SOA-C02 Practice Test 41 — 15 Questions

Question 1

A SysOps administrator is troubleshooting a CloudFormation stack creation failure. The stack is designed to create an Amazon RDS DB instance with a specific parameter group. The error message indicates that the DB instance could not be created because the parameter group does not exist. The administrator has verified that the parameter group exists in the same region and account. What is the MOST likely issue?

Accepted Answer

The parameter group resource is defined in the same template but is not linked to the DB instance using the 'DependsOn' attribute.. Option A is correct because CloudFormation must create resources in order based on dependencies. If the parameter group is defined in the same template, it might be created after the DB instance, causing an error. The administrator should use the DependsOn attribute to ensure the parameter group is created first. Option B is incorrect because the error is about the parameter group not existing, not about security groups. Option C is incorrect because the parameter group name being incorrect would result in a different error. Option D is incorrect because the DB instance class does not affect parameter group existence.

Answer

The parameter group name in the template has a typo or does not match the actual resource name.

Answer

The VPC security group specified for the DB instance does not allow inbound traffic from the application tier.

Answer

The DB instance class requires a different parameter group family.

Question 2

A company deploys microservices on Amazon ECS using Fargate. The deployment is managed by AWS CodePipeline. The administrator notices that deployments sometimes fail because the new task definition is not registered before the deployment. Which THREE steps should the administrator take to resolve this issue? (Choose THREE.)

Accepted Answer

Ensure that the task definition is registered in the CodePipeline build stage before the deploy stage.. The issue is that the task definition must be registered before the ECS service update. Options A, D, and E are correct. Option B is wrong because the task definition is not stored in ECR; ECR stores container images. Option C is wrong because the ECS service update is triggered by CodePipeline, not manually.

Answer

Manually update the ECS service with the new task definition after the pipeline runs.

Answer

Store the task definition in Amazon ECR alongside the container image.

Question 3

A SysOps administrator needs to deploy a new version of an application to an Auto Scaling group using a blue/green deployment strategy. The application runs on EC2 instances behind an Application Load Balancer. Which AWS service should be used to automate this deployment?

Accepted Answer

AWS CodeDeploy. Option C is correct. AWS CodeDeploy supports blue/green deployments for EC2 instances behind a load balancer, allowing traffic to be shifted gradually. Option A (Elastic Beanstalk) is a PaaS service, not for existing Auto Scaling groups. Option B (CloudFormation) can create infrastructure but not manage traffic shifting natively. Option D (CodePipeline) orchestrates steps but relies on CodeDeploy for the deployment.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CloudFormation

Question 4

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Option B is correct because ElastiCache for Redis provides a centralized session store that can be accessed by any instance, allowing the application to be stateless without code changes if the application is configured to use Redis. Option A is incorrect because Sticky Sessions (session affinity) is a workaround but does not eliminate the dependency on local storage; if an instance fails, sessions are lost. Option C is incorrect because modifying the application to use a database for session storage requires code changes. Option D is incorrect because disabling the feature does not solve the problem.

Answer

Configure the Application Load Balancer with sticky sessions (session affinity).

Answer

Disable the feature that stores session state locally.

Answer

Modify the application to store session data in an Amazon RDS database.

Question 5

An organization uses AWS Service Catalog to manage approved IT services. A SysOps administrator needs to update a CloudFormation template used by a product. The administrator wants to ensure that existing provisioned products are updated with the new template version. What step must the administrator take after updating the product?

Accepted Answer

Create a new product version and update the provisioned products to use the new version.. Option B is correct because in Service Catalog, to update existing provisioned products, you need to create a new product version and update the provisioned product to that version. Simply updating the template does not automatically trigger updates. Option A is incorrect because Service Catalog uses versions, not direct template updates. Option C is incorrect because terminating and reprovisioning is disruptive and not recommended. Option D is incorrect because updating the portfolio does not update provisioned products.

Answer

Update the portfolio that contains the product.

Answer

Update the product's CloudFormation template directly in the Service Catalog console.

Answer

Terminate the existing provisioned products and reprovision them.

Question 6

An administrator is using AWS CloudFormation to create a stack that includes an Auto Scaling group and a launch template. The launch template specifies an AMI ID. Which TWO changes to the launch template will trigger an update to the Auto Scaling group? (Choose TWO.)

Accepted Answer

Changing the instance type.. Changing the AMI ID or the instance type will trigger an update because they affect the instances launched. Options A and B are correct. Option C is wrong because tag changes do not trigger a replacement. Option D is wrong because the security group is part of the launch template but changes to it do not trigger an update of the Auto Scaling group; they update the instances. Option E is wrong because the key pair does not trigger an update.

Answer

Modifying the security group IDs.

Answer

Changing the key pair name.

Answer

Adding a new tag to the launch template.

Question 7

A company uses AWS CloudFormation to deploy a multi-tier application. The administrator wants to ensure that the database layer is fully provisioned and available before the application layer starts. How can this be achieved?

Accepted Answer

Use the DependsOn attribute on the application layer resources to depend on the database layer.. Option D is correct. Using CloudFormation's DependsOn attribute ensures that the database resource is created before the application resource. Option A (wait conditions) is used for external signals, not for resource dependencies. Option B (creation policy) is for signaling from within an instance. Option C (nested stacks) does not inherently order resources across stacks.

Answer

Create separate stacks for the database and application layers.

Answer

Use a CloudFormation creation policy on the application instances.

Answer

Use a CloudFormation wait condition in the database stack.

Question 8

A company uses AWS Systems Manager to automate patching of EC2 instances. The SysOps administrator creates a Maintenance Window that targets a list of instances. The patching task fails with the error: 'Instance is not in a supported state.' What should the administrator check FIRST?

Accepted Answer

Verify that the SSM Agent is installed and running on the instance.. Option C is correct because Systems Manager requires the SSM Agent to be installed and running on the instance to execute commands. Option A is wrong because instance profiles are for IAM roles, not patching. Option B is wrong because security groups affect network access, not the agent. Option D is wrong because patching does not require a public IP.

Answer

Verify that the instance has a public IP address.

Answer

Verify that the instance's security group allows inbound traffic from Systems Manager.

Answer

Verify that the instance has an IAM instance profile attached with the necessary permissions.

Question 9

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

Accepted Answer

Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.. Option D is correct because CodePipeline allows you to manually release a change, which re-runs the pipeline from the last successful execution or from the source stage. Option A is incorrect because modifying the S3 object directly might not trigger the pipeline automatically (depending on configuration), but it's not the standard way to retry. Option B is incorrect because commit messages do not affect pipeline execution. Option C is incorrect because the pipeline will not automatically retry; the developer must manually retry.

Answer

Create a new commit with an empty message to trigger the pipeline.

Answer

Wait for the pipeline to automatically retry after the failure.

Answer

Re-upload the same artifact to the source S3 bucket to trigger the pipeline.

Question 10

A company is using AWS CloudFormation to manage infrastructure. A recent stack update failed, and the SysOps administrator needs to roll back to the previous known good state. However, the stack is in UPDATE_ROLLBACK_FAILED state. What should the administrator do to recover the stack?

Accepted Answer

Use the ContinueUpdateRollback API or AWS Management Console to resume the rollback after addressing the failure cause. Option B is correct because when a stack is in UPDATE_ROLLBACK_FAILED, you can continue the rollback by fixing the underlying issue (e.g., deleting a resource that cannot be rolled back) and then executing ContinueUpdateRollback. Option A is wrong because deleting the stack would remove all resources, causing data loss. Option C is wrong because updating the stack again may not resolve the rollback failure and could compound errors. Option D is wrong because CloudFormation does not have an automatic rollback recovery feature; manual intervention is required.

Answer

Delete the stack and recreate it from the previous template

Answer

Contact AWS Support to enable automatic rollback recovery

Answer

Execute another stack update with the same parameters to overwrite the failed state

Question 11

An organization has a requirement to automatically scale its web application based on a custom metric that measures the number of active user sessions stored in Amazon ElastiCache. The metric is published to CloudWatch every minute. The Auto Scaling group currently uses a simple scaling policy based on CPU utilization. What is the most effective way to implement scaling based on this custom metric?

Accepted Answer

Create a target tracking scaling policy that uses the custom metric as a target.. Option D is correct. A target tracking scaling policy can be configured to use a custom CloudWatch metric, which simplifies management and maintains a target value. Option A (simple scaling policy) would require manual thresholds and is less responsive. Option B (step scaling) is possible but more complex. Option C (scheduled scaling) is not appropriate for dynamic changes.

Answer

Create a step scaling policy that adjusts capacity based on the magnitude of the metric breach.

Answer

Create a scheduled scaling policy that increases capacity during peak hours.

Answer

Create a simple scaling policy that adds instances when the custom metric exceeds a threshold and removes when below.

Question 12

A SysOps administrator ran the above AWS CLI command to update an existing CloudFormation stack. The command failed with the error shown. What is the most likely cause?

Accepted Answer

The stack is in a failed state from a previous operation and must be deleted or rollback continued.. Option C is correct. The error indicates the stack is in ROLLBACK_COMPLETE state, which means a previous stack creation or update failed and rolled back. To update a stack in ROLLBACK_COMPLETE, you must first delete it or execute a continue update rollback. Option A (template syntax) is not indicated; the error is about stack state. Option B (permissions) would give a different error. Option D (parameter values) would also give a different error.

Answer

The template file has a syntax error.

Answer

The parameter values provided are invalid.

Answer

The IAM role specified lacks permissions.

Question 13

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The SysOps administrator checks the deployment logs and finds that the application installation script exits with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The AppSpec file contains a lifecycle hook that fails.. Option D is correct because a non-zero exit code from the AppSpec lifecycle hook (e.g., ApplicationStop, BeforeInstall) causes the deployment to fail. Option A is wrong because insufficient capacity would trigger a different error. Option B is wrong because an outdated agent would show a different error. Option C is wrong because security groups do not affect script execution exit codes.

Answer

The Auto Scaling group does not have enough instances to meet the minimum capacity.

Answer

The security group for the instances blocks outbound traffic to CodeDeploy endpoints.

Answer

The CodeDeploy agent is outdated on the instances.

Question 14

A SysOps administrator is deploying a new application using AWS CloudFormation. The template includes an EC2 instance with a UserData script that installs software from a private S3 bucket. What is the BEST way to ensure the EC2 instance can access the S3 bucket without storing long-term credentials on the instance?

Accepted Answer

Create an IAM role with S3 access and associate it with the instance profile.. Option D is correct because assigning an IAM role to the EC2 instance allows it to obtain temporary credentials via the instance metadata service, which is the recommended secure method. Option A is wrong because storing access keys in UserData is insecure. Option B is wrong because instance profiles require IAM roles, not direct IAM user credentials. Option C is wrong because security groups control network access, not authentication to S3.

Answer

Create an IAM user with S3 access and attach the access key to the instance profile.

Answer

Store the access key ID and secret access key in the UserData script.

Answer

Configure a security group rule that allows the instance to reach S3 via VPC endpoint.

Question 15

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The update attempted to modify an Amazon RDS DB instance's storage type from gp2 to io1. The error message indicates that the modification is not supported. Which TWO reasons could cause this error? (Choose TWO.)

Accepted Answer

The DB instance is using an Oracle DB engine version that does not support storage type modification.. Option A is correct because CloudFormation stack updates that require replacement will fail if 'DeletionPolicy' is set to 'Retain' and the resource is replaced. Option C is correct because some storage modifications require a migration that is not supported for certain DB engine versions. Option B is wrong because storage type changes are generally allowed without enabling backup. Option D is wrong because maintenance windows do not affect the feasibility of modification. Option E is wrong because the allocated storage size can be changed during modification.

Answer

The DB instance does not have automated backups enabled.

Answer

The stack update is occurring during the DB instance's maintenance window.

Answer

The allocated storage size is below the minimum required for io1.