SOA-C02 Deployment, Provisioning, and Automation Practice Test 11 — 15 Questions

Question 1

A DevOps engineer is designing a CI/CD pipeline for a microservices application hosted on Amazon ECS with Fargate. The team wants to deploy updates to the services without downtime. The current pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service using AWS CodeDeploy with a blue/green deployment. However, during the deployment, the new tasks fail to start due to an incorrect environment variable. The engineer wants to validate the task definition before the actual deployment. What should the engineer do?

Accepted Answer

Configure CodeDeploy to use a validation hook with an AWS Lambda function that tests the new task definition before shifting traffic.. Option B is correct because CodeDeploy allows specifying a Lambda function as a validation hook. The function can run integration tests against the new tasks before traffic is shifted, preventing the deployment from proceeding if validation fails. Option A is incorrect because ECS Service Auto Scaling adjusts the number of tasks based on load, not validation. Option C is incorrect because 'docker run' locally does not guarantee the same behavior in ECS Fargate. Option D is incorrect because CloudWatch Synthetics can monitor endpoints but cannot be used as a pre-deployment validation gate in the pipeline.

Answer

Use Amazon CloudWatch Synthetics canaries to monitor the health of the new tasks after deployment.

Answer

Run the Docker container locally using 'docker run' with the same environment variables to verify the configuration.

Answer

Use Amazon ECS Service Auto Scaling to gradually increase the number of tasks and monitor CPU utilization.

Question 2

An organization is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS DB instance. The update requires changing the DB instance class. However, the administrator wants to minimize downtime. What should the administrator do?

Accepted Answer

Enable Multi-AZ on the DB instance (if not already enabled) before performing the stack update.. Option C is correct because changing the DB instance class may require a replacement, which causes downtime. Using a Multi-AZ deployment allows the update to be applied to the standby first, then fail over, minimizing downtime. Option A is incorrect because modifying the DB instance class directly with ApplyImmediately may cause a brief outage. Option B is incorrect because creating a read replica does not help with updating the instance class. Option D is incorrect because CloudFormation does not automatically create a standby for single-AZ deployments.

Answer

Use CloudFormation's 'DeletionPolicy' attribute to retain the database during updates.

Answer

Update the stack directly with 'ApplyImmediately' set to true.

Answer

Create a read replica, promote it, and then delete the original DB instance.

Question 3

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Option B is correct because ElastiCache for Redis provides a centralized session store that can be accessed by any instance, allowing the application to be stateless without code changes if the application is configured to use Redis. Option A is incorrect because Sticky Sessions (session affinity) is a workaround but does not eliminate the dependency on local storage; if an instance fails, sessions are lost. Option C is incorrect because modifying the application to use a database for session storage requires code changes. Option D is incorrect because disabling the feature does not solve the problem.

Answer

Configure the Application Load Balancer with sticky sessions (session affinity).

Answer

Disable the feature that stores session state locally.

Answer

Modify the application to store session data in an Amazon RDS database.

Question 4

An organization is using AWS OpsWorks for Chef Automate to manage configuration of EC2 instances. The administrator notices that a new cookbook version is not being applied to existing instances in a layer. The cookbook is stored in a private Amazon S3 bucket and the instances have an instance profile that allows read access. What is the MOST likely reason for this issue?

Accepted Answer

The 'Update Cookbooks' stack command needs to be run manually to apply the new cookbook version to existing instances.. Option C is correct because in OpsWorks, cookbooks are automatically updated only during the Setup or Configure lifecycle events. To force an update on existing instances, the administrator must run the 'Update Cookbooks' stack command or trigger a Configure lifecycle event. Option A is incorrect because the S3 permissions appear correct. Option B is incorrect because the cookbook version is not automatically downloaded when a new version is published; an update must be triggered. Option D is incorrect because the Chef client runs automatically, but it does not fetch new cookbooks unless told to do so.

Answer

The cookbook version is not being automatically downloaded because the instances are not rebooted.

Answer

The S3 bucket policy does not grant the necessary permissions to the instance profile.

Answer

The Chef client on the instances is not configured to run automatically.

Question 5

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

Accepted Answer

The custom AMI does not have a web server installed and configured to serve the application.. Option B is correct because Elastic Beanstalk expects the web server (e.g., Apache, Nginx) to be installed and configured to serve the application. If the custom AMI does not have a web server installed, the health check endpoint will not respond. Option A is incorrect because the health check is based on HTTP response, not instance status checks. Option C is incorrect because Elastic Beanstalk does not require a specific AMI ID; it uses the one provided. Option D is incorrect because the environment URL is created regardless of the AMI.

Answer

The Elastic Beanstalk environment was created before the custom AMI was registered.

Answer

The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.

Answer

The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.

Question 6

A SysOps administrator is troubleshooting a CloudFormation stack creation failure. The stack is designed to create an Amazon RDS DB instance with a specific parameter group. The error message indicates that the DB instance could not be created because the parameter group does not exist. The administrator has verified that the parameter group exists in the same region and account. What is the MOST likely issue?

Accepted Answer

The parameter group resource is defined in the same template but is not linked to the DB instance using the 'DependsOn' attribute.. Option A is correct because CloudFormation must create resources in order based on dependencies. If the parameter group is defined in the same template, it might be created after the DB instance, causing an error. The administrator should use the DependsOn attribute to ensure the parameter group is created first. Option B is incorrect because the error is about the parameter group not existing, not about security groups. Option C is incorrect because the parameter group name being incorrect would result in a different error. Option D is incorrect because the DB instance class does not affect parameter group existence.

Answer

The parameter group name in the template has a typo or does not match the actual resource name.

Answer

The VPC security group specified for the DB instance does not allow inbound traffic from the application tier.

Answer

The DB instance class requires a different parameter group family.

Question 7

An organization uses AWS Service Catalog to manage approved IT services. A SysOps administrator needs to update a CloudFormation template used by a product. The administrator wants to ensure that existing provisioned products are updated with the new template version. What step must the administrator take after updating the product?

Accepted Answer

Create a new product version and update the provisioned products to use the new version.. Option B is correct because in Service Catalog, to update existing provisioned products, you need to create a new product version and update the provisioned product to that version. Simply updating the template does not automatically trigger updates. Option A is incorrect because Service Catalog uses versions, not direct template updates. Option C is incorrect because terminating and reprovisioning is disruptive and not recommended. Option D is incorrect because updating the portfolio does not update provisioned products.

Answer

Update the portfolio that contains the product.

Answer

Update the product's CloudFormation template directly in the Service Catalog console.

Answer

Terminate the existing provisioned products and reprovision them.

Question 8

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

Accepted Answer

Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.. Option D is correct because CodePipeline allows you to manually release a change, which re-runs the pipeline from the last successful execution or from the source stage. Option A is incorrect because modifying the S3 object directly might not trigger the pipeline automatically (depending on configuration), but it's not the standard way to retry. Option B is incorrect because commit messages do not affect pipeline execution. Option C is incorrect because the pipeline will not automatically retry; the developer must manually retry.

Answer

Create a new commit with an empty message to trigger the pipeline.

Answer

Wait for the pipeline to automatically retry after the failure.

Answer

Re-upload the same artifact to the source S3 bucket to trigger the pipeline.

Question 9

A company is deploying a microservices application on Amazon ECS with Fargate. The SysOps administrator needs to implement a deployment strategy that minimizes downtime and allows for automated rollbacks if the new version fails health checks. Which TWO options should the administrator choose? (Choose TWO.)

Accepted Answer

Configure the ECS service to automatically roll back on deployment failure.. Options B and D are correct. Blue/green deployments (B) reduce downtime by shifting traffic gradually. Automated rollbacks (D) are supported by CodeDeploy when health checks fail. Option A is incorrect because canary deployments are a variation of blue/green but not a separate deployment type in ECS. Option C is incorrect because rolling updates can cause downtime and are not the best for minimizing downtime. Option E is incorrect because immutable deployments are not natively supported in ECS with Fargate.

Answer

Use a rolling update with the ECS service scheduler.

Answer

Use an immutable deployment by replacing the entire Auto Scaling group.

Answer

Use a canary deployment with AWS CodeDeploy.

Question 10

An organization uses AWS CloudFormation to manage its infrastructure. The SysOps administrator is implementing a change management process that requires all stack updates to be reviewed and approved before execution. The administrator wants to use CloudFormation change sets to preview changes. Which THREE steps are necessary to implement this process? (Choose THREE.)

Accepted Answer

Review the change set in the CloudFormation console.. Options A, C, and E are correct. To use change sets, you create a change set (A), which you can then review (C). After approval, you execute the change set (E). Option B is incorrect because you do not update the stack directly; you use change sets. Option D is incorrect because you should create a change set from the new template, not compare stacks directly.

Answer

Use the 'Detect Drift' feature to compare the stack with the new template.

Answer

Update the stack directly using the updated template.

Question 11

A SysOps administrator is tasked with automating the provisioning of EC2 instances that must be able to access an Amazon S3 bucket. The administrator needs to ensure that the instances have the necessary permissions without using long-term access keys. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Attach the IAM role to the EC2 instances using an instance profile.. Options A and E are correct. The best practice is to create an IAM role with S3 access (A) and assign it to the EC2 instances via an instance profile (E). Option B is incorrect because storing access keys in a file is insecure. Option C is incorrect because S3 bucket policies control access at the bucket level, not directly for EC2 instances. Option D is incorrect because storing keys in Systems Manager Parameter Store is better than hardcoding, but an IAM role is still the preferred approach.

Answer

Store AWS access keys in a configuration file on the instances.

Answer

Create an S3 bucket policy that allows access from the instances' private IP addresses.

Answer

Store the access keys in AWS Systems Manager Parameter Store.

Question 12

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application is deployed using a custom AMI that is updated monthly. The SysOps administrator uses a launch template that references the latest AMI ID via an AWS Systems Manager parameter. During a recent deployment, the administrator updated the AMI ID in the parameter, but the new instances launched by the Auto Scaling group still use the old AMI. The administrator confirms that the launch template is configured to reference the parameter. The Auto Scaling group has a desired capacity of 5, and the administrator manually terminates one instance to trigger a replacement. The new instance also uses the old AMI. What is the MOST likely cause?

Accepted Answer

The Auto Scaling group is using a cached version of the launch template and needs to be updated or have its instances replaced.. Option B is correct because the Auto Scaling group caches the resolved AMI ID from the launch template at the time of creation or when the launch template is updated. If the launch template is not updated or the group is not refreshed, the group continues to use the cached value. Option A is incorrect because the Systems Manager parameter does not need special permissions for the launch template to reference it; the launch template resolution happens at the account level. Option C is incorrect because instance metadata does not affect which AMI is used for launch. Option D is incorrect because Amazon CloudWatch does not control AMI resolution.

Answer

The Amazon CloudWatch alarm that triggers scaling is not configured correctly.

Answer

The IAM role associated with the Auto Scaling group does not have permission to read the Systems Manager parameter.

Answer

The instance metadata service (IMDS) is disabled on the launch template.

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is configured with a load balancer and an Auto Scaling group. Recently, the development team updated the application code and deployed it via Elastic Beanstalk. After the deployment, users report intermittent 503 errors. The SysOps administrator checks the environment health and sees that it is 'Severe' with many instances being replaced. The administrator notices that the new instances are being launched with the old application version. The deployment was a rolling update with a batch size of 1. What is the MOST likely cause of the issue?

Accepted Answer

The deployment failed health checks on the first instance and rolled back, replacing all instances with the old version.. Option C is correct because in a rolling update with batch size 1, instances are updated one at a time. If the health check fails for the new batch, the deployment is rolled back, and the new instances are replaced with the old version. This would cause intermittent 503 errors as instances are being swapped. Option A is incorrect because the environment URL does not change. Option B is incorrect because the load balancer stickiness would not cause version mismatches. Option D is incorrect because the health check URL is not changed by deployment.

Answer

The load balancer is configured with sticky sessions, causing requests to go to outdated instances.

Answer

The Elastic Beanstalk environment URL was changed during the deployment.

Answer

The health check URL was not updated to reflect the new application version.

Question 14

A company uses AWS CodeCommit to store its source code and AWS CodeBuild to compile and test the code. The SysOps administrator is setting up a new build project that needs to access a private Amazon S3 bucket to download build dependencies. The build project runs in a VPC. The administrator has attached an IAM role to the build project with permissions to access the S3 bucket. However, the build fails with an access denied error when trying to download the dependencies. The S3 bucket is in the same region and account. What should the administrator do to resolve the issue?

Accepted Answer

Create a VPC endpoint for Amazon S3 and associate it with the VPC where CodeBuild runs.. Option A is correct because when CodeBuild runs in a VPC, it does not have internet access by default, and S3 endpoints are required to access S3 buckets without going through a NAT gateway or internet. Option B is incorrect because the IAM role permissions appear correct, but the issue is network connectivity. Option C is incorrect because security groups control traffic at the instance level, not for S3 access. Option D is incorrect because the VPC does not need internet access if VPC endpoints are used.

Answer

Attach an internet gateway to the VPC to provide internet access.

Answer

Configure the security group for CodeBuild to allow outbound traffic to the S3 bucket.

Answer

Update the IAM role to include 's3:ListBucket' permission.

Question 15

A SysOps administrator needs to deploy a web application across multiple AWS Regions for disaster recovery. The application uses Amazon RDS for MySQL and requires a secondary database in a different Region. What is the MOST cost-effective and automated solution to keep the databases synchronized?

Accepted Answer

Create a cross-Region read replica of the primary RDS instance in the secondary Region. Option C is correct because Amazon RDS Cross-Region Read Replicas automatically replicate data from the primary database to a secondary Region, providing a cost-effective solution without needing separate infrastructure. Option A is wrong because it requires manual scripting and is not fully automated. Option B is wrong because it uses RDS Multi-AZ, which is for high availability within a single Region, not cross-Region. Option D is wrong because it uses a custom replication solution that is not managed by AWS.

Answer

Use AWS Database Migration Service (DMS) with ongoing replication

Answer

Set up a cron job on an EC2 instance to export the database and import it into the secondary Region

Answer

Enable Multi-AZ on the primary RDS instance and configure a read replica in the secondary Region