SOA-C02 Deployment, Provisioning, and Automation Practice Test 14 — 15 Questions

Question 1

An administrator uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error: "The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems." The deployment group has a minimum of 2 instances. What should the administrator check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deployment logs on the individual EC2 instances.. The error message indicates that too many individual instances failed deployment. The first step is to check the deployment logs on the individual EC2 instances to identify the specific failure reason, such as script errors, missing dependencies, or permissions issues. This provides the most direct insight into why instances are failing.

Answer

The application revision's compatibility with the instance operating system.

Answer

The Auto Scaling group's health check settings.

Answer

The deployment group's deployment configuration settings.

Question 2

A company uses AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket. The stack creation fails because the S3 bucket name already exists. What should the administrator do to resolve this issue?

Accepted Answer

Change the S3 bucket name in the CloudFormation template to a unique name.. S3 bucket names are globally unique across all AWS accounts and regions, so CloudFormation cannot create a bucket whose name is already taken by another account. The correct fix is to change the BucketName property in the template to a name that is not in use, then re-run the stack. This resolves the naming collision without touching resources owned by other accounts.

Answer

Add a tag to the existing bucket to make it available for the stack.

Answer

Delete the existing S3 bucket and recreate the stack.

Answer

Update the bucket policy to allow the stack to use the bucket.

Question 3

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a deployment stage that uses AWS CloudFormation to deploy infrastructure. The company wants to add a manual approval step before the CloudFormation deployment. How should this be configured?

Accepted Answer

Add a manual approval action in the pipeline before the CloudFormation deployment stage.. AWS CodePipeline natively supports a manual approval action that pauses the pipeline until a designated approver reviews and approves or rejects the action. Placing this action in the pipeline immediately before the CloudFormation deployment stage is the correct, built-in way to add a manual gate.

Answer

Add a CloudFormation change set action before the deployment.

Answer

Configure an Amazon SNS topic to send a notification and require a confirmation.

Answer

Use an AWS Lambda function to send an email and wait for a response.

Question 4

A company uses AWS CloudFormation with nested stacks. The parent stack creates a child stack that launches an Auto Scaling group. The child stack fails to create, and the parent stack rolls back. The administrator wants to debug the child stack. What is the most efficient way to view the child stack's events?

Accepted Answer

Navigate to the child stack in the AWS CloudFormation console and view its events.. After a nested stack fails, it remains in a FAILED state and is visible in the AWS CloudFormation console. You can navigate directly to the child stack to view its events and identify the cause of failure. Option B is incorrect because rerunning the parent stack with a different name would create a new child stack, not help debug the original failed child stack. Option C is incorrect because CloudWatch Logs are not automatically enabled for CloudFormation stacks; you would need to configure logging. Option D is incorrect because the parent stack's events only show aggregated status or a failure message for the child stack, not the detailed events inside the child stack.

Answer

Rerun the parent stack with a different name to see the child stack creation.

Answer

Check the CloudWatch Logs for the parent stack.

Answer

View the parent stack's events in the AWS Management Console.

Question 5

A company uses AWS Systems Manager to automate patching of EC2 instances. The instances are in an Auto Scaling group. The company wants to ensure that patching does not affect application availability. Which feature should be used?

Accepted Answer

Maintenance Windows. Systems Manager Maintenance Windows allow scheduling patching during specific time windows, and can be configured to work with Auto Scaling to maintain availability by ensuring instances are patched without affecting the overall application availability. Option A is wrong because State Manager is used for maintaining consistent configuration of instances, not for scheduling patching. Option C is wrong because Patch Manager is the service that applies patches, but it is typically run within a Maintenance Window to control timing and availability. Option D is wrong because Run Command is for executing ad-hoc commands and scripts, not for scheduled patching with availability considerations.

Answer

State Manager

Answer

Patch Manager

Answer

Run Command

Question 6

A company needs to deploy a new version of an application to an Auto Scaling group. The deployment must ensure that the new version is deployed to all instances, and if any instance fails, the deployment should roll back. Which deployment strategy should be used?

Accepted Answer

Rolling deployment with rollback. A rolling deployment with rollback is the correct choice because it updates instances incrementally, replacing the old version with the new one across the Auto Scaling group while monitoring for failures. If any instance fails to become healthy (e.g., failing an ELB health check), the deployment automatically rolls back to the previous version, ensuring no partial or failed deployment persists. This strategy balances safety and speed, directly meeting the requirement to deploy to all instances with automatic rollback on failure.

Answer

Blue/green deployment

Answer

All-at-once deployment

Answer

Canary deployment

Question 7

A company is using AWS CloudFormation to manage infrastructure. They have a stack that creates an EC2 instance and an Elastic IP. The instance is in a VPC with an internet gateway. The stack creation succeeds, but the instance does not have internet connectivity. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route to the internet gateway.. For an EC2 instance in a VPC to reach the internet, three things are required: a public IP (or Elastic IP), an internet gateway attached to the VPC, and a route in the subnet's route table pointing 0.0.0.0/0 to that IGW. The question states the instance has an Elastic IP and the VPC has an IGW, so the missing piece is the route table entry. Without a 0.0.0.0/0 route to igw-xxxx, traffic from the instance has no path off the subnet regardless of the EIP.

Answer

The instance does not have a public IP address.

Answer

The instance is in a private subnet.

Answer

The security group does not allow outbound traffic.

Question 8

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with Multi-AZ enabled. During a stack update, the database engine version is changed. The update fails with a rollback. What is the most likely cause?

Accepted Answer

The engine version upgrade is not supported for Multi-AZ deployments.. Changing the database engine version on a Multi-AZ RDS instance is not supported directly through a CloudFormation stack update without additional steps. Multi-AZ deployments require both primary and standby instances to be upgraded, and if the new engine version is not compatible or the upgrade path is not supported, the update fails and triggers a rollback. Option B is incorrect because instance class availability is not the primary issue; the error relates to the engine version change, not the instance class. Option C is incorrect because storage type compatibility is not the relevant factor; the storage type remains unchanged. Option D is incorrect because the DB subnet group is not involved in engine version upgrades, and IP address availability is not a typical cause for this failure.

Answer

The DB instance class is not available for the new engine version.

Answer

The storage type is not compatible with the new engine version.

Answer

The DB subnet group does not have enough IP addresses.

Question 9

A company uses AWS CodeBuild to compile code and run unit tests. The build environment requires a specific version of Java that is not available in the default build images. What should the administrator do?

Accepted Answer

Create a custom build image with the required Java version and push it to Amazon ECR.. CodeBuild allows you to specify a custom Docker image for the build environment, which can include any required software such as a specific Java version. By creating a custom image, installing the needed Java version, and pushing it to Amazon ECR, the administrator ensures the build environment meets the exact requirements. This approach is flexible and repeatable, and CodeBuild natively supports pulling images from ECR.

Answer

Request AWS Support to add the Java version to the default build image.

Answer

Use an AWS Lambda function to set up the build environment before CodeBuild runs.

Answer

Install the required Java version in the buildspec file using a command.

Question 10

A company is using AWS CodeDeploy to deploy an application to an EC2 instances in an Auto Scaling group. The deployment fails because the instances are not reporting to CodeDeploy. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed on the instances.. The most likely cause is that the CodeDeploy agent is not installed on the instances. The agent is required to communicate with the CodeDeploy service and execute deployments. Option A is incorrect because the security group needs to allow outbound traffic from the instances to CodeDeploy, not inbound. Option B is incorrect because the IAM role is necessary for the instances to access CodeDeploy, but the immediate issue of not reporting is the agent. Option C is incorrect because the application not running is a symptom, not the cause of the reporting failure.

Answer

The security group does not allow inbound traffic from CodeDeploy.

Answer

The instances do not have the correct IAM role to allow CodeDeploy to access them.

Answer

The application is not running on the instances.

Question 11

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with automated backups enabled. The stack is deleted and then recreated. The administrator wants to restore data from the backup of the original DB instance. How can this be achieved?

Accepted Answer

Data cannot be restored because automated backups are deleted when the DB instance is deleted.. When an RDS DB instance is deleted, its automated backups are deleted along with it — they are tied to the instance's lifecycle and are not retained independently. Because the CloudFormation stack deletion removed the original DB instance, the automated backups no longer exist, so there is nothing to restore from. Unless a manual snapshot was taken beforehand, the data is unrecoverable.

Answer

Restore from the latest automated backup stored in S3.

Answer

Restore from the automated backup snapshot that is retained after deletion.

Answer

Use the RDS recycle bin to recover the deleted DB instance.

Question 12

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls code from an Amazon S3 bucket. The company wants to automatically trigger the pipeline when a new object is uploaded to the S3 bucket. How should this be configured?

Accepted Answer

Configure a CloudWatch Events rule that matches S3 object creation events and triggers the pipeline.. Configuring a CloudWatch Events (now Amazon EventBridge) rule that matches S3 object creation events and triggers the pipeline is the correct approach. EventBridge can directly target CodePipeline as a target, enabling automatic pipeline execution when a new object is uploaded to the S3 bucket. This is the native, serverless integration for event-driven pipelines.

Answer

Use an AWS Lambda function to poll the S3 bucket and start the pipeline.

Answer

Configure the S3 bucket to send events to an Amazon SNS topic that triggers the pipeline.

Answer

Configure the S3 bucket to send events to an Amazon SQS queue that triggers the pipeline.

Question 13

A company is using AWS CodeDeploy to automate deployments to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The instances are running Amazon Linux 2 and the CodeDeploy agent is installed. Which of the following is the MOST likely cause of this failure?

Accepted Answer

The CodeDeploy agent requires ruby and wget, which are not installed by default on Amazon Linux 2.. The CodeDeploy agent needs the ruby and wget packages to function correctly on Amazon Linux 2. Without them, the agent may fail to download or execute the deployment scripts, causing instance failures. Option B is incorrect because S3 bucket policies do not affect CodeDeploy agent functionality directly; the agent uses HTTPS to download revision files. Option C is incorrect because the deployment configuration controls how many instances can fail, but does not cause individual instance failures. Option D is incorrect because the deployment group can be configured with any number of instances; the error is not due to group size but individual instance failures.

Answer

The S3 bucket containing the deployment artifacts has a bucket policy that denies access to the instances.

Answer

The deployment configuration is set to 'OneAtATime', causing insufficient healthy instances during the first deployment.

Answer

The Auto Scaling group has a minimum of 0 instances, so the deployment cannot start.

Question 14

A DevOps engineer is designing a CI/CD pipeline for a microservices application hosted on Amazon ECS with Fargate. The team wants to deploy updates to the services without downtime. The current pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service using AWS CodeDeploy with a blue/green deployment. However, during the deployment, the new tasks fail to start due to an incorrect environment variable. The engineer wants to validate the task definition before the actual deployment. What should the engineer do?

Accepted Answer

Configure CodeDeploy to use a validation hook with an AWS Lambda function that tests the new task definition before shifting traffic.. AWS CodeDeploy for ECS supports lifecycle event hooks, including a BeforeAllowTraffic hook that runs an AWS Lambda function before traffic is shifted to the replacement task set. The Lambda can inspect the new task definition, verify environment variables, and fail the deployment if validation fails, preventing the bad configuration from ever receiving production traffic. This directly addresses the requirement to validate the task definition before the actual deployment.

Answer

Use Amazon CloudWatch Synthetics canaries to monitor the health of the new tasks after deployment.

Answer

Run the Docker container locally using 'docker run' with the same environment variables to verify the configuration.

Answer

Use Amazon ECS Service Auto Scaling to gradually increase the number of tasks and monitor CPU utilization.

Question 15

An organization is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS DB instance. The update requires changing the DB instance class. However, the administrator wants to minimize downtime. What should the administrator do?

Accepted Answer

Enable Multi-AZ on the DB instance (if not already enabled) before performing the stack update.. Enabling Multi-AZ allows the RDS instance to have a standby in a different Availability Zone. When updating the DB instance class, CloudFormation can modify the standby first, then fail over to it, minimizing downtime. Options A, C, and D are incorrect: A (DeletionPolicy) controls resource retention on stack deletion, not updates; C (ApplyImmediately) may cause a brief outage; D (read replica promotion) is for scaling reads, not for minimizing downtime during instance class changes.

Answer

Use CloudFormation's 'DeletionPolicy' attribute to retain the database during updates.

Answer

Update the stack directly with 'ApplyImmediately' set to true.

Answer

Create a read replica, promote it, and then delete the original DB instance.