SOA-C02 Deployment, Provisioning, and Automation Practice Test 11 — 15 Questions

Question 1

A company uses AWS OpsWorks to manage a stack of application servers. The administrator needs to automate the deployment of a new application version. Which of the following are valid methods to trigger a deployment in OpsWorks? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CodePipeline to directly deploy to OpsWorks.. Options B, D, and E are valid methods to trigger a deployment in AWS OpsWorks Stacks. B uses AWS CodePipeline, which has a native deploy action for OpsWorks, making it a direct trigger. D uses the OpsWorks console to manually start a deployment. E uses the AWS CLI command 'create-deployment' to programmatically trigger a deployment. Option A is incorrect because Amazon SNS does not have a direct integration with OpsWorks to trigger deployments; custom middleware would be required. Option C is incorrect because OpsWorks lifecycle events (such as 'Deploy') are not a mechanism to trigger a deployment; they are automatically executed during a deployment to run Chef recipes. The question asks for methods to trigger a deployment, and lifecycle events are part of the deployment process itself.

Answer

Configure an Amazon SNS topic to trigger the deployment.

Answer

Use OpsWorks lifecycle events like 'Deploy' to run recipes.

Question 2

A SysOps administrator is setting up an AWS Elastic Beanstalk environment for a Node.js application. The administrator wants to ensure that environment variables are set for the application. Which of the following methods can be used to set environment variables in Elastic Beanstalk? (Choose TWO.)

Accepted Answer

Use the AWS CLI command update-environment.. The AWS CLI command `update-environment` can set environment variables using the `--option-settings` parameter. Option B is correct because environment variables can be set directly in the Elastic Beanstalk environment configuration in the AWS Management Console under the 'Software' category or via .ebextensions configuration files. Option C is correct because AWS CloudFormation can set environment variables through the `OptionSettings` property of the `AWS::ElasticBeanstalk::Environment` resource, making it a valid method for defining environment variables for an Elastic Beanstalk environment. Option D is incorrect because the AppSpec file is used for AWS CodeDeploy deployments, not for Elastic Beanstalk environment settings. Option E is incorrect because the EB CLI configuration file (`.elasticbeanstalk/config.yml`) stores local project settings and not application environment variables; the correct CLI method is `eb setenv` or the `update-environment` command.

Answer

Include them in the AppSpec file.

Answer

Define them in the EB CLI configuration file.

Question 3

A SysOps administrator is troubleshooting a CodeDeploy deployment that uploads artifacts to an S3 bucket. The deployment fails with an 'AccessDenied' error. The IAM policy for the CodeDeploy service role includes the statement shown in the exhibit. What is the most likely cause of the failure?

Accepted Answer

The upload does not set the ACL to 'bucket-owner-full-control'.. The policy includes a condition that requires the object's ACL to be set to 'bucket-owner-full-control'. If the upload does not specify this ACL in the request, the condition is not met, and the request fails with AccessDenied. Therefore, option A is correct. Option B is incorrect because the resource ARN does include the bucket (the policy grants access to objects within the bucket). Option C is incorrect because the policy does not mention encryption headers; the condition is about ACL. Option D is incorrect because the s3:PutObject action is allowed by the policy; the failure is due to the condition on ACL.

Answer

The resource ARN does not include the bucket itself.

Answer

The policy does not allow encryption headers.

Answer

The policy does not allow the s3:PutObject action.

Question 4

A SysOps administrator is creating a CloudFormation stack and receives the error shown in the exhibit. The template snippet for the Auto Scaling group is:

"MyAutoScalingGroup": {
  "Type": "AWS::AutoScaling::AutoScalingGroup",
  "Properties": {
    "MinSize": "1",
    "MaxSize": "5",
    "DesiredCapacity": "2",
    ...
  }
}

Accepted Answer

The MinSize value must be specified as an integer, not a string.. The `MinSize`, `MaxSize`, and `DesiredCapacity` properties in an `AWS::AutoScaling::AutoScalingGroup` resource must be specified as integer values, not strings. In the provided template snippet, `"1"` is a string literal, which causes CloudFormation to fail validation because it expects a numeric type (e.g., `1` without quotes).

Answer

The DesiredCapacity value must be less than MinSize.

Answer

The MinSize value exceeds the MaxSize value.

Answer

The Auto Scaling group must have a scaling policy.

Question 5

A SysOps administrator sees the deployment failure shown in the exhibit. The deployment group has a minimum of 1 healthy instance. The Auto Scaling group has 2 instances. What is the most likely cause of the failure?

Accepted Answer

The deployment configuration only deploys to one instance at a time, and that instance failed.. With CodeDeployDefault.OneAtATime, only one instance is deployed at a time. If that instance fails, the deployment fails because no other instance has been deployed yet. Option A is correct. Option B is incorrect: the health check grace period does not cause the deployment failure described. Option C is incorrect: the deployment group does have enough instances (2), but the deployment is halted by the failure of the first instance before the second is deployed. Option D is incorrect: deploying to all at once would attempt both instances, which would not cause this specific failure pattern.

Answer

The Auto Scaling group's health check grace period is too long.

Answer

The deployment group does not have enough instances.

Answer

The deployment configuration is set to deploy to all instances at once.

Question 6

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The deployment uses AWS CodeDeploy with an in-place update. During a deployment, the new application version fails health checks, and CodeDeploy automatically rolls back. However, the rollback also fails. What is the MOST likely cause?

Accepted Answer

The health check path specified in the AppSpec file is not valid for the previous application version.. If the health check configuration in the CodeDeploy AppSpec file points to a path that is not valid in the previous version, the rollback will also fail health checks. Option A is incorrect because insufficient capacity would cause a different error. Option B is incorrect because CodeDeploy does not use Elastic Beanstalk. Option C is incorrect because the issue is with health checks, not with the agent.

Answer

The Auto Scaling group's minimum size is too low for a rollback.

Answer

The load balancer is configured with an incorrect target group for the Elastic Beanstalk environment.

Answer

The CodeDeploy agent on the EC2 instances is not running the latest version.

Question 7

A DevOps engineer needs to automate the creation of an Amazon RDS for MySQL DB instance in a VPC. The solution must use infrastructure as code. Which AWS service should be used to provision the database?

Accepted Answer

AWS CloudFormation. AWS CloudFormation allows you to define and provision AWS infrastructure, including RDS instances, as code using templates. Option A is incorrect because AWS OpsWorks is an automation platform that uses Chef or Puppet, but it is not the primary service for simple RDS provisioning with infrastructure as code. Option B is incorrect because AWS Elastic Beanstalk is a Platform as a Service (PaaS) that handles application deployment and scaling, but it does not directly provision infrastructure like RDS in a code-defined manner; it abstracts the underlying infrastructure. Option D is incorrect because EC2 Auto Scaling manages the scaling of EC2 instances, not the provisioning of RDS databases.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

EC2 Auto Scaling

Question 8

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CloudFormation). The deploy stage uses a change set. Recently, the deploy stage fails with the error 'No updates are to be performed.' What is the MOST likely cause?

Accepted Answer

The source code in the S3 bucket has not changed since the last successful deployment.. If the source code hasn't changed, the CloudFormation template and parameters remain identical, so CloudFormation detects no changes and reports 'No updates are to be performed.' Option B is incorrect: if the stack was manually deleted, the pipeline would fail with an error like 'Stack [name] does not exist,' not the 'No updates' error. Option C is incorrect: insufficient IAM permissions would cause an 'Access Denied' error when attempting to update the stack. Option D is incorrect: an incorrect change set name would result in a 'Change set [name] not found' error, not the 'No updates' message.

Answer

The AWS CloudFormation stack was manually deleted outside of the pipeline.

Answer

The IAM role for the pipeline does not have sufficient permissions to update the stack.

Answer

The change set name specified in the pipeline configuration is incorrect.

Question 9

An organization needs to enforce that all Amazon EC2 instances launched in a specific AWS account are created from a baseline Amazon Machine Image (AMI) that includes required security patches. The AMI ID is ami-0abcdef1234567890. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use an IAM policy that denies the ec2:RunInstances action unless the AMI ID matches the approved one.. An IAM policy with a condition that denies ec2:RunInstances unless the AMI ID matches the approved one (ami-0abcdef1234567890) prevents non-compliant instances from being launched at all. This is the most efficient approach as it enforces the requirement proactively at the API level, avoiding the need for reactive detection or termination.

Answer

Use an AWS Config rule to mark non-compliant instances and automatically terminate them.

Answer

Use an AWS Lambda function that is triggered by EC2 launch events to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor and alert on any instance launched with a different AMI.

Question 10

A company uses AWS Elastic Beanstalk to deploy a web application. The environment needs to be updated with a new application version. The SysOps administrator wants to minimize downtime during the deployment. Which deployment policy should be used?

Accepted Answer

Immutable. Immutable deployment (Option C) creates a completely new environment with the new application version and swaps the CNAME when ready, resulting in zero downtime. Rolling with an additional batch (Option B) maintains capacity but still involves a brief transitional period and is not as downtime-free as Immutable. Since the requirement is to minimize downtime, Immutable is the correct choice.

Answer

Rolling based on health

Answer

Rolling with an additional batch

Answer

All at once

Question 11

A SysOps administrator is troubleshooting a failed AWS CodeBuild build. The build project uses an Amazon S3 source. The buildspec.yml file includes commands that require internet access to download dependencies. The build is failing with a timeout error when trying to download from an external repository. The VPC configuration for the build project uses a private subnet with no NAT gateway. What change should be made to resolve the issue?

Accepted Answer

Attach a NAT gateway to the private subnet's route table.. A NAT gateway provides outbound internet access for resources in a private subnet. The CodeBuild build requires internet access to download dependencies, but the private subnet lacks a NAT gateway, causing timeout errors. Adding a NAT gateway to the subnet's route table enables internet access while keeping the build environment private. Option B is incorrect because an HTTP proxy is not necessary; a NAT gateway is the standard solution for outbound internet access from a private subnet. Option C is incorrect because a VPC endpoint only provides private connectivity to AWS services, not to external internet repositories. Option D is incorrect because moving to a public subnet would expose the build to the internet directly, which is less secure and not the recommended change; adding a NAT gateway preserves the private subnet configuration.

Answer

Configure an HTTP proxy in the build project.

Answer

Create a VPC endpoint for the external repository.

Answer

Move the build project to a public subnet with an internet gateway.

Question 12

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator needs to update a stack that contains a critical database. The update may require a replacement of the database resource. The administrator wants to review the changes before they are applied. What is the BEST way to achieve this?

Accepted Answer

Use the AWS CloudFormation create-change-set command and then review the changes before executing.. Creating a change set allows you to review all changes, including replacements, before executing them. Option A is incorrect because the '--no-fail-on-empty-changeset' flag does not provide a review. Option B is incorrect because a stack policy can protect resources but does not allow reviewing changes. Option D is incorrect because the drift detection feature detects drift, not planned changes.

Answer

Use the AWS CloudFormation update-stack command with the --no-fail-on-empty-changeset flag.

Answer

Apply a stack policy that prevents replacement of the database resource.

Answer

Use the AWS CloudFormation detect-stack-drift command to check for differences.

Question 13

A company is using AWS OpsWorks for configuration management. They have a stack with multiple layers, and they want to automate the deployment of a custom configuration file to all instances in a specific layer. What is the MOST efficient way to achieve this?

Accepted Answer

Create a custom cookbook and assign it to the layer.. OpsWorks custom cookbooks allow you to run recipes that can deploy files to instances in a layer. Option A is incorrect because the AWS::OpsWorks::App resource is used to deploy applications, not configuration files, and it does not directly add custom configuration files to instances. Option C is incorrect because AWS Systems Manager Run Command can execute commands but is not specific to OpsWorks layers and is less efficient for automating deployments tied to a specific layer's lifecycle. Option D is incorrect because user data scripts run at boot time only, not on demand, and they are not directly associated with OpsWorks layers.

Answer

Define the file in an AWS CloudFormation template using the AWS::OpsWorks::App resource.

Answer

Use AWS Systems Manager Run Command to execute a script on each instance.

Answer

Add the configuration file as user data in the layer's Auto Scaling group.

Question 14

A company runs a critical application on a fleet of EC2 instances in an Auto Scaling group. The application is deployed using a blue/green deployment strategy with AWS CodeDeploy. The green environment fails immediately after deployment, and the deployment is automatically rolled back. However, the rollback also fails because the original blue environment's Auto Scaling group has been scaled down. What should the SysOps administrator do to prevent this issue in future deployments?

Accepted Answer

Set the original environment termination delay to a longer duration in the CodeDeploy deployment group.. Setting the original environment termination delay in the CodeDeploy deployment group ensures that the blue Auto Scaling group instances are not terminated immediately after a successful deployment. This delay keeps the blue environment available during the rollback window, preventing the rollback failure that occurs when the original environment has already been scaled down. The termination delay is a configurable setting in CodeDeploy that holds the old instances for a specified period, allowing a safe fallback if the new environment fails.

Answer

Configure the deployment to automatically delete the green environment after rollback.

Answer

Increase the minimum size of the Auto Scaling group.

Answer

Change the deployment type to in-place.

Question 15

A company uses AWS CodePipeline with AWS CodeBuild and AWS CodeDeploy. The pipeline is failing because the build stage produces artifacts that are too large for CodeDeploy. Which TWO actions can resolve this issue? (Select TWO.)

Accepted Answer

Use Amazon S3 as the source for CodeDeploy instead of the pipeline artifact.. Options B and D are correct. Option B: Using Amazon S3 as the source for CodeDeploy bypasses the pipeline artifact size limit by allowing large files to be stored directly in S3. Option D: Compressing the application files before creating the artifact reduces its size, potentially fitting within CodeDeploy's limits. Option A: Increasing the timeout does not affect artifact size. Option C: Storing artifacts in CodeCommit does not reduce size; it just changes the repository. Option E: CodeDeploy has a fixed artifact size limit that cannot be increased.

Answer

Increase the timeout for the CodeBuild stage.

Answer

Store the artifacts in an AWS CodeCommit repository.

Answer

Increase the maximum artifact size limit in CodeDeploy.