SOA-C02 Deployment, Provisioning, and Automation Practice Test 15 — 15 Questions

Question 1

An organization is using AWS OpsWorks for Chef Automate to manage configuration of EC2 instances. The administrator notices that a new cookbook version is not being applied to existing instances in a layer. The cookbook is stored in a private Amazon S3 bucket and the instances have an instance profile that allows read access. What is the MOST likely reason for this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Update Cookbooks' stack command needs to be run manually to apply the new cookbook version to existing instances.. In OpsWorks, cookbooks are not automatically applied to existing instances when a new version is published. To force an update on existing instances, the administrator must run the 'Update Cookbooks' stack command. Option A is incorrect because rebooting instances does not automatically download or apply new cookbook versions. Option B is incorrect because the instance profile already has read access to the S3 bucket as stated, so the bucket policy is not the issue. Option D is incorrect because the Chef client runs automatically, but it does not fetch new cookbooks unless told to do so via the Update Cookbooks command.

Answer

The cookbook version is not being automatically downloaded because the instances are not rebooted.

Answer

The S3 bucket policy does not grant the necessary permissions to the instance profile.

Answer

The Chef client on the instances is not configured to run automatically.

Question 2

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

Accepted Answer

The custom AMI does not have a web server installed and configured to serve the application.. Elastic Beanstalk relies on the platform's web server (Apache, Nginx, IIS) to serve the application and respond to the health check endpoint. When you supply a custom AMI, you must ensure it includes the same web server and configuration that the chosen Beanstalk platform expects. If the AMI lacks a running web server on the expected port (e.g., port 80 for the default health check path '/'), the ELB health check will fail and instances will be marked unhealthy.

Answer

The Elastic Beanstalk environment was created before the custom AMI was registered.

Answer

The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.

Answer

The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.

Question 3

An organization uses AWS Service Catalog to manage approved IT services. A SysOps administrator needs to update a CloudFormation template used by a product. The administrator wants to ensure that existing provisioned products are updated with the new template version. What step must the administrator take after updating the product?

Accepted Answer

Create a new product version and update the provisioned products to use the new version.. After updating a CloudFormation template used by an AWS Service Catalog product, the administrator must create a new product version and then update the existing provisioned products to use that new version. Service Catalog versions are immutable — you cannot edit an existing version in place. Existing provisioned products continue using the version they were launched with until explicitly updated, so the administrator must both publish the new version and perform the update on each provisioned product.

Answer

Update the portfolio that contains the product.

Answer

Update the product's CloudFormation template directly in the Service Catalog console.

Answer

Terminate the existing provisioned products and reprovision them.

Question 4

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

Accepted Answer

Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.. AWS CodePipeline provides a 'Release change' button in the console that manually triggers the pipeline to run from the source stage using the latest commit. This allows the developer to rerun the pipeline without making a new commit. The pipeline will fetch the latest source revision and proceed through the stages.

Answer

Create a new commit with an empty message to trigger the pipeline.

Answer

Wait for the pipeline to automatically retry after the failure.

Answer

Re-upload the same artifact to the source S3 bucket to trigger the pipeline.

Question 5

An organization uses AWS CloudFormation to manage its infrastructure. The SysOps administrator is implementing a change management process that requires all stack updates to be reviewed and approved before execution. The administrator wants to use CloudFormation change sets to preview changes. Which THREE steps are necessary to implement this process? (Choose THREE.)

Accepted Answer

Review the change set in the CloudFormation console.. To implement a review-and-approval process using CloudFormation change sets, the necessary steps are: create a change set from the updated template (E), review the change set in the CloudFormation console (C), and execute the change set after approval (D). Option A is incorrect because the 'Detect Drift' feature is used to check if the actual stack resources have drifted from the template, not to preview changes. Option B is incorrect because updating the stack directly bypasses the review process, which defeats the purpose of change management.

Answer

Use the 'Detect Drift' feature to compare the stack with the new template.

Answer

Update the stack directly using the updated template.

Question 6

A SysOps administrator is tasked with automating the provisioning of EC2 instances that must be able to access an Amazon S3 bucket. The administrator needs to ensure that the instances have the necessary permissions without using long-term access keys. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Attach the IAM role to the EC2 instances using an instance profile.. Option D is correct because an IAM role is the identity that carries the S3 permission policy, and it is the prerequisite for granting temporary credentials to EC2. Option B is correct because the role must be delivered to the instances through an instance profile, which lets the EC2 instance metadata service (IMDS) vend rotating temporary credentials via AWS STS, satisfying the no-long-term-keys requirement. Option A is wrong because storing AWS access keys in a configuration file uses long-term credentials, which the scenario explicitly forbids. Option C is wrong because an S3 bucket policy cannot meaningfully grant access based on an instance's private IP address, which is not a valid principal identifier for EC2. Option E is wrong because Systems Manager Parameter Store is a secrets storage mechanism, not an automatic credential provider, so instances would still need long-term keys to retrieve the values.

Answer

Store AWS access keys in a configuration file on the instances.

Answer

Create an S3 bucket policy that allows access from the instances' private IP addresses.

Answer

Store the access keys in AWS Systems Manager Parameter Store.

Question 7

A SysOps administrator needs to deploy a web application across multiple AWS Regions for disaster recovery. The application uses Amazon RDS for MySQL and requires a secondary database in a different Region. What is the MOST cost-effective and automated solution to keep the databases synchronized?

Accepted Answer

Create a cross-Region read replica of the primary RDS instance in the secondary Region. A cross-Region read replica of the primary RDS instance is the most cost-effective and automated solution because RDS natively replicates data asynchronously to the replica in another Region with minimal configuration. It requires no additional replication infrastructure or ongoing management, and it can be promoted to a standalone database during disaster recovery. This meets the requirement for automated, cost-effective cross-Region synchronization.

Answer

Use AWS Database Migration Service (DMS) with ongoing replication

Answer

Set up a cron job on an EC2 instance to export the database and import it into the secondary Region

Answer

Enable Multi-AZ on the primary RDS instance and configure a read replica in the secondary Region

Question 8

A company is using AWS CloudFormation to manage infrastructure. A recent stack update failed, and the SysOps administrator needs to roll back to the previous known good state. However, the stack is in UPDATE_ROLLBACK_FAILED state. What should the administrator do to recover the stack?

Accepted Answer

Use the ContinueUpdateRollback API or AWS Management Console to resume the rollback after addressing the failure cause. When a CloudFormation stack enters UPDATE_ROLLBACK_FAILED, the rollback could not complete because a resource could not be returned to its previous state. The administrator must first fix the underlying resource issue (e.g., a deleted resource, a permission problem, or a resource that cannot be reverted), then invoke ContinueUpdateRollback via the console, CLI, or API to resume the rollback from where it stopped. This preserves the stack and its resources rather than destroying them.

Answer

Delete the stack and recreate it from the previous template

Answer

Contact AWS Support to enable automatic rollback recovery

Answer

Execute another stack update with the same parameters to overwrite the failed state

Question 9

A SysOps administrator is automating the creation of Amazon RDS instances using AWS CloudFormation. The template includes a DBInstance resource with a DBSubnetGroupName property referencing a subnet group created in the same template. The stack creation fails with the error 'DBSubnetGroup not found'. What is the MOST likely reason?

Accepted Answer

A DependsOn clause is missing between the DBInstance and the DBSubnetGroup.. In AWS CloudFormation, resource creation order is not guaranteed unless explicitly defined. When a DBInstance resource references a DBSubnetGroup by name, CloudFormation may attempt to create the DBInstance before the DBSubnetGroup is fully created, resulting in a 'DBSubnetGroup not found' error. Adding a DependsOn clause to the DBInstance resource ensures the DBSubnetGroup is created first, resolving the dependency.

Answer

The VPC ID is incorrect or does not exist.

Answer

The DBSubnetGroup is not associated with a public subnet.

Answer

The DBSubnetGroup is defined in a different CloudFormation stack.

Question 10

A SysOps administrator is tasked with automating the creation of IAM roles and policies using AWS CloudFormation. The template includes an IAM role and a managed policy. The stack creation fails with the error 'Policy arn:aws:iam::123456789012:policy/MyManagedPolicy not found'. The policy is created in the same template. What is the MOST likely solution?

Accepted Answer

Add a 'DependsOn' clause to the IAM role resource for the managed policy, and reference the policy ARN using the 'Ref' intrinsic function.. The error occurs because CloudFormation attempts to create the IAM role before the managed policy is fully created, even though both are defined in the same template. Adding a 'DependsOn' clause to the IAM role resource ensures that CloudFormation waits for the managed policy to be created first. Using the 'Ref' intrinsic function to reference the policy ARN is correct because 'Ref' for an AWS::IAM::ManagedPolicy returns the policy ARN, which is needed for the role's 'ManagedPolicyArns' property.

Answer

Remove the policy document from the template and create the policy separately.

Answer

Use a custom resource to create the policy before the role.

Answer

Create the IAM role in a separate stack.

Question 11

A company uses AWS CodeDeploy to automate deployments to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero exit code.. The error message indicates that the deployment failed because too many instances failed, and the logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. In AWS CodeDeploy, each lifecycle event script must exit with a zero exit code to indicate success; any non-zero exit code is treated as a failure, causing the deployment to fail on that instance. Since the logs explicitly point to the BeforeInstall script's non-zero exit, the most likely cause is a bug in that script.

Answer

The instance does not have the required permissions to download the application revision.

Answer

The instance is not healthy according to the Elastic Load Balancer health checks.

Answer

The CodeDeploy agent is not running on the instance.

Question 12

A SysOps administrator uses AWS Systems Manager Run Command to install software on a fleet of EC2 instances. The command fails on some instances with the error 'Instance ID not found'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not installed or configured on the instances, or the instances lack the required IAM role.. The error 'Instance ID not found' indicates that Systems Manager Run Command cannot communicate with the SSM Agent on the target instances. This typically occurs when the SSM Agent is not installed, is not running, or the instance does not have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) for Systems Manager to manage it. Without a valid agent and IAM role, the instance is not registered with Systems Manager, so Run Command cannot find its Instance ID.

Answer

The user data script has overridden the SSM Agent.

Answer

The instances are not tagged with the correct key-value pair.

Answer

The instances are in a stopped state.

Question 13

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an AWS::RDS::DBInstance resource. The administrator wants to ensure that the database is not deleted when the stack is deleted. Which CloudFormation resource property should be set?

Accepted Answer

Set the 'DeletionPolicy' attribute to 'Retain' on the DBInstance resource.. The 'DeletionPolicy' attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. Setting 'DeletionPolicy' to 'Retain' on the AWS::RDS::DBInstance resource ensures the database is preserved and not deleted when the stack is deleted. This is the standard mechanism for preventing accidental deletion of critical resources during stack teardown.

Answer

Set the 'DeletionPolicy' attribute to 'Snapshot' on the DBInstance.

Answer

Set the 'RetainOnDeletion' property to 'true' on the DBInstance.

Answer

Set the 'DeletionProtection' property to 'true' on the DBInstance.

Question 14

A SysOps administrator is automating the creation of an Amazon ECS cluster with Fargate launch type using AWS CloudFormation. The template must define the task definition, service, and cluster. Which THREE resources are required to be in the template? (Choose THREE.)

Accepted Answer

AWS::ECS::TaskDefinition. For an Amazon ECS cluster using the Fargate launch type, the AWS CloudFormation template must define the cluster itself (AWS::ECS::Cluster), the task definition (AWS::ECS::TaskDefinition) that specifies the container image, CPU, memory, and networking configuration, and the service (AWS::ECS::Service) that maintains the desired count of tasks and optionally integrates with a load balancer. These three resources are the minimum required to create and run a Fargate-based ECS workload.

Answer

AWS::EC2::VPC

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Question 15

A SysOps administrator is creating an IAM policy for automation. The policy is attached to an IAM role used by an automated deployment script. The script needs to launch EC2 instances of type t2.micro and describe all EC2 resources. However, the script fails when trying to launch instances. What is the MOST likely reason?

Accepted Answer

The policy does not grant permissions for additional resources required by RunInstances, such as images, network interfaces, and security groups.. The RunInstances API action requires permissions for not only the EC2 instance resource itself but also for dependent resources such as Amazon Machine Images (AMI), network interfaces, security groups, and key pairs. If the IAM policy only grants ec2:RunInstances on the instance resource ARN but omits these supporting resources, the launch will fail with an 'unauthorized operation' error. Option C correctly identifies this missing dependency.

Answer

The Resource ARN for the instance is incorrect.

Answer

The policy does not include the 'ec2:DescribeInstances' action.

Answer

The Condition key 'ec2:InstanceType' is misspelled.