SOA-C02 Deployment, Provisioning, and Automation Practice Test 13 — 15 Questions

Question 1

A SysOps administrator wants to automate the deployment of an application to an EC2 instance. The instance is running, but the deployment script fails because the instance is not reachable via SSH. The administrator checks the instance state as shown in the exhibit. What should the administrator check NEXT to troubleshoot the SSH connectivity issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the security group rules to ensure SSH (port 22) is allowed from the administrator's IP.. The instance is running but unreachable via SSH, so the most likely issue is network connectivity. The security group controls inbound traffic, so checking that SSH (port 22) is allowed from the administrator's IP is the next logical step. Option A is correct. Option B is incorrect because verifying a public subnet and internet gateway is important but usually done after security group checks; also, the instance may be in a private subnet with a bastion host. Option C is incorrect because the instance ID is already confirmed. Option D is incorrect because the instance is running, not stopped.

Answer

Verify the instance is in a public subnet with an internet gateway.

Answer

Verify the instance ID is correct.

Answer

Check if the instance is in a stopped state.

Question 2

A company uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. During a deployment, the pipeline fails at the Deploy stage with an error indicating that the CodeDeploy agent is not responding. The instances are in an Auto Scaling group. What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed on the EC2 instances.. The error indicates that the CodeDeploy agent is not responding, which most likely means the agent is not installed on the EC2 instances. The CodeDeploy agent must be installed and running on each instance to pull deployment instructions from CodeDeploy. Option C is correct. Option A is incorrect because CodePipeline can communicate with CodeDeploy without a VPC endpoint; the error is from the agent on the instance. Option B is incorrect: while IAM roles are necessary for the agent to access AWS resources, the specific error 'agent not responding' typically occurs when the agent itself is missing or not running, not due to missing permissions. Option D is incorrect because the ALB's target group configuration is unrelated to the CodeDeploy agent status.

Answer

The pipeline does not have a VPC endpoint to connect to the instances.

Answer

The IAM role attached to the instances does not have permissions for CodeDeploy.

Answer

The Application Load Balancer is not configured with a target group.

Question 3

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an Amazon RDS DB instance with a custom DB parameter group. The error message states: 'The following resource(s) failed to create: [DBParameterGroup].' The administrator checks the CloudFormation template and sees that the DBParameterGroup resource has a property 'Parameters' with a list of parameters. What is the MOST likely reason for the failure?

Accepted Answer

The parameter group is configured with parameters that are not compatible with the DB engine version.. Custom DB parameter groups must be configured with parameters that are compatible with the DB engine and version specified for the RDS instance. If the parameter group includes parameters that are not supported by the chosen engine version, the stack creation will fail with an error for the DBParameterGroup resource. In this case, the most likely cause is that one or more parameters in the 'Parameters' list are incompatible with the DB engine version. Option B is correct. Option A is incorrect because parameter group names can contain letters, numbers, and hyphens; they are not restricted. Option C is incorrect because the DB subnet group is not related to parameter group creation failure. Option D is incorrect because RDS does not require a VPC endpoint to create a parameter group.

Answer

The parameter group name contains invalid characters.

Answer

The DB subnet group specified for the DB instance does not exist.

Answer

The VPC does not have an RDS VPC endpoint enabled.

Question 4

A company uses AWS Elastic Beanstalk to deploy a Node.js application. The application requires a specific version of Node.js that is not the default version provided by the Elastic Beanstalk platform. How can the administrator ensure that the correct Node.js version is installed on the environment's EC2 instances?

Accepted Answer

Include a configuration file in the .ebextensions folder that specifies the desired Node.js version.. Elastic Beanstalk allows customization via configuration files in the .ebextensions folder. Option D is correct. Option A is wrong because the AWS CLI is not used for instance-level configuration in a managed environment. Option B is wrong because you cannot change the platform version after environment creation; you would need to create a new environment. Option C is wrong because environment properties are for environment variables, not platform settings.

Answer

Use the AWS CLI to run a command on each instance to install the desired Node.js version.

Answer

Use the Elastic Beanstalk console to change the platform version after the environment is created.

Answer

Set an environment property 'NODE_VERSION' to the desired version.

Question 5

A company has a production AWS CloudFormation stack that creates an Amazon EC2 instance with an AWS Systems Manager Association to install software. The stack creation succeeds, but the association does not apply to the instance. The instance is in a private subnet with a VPC endpoint for Systems Manager. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not installed or is not running on the EC2 instance.. The association is created at stack creation, but if the instance does not have the SSM Agent installed and running, the association will not apply. Option A is correct. Option B is wrong because the VPC endpoint is configured. Option C is wrong because the instance profile is not directly related to the association application. Option D is wrong because the Systems Manager automation document is not needed for state manager associations.

Answer

The VPC endpoint for Systems Manager is not in the same subnet as the instance.

Answer

The instance does not have an IAM instance profile that allows Systems Manager actions.

Answer

The association uses an Automation document that requires a different type of instance.

Question 6

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target instances are not passing the health checks. The administrator reviews the CodeDeploy deployment logs and finds that the application installation succeeded but the built-in health check failed. What should the administrator do to resolve this issue?

Accepted Answer

Modify the AppSpec file to include a script in the 'Validate Service' lifecycle event that performs a custom health check.. The Validate Service lifecycle event in the AppSpec file is intended for custom health checks after deployment. Since the built-in health check failed, adding a script in this event allows the administrator to perform a custom health check that may override or supplement the default check. Option A is incorrect because 'healthCheckGracePeriod' is an Auto Scaling group setting, not an AppSpec file parameter. Option B is incorrect because restarting the web server in the AfterInstall event does not address the health check failure; the Validate Service event is specifically for validation. Option C is incorrect because the ApplicationStop event runs before the deployment starts and is not related to post-deployment health checks.

Answer

Modify the AppSpec file to set the 'healthCheckGracePeriod' to a higher value.

Answer

Modify the AppSpec file to include a script in the 'AfterInstall' lifecycle event that restarts the web server.

Answer

Modify the AppSpec file to run a script in the 'ApplicationStop' lifecycle event.

Question 7

A SysOps administrator needs to automate the creation of an Amazon S3 bucket with versioning enabled and default encryption using AWS CloudFormation. Which CloudFormation resource type should the administrator use?

Accepted Answer

AWS::S3::Bucket. AWS::S3::Bucket is the correct resource type for creating an S3 bucket. It supports properties to enable versioning and configure default encryption. Option B (AWS::S3::BucketPolicy) is used to attach a policy to an existing bucket, not to create a bucket. Option C (AWS::KMS::Key) creates a KMS key, not an S3 bucket. Option D (AWS::S3::BucketVersioning) is not a valid AWS CloudFormation resource type; versioning is configured as a property within AWS::S3::Bucket.

Answer

AWS::S3::BucketPolicy

Answer

AWS::KMS::Key

Answer

AWS::S3::BucketVersioning

Question 8

A company uses AWS OpsWorks for Chef Automate to manage its EC2 instances. The administrator needs to deploy a new cookbook to all instances in a stack. The cookbook is stored in an S3 bucket. What is the MOST efficient way to deploy the cookbook to the instances?

Accepted Answer

Configure the OpsWorks stack to use the S3 bucket as the custom cookbook source and run the 'Update Custom Cookbooks' stack command.. The most efficient way to deploy a cookbook stored in an S3 bucket to all instances in an AWS OpsWorks for Chef Automate stack is to configure the stack to use the S3 bucket as the custom cookbook source and then run the 'Update Custom Cookbooks' stack command. This approach automates the distribution across all instances without manual intervention. Option A is incorrect because Chef Server is not used in OpsWorks Chef Automate; it uses the Chef Automate server, and uploading to a Chef Server is not applicable. Option B is wrong because manually SSHing into each instance is inefficient and not scalable. Option D is wrong because while a lifecycle event could be configured, it is less direct and efficient than using the built-in custom cookbook source feature, which is specifically designed for this purpose.

Answer

Upload the cookbook to the Chef Server and have the instances pull from there.

Answer

SSH into each instance and manually download the cookbook from S3.

Answer

Configure a lifecycle event in the OpsWorks layer to run a script that downloads the cookbook from S3.

Question 9

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The administrator wants to ensure that the DB instance is not deleted when the stack is deleted. Which property should the administrator set in the CloudFormation template?

Accepted Answer

DeletionPolicy: Retain. The DeletionPolicy attribute with value 'Retain' ensures the resource is retained when the stack is deleted. Therefore, option D is correct. Option A (DeletionPolicy: Delete) is the default behavior and would delete the DB instance. Option B (DeletionPolicy: Snapshot) creates a final snapshot before deletion, but still deletes the instance. Option C (DeletionPolicy: Replace) is not a valid DeletionPolicy; the valid values are Delete, Retain, and Snapshot.

Answer

DeletionPolicy: Delete

Answer

DeletionPolicy: Snapshot

Answer

DeletionPolicy: Replace

Question 10

A company uses AWS Elastic Beanstalk to deploy a Python web application. The administrator needs to update the environment's configuration to use a larger instance type. What is the correct way to perform this update with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to change the instance type and select a rolling update policy.. Elastic Beanstalk supports rolling updates, which allow you to change the instance type without downtime by updating instances in batches. Option B is incorrect because creating a new environment and swapping URLs is more complex and can still cause disruption. Option C is incorrect because applying the change immediately without a rolling update policy would cause downtime. Option D is incorrect because terminating all instances would cause downtime.

Answer

Create a new Elastic Beanstalk environment with the larger instance type and swap the environment URLs.

Answer

Use the Elastic Beanstalk console to change the instance type and apply the change immediately.

Answer

Terminate all instances and launch new ones with the larger instance type.

Question 11

A SysOps administrator is deploying a critical application using AWS CloudFormation. The stack must be updated frequently. Which TWO strategies should the administrator use to minimize the risk of update failures? (Choose TWO.)

Accepted Answer

Use change sets to review the impact of changes before applying them.. Use change sets to review the impact of changes before applying them, and use a stack policy to protect critical resources from accidental updates. These are two key strategies to minimize update failures. Change sets allow you to preview how proposed changes will affect your stack resources before execution, reducing the risk of unintended modifications. Stack policies define what resource updates are allowed, protecting critical resources during stack updates. Disabling rollback on failure (B) is risky because it leaves the stack in a failed state, which can cause operational issues. The AWS CLI (C) does not inherently reduce risk; updates can be performed safely via console or CLI. Manual approval for each resource (D) is not a feature of CloudFormation; such granular control is impractical and not supported.

Answer

Disable rollback on failure to avoid stack deletion.

Answer

Always use the AWS CLI to perform updates instead of the console.

Answer

Manually approve each resource update through the console.

Question 12

A company deploys microservices on Amazon ECS using Fargate. The deployment is managed by AWS CodePipeline. The administrator notices that deployments sometimes fail because the new task definition is not registered before the deployment. Which THREE steps should the administrator take to resolve this issue? (Choose THREE.)

Accepted Answer

Ensure that the task definition is registered in the CodePipeline build stage before the deploy stage.. The issue is that the task definition must be registered before the ECS service update. Option A is correct because registering the task definition in the build stage ensures it is available for the deploy stage. Option C is correct because the ECS deploy action in CodePipeline automatically handles task definition registration and service update. Option D is correct because adding a CLI or SDK step explicitly registers the task definition. Option B is incorrect because the task definition should be registered automatically, not manually. Option E is incorrect because ECR stores container images, not task definitions.

Answer

Manually update the ECS service with the new task definition after the pipeline runs.

Answer

Store the task definition in Amazon ECR alongside the container image.

Question 13

An administrator is using AWS CloudFormation to create a stack that includes an Auto Scaling group and a launch template. The launch template specifies an AMI ID. Which TWO changes to the launch template will trigger an update to the Auto Scaling group? (Choose TWO.)

Accepted Answer

Changing the instance type.. Changing the AMI ID (option D) or the instance type (option C) in the launch template will trigger an update to the Auto Scaling group because these changes affect the instances that will be launched. The AWS CloudFormation documentation states that updates to these properties cause the Auto Scaling group to update the instances. Modifying security group IDs (A), changing the key pair name (B), or adding a new tag (E) do not trigger an update to the Auto Scaling group itself; they may only affect new instances or require a separate update policy.

Answer

Modifying the security group IDs.

Answer

Changing the key pair name.

Answer

Adding a new tag to the launch template.

Question 14

A SysOps administrator is tasked with automating the deployment of an application across multiple AWS accounts. Which AWS service should be used to orchestrate the deployment across accounts?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets allows you to deploy CloudFormation stacks across multiple accounts and regions in a single operation. Option A (CodeDeploy) is for deploying applications to EC2 or on-premises, not across accounts. Option C (Service Catalog) is for creating and managing a catalog of approved IT services, not for multi-account orchestration. Option D (Systems Manager) is for management and patching, not orchestrated cross-account deployments.

Answer

AWS CodeDeploy

Answer

AWS Service Catalog

Answer

AWS Systems Manager

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The administrator needs to update a stack that includes an Amazon RDS DB instance. The update requires replacing the DB instance with a new one. What is the most efficient way to achieve this with minimal downtime?

Accepted Answer

Use CloudFormation's UpdateReplace policy by modifying a property that requires replacement, such as DBInstanceClass, and take a snapshot before update.. By modifying a property that requires replacement (e.g., DBInstanceClass), CloudFormation will create a new DB instance while retaining the old one until the new one is fully operational. Taking a snapshot before the update ensures data is backed up. This approach minimizes downtime because the old instance remains available until the new instance is ready. Option A is incorrect because simply changing the DB instance identifier does not trigger replacement; it attempts to rename the instance, which is not supported for an existing RDS instance. Option B is incorrect because using a custom resource adds unnecessary complexity and does not leverage CloudFormation's native replacement capabilities. Option C is incorrect because deleting and recreating the stack would cause complete downtime during the entire process, which is not efficient.

Answer

Modify the stack template to change the DB instance identifier and update the stack.

Answer

Use a custom resource to create a new DB instance and delete the old one.

Answer

Delete the stack and create a new one with the updated DB instance.