SOA-C02 Deployment, Provisioning, and Automation — 40 Questions

Question 1

A company uses AWS Systems Manager Patch Manager to automate patching of Amazon EC2 instances. The SysOps administrator needs to configure a maintenance window that will patch instances on the second Tuesday of every month at 2:00 AM. The administrator wants to ensure that patches are automatically applied but reboots are only performed if required. Which combination of configurations should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a maintenance window with a cron schedule of cron(0 2 ? * TUE#2 *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.. It uses the cron expression `cron(0 2 ? * TUE#2 *)` to schedule the maintenance window for the second Tuesday of every month at 2:00 AM, and the `AWS-RunPatchBaseline` document with operation `Install` and reboot option `RebootIfNeeded` ensures patches are applied automatically and reboots only occur when required by the patch installation.

Answer

Create a maintenance window with a rate schedule of 30 days and use an AWS-ApplyPatchBaseline document with operation 'Scan' and reboot option 'RebootIfNeeded'.

Answer

Create a maintenance window with a cron schedule of cron(0 2 14 * ? *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.

Answer

Create a maintenance window with a cron schedule of cron(0 2 2 * 2 *) and use an AWS-InstallPatchBaseline document with operation 'Install' and reboot option 'NoReboot'.

Question 2

A company uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The SysOps administrator wants to deploy a new version of the application by first shifting 10% of traffic to the new version, monitoring for errors, and then after manual approval, shifting the remaining 90%. Which deployment configuration should be used?

Accepted Answer

Blue/green deployment with Canary10Percent configuration. A Blue/green deployment with Canary10Percent configuration shifts 10% of traffic to the new version, waits for a specified period (default 10 minutes), and then automatically shifts the remaining 90%. Note that manual approval is not natively supported by this configuration; it would need to be implemented separately (e.g., via a lifecycle hook). The question's requirement for manual approval is not directly met by the deployment configuration itself, but among the options, Canary10Percent is the only one that shifts traffic in the described pattern of 10% first then 90%.

Answer

In-place deployment

Answer

Blue/green deployment with Linear10PercentEvery10Minutes configuration

Answer

Blue/green deployment with AllAtOnce configuration

Question 3

A company uses AWS CodeDeploy to deploy a new version of a web application to a fleet of Amazon EC2 instances. The SysOps administrator wants to shift 10% of traffic to the new version first, monitor for errors, and then after manual approval, deploy to the remaining 90%. Which CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.Canary10Percent5Minutes. The Canary10Percent5Minutes deployment configuration shifts 10% of traffic to the new version, waits 5 minutes for monitoring, and then automatically deploys to the remaining 90%. This matches the requirement for a 10% traffic shift with a monitoring window, though the question specifies manual approval—CodeDeploy does not natively support manual approval within a deployment configuration; instead, you would combine this configuration with a manual approval step in a CodePipeline or use a lifecycle hook. However, among the given options, this is the only one that provides the 10% traffic shift and a built-in wait period.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

Custom configuration with 10% and manual approval

Question 4

A SysOps administrator uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The administrator wants to ensure that during deployment, traffic is shifted from the original instances to the new instances incrementally in 10-minute intervals. The deployment should automatically roll back if any health check fails. Which deployment configuration should the administrator choose?

Accepted Answer

Custom deployment configuration with 25% every 10 minutes and traffic routing enabled. It allows a custom deployment configuration that shifts traffic in 10-minute intervals (e.g., 25% every 10 minutes) with automatic rollback on health check failure. The built-in configurations (AllAtOnce, OneAtATime, HalfAtATime) do not support incremental traffic shifting with time-based intervals; only a custom configuration can achieve the specified 10-minute interval requirement.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.HalfAtATime

Question 5

A SysOps administrator maintains an AWS CloudFormation stack for a web application. The administrator needs to update the stack to change the instance type of an Amazon EC2 instance. The administrator wants to review the changes before applying them and ensure that any updates that would replace the instance are clearly identified. Which CloudFormation feature should the administrator use?

Accepted Answer

Change Sets. Change Sets allow the administrator to preview the proposed changes to a CloudFormation stack before executing them. They clearly indicate whether a resource will be updated without replacement (e.g., modifying an attribute that supports in-place update) or replaced (e.g., changing the instance type of an EC2 instance, which requires recreation). This gives the administrator the ability to review the exact impact and identify any resource replacements before applying the update.

Answer

Stack Policies

Answer

Resource Signals

Answer

Nested Stacks

Question 6

A SysOps administrator needs to deploy a new version of a web application using AWS Elastic Beanstalk. The deployment must achieve zero downtime and allow the administrator to validate the new version by running tests before routing production traffic to it. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option C) is correct because Elastic Beanstalk launches a new set of instances in a separate Auto Scaling group, deploys the new version to them, and performs health checks while the old instances continue serving production traffic. After the new instances pass health checks, Elastic Beanstalk shifts traffic to the new group and terminates the old instances. This ensures zero downtime and allows the administrator to validate the new version before it receives production traffic.

Answer

Rolling

Answer

Rolling with additional batch

Answer

All at once

Question 7

Match each AWS networking concept to its description.

Accepted Answer

VPC: A logically isolated virtual network in the AWS cloud.. Correct matches: VPC is a virtual network, Subnet is an IP range segment, Internet Gateway enables internet access, Route Table controls traffic routing. Common confusions include mixing VPC with VPN and NAT Gateway direction.

Answer

VPC: A managed VPN service for connecting on-premises networks to AWS.

Answer

NAT Gateway: A component that allows inbound internet traffic to reach private instances.

Question 8

A company is using AWS CloudFormation to manage its infrastructure. A stack update fails because a change set includes a modification to an RDS database that triggers a replacement. The engineer needs to allow updates that may cause a replacement but wants to be warned first. What should the engineer do?

Accepted Answer

Create a change set and review it before executing the update.. Using a change set allows the engineer to review the changes before executing them. Disabling rollback on failure is not a warning mechanism, and using a nested stack does not provide a warning. The '--parameters' option does not warn about replacements.

Answer

Use the '--disable-rollback' flag when updating the stack.

Answer

Use a nested stack to isolate the RDS resource.

Answer

Use the '--parameters' option to specify a parameter that controls replacement.

Question 9

A SysOps administrator needs to deploy an application to a set of EC2 instances in an Auto Scaling group. The deployment must be performed in batches, with each batch health-checked before proceeding. Which AWS CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application revision to one EC2 instance at a time, waiting for the instance to pass health checks before proceeding to the next. This ensures that the deployment is performed in batches of one, with each batch health-checked before moving on, which aligns with the requirement for batch-based, health-checked deployments.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.Custom

Question 10

A company has a mission-critical application running on EC2 instances in an Auto Scaling group. The application stores state locally on the instance. The company wants to update the application to a new version with minimal downtime. The update requires a change to the instance configuration. What deployment strategy should be used?

Accepted Answer

Blue/green deployment. Blue/green deployment is correct because it allows you to launch a completely new set of EC2 instances (the green environment) with the updated application version and instance configuration, while the original instances (blue) continue serving traffic. Once the new environment is validated, traffic is shifted—typically via a load balancer or Route 53—so downtime is near zero. Because the application stores state locally, the new instances start fresh with the new configuration, and the old instances remain intact until the cutover is complete, avoiding in-place modification risks.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 11

A SysOps administrator is troubleshooting a slow deployment with AWS CloudFormation. The stack update is taking a long time because it is waiting for a resource to be created. Which TWO CloudFormation features can help speed up the deployment?

Accepted Answer

Use nested stacks to create resources in parallel.. CreationPolicy with a short timeout can reduce waiting time for signals. WaitCondition can be used with a timeout. '--disable-rollback' does not speed up deployment. Nested stacks can parallelize resource creation. DependsOn is required for dependencies but does not speed up; it can actually increase time if not needed.

Answer

Remove DependsOn clauses to allow parallel resource creation.

Answer

Set the '--disable-rollback' flag.

Answer

Increase the timeout on the WaitCondition.

Question 12

A SysOps administrator is deploying a new version of an application using AWS CodeDeploy. The deployment to an Auto Scaling group fails, and the instances are rolled back. What is the most likely reason for the failure?

Accepted Answer

The IAM instance profile does not have permission to download the revision from S3.. CodeDeploy agents on EC2 instances must download the application revision from its S3 bucket or GitHub location, and they authenticate using the instance profile attached to the instance. If that IAM role lacks `s3:GetObject` on the revision bucket, the download fails and CodeDeploy rolls back the deployment. This is the most common cause of a CodeDeploy failure that triggers automatic rollback.

Answer

The instances are in a private subnet without a NAT gateway.

Answer

The instances do not have internet access.

Answer

The application's health check is failing on the target group.

Question 13

A company is deploying a serverless application using AWS SAM. The SysOps administrator wants to automate the build and deployment process whenever code is pushed to the main branch of an AWS CodeCommit repository. Which service should be used to trigger the pipeline?

Accepted Answer

AWS CodePipeline.. CodePipeline can be configured to start on changes to a CodeCommit repository. Option A is incorrect because CloudWatch Events can trigger but is not the primary service for CI/CD pipelines. Option B is incorrect because CodeBuild is a build service, not a trigger. Option D is incorrect because Lambda would require custom integration.

Answer

AWS Lambda.

Answer

AWS CodeBuild.

Answer

Amazon CloudWatch Events.

Question 14

An organization is using AWS CodeDeploy with a blue/green deployment configuration for an EC2/On-Premises compute platform. During a deployment, the new instances pass all health checks, but the old instances are not terminated after the deployment completes. What is the most likely cause?

Accepted Answer

The deployment configuration specifies 'Reroute traffic to new instances and keep old instances running' with no termination.. In AWS CodeDeploy blue/green deployments for the EC2/On-Premises compute platform, the deployment configuration determines the lifecycle of the original (old) instances. Option C is correct because the deployment configuration explicitly specifies 'Reroute traffic to new instances and keep old instances running' with no termination, which instructs CodeDeploy to leave the old instances running after traffic is rerouted. This behavior is controlled by the deployment group's configuration, not by Auto Scaling or health check failures.

Answer

The Auto Scaling group has a cooldown period that prevents termination.

Answer

The new instances failed the initial health check.

Answer

The deployment was rolled back automatically.

Question 15

A SysOps administrator is designing an automated deployment pipeline using AWS CodePipeline. The pipeline must include a manual approval step before deploying to production. Which TWO actions are required to implement this?

Accepted Answer

Create an Amazon SNS topic for approval notifications.. Option B is correct because CodePipeline's manual approval action sends approval notifications through an Amazon SNS topic, so an SNS topic must exist for approvers to be notified and to act on the approval request. Option D is correct because the CodePipeline service role must have IAM permissions (for example, sns:Publish) to publish approval notifications to that SNS topic; without this permission the approval action cannot notify approvers. Option A is not required because a manual approval action can be added within an existing stage (typically the production deploy stage) rather than needing its own dedicated stage. Option C is incorrect because a Lambda function would create an automated approval, which contradicts the requirement for a manual approval step. Option E is incorrect because enabling CloudWatch Logs is useful for monitoring and troubleshooting but is not required to implement manual approval.

Answer

Add a separate stage for approval in the pipeline.

Answer

Configure an AWS Lambda function to approve automatically.

Answer

Enable CloudWatch Logs for the pipeline.

Question 16

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an EC2 instance, an RDS database, and an Application Load Balancer. The SysOps administrator wants to ensure that the database is not replaced during an update if the administrator accidentally changes a property that requires replacement. Which THREE actions should the administrator take?

Accepted Answer

Use a custom resource backed by a Lambda function to manage the database.. The correct answers are A, B, and E. A is correct because a custom resource backed by Lambda can manage the database outside the CloudFormation lifecycle, preventing accidental replacement. B is correct because setting DeletionPolicy: Retain on the RDS resource ensures that if the resource is deleted during a stack update (e.g., due to a property change requiring replacement), the actual database is retained. E is correct because a stack policy can deny updates to the RDS instance, preventing modifications that would trigger replacement. C is incorrect: placing the RDS instance in a separate nested stack does not prevent replacement; it only isolates the resource, but replacement can still occur. D is incorrect: termination protection prevents stack deletion, not resource replacement within an update.

Answer

Place the RDS instance in a separate nested stack.

Answer

Enable termination protection on the CloudFormation stack.

Question 17

A SysOps administrator creates an IAM policy that grants s3:PutObject permission to the bucket 'my-bucket' (arn:aws:s3:::my-bucket) and attaches it to an IAM role used by an application. The application needs to upload objects to a subfolder named 'uploads/' in the bucket. The uploads fail with an access denied error. What is the most likely cause?

Accepted Answer

The policy does not grant s3:PutObject permission to the 'uploads/' prefix.. The policy likely grants s3:PutObject permission only to the bucket root (arn:aws:s3:::my-bucket) or to a different prefix, not to the 'uploads/' subfolder. To allow uploads to the subfolder, the resource ARN must include the full path, e.g., arn:aws:s3:::my-bucket/uploads/*. Therefore, the correct answer is D.

Answer

The IAM role does not have permission to assume the role.

Answer

The application is using the wrong AWS credentials.

Answer

The policy does not include the 's3:PutObject' action for the bucket itself.

Question 18

A company uses AWS CloudFormation to deploy EC2 instances. The stack creation fails with the error 'Resource creation cancelled' after 20 minutes. What is the most likely cause?

Accepted Answer

The EC2 instance creation exceeded the CloudFormation timeout. The error 'Resource creation cancelled' typically occurs when the CloudFormation stack creation times out. CloudFormation allows you to set a stack creation timeout (via the TimeoutInMinutes parameter). If the time expires before resources are fully created, CloudFormation cancels the operation. In this scenario, the EC2 instance likely took longer than the 20-minute timeout configured for the stack, causing CloudFormation to cancel the resource creation. Option A is incorrect because an unsupported template format would cause a validation error before resource creation starts. Option C is incorrect because an unavailable instance type would cause an immediate API error. Option D is incorrect because insufficient IAM permissions would cause an immediate access denied error.

Answer

The CloudFormation template uses an unsupported template format

Answer

The instance type specified is not available in the chosen Availability Zone

Answer

Insufficient IAM permissions for CloudFormation to create EC2 instances

Question 19

A SysOps administrator is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. What should the administrator check FIRST?

Accepted Answer

The ApplicationStop lifecycle event hook script in the AppSpec file. The error message 'too many individual instances failed deployment' typically points to a lifecycle event hook failing on the instances. The ApplicationStop hook runs before the new revision is installed and is the most common culprit because a stale or buggy stop script prevents the deployment from proceeding. Checking the AppSpec's ApplicationStop script first is the fastest way to identify why instances are failing.

Answer

The CodeDeploy agent version on the instances

Answer

The Auto Scaling group's minimum size

Answer

The load balancer health check configuration

Question 20

A company uses AWS CloudFormation to manage infrastructure. The administrator wants to update a stack that contains an RDS DB instance. The update requires replacing the DB instance. What should the administrator do to minimize downtime?

Accepted Answer

Use a CloudFormation stack update with a Replacement update policy and a snapshot. To truly minimize downtime, you would need to create a new DB instance, restore data from a snapshot, and update the application to point to the new endpoint before removing the old instance. Simply setting `UpdateReplacePolicy: Snapshot` and updating the stack does not automatically populate the new instance or update the application. Therefore none of the provided options fully solves the requirement.

Answer

Delete the stack and create a new one with the updated template

Answer

Disable deletion protection on the DB instance before the update

Answer

Modify the DB instance endpoint in the application configuration after update