SOA-C02 Practice Test 39 — 15 Questions

Question 1

A SysOps administrator is deploying a critical application using AWS CloudFormation. The stack must be updated frequently. Which TWO strategies should the administrator use to minimize the risk of update failures? (Choose TWO.)

Accepted Answer

Use change sets to review the impact of changes before applying them.. Stack policies and change sets help manage updates safely. Options B and D are correct. Option A is wrong because disabling rollback on failure is risky; it leaves the stack in a failed state. Option C is wrong because using the AWS CLI does not inherently reduce risk. Option E is wrong because manual approval is not a feature of CloudFormation directly.

Answer

Disable rollback on failure to avoid stack deletion.

Answer

Always use the AWS CLI to perform updates instead of the console.

Answer

Manually approve each resource update through the console.

Question 2

A company wants to automate the creation of AWS resources based on tags. When a user tags an S3 bucket with 'Deploy: True', a Lambda function should trigger to create a corresponding CloudFront distribution. Which AWS service should be used to invoke the Lambda function when the tag is applied?

Accepted Answer

AWS Config. Option B is correct. AWS Config rules can be configured to trigger on resource changes, including tag changes. CloudTrail (A) logs API calls but does not directly trigger Lambda. CloudWatch Events (C) can match API calls, but Config is more straightforward for tag compliance. S3 Events (D) only trigger on object-level events, not bucket tagging.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Events

Answer

Amazon S3 Events

Question 3

A SysOps administrator is managing a CloudFormation stack that creates an Amazon RDS DB instance. The stack uses the 'DBInstance' resource with a 'DeletionPolicy' attribute set to 'Delete'. The administrator wants to modify the stack to retain the DB instance when the stack is deleted, but the change fails because the DB instance is in a state that does not allow modification. What is the MOST likely reason?

Accepted Answer

The DeletionPolicy attribute cannot be changed after the stack is created.. Option A is correct because the DeletionPolicy attribute is immutable after the resource is created; to change it, you must create a new stack or use a different resource name. Option B is wrong because RDS does not have a backup window restriction for DeletionPolicy changes. Option C is wrong because the DeletionPolicy is applied at deletion, not creation. Option D is wrong because deletion protection is a separate property.

Answer

The stack is in a 'CREATE_COMPLETE' state and cannot be updated.

Answer

The DB instance has deletion protection enabled.

Answer

The DB instance is in a maintenance window that prevents modifications.

Question 4

A company is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS database. The administrator needs to modify the DB instance class but wants to avoid downtime. Which TWO options should the administrator consider? (Choose two.)

Accepted Answer

Apply the change during the RDS maintenance window to control when the modification occurs.. Option A is correct because a Multi-AZ deployment allows modifications with minimal downtime by applying the change to the standby first. Option B is correct because applying the change during a maintenance window can also reduce impact. Option C is wrong because deleting and recreating causes downtime. Option D is wrong because using a snapshot does not help with modifying the instance class. Option E is wrong because setting DeletionPolicy to Retain does not affect updates.

Answer

Set the DeletionPolicy attribute to Retain on the RDS instance.

Answer

Delete the current RDS instance and create a new one with the desired instance class.

Answer

Take a snapshot of the database and restore it with the new instance class.

Question 5

A DevOps engineer is troubleshooting a failed CloudFormation stack update. The stack includes an Auto Scaling group with a launch template. The update changed the AMI ID in the launch template, but the new instances launched with the old AMI. What is the most likely cause?

Accepted Answer

The Auto Scaling group is not configured to perform a rolling update.. Option B is correct because updating the launch template does not affect existing instances; a rolling update is required. Option A is wrong because even if the launch template is updated, new instances will still use the old AMI until the Auto Scaling group triggers a replacement. Option C is wrong because the issue is not the AMI ID itself. Option D is wrong because CloudFormation does not automatically perform rolling updates unless specified.

Answer

The new AMI ID is invalid or not available in the region.

Answer

The CloudFormation stack update did not successfully complete.

Answer

The launch template version is not set to use the latest version.

Question 6

A SysOps administrator is tasked with automating the provisioning of EC2 instances that must be able to access an Amazon S3 bucket. The administrator needs to ensure that the instances have the necessary permissions without using long-term access keys. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Attach the IAM role to the EC2 instances using an instance profile.. Options A and E are correct. The best practice is to create an IAM role with S3 access (A) and assign it to the EC2 instances via an instance profile (E). Option B is incorrect because storing access keys in a file is insecure. Option C is incorrect because S3 bucket policies control access at the bucket level, not directly for EC2 instances. Option D is incorrect because storing keys in Systems Manager Parameter Store is better than hardcoding, but an IAM role is still the preferred approach.

Answer

Store AWS access keys in a configuration file on the instances.

Answer

Create an S3 bucket policy that allows access from the instances' private IP addresses.

Answer

Store the access keys in AWS Systems Manager Parameter Store.

Question 7

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not hard-coded in the application code. Which approach should be used?

Accepted Answer

Use Elastic Beanstalk environment properties to pass the credentials, referencing them from AWS Secrets Manager.. Option D is correct because Elastic Beanstalk can pass environment properties to the application, and these can be stored securely using AWS Systems Manager Parameter Store or Secrets Manager. Option A is wrong because storing in the source code is not secure. Option B is wrong because storing in S3 requires access management and is not best practice. Option C is wrong because EC2 user data is not encrypted and is visible in the console.

Answer

Pass the credentials via EC2 user data when the instance launches.

Answer

Store the credentials in a configuration file in the application source code.

Answer

Store the credentials in an S3 bucket and retrieve them at runtime.

Question 8

A company uses AWS Systems Manager to automate patching of EC2 instances. The instances are in an Auto Scaling group. The company wants to ensure that patching does not affect application availability. Which feature should be used?

Accepted Answer

Maintenance Windows. Option A is correct because Systems Manager Maintenance Windows allow scheduling patching during specific time windows, and can be configured to work with Auto Scaling to maintain availability. Option B is wrong because Run Command is for ad-hoc commands. Option C is wrong because Patch Manager is the service, but Maintenance Windows schedule it. Option D is wrong because State Manager is for configuration, not patching.

Answer

State Manager

Answer

Patch Manager

Answer

Run Command

Question 9

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a deployment stage that uses AWS CloudFormation to deploy infrastructure. The company wants to add a manual approval step before the CloudFormation deployment. How should this be configured?

Accepted Answer

Add a manual approval action in the pipeline before the CloudFormation deployment stage.. Option B is correct because CodePipeline has a built-in approval action that pauses the pipeline until manually approved. Option A is wrong because CloudFormation change sets allow review but do not pause the pipeline. Option C is wrong because Lambda cannot block the pipeline. Option D is wrong because SNS alone does not pause the pipeline.

Answer

Add a CloudFormation change set action before the deployment.

Answer

Configure an Amazon SNS topic to send a notification and require a confirmation.

Answer

Use an AWS Lambda function to send an email and wait for a response.

Question 10

A company is using AWS CodeDeploy to automate deployments to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The instances are running Amazon Linux 2 and the CodeDeploy agent is installed. Which of the following is the MOST likely cause of this failure?

Accepted Answer

The CodeDeploy agent requires ruby and wget, which are not installed by default on Amazon Linux 2.. Option A is correct because the CodeDeploy agent needs the ruby and wget packages to function correctly on Amazon Linux 2. Without them, the agent may fail to download or execute the deployment scripts, causing instance failures. Option B is incorrect because S3 bucket policies do not affect CodeDeploy agent functionality directly; the agent uses HTTPS to download revision files. Option C is incorrect because the deployment configuration controls how many instances can fail, but does not cause individual instance failures. Option D is incorrect because the deployment group can be configured with any number of instances; the error is not due to group size but individual instance failures.

Answer

The S3 bucket containing the deployment artifacts has a bucket policy that denies access to the instances.

Answer

The deployment configuration is set to 'OneAtATime', causing insufficient healthy instances during the first deployment.

Answer

The Auto Scaling group has a minimum of 0 instances, so the deployment cannot start.

Question 11

A company is deploying a microservices application on Amazon ECS with Fargate. The SysOps administrator needs to implement a deployment strategy that minimizes downtime and allows for automated rollbacks if the new version fails health checks. Which TWO options should the administrator choose? (Choose TWO.)

Accepted Answer

Configure the ECS service to automatically roll back on deployment failure.. Options B and D are correct. Blue/green deployments (B) reduce downtime by shifting traffic gradually. Automated rollbacks (D) are supported by CodeDeploy when health checks fail. Option A is incorrect because canary deployments are a variation of blue/green but not a separate deployment type in ECS. Option C is incorrect because rolling updates can cause downtime and are not the best for minimizing downtime. Option E is incorrect because immutable deployments are not natively supported in ECS with Fargate.

Answer

Use a rolling update with the ECS service scheduler.

Answer

Use an immutable deployment by replacing the entire Auto Scaling group.

Answer

Use a canary deployment with AWS CodeDeploy.

Question 12

A company uses AWS Elastic Beanstalk to deploy a Node.js application. The application requires a specific version of Node.js that is not the default version provided by the Elastic Beanstalk platform. How can the administrator ensure that the correct Node.js version is installed on the environment's EC2 instances?

Accepted Answer

Include a configuration file in the .ebextensions folder that specifies the desired Node.js version.. Elastic Beanstalk allows customization via configuration files in the .ebextensions folder. Option A is correct. Option B is wrong because the environment properties are for environment variables, not platform settings. Option C is wrong because you cannot change the platform version after environment creation; you would need to create a new environment. Option D is wrong because the AWS CLI is not used for instance-level configuration.

Answer

Use the AWS CLI to run a command on each instance to install the desired Node.js version.

Answer

Use the Elastic Beanstalk console to change the platform version after the environment is created.

Answer

Set an environment property 'NODE_VERSION' to the desired version.

Question 13

A SysOps administrator is tasked with automating the deployment of an application across multiple AWS accounts. Which AWS service should be used to orchestrate the deployment across accounts?

Accepted Answer

AWS CloudFormation StackSets. Option B is correct because AWS CloudFormation StackSets allows you to deploy CloudFormation stacks across multiple accounts and regions in a single operation. Option A (CodeDeploy) is for deploying applications to EC2 or on-premises, not across accounts. Option C (Service Catalog) is for creating and managing a catalog of approved IT services, not for multi-account orchestration. Option D (Systems Manager) is for management and patching, not orchestrated cross-account deployments.

Answer

AWS CodeDeploy

Answer

AWS Service Catalog

Answer

AWS Systems Manager

Question 14

A company needs to deploy a set of microservices using Docker containers on AWS. The deployment should be automated and support scaling based on demand. Which AWS service should be used to orchestrate the containers?

Accepted Answer

Amazon ECS. Option D is correct. Amazon ECS is a fully managed container orchestration service that integrates with Auto Scaling and CloudWatch. Option A (Lambda) is for serverless functions, not containers. Option B (Elastic Beanstalk) can deploy containers but is less flexible for microservices. Option C (CodeDeploy) is for application deployments, not orchestration.

Answer

AWS Lambda

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 15

A company uses AWS CodeBuild to compile code and run unit tests. The build environment requires a specific version of Java that is not available in the default build images. What should the administrator do?

Accepted Answer

Create a custom build image with the required Java version and push it to Amazon ECR.. Option D is correct because the administrator can create a custom build image and push it to Amazon ECR, then reference it in the buildspec. Option A is wrong because installing Java in the buildspec is possible but inefficient and may not persist. Option B is wrong because the default images cannot be modified. Option C is wrong because using a Lambda function is not the right approach.

Answer

Request AWS Support to add the Java version to the default build image.

Answer

Use an AWS Lambda function to set up the build environment before CodeBuild runs.

Answer

Install the required Java version in the buildspec file using a command.