SOA-C02 Practice Exam 65 — 20 Questions

Question 1

A SysOps administrator needs to automatically deploy a new version of an application to a fleet of Amazon EC2 instances every time changes are pushed to the main branch of a code repository hosted on AWS CodeCommit. Which combination of AWS services should be used?

Accepted Answer

AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy.. AWS CodePipeline orchestrates the continuous delivery workflow by detecting changes in the CodeCommit repository, then automatically triggering AWS CodeBuild to compile and package the application, and finally deploying the new version to EC2 instances using AWS CodeDeploy. This combination provides a fully managed, end-to-end CI/CD pipeline that meets the requirement of deploying on every push to the main branch.

Answer

AWS CloudFormation and AWS CodeDeploy.

Answer

Amazon EventBridge and AWS Systems Manager.

Answer

AWS CloudTrail and AWS Lambda.

Question 2

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and a security group. The administrator wants to ensure that when the stack is updated, the security group is not accidentally replaced if its properties change. The administrator wants to receive a failure if an update would require replacement of the security group. Which CloudFormation feature should the administrator use?

Accepted Answer

Define a stack policy that denies replacement of the security group resource.. Option C is correct because a stack policy can explicitly deny update actions that would replace a resource, such as the security group. By defining a stack policy with a Deny statement for the 'Replace' effect on the security group's logical resource ID, CloudFormation will fail the update if any property change triggers a replacement, preventing accidental deletion and recreation.

Answer

Add a 'DeletionPolicy' attribute set to 'Retain' on the security group resource.

Answer

Add a 'CreationPolicy' attribute to the security group resource.

Answer

Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' on the security group.

Question 3

A SysOps administrator uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The administrator wants to ensure that during deployment, traffic is shifted from the original instances to the new instances incrementally in 10-minute intervals. The deployment should automatically roll back if any health check fails. Which deployment configuration should the administrator choose?

Accepted Answer

Custom deployment configuration with 25% every 10 minutes and traffic routing enabled. Option D is correct because it allows a custom deployment configuration that shifts traffic in 10-minute intervals (e.g., 25% every 10 minutes) with automatic rollback on health check failure. The built-in configurations (AllAtOnce, OneAtATime, HalfAtATime) do not support incremental traffic shifting with time-based intervals; only a custom configuration can achieve the specified 10-minute interval requirement.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.HalfAtATime

Question 4

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS Systems Manager

Question 5

A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?

Accepted Answer

Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket. SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.

Answer

Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script

Answer

Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script

Answer

Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in

Question 6

A company uses AWS CodeDeploy to deploy a new version of a web application to a fleet of Amazon EC2 instances. The SysOps administrator wants to shift 10% of traffic to the new version first, monitor for errors, and then after manual approval, deploy to the remaining 90%. Which CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.Canary10Percent5Minutes. Option C is correct because the Canary10Percent5Minutes deployment configuration shifts 10% of traffic to the new version, waits 5 minutes for monitoring, and then automatically deploys to the remaining 90%. This matches the requirement for a 10% traffic shift with a monitoring window, though the question specifies manual approval—CodeDeploy does not natively support manual approval within a deployment configuration; instead, you would combine this configuration with a manual approval step in a CodePipeline or use a lifecycle hook. However, among the given options, this is the only one that provides the 10% traffic shift and a built-in wait period.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

Custom configuration with 10% and manual approval

Question 7

A SysOps administrator maintains an AWS CloudFormation stack for a web application. The administrator needs to update the stack to change the instance type of an Amazon EC2 instance. The administrator wants to review the changes before applying them and ensure that any updates that would replace the instance are clearly identified. Which CloudFormation feature should the administrator use?

Accepted Answer

Change Sets. Change Sets allow the administrator to preview the proposed changes to a CloudFormation stack before executing them. They clearly indicate whether a resource will be updated without replacement (e.g., modifying an attribute that supports in-place update) or replaced (e.g., changing the instance type of an EC2 instance, which requires recreation). This gives the administrator the ability to review the exact impact and identify any resource replacements before applying the update.

Answer

Stack Policies

Answer

Resource Signals

Answer

Nested Stacks

Question 8

A SysOps administrator needs to deploy the same AWS CloudFormation template across multiple AWS accounts and Regions in a single operation. The administrator wants to manage the deployment from a single management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy the same template across multiple accounts and Regions from a single management account. StackSets uses a self-managed or service-managed permission model to create, update, and delete stacks across target accounts in a single operation, making it the correct choice for this multi-account, multi-Region deployment requirement.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog

Question 9

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot into the correct order.

Question 10

A SysOps administrator needs to deploy a new version of a web application using AWS Elastic Beanstalk. The deployment must achieve zero downtime and allow the administrator to validate the new version by running tests before routing production traffic to it. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option C) is correct because it launches a completely new set of instances in a new Auto Scaling group, deploys the new application version to them, and then swaps the environment's CNAME record from the old instances to the new ones only after all health checks pass. This ensures zero downtime and allows the administrator to run validation tests against the new instances before any production traffic is routed to them, as the old environment remains fully operational during the process.

Answer

Rolling

Answer

Rolling with additional batch

Answer

All at once

Question 11

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an Amazon RDS DB instance. The SysOps administrator needs to ensure that the database password is not exposed in the template or in the stack outputs. The password should be stored securely and rotated automatically every 90 days. Which solution should the administrator use?

Accepted Answer

Use AWS Secrets Manager to store the password and reference it using the dynamic reference {{resolve:secretsmanager:secretId:secretString:password}} in the CloudFormation template. Enable automatic rotation.. Option C is correct because AWS Secrets Manager is designed to securely store secrets like database passwords, supports automatic rotation (including a 90-day schedule), and can be referenced in CloudFormation templates using the dynamic reference {{resolve:secretsmanager:secretId:secretString:password}}. This ensures the password is never exposed in the template or stack outputs, and rotation is handled automatically without manual intervention.

Answer

Store the password as a plaintext parameter in the CloudFormation template and mark it as NoEcho.

Answer

Use AWS Systems Manager Parameter Store to store the password as a SecureString and reference it using the dynamic reference {{resolve:ssm-secure:password}} in the template.

Answer

Hardcode the password in a userdata script that is passed to the EC2 instances.

Question 12

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The administrator needs to store and reference sensitive data such as database passwords in the stack without hardcoding them in the template. Which CloudFormation feature should be used?

Accepted Answer

Use AWS Systems Manager Parameter Store secure strings and dynamic references in the CloudFormation template. Option A is correct because AWS CloudFormation supports dynamic references (using the `resolve:ssm` or `resolve:ssm-secure` syntax) that allow you to reference Systems Manager Parameter Store secure strings directly in the template. This keeps sensitive data like database passwords out of the template and the stack's metadata, ensuring they are not exposed in plaintext during stack operations or in the console.

Answer

Use AWS Secrets Manager and reference the secret using a static reference in the template

Answer

Define plaintext parameters in the template and mark them as NoEcho

Answer

Store the secrets in an encrypted S3 object and reference it via a URL in the template

Question 13

A company has multiple AWS accounts managed under AWS Organizations. The SysOps administrator needs to deploy a common AWS CloudFormation template to all accounts in a specific organizational unit (OU), ensuring consistent security group configurations across the organization. Which AWS service should the administrator use to perform this deployment?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy a common template across multiple accounts and regions from a single management account. In this scenario, the administrator can target the specific organizational unit (OU) within AWS Organizations, ensuring consistent security group configurations are applied to all member accounts without manual intervention.

Answer

AWS CodePipeline with cross-account actions

Answer

AWS Service Catalog portfolio

Answer

AWS Systems Manager Automation

Question 14

A development team uses AWS CloudFormation to deploy infrastructure. They want to update a stack but first need to review how the changes will impact existing resources before applying them. Which CloudFormation feature should they use?

Accepted Answer

Change sets. Change sets allow you to preview how proposed changes to a CloudFormation stack will affect your running resources before you apply them. They generate a summary of the changes (additions, modifications, deletions) based on the new template and parameters, enabling you to assess impact such as resource replacement or updates without executing the changes. This directly addresses the team's requirement to review changes before applying them.

Answer

Stack policies

Answer

Condition functions

Answer

Custom resources

Question 15

A company uses AWS CodePipeline to deploy a web application. The pipeline has a source stage (Amazon S3) and a deploy stage (AWS Elastic Beanstalk). The SysOps administrator needs to add a manual approval step before the deployment proceeds to the production environment. Which action should the administrator take?

Accepted Answer

Add a manual approval action in the pipeline using the AWS CodePipeline approval action type.. Option B is correct because AWS CodePipeline natively supports a manual approval action type that can be added as a stage in the pipeline. This action pauses the pipeline execution until an authorized user manually approves or rejects the deployment, allowing the SysOps administrator to gate the deployment to the production environment without external services.

Answer

Add an approval stage in the pipeline using the Amazon SNS topic as a notification method.

Answer

Use an AWS CloudFormation change set to require manual approval.

Answer

Create a separate pipeline for production and trigger it manually.

Question 16

A SysOps administrator needs to deploy a new version of a web application to Amazon EC2 instances using AWS Elastic Beanstalk. The administrator wants to deploy the new version with zero downtime and validate the new version before routing production traffic to it. Which deployment policy should be used?

Accepted Answer

Immutable. Immutable deployment is correct because it launches a completely new set of EC2 instances in a separate Auto Scaling group, deploys the new application version to them, and passes health checks before swapping the environment's CNAME record to point to the new instances. This ensures zero downtime and allows validation of the new version before any production traffic is routed to it, as the old instances remain untouched until the swap is complete.

Answer

All at once

Answer

Rolling

Answer

Traffic splitting

Question 17

A SysOps administrator uses AWS CodeDeploy to deploy a new version of an application to an Auto Scaling group. The deployment uses the 'CodeDeployDefault.OneAtATime' deployment configuration. During the deployment, the first instance succeeds, but subsequent instances fail because the new application version has a bug that causes the application health check to fail. The administrator wants to immediately roll back the change and restore the previous working version on all instances. Which action should the administrator take?

Accepted Answer

Initiate a rollback from the CodeDeploy console to redeploy the previous working revision.. Option A is correct because CodeDeploy supports automatic and manual rollbacks to a previous working revision. When a deployment fails, the administrator can initiate a rollback from the CodeDeploy console, which redeploys the last successful revision to all instances in the deployment group, including those that were already updated. This ensures the previous working version is restored across the entire Auto Scaling group.

Answer

Stop the deployment immediately; the instances that have already been updated will revert automatically.

Answer

Edit the deployment group settings to pause deployments after a failure, then manually fix the instances.

Answer

Redeploy the same failing revision but with a different deployment configuration.

Question 18

A company uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The SysOps administrator wants to deploy a new version of the application by first shifting 10% of traffic to the new version, monitoring for errors, and then after manual approval, shifting the remaining 90%. Which deployment configuration should be used?

Accepted Answer

Blue/green deployment with Canary10Percent configuration. Option B is correct because a Blue/green deployment with Canary10Percent configuration shifts 10% of traffic to the new version, waits for a specified period (default 10 minutes), and then requires manual approval to shift the remaining 90%. This matches the requirement of shifting 10% first, monitoring, and then manually approving the full traffic shift.

Answer

In-place deployment

Answer

Blue/green deployment with Linear10PercentEvery10Minutes configuration

Answer

Blue/green deployment with AllAtOnce configuration

Question 19

A company uses AWS CloudFormation to deploy a multi-tier application. The template uses nested stacks. One of the nested stacks creates an Auto Scaling group. The administrator wants to update the Auto Scaling group's launch configuration to use a new AMI ID. The AMI ID is stored in AWS Systems Manager Parameter Store. The administrator wants to ensure that the stack update automatically uses the latest AMI ID value from Parameter Store. What should the administrator do?

Accepted Answer

Use a CloudFormation dynamic reference to the parameter store in the template.. Option A is correct because CloudFormation dynamic references for Systems Manager Parameter Store (using the `{{resolve:ssm:/parameter-name}}` syntax) automatically resolve the latest parameter value at stack creation or update time. This ensures that the launch configuration always uses the current AMI ID from Parameter Store without manual intervention or hardcoding.

Answer

Use a CloudFormation mapping to map the AMI ID.

Answer

Use a custom resource to call Systems Manager to retrieve the AMI ID.

Answer

Use a CloudFormation parameter with a default value that matches the AMI ID.

Question 20

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline consists of a source stage (AWS CodeCommit) and a deploy stage (AWS CodeDeploy) that deploys to an Auto Scaling group. The SysOps administrator needs to add a stage to run automated unit tests before the deployment proceeds. The tests must be executed in an isolated environment, and if they fail, the pipeline must stop and notify the development team. Which action should the administrator take?

Accepted Answer

Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.. Option C is correct because AWS CodeBuild is natively integrated with CodePipeline to run automated tests defined in a buildspec file. When the build action fails, CodePipeline automatically stops the pipeline execution and can send notifications via Amazon SNS, meeting the requirement for an isolated test environment and automatic failure notification without manual intervention.

Answer

Add a manual approval action between the source and deploy stages. The development team will manually run the tests on their local machines and then approve the pipeline to proceed.

Answer

Insert a test stage after the source stage with an AWS CloudFormation action that deploys a test stack and runs tests using a custom resource Lambda function.

Answer

Add a Lambda function as an action in the pipeline that runs the unit tests. The Lambda function writes the test results to an S3 bucket, and a subsequent approval action checks the results.