SOA-C02 Deployment, Provisioning, and Automation Practice Test 12 — 15 Questions

Question 1

A company is using AWS CloudFormation to manage infrastructure. A recent stack update failed, and the SysOps administrator needs to roll back to the previous known good state. However, the stack is in UPDATE_ROLLBACK_FAILED state. What should the administrator do to recover the stack?

Accepted Answer

Use the ContinueUpdateRollback API or AWS Management Console to resume the rollback after addressing the failure cause. Option B is correct because when a stack is in UPDATE_ROLLBACK_FAILED, you can continue the rollback by fixing the underlying issue (e.g., deleting a resource that cannot be rolled back) and then executing ContinueUpdateRollback. Option A is wrong because deleting the stack would remove all resources, causing data loss. Option C is wrong because updating the stack again may not resolve the rollback failure and could compound errors. Option D is wrong because CloudFormation does not have an automatic rollback recovery feature; manual intervention is required.

Answer

Delete the stack and recreate it from the previous template

Answer

Contact AWS Support to enable automatic rollback recovery

Answer

Execute another stack update with the same parameters to overwrite the failed state

Question 2

A company uses AWS CloudFormation to deploy EC2 instances across multiple environments. The operations team notices that stack updates fail when parameter values change. What is the MOST likely cause?

Accepted Answer

The parameter has the NoEcho property set to true, and the previous value is not provided.. Option B is correct because in CloudFormation, parameters with NoEcho set to true cannot be updated without specifying the previous value; the default behavior is to require the parameter to be provided again. Option A is wrong because stack policies protect resources from updates, not parameter changes. Option C is wrong because change sets allow updates, not prevent them. Option D is wrong because the condition function affects resource creation, not parameter updates.

Answer

The parameter uses the AWS::NoValue condition.

Answer

A change set is required but not generated.

Answer

A stack policy prevents parameter updates.

Question 3

A SysOps administrator is automating the creation of Amazon RDS instances using AWS CloudFormation. The template includes a DBInstance resource with a DBSubnetGroupName property referencing a subnet group created in the same template. The stack creation fails with the error 'DBSubnetGroup not found'. What is the MOST likely reason?

Accepted Answer

A DependsOn clause is missing between the DBInstance and the DBSubnetGroup.. Option C is correct because CloudFormation creates resources in parallel by default, and the DBSubnetGroup may not be created before the DBInstance if there is no DependsOn clause. Option A is wrong because subnet groups can be created in the same template. Option B is wrong because the VPC exists. Option D is wrong because the database subnet group is not required to be public.

Answer

The VPC ID is incorrect or does not exist.

Answer

The DBSubnetGroup is not associated with a public subnet.

Answer

The DBSubnetGroup is defined in a different CloudFormation stack.

Question 4

A company uses AWS OpsWorks for configuration management of EC2 instances. The administrator needs to ensure that a custom recipe runs on all instances after the instance is fully configured. Which lifecycle event should the recipe be associated with?

Accepted Answer

Configure. Option C is correct because the Configure lifecycle event occurs after the instance is fully set up and runs whenever the instance enters a new state. Option A is wrong because Setup runs only once when the instance boots. Option B is wrong because Deploy runs when a deploy command is issued. Option D is wrong because Undeploy runs when the instance is removed.

Answer

Undeploy

Answer

Deploy

Answer

Setup

Question 5

A company is using AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) that includes specific software. The administrator creates a custom AMI and configures the Elastic Beanstalk environment to use it. However, new instances launched during scaling use the default platform AMI instead. What is the MOST likely cause?

Accepted Answer

The custom AMI is configured in the environment's launch configuration, but the environment has not been updated to replace existing instances.. Option D is correct because the custom AMI must be specified in the launch configuration or launch template used by the Auto Scaling group, and if the environment is updated, the existing instances may not be replaced. Option A is wrong because the Elastic Beanstalk platform version determines the base AMI, but custom AMIs can override it. Option B is wrong because the AMI ID must be specified in the launch configuration, not the environment properties. Option C is wrong because encryption does not prevent the custom AMI from being used.

Answer

The custom AMI ID is specified in the environment properties instead of the launch configuration.

Answer

The custom AMI is encrypted, and the instance profile does not have permissions to decrypt it.

Answer

The Elastic Beanstalk platform version is incompatible with the custom AMI.

Question 6

A SysOps administrator is tasked with automating the creation of IAM roles and policies using AWS CloudFormation. The template includes an IAM role and a managed policy. The stack creation fails with the error 'Policy arn:aws:iam::123456789012:policy/MyManagedPolicy not found'. The policy is created in the same template. What is the MOST likely solution?

Accepted Answer

Add a 'DependsOn' clause to the IAM role resource for the managed policy, and reference the policy ARN using the 'Ref' intrinsic function.. Option A is correct because the IAM role has a DependsOn the policy, but the policy ARN is not known until the policy is created; referencing the policy by its logical name in the role's ManagedPolicyArns property resolves this. Option B is wrong because the policy document is not the issue. Option C is wrong because the role name can be specified. Option D is wrong because the role can be created in the same stack.

Answer

Remove the policy document from the template and create the policy separately.

Answer

Use a custom resource to create the policy before the role.

Answer

Create the IAM role in a separate stack.

Question 7

A company uses AWS CodeDeploy to automate deployments to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero exit code.. Option B is correct because the BeforeInstall hook script failed, causing the instance to fail deployment. Option A is wrong because Agent log errors indicate agent issues, not script failures. Option C is wrong because the instance is unhealthy, but the specific error is a script exit code. Option D is wrong because the IAM role would cause a different error.

Answer

The instance does not have the required permissions to download the application revision.

Answer

The instance is not healthy according to the Elastic Load Balancer health checks.

Answer

The CodeDeploy agent is not running on the instance.

Question 8

A SysOps administrator uses AWS Systems Manager Run Command to install software on a fleet of EC2 instances. The command fails on some instances with the error 'Instance ID not found'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not installed or configured on the instances, or the instances lack the required IAM role.. Option D is correct because Run Command requires the SSM Agent to be installed and running, and the instance must have an IAM role that allows communication with Systems Manager. Option A is wrong because the command can target instances by tags. Option B is wrong because the SSM Agent is separate from the user data script. Option C is wrong because the instances are likely running.

Answer

The user data script has overridden the SSM Agent.

Answer

The instances are not tagged with the correct key-value pair.

Answer

The instances are in a stopped state.

Question 9

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an AWS::RDS::DBInstance resource. The administrator wants to ensure that the database is not deleted when the stack is deleted. Which CloudFormation resource property should be set?

Accepted Answer

Set the 'DeletionPolicy' attribute to 'Retain' on the DBInstance resource.. Option C is correct because the DeletionPolicy attribute with value Retain prevents the database from being deleted when the stack is deleted. Option A is wrong because the deletion policy is not a property of the DBInstance; it's a top-level attribute. Option B is wrong because the DBInstance does not have a 'DeletionProtection' property in CloudFormation for RDS; that's a separate RDS feature. Option D is wrong because there is no 'RetainOnDeletion' property.

Answer

Set the 'DeletionPolicy' attribute to 'Snapshot' on the DBInstance.

Answer

Set the 'RetainOnDeletion' property to 'true' on the DBInstance.

Answer

Set the 'DeletionProtection' property to 'true' on the DBInstance.

Question 10

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

Accepted Answer

Perform a rolling update based on health.. Option B is correct because a rolling update replaces instances in batches, minimizing downtime. Option A is wrong because an immutable update launches new instances in a separate Auto Scaling group and swaps them, which can be faster but may cause brief downtime. Option C is wrong because terminating all instances causes downtime. Option D is wrong because environment cloning creates a separate environment, not an update.

Answer

Terminate all instances and let the Auto Scaling group launch new ones.

Answer

Perform an immutable update.

Answer

Clone the environment with the new configuration and swap URLs.

Question 11

A SysOps administrator is designing an automated deployment pipeline for a web application using AWS CodePipeline. The application is deployed to an Auto Scaling group behind an Application Load Balancer. The administrator wants to ensure zero downtime during deployments. Which TWO strategies should be combined? (Choose TWO.)

Accepted Answer

Use a blue/green deployment with CodeDeploy and an Elastic Load Balancer.. Options A and D are correct because an immutable update launches new instances with the new version, then swaps them into the load balancer and terminates old ones, providing zero downtime. A blue/green deployment (option D) does the same by creating a new environment and shifting traffic. Option B is wrong because an in-place update with rolling batches may cause brief downtime if health checks fail. Option C is wrong because canary deployments are not zero downtime by default but can be used with blue/green. Option E is wrong because all-at-once causes downtime.

Answer

Use CodeDeploy with an all-at-once deployment.

Answer

Use CodeDeploy with a canary deployment.

Answer

Use CodeDeploy with an in-place update and a rolling batch configuration.

Question 12

A company is using AWS CloudFormation to manage infrastructure. The administrator needs to update a stack that contains a critical Amazon RDS database. The administrator wants to prevent accidental updates to the database while allowing updates to other resources. Which TWO steps should the administrator take? (Choose TWO.)

Accepted Answer

Apply a stack policy that denies updates to the RDS resource.. Options A and C are correct because a stack policy can protect specific resources from updates, and setting a deletion policy of Snapshot ensures backups before deletion. Option B is wrong because disabling updates entirely is not desired. Option D is wrong because the RDS resource can be updated if the policy allows. Option E is wrong because termination protection is for preventing deletion of the stack, not specific resources.

Answer

Use a condition to prevent the RDS resource from being updated.

Answer

Enable termination protection on the CloudFormation stack.

Answer

Remove the RDS resource from the CloudFormation template.

Question 13

A SysOps administrator is automating the creation of an Amazon ECS cluster with Fargate launch type using AWS CloudFormation. The template must define the task definition, service, and cluster. Which THREE resources are required to be in the template? (Choose THREE.)

Accepted Answer

AWS::ECS::TaskDefinition. Options A, B, and D are correct. An ECS cluster (A) is required to run tasks. A task definition (B) defines the container specification. A service (D) manages the desired count and scheduling. Option C is wrong because a VPC is not a resource within ECS; it's an EC2 resource but is required for Fargate; however, the question asks for resources that must be in the template, and VPC is typically created separately. Option E is wrong because a load balancer is optional.

Answer

AWS::EC2::VPC

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Question 14

A SysOps administrator is creating an IAM policy for automation. The policy is attached to an IAM role used by an automated deployment script. The script needs to launch EC2 instances of type t2.micro and describe all EC2 resources. However, the script fails when trying to launch instances. What is the MOST likely reason?

Accepted Answer

The policy does not grant permissions for additional resources required by RunInstances, such as images, network interfaces, and security groups.. Option B is correct because the RunInstances action requires additional permissions for resources such as images (AMI), network interfaces, security groups, etc. The policy only grants permission for the instance resource. Option A is wrong because the Condition is correct. Option C is wrong because Describe* is allowed. Option D is wrong because the Resource ARN is for instances, but other resources like images need to be allowed separately.

Answer

The Resource ARN for the instance is incorrect.

Answer

The policy does not include the 'ec2:DescribeInstances' action.

Answer

The Condition key 'ec2:InstanceType' is misspelled.

Question 15

A SysOps administrator updates a CloudFormation stack to change the EC2 instance type from t2.micro to t3.medium. The update fails with the error shown. What is the MOST likely cause?

Accepted Answer

The t3.medium instance type is not available in the specified Availability Zone.. Option A is correct because the error message explicitly states that the instance type is not supported in the Availability Zone. Option B is wrong because the error does not mention insufficient capacity. Option C is wrong because the error does not mention AMI. Option D is wrong because the error does not mention parameter validation.

Answer

The account does not have service limits to launch a t3.medium instance.

Answer

The AMI used does not support the t3.medium instance type.

Answer

The CloudFormation template has a parameter constraint that rejects t3.medium.