SOA-C02 Deployment, Provisioning, and Automation Practice Test 12 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The SysOps administrator wants to ensure that the RDS instance is created before the EC2 instance and that the EC2 instance receives the database endpoint as a user data parameter. Which THREE steps should be taken? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a DependsOn attribute to the EC2 instance resource referencing the RDS instance.. To ensure the RDS instance is created before the EC2 instance and that the EC2 instance receives the database endpoint, the correct steps are:

- **B: Add a DependsOn attribute to the EC2 instance resource referencing the RDS instance.** This explicitly orders resource creation so that the RDS instance is created first.
- **C: Use the cfn-init helper script to process the UserData and configure the application.** The cfn-init script can read metadata from the CloudFormation template and execute configuration steps, such as writing the endpoint to the application configuration.
- **E: Use the Fn::GetAtt intrinsic function to retrieve the RDS endpoint and pass it to the EC2 instance's UserData property.** Fn::GetAtt returns the endpoint attribute of the RDS instance, which can be embedded in the UserData script to pass to the EC2 instance at launch.

Option A (AWS::CloudFormation::Init metadata) is used to configure applications, not to set creation order; DependsOn handles ordering. Option D (DependsOn on RDS referencing EC2) would reverse the dependency, causing EC2 to be created first, which is not desired.

Answer

Use the AWS::CloudFormation::Init metadata to set the creation order.

Answer

Add a DependsOn attribute to the RDS instance resource referencing the EC2 instance.

Question 2

A company uses AWS Elastic Beanstalk to deploy a web application. After updating the environment configuration, the deployment fails and the environment health turns red. The SysOps administrator checks the logs and finds a permission error related to the EC2 instance profile. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM instance profile associated with the environment to include the required permissions.. Elastic Beanstalk uses an IAM instance profile for the EC2 instances. The instance profile must have the necessary permissions to access resources like S3 buckets or DynamoDB tables. Updating the instance profile with the required permissions resolves the issue. Option A is wrong because rebuilding the environment from scratch using a saved configuration template does not address the underlying permission issue; it would only recreate the same problem. Option C is wrong because the security group controls network access, not IAM permissions; modifying it would not resolve the permission error. Option D is wrong because updating the application version does not fix permission issues; the application version itself does not grant or modify IAM permissions.

Answer

Rebuild the environment from scratch using a saved configuration template.

Answer

Modify the security group attached to the environment to allow outbound traffic.

Answer

Update the application version to the latest build.

Question 3

A SysOps administrator is automating the deployment of a three-tier web application using AWS CloudFormation. The administrator wants to ensure that the database tier is created before the application tier. How should the administrator define this dependency in the CloudFormation template?

Accepted Answer

Use the DependsOn attribute on the application tier resources to reference the database tier resources.. CloudFormation supports the DependsOn attribute to specify resource dependencies. The application tier resources must wait for the database tier resources to be created. Option A is wrong because the Conditions section determines whether resources are created based on conditions, not the creation order. Option B is wrong because the Outputs section exports values for use in other stacks, but does not control the order of creation within the same stack. Option D is wrong because the Parameters section defines input values passed to the template, not dependencies.

Answer

Use the Conditions section to check if the database exists before creating the application tier.

Answer

Use the Outputs section to export the database endpoint and import it in the application tier.

Answer

Use the Parameters section to pass the database instance identifier to the application stack.

Question 4

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances in the Auto Scaling group are not registered with the target group of an Application Load Balancer. The SysOps administrator needs to ensure that new instances launched by the Auto Scaling group are automatically registered with the target group. What should the administrator do?

Accepted Answer

Attach the target group to the Auto Scaling group.. When an Auto Scaling group is attached to a target group, the Auto Scaling group automatically registers new instances with the target group. This ensures CodeDeploy can deploy to registered instances. Option A is wrong because Amazon Inspector is a security assessment tool and does not handle target group registration. Option C is wrong because lifecycle hooks trigger custom actions but do not automatically register instances without additional configuration. Option D is wrong because a user data script would require custom logic to register instances, and it is not the standard method for automatic registration.

Answer

Use Amazon Inspector to automatically register instances with the target group.

Answer

Create a lifecycle hook in the Auto Scaling group to register instances with the target group.

Answer

Configure the Auto Scaling group to launch instances with a user data script that registers the instance with the target group.

Question 5

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to a stack. What is the recommended way to update the application on the instances?

Accepted Answer

Update the custom cookbook and run the 'deploy' recipe on the stack.. AWS OpsWorks uses recipes and custom cookbooks to manage application deployment. To deploy a new version, the SysOps administrator should update the custom cookbook with the new application code or configuration and then run the 'deploy' recipe on the stack. This triggers the deployment process on all instances automatically. Option A is incorrect because creating a new CloudFormation stack is not the recommended approach for updating an existing OpsWorks stack; CloudFormation is a different service for infrastructure as code. Option C is incorrect because the OpsWorks built-in 'deploy' command is meant for straightforward deployments and may not support custom cookbooks or complex application logic. Option D is incorrect because manually SSH-ing into each instance is not scalable and defeats the purpose of automation.

Answer

Create a new CloudFormation stack to replace the OpsWorks stack.

Answer

Use the OpsWorks built-in 'deploy' command on each instance.

Answer

SSH into each instance and manually update the application files.

Question 6

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The error message indicates that a resource failed to create due to insufficient IAM permissions. The administrator used a service role for CloudFormation. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM policy attached to the CloudFormation service role to include the necessary permissions.. CloudFormation service roles are used to grant permissions for stack operations. When a service role is specified, CloudFormation assumes that role to perform actions. If the role lacks the required IAM permissions to create a resource, the stack update fails. Updating the IAM policy attached to the service role to include the necessary permissions resolves the issue. Option A is incorrect because the administrator's own IAM user permissions are not used when a service role is specified. Option B is incorrect because the error indicates insufficient permissions, not an IAM role limit. Option D is incorrect because modifying the resource's IAM policy controls access to the resource itself, not CloudFormation's ability to create it.

Answer

Add the required permissions to the administrator's IAM user.

Answer

Request a limit increase for IAM roles in the AWS account.

Answer

Modify the resource's IAM policy to allow CloudFormation to create it.

Question 7

A company uses AWS CodePipeline with AWS CodeBuild to build and deploy a static website to an S3 bucket. The website is served via Amazon CloudFront. The deployment fails intermittently because the S3 bucket policy does not allow CloudFront access after the bucket is updated. What is the BEST way to automate the bucket policy update during the deployment?

Accepted Answer

Use AWS CloudFormation to manage the S3 bucket and its policy, and update the stack as part of the pipeline.. AWS CloudFormation can manage the S3 bucket and its policy as part of the infrastructure. Using CloudFormation, the bucket policy can be updated automatically when the stack is updated, ensuring that CloudFront access is maintained. Option A is incorrect because including an AWS CLI command in the buildspec may work but is less robust and not as automated as using CloudFormation. Option C is incorrect because manually adding a bucket policy statement in the S3 management console is not automated and prone to errors. Option D is incorrect because while using a CloudFront origin access identity (OAI) and configuring it in the bucket policy is a best practice, it does not automate the policy update during deployment; CloudFormation handles this automatically.

Answer

Include an AWS CLI command in the buildspec to update the bucket policy after the build.

Answer

Add a bucket policy statement in the S3 management console to grant CloudFront access.

Answer

Use a CloudFront origin access identity (OAI) and configure it in the bucket policy.

Question 8

A SysOps administrator wants to automate the creation of an Amazon RDS database instance using AWS CloudFormation. The database must be created in a specific VPC and must be Multi-AZ. Which CloudFormation resource property should the administrator configure to meet these requirements?

Accepted Answer

DBSubnetGroupName and MultiAZ. The DBSubnetGroupName property specifies the VPC subnets for the RDS instance, ensuring it is created in the desired VPC. The MultiAZ property enables Multi-AZ deployment for high availability. Other options: DBInstanceIdentifier (D) is only a name, Engine (B) defines the database engine type, and DBInstanceClass (C) specifies the instance size; none affect VPC placement or Multi-AZ functionality.

Answer

Engine

Answer

DBInstanceClass

Answer

DBInstanceIdentifier

Question 9

A company uses AWS Elastic Beanstalk for a Java application. The environment uses a custom platform. The SysOps administrator wants to update the environment's configuration to use a larger instance type to handle increased load. What is the correct way to perform this change with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to update the instance type and choose a rolling update strategy.. Elastic Beanstalk allows you to update the environment's configuration, such as instance type, via the console or CLI. To minimize downtime, you can choose a rolling update strategy, which updates instances in batches, ensuring that the environment remains available throughout the process. Option B is incorrect because manually SSHing into instances is not a scalable or persistent solution; Elastic Beanstalk manages the instances and changes may not survive environment updates. Option C is incorrect because terminating all instances causes complete downtime until the new instances are launched. Option D is incorrect because while creating a new environment and swapping URLs (blue/green deployment) can achieve zero downtime, it is more complex and resource-intensive than necessary for a simple instance type change, and the question asks for minimal downtime with correct method.

Answer

SSH into each instance and modify the instance type manually.

Answer

Terminate all instances and launch new ones with the larger instance type.

Answer

Create a new environment with the larger instance type and swap the environment URLs.

Question 10

A SysOps administrator is responsible for deploying a critical application using AWS CloudFormation. The stack creation fails during the creation of an Amazon EC2 instance. The error message indicates that the instance type is not supported in the specified Availability Zone. What should the administrator do to prevent this issue in future deployments?

Accepted Answer

Use an AWS Systems Manager parameter to dynamically select an available instance type based on the Availability Zone.. Using an AWS Systems Manager parameter allows the CloudFormation template to dynamically select an instance type supported in the specified Availability Zone. This approach avoids hardcoding or manual selection, making deployments more resilient to regional differences. Option A is wrong because hardcoding an Availability Zone reduces flexibility and does not solve the unsupported instance type issue if that zone also lacks the type. Option B is wrong because selecting a different instance type may not meet application requirements. Option C is wrong because changing regions may introduce latency or compliance issues without guaranteeing support in all zones.

Answer

Hardcode the Availability Zone in the template to one that supports the instance type.

Answer

Use a different instance type that is available in all Availability Zones.

Answer

Change the AWS region to one where the instance type is supported.

Question 11

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must include a build stage, a test stage, and a deployment stage. The administrator wants to ensure that if the build stage fails, the pipeline stops and notifies the team. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure the pipeline to stop on failure in the build stage.. The correct answers are A and B. AWS CodePipeline automatically stops execution on failure when a stage fails (A). To notify the team, you can configure an Amazon SNS topic to send notifications on pipeline stage failures (B). Option C is wrong because while CloudWatch Events can detect build failures, the question asks for an action that the administrator should take; directly configuring an SNS topic is the recommended approach. Option D is wrong because manual approval is not used for automatic notification; it is for manual review. Option E is wrong because CodeBuild itself does not stop the pipeline; the pipeline stops automatically on failure.

Answer

Set up an Amazon CloudWatch Events rule to detect build failures and send an email.

Answer

Add a manual approval action after the build stage to review results.

Answer

Use AWS CodeBuild as the build provider and configure it to stop the pipeline on failure.

Question 12

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator wants to update a stack that contains an Amazon RDS DB instance. The update involves changing the DB instance class. Which THREE steps should the administrator take to perform this update with minimal downtime? (Choose three.)

Accepted Answer

Update the CloudFormation stack with a new parameter value for the DB instance class.. The correct answers are B, D, and E. Updating the CloudFormation stack with a new parameter value for the DB instance class (B) triggers the stack update, which modifies the RDS instance via CloudFormation. Taking a manual snapshot (D) provides a backup before the change, enabling recovery if needed. Enabling Multi-AZ (E) allows a rolling upgrade: the modification is applied to the standby first, then failover occurs, minimizing downtime. Option A is incorrect because modifying the RDS instance directly outside CloudFormation causes drift and is not a recommended practice. Option C is incorrect because deleting and recreating the stack would result in significant downtime and is unnecessary.

Answer

Modify the RDS instance class directly in the RDS console and then update the CloudFormation template.

Answer

Delete the existing stack and create a new one with the updated instance class.

Question 13

A SysOps administrator is using AWS System Manager Automation to patch a fleet of Amazon EC2 instances. The administrator wants to ensure that instances are patched during a maintenance window and that they are rebooted only if required. Which TWO steps should the administrator include in the automation document? (Choose two.)

Accepted Answer

Set the 'RebootIfNeeded' parameter to 'True' or 'False' as appropriate.. The correct answers are B and D. The 'AWS-RunPatchBaseline' document applies patches to instances (D). The 'RebootIfNeeded' parameter controls whether instances reboot after patching (B). Option A is incorrect because creating an EBS snapshot is not part of the patching document; it may be done separately but is not required. Option C is incorrect because a maintenance window is scheduled in the Systems Manager console or via API, not within the automation document. Option E is incorrect because CloudWatch alarms are not part of the patching document.

Answer

Create an Amazon EBS snapshot of each instance before patching.

Answer

Schedule a maintenance window in the Systems Manager console.

Answer

Configure an Amazon CloudWatch alarm to detect failed patches.

Question 14

A SysOps administrator has created the IAM policy shown in the exhibit. The policy is attached to a role used by an automation script that manages Amazon EBS snapshots. The script is failing when it tries to delete snapshots. What is the likely cause?

Accepted Answer

The script is trying to delete snapshots in a different region or account.. The IAM policy likely restricts the 'ec2:DeleteSnapshot' action to a specific resource ARN that includes a particular region and account. When the automation script attempts to delete snapshots in a different region or account, it fails because the policy condition is not met. Option A is incorrect because the script may have permission to delete snapshots that match the resource restrictions. Option C is incorrect because the failure is not related to 'DescribeSnapshots' permission; the script can describe snapshots but fails on delete. Option D is incorrect because the script does not need 'CreateTags' permission to delete snapshots; the failure is caused by the resource-level restriction on 'DeleteSnapshot'.

Answer

The script does not have permission to delete any snapshots.

Answer

The script does not have permission to describe snapshots.

Answer

The script does not have permission to create tags on snapshots.

Question 15

A SysOps administrator ran a CloudFormation stack update that failed and rolled back. The stack status is UPDATE_ROLLBACK_FAILED. The administrator needs to fix the issue and bring the stack to a stable state. What should the administrator do FIRST?

Accepted Answer

Identify and resolve the resource issue that caused the rollback failure, then continue the rollback.. When a CloudFormation stack update fails and the rollback also fails (UPDATE_ROLLBACK_FAILED), the administrator must first identify and resolve the underlying issue that prevented the rollback from completing. This could include fixing permissions, deleting resources that were manually created, or resolving conflicts. After resolving the issue, the administrator can use the ContinueUpdateRollback API (or the AWS Management Console) to continue the rollback. Option B is incorrect because CloudFormation does not automatically retry failed rollbacks. Option C is incorrect because executing a new stack update without resolving the rollback failure may cause further issues and is not recommended. Option D is incorrect because deleting the stack may result in data loss and is a more drastic measure than necessary.

Answer

Wait for CloudFormation to automatically retry the rollback.

Answer

Execute a new stack update to overwrite the failed resources.

Answer

Delete the stack and recreate it from the template.