SOA-C02 Deployment, Provisioning, and Automation Practice Test 14 — 15 Questions

Question 1

A SysOps administrator sees the deployment failure shown in the exhibit. The deployment group has a minimum of 1 healthy instance. The Auto Scaling group has 2 instances. What is the most likely cause of the failure?

Accepted Answer

The deployment configuration only deploys to one instance at a time, and that instance failed.. With CodeDeployDefault.OneAtATime, only one instance is deployed at a time. If that instance fails, the deployment fails because there are no other instances to deploy (the other instance is not deployed yet). Option A is correct. Option B is wrong because the deployment configuration is correct. Option C is wrong because the health check grace period is not relevant. Option D is wrong because the deployment group has 2 instances, which is enough.

Answer

The Auto Scaling group's health check grace period is too long.

Answer

The deployment group does not have enough instances.

Answer

The deployment configuration is set to deploy to all instances at once.

Question 2

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The deployment uses AWS CodeDeploy with an in-place update. During a deployment, the new application version fails health checks, and CodeDeploy automatically rolls back. However, the rollback also fails. What is the MOST likely cause?

Accepted Answer

The health check path specified in the AppSpec file is not valid for the previous application version.. Option D is correct because if the health check configuration in the CodeDeploy AppSpec file points to a path that is not valid in the previous version, the rollback will also fail health checks. Option A is incorrect because insufficient capacity would cause a different error. Option B is incorrect because CodeDeploy does not use Elastic Beanstalk. Option C is incorrect because the issue is with health checks, not with the agent.

Answer

The Auto Scaling group's minimum size is too low for a rollback.

Answer

The load balancer is configured with an incorrect target group for the Elastic Beanstalk environment.

Answer

The CodeDeploy agent on the EC2 instances is not running the latest version.

Question 3

A DevOps engineer needs to automate the creation of an Amazon RDS for MySQL DB instance in a VPC. The solution must use infrastructure as code. Which AWS service should be used to provision the database?

Accepted Answer

AWS CloudFormation. Option B is correct because AWS CloudFormation can define and provision AWS infrastructure, including RDS instances, as code. Option A is incorrect because AWS OpsWorks uses Chef/Puppet but is not the primary choice for simple RDS provisioning. Option C is incorrect because AWS Elastic Beanstalk is a PaaS service that manages application deployment, not infrastructure provisioning directly. Option D is incorrect because EC2 Auto Scaling manages EC2 instances, not RDS.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

EC2 Auto Scaling

Question 4

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CloudFormation). The deploy stage uses a change set. Recently, the deploy stage fails with the error 'No updates are to be performed.' What is the MOST likely cause?

Accepted Answer

The source code in the S3 bucket has not changed since the last successful deployment.. Option A is correct because if the source code hasn't changed, CloudFormation detects no changes and reports 'No updates are to be performed.' Option B is incorrect because IAM permissions would cause access denied errors. Option C is incorrect because stack deletion would cause a different error. Option D is incorrect because the change set name is not relevant to this error.

Answer

The AWS CloudFormation stack was manually deleted outside of the pipeline.

Answer

The IAM role for the pipeline does not have sufficient permissions to update the stack.

Answer

The change set name specified in the pipeline configuration is incorrect.

Question 5

An organization needs to enforce that all Amazon EC2 instances launched in a specific AWS account are created from a baseline Amazon Machine Image (AMI) that includes required security patches. The AMI ID is ami-0abcdef1234567890. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use an IAM policy that denies the ec2:RunInstances action unless the AMI ID matches the approved one.. Option C is correct because using an IAM policy with a condition that denies launching instances unless the specified AMI ID is used is the most efficient way to enforce the requirement. Option A is incorrect because CloudTrail logs after the fact and does not prevent launches. Option B is incorrect because Config rules can detect non-compliance but do not block the action. Option D is incorrect because Lambda would need to be triggered and could delay the launch.

Answer

Use an AWS Config rule to mark non-compliant instances and automatically terminate them.

Answer

Use an AWS Lambda function that is triggered by EC2 launch events to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor and alert on any instance launched with a different AMI.

Question 6

A company uses AWS Elastic Beanstalk to deploy a web application. The environment needs to be updated with a new application version. The SysOps administrator wants to minimize downtime during the deployment. Which deployment policy should be used?

Accepted Answer

Rolling with an additional batch. Option D is correct because a rolling update with an additional batch creates new instances before terminating old ones, minimizing downtime. Option A is incorrect because all-at-once causes downtime. Option B is incorrect because immutable deployments create a full new set of instances, which can be costly but also minimizes downtime, but rolling with additional batch is more cost-effective. Option C is incorrect because rolling update based on health does not add extra instances, so there is a brief period with reduced capacity.

Answer

Rolling based on health

Answer

Immutable

Answer

All at once

Question 7

A SysOps administrator is troubleshooting a failed AWS CodeBuild build. The build project uses an Amazon S3 source. The buildspec.yml file includes commands that require internet access to download dependencies. The build is failing with a timeout error when trying to download from an external repository. The VPC configuration for the build project uses a private subnet with no NAT gateway. What change should be made to resolve the issue?

Accepted Answer

Attach a NAT gateway to the private subnet's route table.. Option B is correct because a NAT gateway or NAT instance is required to allow instances in a private subnet to access the internet. Option A is incorrect because a public subnet would provide internet access directly, but the question implies the build must be in a private subnet. Option C is incorrect because VPC endpoints are for accessing AWS services, not the internet. Option D is incorrect because a proxy is not the standard solution; NAT is.

Answer

Configure an HTTP proxy in the build project.

Answer

Create a VPC endpoint for the external repository.

Answer

Move the build project to a public subnet with an internet gateway.

Question 8

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator needs to update a stack that contains a critical database. The update may require a replacement of the database resource. The administrator wants to review the changes before they are applied. What is the BEST way to achieve this?

Accepted Answer

Use the AWS CloudFormation create-change-set command and then review the changes before executing.. Option C is correct because creating a change set allows you to review all changes, including replacements, before executing them. Option A is incorrect because the '--no-fail-on-empty-changeset' flag does not provide a review. Option B is incorrect because a stack policy can protect resources but does not allow reviewing changes. Option D is incorrect because the drift detection feature detects drift, not planned changes.

Answer

Use the AWS CloudFormation update-stack command with the --no-fail-on-empty-changeset flag.

Answer

Apply a stack policy that prevents replacement of the database resource.

Answer

Use the AWS CloudFormation detect-stack-drift command to check for differences.

Question 9

A company is using AWS OpsWorks for configuration management. They have a stack with multiple layers, and they want to automate the deployment of a custom configuration file to all instances in a specific layer. What is the MOST efficient way to achieve this?

Accepted Answer

Create a custom cookbook and assign it to the layer.. Option B is correct because OpsWorks custom cookbooks allow you to run recipes that can deploy files to instances in a layer. Option A is incorrect because user data scripts run at boot time, not on demand. Option C is incorrect because AWS Systems Manager Run Command can execute commands but is not specific to OpsWorks layers. Option D is incorrect because the AWS::OpsWorks::App resource is for deploying applications, not configuration files.

Answer

Define the file in an AWS CloudFormation template using the AWS::OpsWorks::App resource.

Answer

Use AWS Systems Manager Run Command to execute a script on each instance.

Answer

Add the configuration file as user data in the layer's Auto Scaling group.

Question 10

A company runs a critical application on a fleet of EC2 instances in an Auto Scaling group. The application is deployed using a blue/green deployment strategy with AWS CodeDeploy. The green environment fails immediately after deployment, and the deployment is automatically rolled back. However, the rollback also fails because the original blue environment's Auto Scaling group has been scaled down. What should the SysOps administrator do to prevent this issue in future deployments?

Accepted Answer

Set the original environment termination delay to a longer duration in the CodeDeploy deployment group.. Option D is correct because the blue/green deployment in CodeDeploy allows you to specify how long to keep the original (blue) environment after a successful deployment. Setting this to a sufficient duration ensures the blue environment is available for rollback. Option A is incorrect because it changes the deployment type, not the root cause. Option B is incorrect because increasing the minimum size does not guarantee the blue environment retains instances. Option C is incorrect because it deletes the green environment, which may be needed for rollback.

Answer

Configure the deployment to automatically delete the green environment after rollback.

Answer

Increase the minimum size of the Auto Scaling group.

Answer

Change the deployment type to in-place.

Question 11

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running in a VPC with public and private subnets. The SysOps administrator needs to update the environment to use a new platform version. Which TWO steps should be taken to ensure a smooth update with minimal downtime? (Select TWO.)

Accepted Answer

Take a snapshot of the attached Amazon RDS database before starting the update.. Options B and C are correct. Option B: Performing a blue/green deployment creates a new environment and swaps CNAMEs, minimizing downtime. Option C: Taking a snapshot of the RDS database ensures data backup before the update. Option A: Immutable updates are not supported for all platforms. Option D: Updating the security groups is not necessary for the update. Option E: Manually draining connections is not needed if using blue/green.

Answer

Update the security groups to allow traffic from the new environment.

Answer

Enable immutable updates in the environment configuration.

Answer

Manually drain connections from the current environment before swapping.

Question 12

A company uses AWS CodePipeline with AWS CodeBuild and AWS CodeDeploy. The pipeline is failing because the build stage produces artifacts that are too large for CodeDeploy. Which TWO actions can resolve this issue? (Select TWO.)

Accepted Answer

Use Amazon S3 as the source for CodeDeploy instead of the pipeline artifact.. Options B and D are correct. Option B: Using Amazon S3 as the source for CodeDeploy allows large files to be stored in S3 instead of the artifact. Option D: Compressing the artifact reduces its size. Option A: Increasing the timeout does not help with size. Option C: CodeDeploy has a fixed artifact size limit. Option E: Storing artifacts in CodeCommit does not reduce size.

Answer

Increase the timeout for the CodeBuild stage.

Answer

Store the artifacts in an AWS CodeCommit repository.

Answer

Increase the maximum artifact size limit in CodeDeploy.

Question 13

A company is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The SysOps administrator wants to ensure that the RDS instance is created before the EC2 instance and that the EC2 instance receives the database endpoint as a user data parameter. Which THREE steps should be taken? (Select THREE.)

Accepted Answer

Add a DependsOn attribute to the EC2 instance resource referencing the RDS instance.. Options A, C, and D are correct. Option A: Using DependsOn ensures the RDS instance is created first. Option C: Using Fn::GetAtt retrieves the endpoint. Option D: Using CloudFormation helper scripts (cfn-init) can process the metadata and write user data. Option B: Not necessary because DependsOn is used. Option E: Not necessary because DependsOn ensures order.

Answer

Use the AWS::CloudFormation::Init metadata to set the creation order.

Answer

Add a DependsOn attribute to the RDS instance resource referencing the EC2 instance.

Question 14

A company uses AWS Elastic Beanstalk to deploy a web application. After updating the environment configuration, the deployment fails and the environment health turns red. The SysOps administrator checks the logs and finds a permission error related to the EC2 instance profile. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM instance profile associated with the environment to include the required permissions.. The correct answer is B because Elastic Beanstalk uses an IAM instance profile for the EC2 instances. The instance profile must have the necessary permissions to access resources like S3 buckets or DynamoDB tables. Updating the instance profile with the required permissions resolves the issue. Option A is wrong because updating the application version does not fix permission issues. Option C is wrong because rebuilding the environment from scratch is unnecessary and time-consuming. Option D is wrong because the security group controls network access, not IAM permissions.

Answer

Rebuild the environment from scratch using a saved configuration template.

Answer

Modify the security group attached to the environment to allow outbound traffic.

Answer

Update the application version to the latest build.

Question 15

A SysOps administrator is automating the deployment of a three-tier web application using AWS CloudFormation. The administrator wants to ensure that the database tier is created before the application tier. How should the administrator define this dependency in the CloudFormation template?

Accepted Answer

Use the DependsOn attribute on the application tier resources to reference the database tier resources.. The correct answer is C because CloudFormation supports the DependsOn attribute to specify resource dependencies. The application tier resources must wait for the database tier resources to be created. Option A is wrong because the Outputs section does not control creation order. Option B is wrong because the Parameters section defines input values, not dependencies. Option D is wrong because the Conditions section determines whether resources are created, not the order.

Answer

Use the Conditions section to check if the database exists before creating the application tier.

Answer

Use the Outputs section to export the database endpoint and import it in the application tier.

Answer

Use the Parameters section to pass the database instance identifier to the application stack.