SOA-C02 Deployment, Provisioning, and Automation Practice Test 12 — 15 Questions

Question 1

Refer to the exhibit. A SysOps administrator ran the describe-stack-events command for a CloudFormation stack named 'my-stack'. The stack creation failed with 'Resource creation cancelled'. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The nested stack creation timed out and was cancelled.. When a CloudFormation stack creation fails with 'Resource creation cancelled', it typically indicates that a nested stack creation was cancelled due to a timeout. CloudFormation sets a default timeout of 60 minutes for stack creation; if a nested stack does not complete within that period, the parent stack cancels the nested stack creation and reports this error. This is distinct from manual cancellation, which would show a different status.

Answer

The stack creation was manually cancelled by the administrator.

Answer

The IAM role for the stack does not have sufficient permissions.

Answer

The nested stack creation failed due to an invalid template.

Question 2

A SysOps administrator needs to deploy a new version of a Lambda function while minimizing downtime. The function is behind an API Gateway endpoint. What is the MOST effective approach?

Accepted Answer

Create a new Lambda version, then use an alias with weighted routing to shift traffic gradually. The most effective approach for zero-downtime Lambda deployment behind API Gateway is to publish a new version and use an alias with weighted routing (canary or linear). API Gateway integrates with the alias ARN, so traffic can be shifted gradually from the old version to the new one, allowing rollback if errors spike. This is the native, serverless-safe deployment pattern that minimizes downtime and risk.

Answer

Update the Lambda function code in-place and publish a new version

Answer

Create a new Lambda version and update the API Gateway integration to point to it

Answer

Deploy a new Lambda function and use an Amazon Route 53 weighted record set to distribute traffic

Question 3

A company uses AWS Elastic Beanstalk to deploy a web application. During a deployment, the environment's health turns from Green to Red, and the deployment fails. The logs show 'ERROR: Failed to download the application version from Amazon S3.' What is the MOST likely cause?

Accepted Answer

The EC2 instance profile does not have an IAM policy granting s3:GetObject on the application version. The error 'Failed to download the application version from Amazon S3' indicates that the EC2 instances in the Elastic Beanstalk environment cannot access the S3 bucket where the application version is stored. The most likely cause is that the EC2 instance profile (IAM role) lacks the necessary s3:GetObject permission on the application version object. Elastic Beanstalk uses the instance profile to download the application from S3 during deployment.

Answer

The Elastic Beanstalk service role does not have permissions to access S3

Answer

The S3 bucket is in a different AWS Region

Answer

The S3 bucket containing the application version has public read access disabled

Question 4

A SysOps administrator wants to automate the creation of an Amazon RDS MySQL instance using AWS CloudFormation. Which CloudFormation resource type should be used?

Accepted Answer

AWS::RDS::DBInstance. AWS CloudFormation uses resource types to define infrastructure components. For an Amazon RDS MySQL instance, the correct resource type is `AWS::RDS::DBInstance`, which directly maps to creating and configuring a relational database instance, including engine selection (MySQL), allocated storage, and backup settings. This resource type supports all RDS engines and is the standard way to provision RDS databases via CloudFormation. Option A is correct because `AWS::RDS::DBInstance` is the appropriate resource for creating an RDS MySQL instance. Option B is incorrect because `AWS::DynamoDB::Table` is for Amazon DynamoDB, a NoSQL database service, not a relational MySQL database. Option C is incorrect because `AWS::AppStream::DirectoryConfig` is used for Amazon AppStream 2.0 directory configuration, unrelated to RDS. Option D is incorrect because `AWS::Redshift::Cluster` is for Amazon Redshift, a data warehouse service, not a relational MySQL database.

Answer

AWS::DynamoDB::Table

Answer

AWS::AppStream::DirectoryConfig

Answer

AWS::Redshift::Cluster

Question 5

An organization uses AWS OpsWorks to manage a stack of application servers. The stack uses a custom cookbook that is stored in a private GitHub repository. When deploying new instances, the cookbook download fails. What should the administrator do to resolve this?

Accepted Answer

Configure an SSH key in the OpsWorks stack to access the private repository. AWS OpsWorks needs credentials to clone a cookbook from a private GitHub repository. The correct approach is to configure an SSH key (deploy key) in the OpsWorks stack settings so that the instance can authenticate to GitHub during the cookbook download. This allows OpsWorks to securely access the private repository without exposing credentials in the cookbook or making the repository public.

Answer

Upload the cookbook to Amazon S3 and reference the S3 URL

Answer

Make the GitHub repository public

Answer

Store the GitHub credentials in the OpsWorks stack settings

Question 6

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource that depends on an AWS::IAM::Role. The error message is 'Resource handler returned message: "The role defined for the function cannot be assumed by Lambda" (Service: Lambda, Status Code: 400).' What is the most likely cause?

Accepted Answer

The trust policy of the IAM role does not include 'lambda.amazonaws.com' as a trusted entity. The error 'The role defined for the function cannot be assumed by Lambda' specifically indicates that the IAM role's trust policy (assume role policy document) does not list lambda.amazonaws.com as a trusted principal. When Lambda attempts to assume the execution role during function creation, the STS AssumeRole call fails because the trust relationship is missing or misconfigured. The fix is to update the role's trust policy to include the Lambda service principal.

Answer

The Lambda function name conflicts with an existing function

Answer

The IAM role does not have sufficient permissions to execute the Lambda function

Answer

The Lambda function has a resource-based policy that denies access

Question 7

Which TWO options are best practices for automating deployments using AWS CodeDeploy? (Choose two.)

Accepted Answer

Use a blue/green deployment strategy. A blue/green deployment strategy minimizes downtime and risk by running two identical environments (blue for current, green for new) and shifting traffic after validation. This approach allows instant rollback by switching traffic back to the blue environment if issues arise, making it a best practice for critical production deployments.

Answer

Use a single deployment group for all environments

Answer

Deploy to all instances simultaneously

Answer

Require manual approval for every deployment

Question 8

Which TWO actions should a SysOps administrator take to automate the deployment of a multi-tier application with AWS CloudFormation? (Choose two.)

Accepted Answer

Use nested stacks to separate concerns such as network, app, and database. Option B is correct because nested stacks let you decompose a multi-tier application into reusable, independently managed templates (for example, a network stack, an application stack, and a database stack), which CloudFormation deploys as a parent stack with AWS::CloudFormation::Stack resources and promotes separation of concerns and reuse. Option D is correct because cross-stack references via Export in an Outputs section and Fn::ImportValue allow one stack to consume another stack's outputs (such as a VPC ID or subnet IDs), enabling modular, loosely coupled templates that pass values between stacks without hardcoding. Option A is wrong because hardcoding CIDR blocks and instance types reduces reusability and portability; parameters (with defaults and constraints) are the proper mechanism for environment-specific inputs. Option C is wrong because AWS::Include is a transform for inserting template snippets from S3 at deployment time, not a substitute for parameters, and it does not by itself provide the modular stack separation needed here. Option E is wrong because defining every resource in a single template creates a monolithic, hard-to-maintain stack and prevents the independent lifecycle management that nested stacks and cross-stack references provide.

Answer

Hardcode CIDR blocks and instance types to avoid parameter input

Answer

Use AWS::Include to reuse snippets instead of parameters

Answer

Define all resources in a single template to simplify management

Question 9

An administrator attempts to deploy an application using AWS CodeDeploy. The deployment fails with 'Access Denied' when trying to download the revision from the S3 bucket 'example-bucket'. The IAM policy attached to the instance profile is shown in the exhibit. What is the cause of the failure?

Accepted Answer

The policy is missing the s3:GetObjectVersion action for the bucket. The deployment fails with 'Access Denied' when trying to download the revision from S3. The IAM policy attached to the instance profile must allow the s3:GetObject action to download objects. However, if the deployment uses a specific version of the revision (e.g., when using CodeDeploy with S3 versioning), the s3:GetObjectVersion action is also required. The exhibit shows the policy includes s3:GetObject but not s3:GetObjectVersion, causing the failure. Option B is correct because the missing s3:GetObjectVersion action is the cause. Option A is incorrect because s3:ListBucket is present in the policy. Option C is incorrect because the policy does include s3:GetObject. Option D is incorrect because the policy is attached to the correct instance profile.

Answer

The policy does not include s3:ListBucket

Answer

The policy grants s3:ListBucket but not s3:GetObject

Answer

The policy is attached to the wrong IAM role

Question 10

An administrator deploys a CloudFormation template that includes the snippet shown in the exhibit. Later, the administrator deletes the stack. What happens to the S3 bucket?

Accepted Answer

The bucket is retained but no longer managed by CloudFormation. The DeletionPolicy attribute set to 'Retain' on the S3 bucket resource causes CloudFormation to preserve the bucket when the stack is deleted. The bucket will still exist in the account but will no longer be under CloudFormation management. Therefore, option D is correct. Option A is incorrect because the bucket is retained regardless of its contents. Option B is incorrect because the bucket is not emptied or deleted. Option C is incorrect because the bucket is not deleted along with the stack.

Answer

The bucket is deleted only if it contains no objects

Answer

The bucket is emptied and then deleted

Answer

The bucket is deleted along with the stack

Question 11

A company is using AWS CloudFormation to deploy a multi-tier web application. After updating the stack template, the update fails with a stack creation rollback in progress error. The SysOps administrator needs to identify the specific resource that caused the failure. What is the MOST efficient way to accomplish this?

Accepted Answer

Run the AWS CLI command aws cloudformation describe-stack-events --stack-name <stack-name> and review the resource status reason.. The describe-stack-events command returns a chronological list of every stack event, including each resource's status and the 'ResourceStatusReason' field that contains the exact error message from the failed resource. This is the fastest, most direct way to pinpoint which resource caused the rollback without digging through unrelated logs.

Answer

Use the AWS Management Console to view the stack status and check the stack policy.

Answer

Use the aws cloudformation describe-change-set command to review the proposed changes.

Answer

Check the CloudTrail logs for the UpdateStack API call to see the error message.

Question 12

An organization is using OpsWorks to manage a stack of application servers. They need to automatically scale out based on CPU utilization. Which configuration should the SysOps administrator use to achieve this?

Accepted Answer

Add a load-based layer and configure the scaling thresholds for CPU utilization.. OpsWorks load-based layers automatically scale instances based on CloudWatch alarms, such as CPU utilization thresholds. Option A is incorrect because auto-healing replaces failed instances, not scales out. Option B is incorrect because custom Chef recipes run on lifecycle events (setup, configure, etc.) but do not directly handle automatic scaling. Option D is incorrect because time-based instances scale on a schedule, not based on CPU utilization.

Answer

Enable auto-healing on the layer to replace unhealthy instances automatically.

Answer

Create a custom Chef recipe that runs on a lifecycle event to launch new instances.

Answer

Configure a time-based instance with a recurring schedule to add instances during peak hours.

Question 13

A SysOps administrator is troubleshooting a CloudFormation stack that failed to create. The stack includes an Amazon RDS DB instance. The error message indicates that the DB instance name already exists. The stack uses a parameter for the DB instance identifier. What should the administrator do to resolve this issue and create the stack?

Accepted Answer

Delete the failed stack, change the DB instance identifier parameter to a unique name, and recreate the stack.. When a CloudFormation stack creation fails due to a naming conflict (e.g., DB instance identifier already exists), the failed stack must be deleted because it cannot be updated or continued. Changing the parameter to a unique name and recreating the stack resolves the conflict. Option B is incorrect because, while deleting the conflicting DB instance would resolve the name conflict, the failed stack still exists and must be deleted before recreating the stack; in addition, deleting an existing DB instance is not the recommended approach — you should use a unique identifier. Option C is incorrect because `update-stack` cannot be applied to a failed stack creation; the stack is in a failed state and must be recreated. Option D is incorrect because `ContinueUpdateRollback` is used for update rollbacks, not for failed creations.

Answer

Manually delete the DB instance from the AWS Management Console and then retry the stack creation.

Answer

Use the AWS CLI command aws cloudformation update-stack with a new parameter value.

Answer

Execute ContinueUpdateRollback on the stack to retry the creation.

Question 14

A SysOps administrator needs to deploy a CloudFormation stack across multiple AWS accounts in an organization using AWS Organizations. The administrator wants to use a single template and a single deployment operation. Which AWS service should be used to centrally manage the deployment?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple AWS accounts and regions with a single operation. It is designed for centralized management of stacks in an organization, leveraging AWS Organizations for automatic deployment to member accounts. This meets the requirement of using one template and one deployment operation across multiple accounts.

Answer

AWS Systems Manager

Answer

AWS OpsWorks Stacks

Answer

AWS CodePipeline

Question 15

A SysOps administrator needs to deploy a new application version to an Auto Scaling group without causing any downtime. The application runs on EC2 instances behind an Application Load Balancer. Which deployment method should the administrator use?

Accepted Answer

Use a rolling update with a batch size of 1 instance and enable the health check grace period.. A rolling update with a batch size of 1 instance replaces instances one at a time, ensuring that the Auto Scaling group always maintains the desired capacity minus one, which prevents downtime. Enabling the health check grace period allows the new instance to pass the ALB health checks before the next instance is terminated, ensuring traffic is only sent to healthy instances.

Answer

Perform an in-place update by updating the launch template and manually replacing instances one by one.

Answer

Use a rolling update with a batch size of 100% of the instances.

Answer

Create a new Auto Scaling group with the new launch template and gradually shift traffic using a load balancer target group.