label v2.0 --environment-name my-env

Answer

Run aws elasticbeanstalk create-environment --application-name my-app --environment-name my-env-v2 --version-label v2.0

Question 8

A SysOps administrator needs to automate the creation of an Amazon RDS for MySQL database instance. The administrator wants to use AWS CloudFormation and ensure that the database password is not stored in plaintext in the template. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to generate a random password and reference it in the CloudFormation template using a dynamic reference (resolve:secretsmanager).. Using AWS Secrets Manager to generate a password and referencing it with a dynamic reference is the secure, automated way. Option B is wrong because CloudFormation parameters also store values in plaintext in the template. Option C is wrong because it requires manual retrieval. Option D is wrong because Parameter Store also stores plaintext unless using SecureString, but the reference would still be resolved to plaintext in the template.

Answer

Store the password as a CloudFormation parameter with a default value and use the Ref intrinsic function.

Answer

Generate a password manually and store it in a text file in Amazon S3; reference the S3 URL in the template.

Answer

Use AWS Systems Manager Parameter Store (String type) and reference it with the dynamic reference resolve:ssm.

Question 9

A SysOps administrator ran a CloudFormation stack update that failed and rolled back. The stack status is UPDATE_ROLLBACK_FAILED. The administrator needs to fix the issue and bring the stack to a stable state. What should the administrator do FIRST?

Accepted Answer

Identify and resolve the resource issue that caused the rollback failure, then continue the rollback.. The correct answer is B because when a rollback fails, the administrator must resolve the underlying issue (e.g., permissions, resource conflict) and then continue the rollback. Option A is wrong because attempting a new update without fixing the issue may fail again. Option C is wrong because deleting the stack may cause data loss. Option D is wrong because CloudFormation does not automatically retry.

Answer

Wait for CloudFormation to automatically retry the rollback.

Answer

Execute a new stack update to overwrite the failed resources.

Answer

Delete the stack and recreate it from the template.

Question 10

A company is using AWS Elastic Beanstalk to manage a web application. The SysOps administrator needs to update the application to a new version with zero downtime. Which THREE steps should the administrator take to achieve this? (Choose three.)

Accepted Answer

Create a new Elastic Beanstalk environment with the new application version, then swap the environment URLs.. To achieve zero downtime with Elastic Beanstalk, the administrator should use a blue/green deployment or rolling update with a batch size of 1 and pause. Option A is correct because creating a new environment and swapping URLs is blue/green, which provides zero downtime. Option C is correct because rolling updates with a batch size of 1 ensure only one instance is replaced at a time, minimizing impact. Option E is correct because setting a health check grace period prevents premature termination. Option B is wrong because terminating instances causes downtime. Option D is wrong because increasing the load balancer's health check interval to 300 seconds would cause longer delays in detecting healthy instances, potentially causing issues.

Answer

Terminate all existing instances and replace them with new ones.

Answer

Set the load balancer's health check interval to 300 seconds to allow more time for the new instances to become healthy.

Question 11

A company uses AWS Elastic Beanstalk to deploy a Python web application. The administrator needs to update the environment's configuration to use a larger instance type. What is the correct way to perform this update with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to change the instance type and select a rolling update policy.. Elastic Beanstalk supports rolling updates to change instance types without downtime. Option D is correct. Option A is wrong because terminating instances causes downtime. Option B is wrong because you cannot change the instance type in an existing environment's configuration without a rolling update. Option C is wrong because creating a new environment is more disruptive than a rolling update.

Answer

Create a new Elastic Beanstalk environment with the larger instance type and swap the environment URLs.

Answer

Use the Elastic Beanstalk console to change the instance type and apply the change immediately.

Answer

Terminate all instances and launch new ones with the larger instance type.

Question 12

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. Which configuration step is required?

Accepted Answer

Configure the target group to use HTTPS protocol and install SSL/TLS certificates on the instances.. Option B is correct because configuring the target group with HTTPS health checks and expecting HTTPS traffic ensures that the ALB communicates with the instances over HTTPS. Option A is wrong because the listener handles client-facing encryption, not backend. Option C is wrong because security groups control access but not encryption. Option D is wrong because the ALB does not have a NAT gateway.

Answer

Configure the ALB listener to use HTTPS with a security policy.

Answer

Place the instances in a private subnet and use a NAT gateway for outbound traffic.

Answer

Create a security group rule that allows only HTTPS traffic from the ALB to the instances.

Question 13

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.. DependsOn ensures the order of resource creation. For the Auto Scaling group to wait for both the ALB and RDS, it must list both as dependencies. Additionally, a CreationPolicy on the RDS instance can be used to signal when it is fully available (e.g., after the database is created and ready). However, the question asks for two actions; the most direct are using DependsOn on the Auto Scaling group for both resources, and also possibly using a CreationPolicy on the RDS to ensure it is truly available, but since the question says 'fully created and available', the best two are: (1) Add a DependsOn attribute to the Auto Scaling group resource listing both the ALB and RDS resources. (2) Add a CreationPolicy to the RDS instance resource to wait for a signal that indicates it is available. Option A is incomplete. Option B is correct because DependsOn with both resources ensures creation order. Option C is also correct because CreationPolicy on RDS ensures it signals readiness. Note: The question may have a different intended answer; but based on typical exam, DependsOn and CreationPolicy are the standard ways.

Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.

Answer

Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.

Answer

Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.

Question 14

A company uses AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket. The stack creation fails because the S3 bucket name already exists. What should the administrator do to resolve this issue?

Accepted Answer

Change the S3 bucket name in the CloudFormation template to a unique name.. Option B is correct because S3 bucket names must be globally unique, so using a different name resolves the conflict. Option A is wrong because deleting the bucket is not viable if it's in use. Option C is wrong because policies do not affect bucket name uniqueness. Option D is wrong because tags do not affect bucket names.

Answer

Add a tag to the existing bucket to make it available for the stack.

Answer

Delete the existing S3 bucket and recreate the stack.

Answer

Update the bucket policy to allow the stack to use the bucket.

Question 15

A SysOps administrator wants to automate the deployment of an application to an EC2 instance. The instance is running, but the deployment script fails because the instance is not reachable via SSH. The administrator checks the instance state as shown in the exhibit. What should the administrator check NEXT to troubleshoot the SSH connectivity issue?

Accepted Answer

Check the security group rules to ensure SSH (port 22) is allowed from the administrator's IP.. The correct answer is C because the instance is running, so the issue is likely network-related. Checking the security group rules ensures the correct inbound SSH rule exists. Option A is wrong because the instance is running, so no need to start it. Option B is wrong because the instance ID is correct. Option D is wrong because the subnet is likely correct if the instance is running.

Answer

Verify the instance is in a public subnet with an internet gateway.

Answer

Verify the instance ID is correct.

Answer

Check if the instance is in a stopped state.