SOA-C02 Deployment, Provisioning, and Automation Practice Test 13 — 15 Questions

Question 1

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The administrator wants to ensure that the code is version-controlled and that changes are reviewed before deployment. Which TWO AWS services should the administrator use together to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudFormation. AWS CloudFormation (B) is correct because it provides infrastructure as code, allowing the administrator to define and provision AWS resources declaratively through templates, which is exactly what is needed for automated provisioning. AWS CodeCommit (C) is correct because it is a fully managed Git-based version control service that stores the CloudFormation templates, enabling version control and supporting pull requests so changes can be reviewed before deployment. Together, CodeCommit holds and reviews the template code while CloudFormation deploys it, satisfying both the version-control and review requirements. AWS Config (A) is incorrect because it is used for assessing, auditing, and evaluating resource configurations for compliance, not for provisioning or version-controlling code. AWS Service Catalog (D) is incorrect because it lets organizations create and manage approved product portfolios for end users, but it does not itself provide version control or code review. AWS OpsWorks Stacks (E) is incorrect because it is a configuration management service using Chef/Puppet for managing application stacks, not a Git-based version control or review service.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS OpsWorks Stacks

Question 2

A company is deploying a microservices application on AWS using Amazon ECS with Fargate launch type. The SysOps administrator needs to automate the deployment process so that when a new Docker image is pushed to Amazon ECR, the ECS service is updated with the new image. Which THREE AWS services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodePipeline. The correct combination to automate deployment when a new Docker image is pushed to Amazon ECR is AWS CodePipeline, Amazon ECR, and Amazon ECS. CodePipeline orchestrates the CI/CD pipeline triggered by an ECR push event. ECR stores the Docker images. ECS with Fargate runs the containers and updates the service with the new image. Option A (CloudFormation) is for infrastructure provisioning, not continuous deployment. Option E (Systems Manager) is for management and operations, not CI/CD.

Answer

AWS CloudFormation

Answer

AWS Systems Manager

Question 3

A SysOps administrator is investigating a failed CloudFormation stack creation. The describe-stack-events output shows that the stack creation failed with the reason 'Resource creation cancelled'. What is the most likely cause of this failure?

Accepted Answer

A WaitCondition resource did not receive the required signal within the specified timeout period.. The WaitCondition timed out before receiving the required signal, causing CloudFormation to cancel the stack creation. Option A is incorrect because a parameter validation error would appear as a different reason. Option B is incorrect because there is no indication of missing IAM permissions. Option D is incorrect because the stack creation was cancelled due to the wait condition timeout, not a nested stack failure.

Answer

The stack template contains an invalid parameter value.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to create the resources.

Answer

A nested stack within the parent stack failed to create.

Question 4

A SysOps administrator is creating a CloudFormation stack that requires an IAM role to be passed to EC2 instances. The administrator is using the IAM policy shown in the exhibit. The stack creation fails with an error indicating insufficient permissions to pass the role. What is the most likely cause?

Accepted Answer

The iam:PassRole permission is restricted to a specific role ARN that does not match the role the administrator is trying to pass.. The IAM policy likely includes an iam:PassRole action restricted to a specific role ARN (e.g., 'arn:aws:iam::account:role/Admin'), but the CloudFormation stack is attempting to pass a different role. This causes an insufficient permissions error because the PassRole permission is scoped to that specific role. Option A is incorrect because cloudformation:* includes all CloudFormation actions, including creating stacks. Option B is incorrect because the policy uses cloudformation:*, which implicitly includes CreateStack. Option C is incorrect because ec2:RunInstances is not required for passing an IAM role; the necessary permission is iam:PassRole.

Answer

The cloudformation:* action does not include permission to create stacks.

Answer

The policy does not include the cloudformation:CreateStack action.

Answer

The ec2:RunInstances permission is missing from the policy.

Question 5

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The administrator wants to ensure that the code is version-controlled and that changes are reviewed before deployment. Which TWO AWS services should the administrator use together to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Secrets Manager to generate a random password and reference it in the CloudFormation template using a dynamic reference (resolve:secretsmanager).. AWS CloudFormation dynamic references with the resolve:secretsmanager syntax retrieve a secret value at stack deployment time directly from AWS Secrets Manager without ever storing it in the template or its parameters. Secrets Manager can generate and rotate the password automatically, and the template only contains a reference such as '{{resolve:secretsmanager:MySecret:SecretString:password}}'. This satisfies the requirement that the password never appears in plaintext in the template.

Answer

Store the password as a CloudFormation parameter with a default value and use the Ref intrinsic function.

Answer

Generate a password manually and store it in a text file in Amazon S3; reference the S3 URL in the template.

Answer

Use AWS Systems Manager Parameter Store (String type) and reference it with the dynamic reference resolve:ssm.

Question 6

A SysOps administrator is troubleshooting a failed AWS Elastic Beanstalk environment update. The update changed the configuration of the EC2 instances in the Auto Scaling group, but the new instances fail to launch. The administrator checks the Auto Scaling group's scaling activities and sees a 'Failed' status with the message: 'Instance failed to reach the desired state.' What should the administrator check next?

Accepted Answer

Check the CloudWatch logs for the failed instance to identify application or configuration errors.. When Elastic Beanstalk instances fail to launch with 'Instance failed to reach the desired state,' the next step is to examine the instance's logs (via CloudWatch Logs or the EB console's logs bundle) to identify configuration or application errors. This message typically indicates the instance launched but failed health checks or initialization, so logs reveal the root cause.

Answer

Check the IAM role attached to the environment's EC2 instances for missing permissions.

Answer

Check the account service quotas for EC2 instances.

Answer

Check the termination protection setting on the Auto Scaling group.

Question 7

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to existing EC2 instances managed by OpsWorks. Which OpsWorks lifecycle event should the administrator trigger to install the new application?

Accepted Answer

Deploy. The 'Deploy' lifecycle event is specifically designed for deploying applications. Option B (Deploy) is correct because it triggers the deploy recipes to install the new application version. Option A (Configure) is incorrect because it runs when instances come online or leave the stack, not for application deployment. Option C (Shutdown) is incorrect because it runs when an instance is terminated. Option D (Setup) is incorrect because it runs only once when the instance is first booted, not for ongoing deployments.

Answer

Configure

Answer

Shutdown

Answer

Setup

Question 8

A SysOps administrator wants to deploy a serverless application using AWS Lambda functions, Amazon API Gateway, and Amazon DynamoDB. The deployment must be automated and repeatable. Which AWS service should the administrator use to define and manage this infrastructure as code?

Accepted Answer

AWS CloudFormation with the AWS Serverless Application Model (SAM). AWS CloudFormation with the AWS Serverless Application Model (SAM) is the correct choice for defining and managing serverless infrastructure as code, as SAM extends CloudFormation with shorthand syntax for Lambda, API Gateway, and DynamoDB. Option A is wrong because AWS CodeDeploy automates code deployment to running instances, not infrastructure provisioning. Option B is wrong because AWS OpsWorks manages Chef/Puppet-based application stacks. Option C is wrong because AWS Elastic Beanstalk is designed for deploying web applications on EC2, not serverless architectures.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 9

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The SysOps administrator checks the deployment logs and finds that the BeforeInstall lifecycle event script is failing on some instances. The instances are Amazon Linux 2. What should the administrator do to troubleshoot this issue?

Accepted Answer

Review the BeforeInstall script's output and exit code in the deployment logs or on the instance.. The error indicates that the BeforeInstall lifecycle script is failing. The correct first step is to examine the script's output and exit code, which can be found in the deployment logs (under the instance's CodeDeploy agent logs) or directly on the instance. This allows you to identify why the script is failing. Option A is not directly relevant because the issue is not agent connectivity but script execution. Option B is incorrect because changing the deployment configuration to 'OneAtATime' would only affect the pace of deployments, not fix a failing script. Option C is unnecessary because the appspec.yml syntax is likely correct if the script runs at all; the problem lies in the script itself.

Answer

Verify that the CodeDeploy agent on the instances is running and can communicate with the CodeDeploy service.

Answer

Ensure that the CodeDeploy deployment configuration is set to 'OneAtATime' to reduce instance failures.

Answer

Check the appspec.yml file for syntax errors in the hooks section.

Question 10

A company has a CloudFormation stack that creates an Amazon EC2 instance with a user data script that installs software from the internet. The stack creation is failing with a timeout. The SysOps administrator suspects that the user data script is taking too long or failing. How can the administrator configure the stack to wait for the user data script to complete successfully before marking the instance as CREATE_COMPLETE?

Accepted Answer

Add a CreationPolicy with a resource signal to the EC2 instance resource and have the user data script send a success signal using cfn-signal.. A CreationPolicy with a resource signal tells CloudFormation to wait for a success signal (via cfn-signal) from the EC2 instance before marking it CREATE_COMPLETE. The user data script calls cfn-signal after the software installation succeeds, ensuring the stack only proceeds when the instance is truly ready.

Answer

Add a DependsOn attribute to the EC2 instance resource to wait for another resource.

Answer

Add an UpdatePolicy with a resource signal to the EC2 instance resource.

Answer

Add a WaitCondition resource and a WaitHandle, and have the user data script send a signal to the WaitHandle.

Question 11

A SysOps administrator needs to deploy a new version of an application that runs on Amazon EC2 instances in an Auto Scaling group. The deployment should minimize downtime and roll back automatically if health checks fail. Which deployment method should the administrator use?

Accepted Answer

Blue/green deployment using a new Auto Scaling group and an Application Load Balancer. A blue/green deployment using a new Auto Scaling group and an Application Load Balancer minimizes downtime by shifting traffic from the old environment to the new one only after health checks pass. If health checks fail, traffic is not shifted, and the old environment remains serving, providing automatic rollback. This is the standard AWS pattern for zero-downtime deployments with rollback.

Answer

Canary deployment

Answer

Rolling update via an Auto Scaling group

Answer

In-place deployment

Question 12

A company wants to automatically start and stop an EC2 instance on a schedule to reduce costs. The instance runs a critical application that must be available from 8 AM to 6 PM weekdays. Which AWS service should be used to implement this scheduling?

Accepted Answer

AWS Instance Scheduler. AWS Instance Scheduler is a purpose-built solution (deployed via CloudFormation) that uses Lambda, DynamoDB, and EventBridge to start and stop EC2 instances and RDS databases on customizable schedules. It supports period-based and schedule-based tagging, making it the correct choice for automatically starting/stopping an instance on a weekday 8 AM–6 PM schedule. The other services can be cobbled together to achieve scheduling, but none is designed specifically for this cost-optimization use case.

Answer

AWS OpsWorks

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation

Question 13

A DevOps engineer is troubleshooting a failed CloudFormation stack update. The stack includes an Auto Scaling group with a launch template. The update changed the AMI ID in the launch template, but the new instances launched with the old AMI. What is the most likely cause?

Accepted Answer

The launch template version is not set to use the latest version.. When a CloudFormation stack references a launch template by ID without pinning a version, the Auto Scaling group uses the template's default version. Updating the AMI in a new launch template version does not change the default version automatically, so the ASG continues launching instances from the old default version. The fix is to either set the new version as default or explicitly reference the version in the ASG's LaunchTemplate specification.

Answer

The Auto Scaling group is not configured to perform a rolling update.

Answer

The new AMI ID is invalid or not available in the region.

Answer

The CloudFormation stack update did not successfully complete.

Question 14

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance. The database is in a VPC with public and private subnets. The DB instance is in a private subnet. When the stack is created, the DB instance is not accessible from an EC2 instance in the same VPC. What is the most likely cause?

Accepted Answer

The security group for the DB instance does not allow inbound traffic from the EC2 instance.. The most likely cause is that the security group attached to the RDS DB instance does not permit inbound traffic from the EC2 instance's security group or IP address on the database port. In a VPC, security groups act as virtual firewalls, and even if the DB is in the same VPC, traffic is blocked unless explicitly allowed. CloudFormation stack creation would succeed, but connectivity would fail.

Answer

The DB subnet group does not include the correct subnets.

Answer

The VPC does not have an internet gateway attached.

Answer

The DB instance does not have a public IP address.

Question 15

A company uses AWS OpsWorks to manage a stack of web servers. They need to deploy a configuration change that updates the /etc/nginx/nginx.conf file on all instances. Which OpsWorks feature should be used?

Accepted Answer

Custom Chef recipes. Custom Chef recipes are the correct choice because OpsWorks uses Chef to manage configuration, and deploying a specific file change like /etc/nginx/nginx.conf requires a custom recipe that directly modifies the file using Chef resources (e.g., template or file resource). This allows precise, idempotent configuration management across all instances in the stack.

Answer

OpsWorks layers

Answer

Lifecycle events

Answer

Custom cookbooks