SOA-C02 Deployment, Provisioning, and Automation Practice Test 15 — 15 Questions

Question 1

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances in the Auto Scaling group are not registered with the target group of an Application Load Balancer. The SysOps administrator needs to ensure that new instances launched by the Auto Scaling group are automatically registered with the target group. What should the administrator do?

Accepted Answer

Attach the target group to the Auto Scaling group.. The correct answer is B because when an Auto Scaling group is attached to a target group, the Auto Scaling group automatically registers new instances with the target group. This ensures that CodeDeploy can deploy to registered instances. Option A is wrong because instance metadata does not affect registration. Option C is wrong because lifecycle hooks do not perform registration automatically. Option D is wrong because Amazon Inspector is a security assessment tool, not related to target group registration.

Answer

Use Amazon Inspector to automatically register instances with the target group.

Answer

Create a lifecycle hook in the Auto Scaling group to register instances with the target group.

Answer

Configure the Auto Scaling group to launch instances with a user data script that registers the instance with the target group.

Question 2

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to a stack. What is the recommended way to update the application on the instances?

Accepted Answer

Update the custom cookbook and run the 'deploy' recipe on the stack.. The correct answer is D because OpsWorks uses recipes and custom cookbooks to manage application deployment. By updating the custom cookbook and running the appropriate recipe, the administrator can deploy the new version. Option A is wrong because the built-in deploy command may not support custom application logic. Option B is wrong because SSH access is not recommended for automation. Option C is wrong because CloudFormation is a separate service; OpsWorks has its own deployment mechanism.

Answer

Create a new CloudFormation stack to replace the OpsWorks stack.

Answer

Use the OpsWorks built-in 'deploy' command on each instance.

Answer

SSH into each instance and manually update the application files.

Question 3

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The error message indicates that a resource failed to create due to insufficient IAM permissions. The administrator used a service role for CloudFormation. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM policy attached to the CloudFormation service role to include the necessary permissions.. The correct answer is B because CloudFormation service roles allow the stack to assume a role that grants necessary permissions. The administrator must ensure the service role's policy includes the required actions for the resource. Option A is wrong because the administrator's own permissions are not used when a service role is specified. Option C is wrong because resource policies are for access to the resource, not for CloudFormation actions. Option D is wrong because the account's IAM limits are not likely the issue.

Answer

Add the required permissions to the administrator's IAM user.

Answer

Request a limit increase for IAM roles in the AWS account.

Answer

Modify the resource's IAM policy to allow CloudFormation to create it.

Question 4

A company uses AWS CodePipeline with AWS CodeBuild to build and deploy a static website to an S3 bucket. The website is served via Amazon CloudFront. The deployment fails intermittently because the S3 bucket policy does not allow CloudFront access after the bucket is updated. What is the BEST way to automate the bucket policy update during the deployment?

Accepted Answer

Use AWS CloudFormation to manage the S3 bucket and its policy, and update the stack as part of the pipeline.. The correct answer is D because AWS CloudFormation can manage the S3 bucket and its policy as part of the infrastructure. Using CloudFormation, the bucket policy can be updated automatically when the stack is updated. Option A is wrong because manually adding statements is error-prone and not automated. Option B is wrong because updating the bucket policy in the buildspec may work but is less robust than using CloudFormation. Option C is wrong because CloudFront origin access identity (OAI) can be configured in the bucket policy, but the policy must be updated accordingly; CloudFormation handles this automatically.

Answer

Include an AWS CLI command in the buildspec to update the bucket policy after the build.

Answer

Add a bucket policy statement in the S3 management console to grant CloudFront access.

Answer

Use a CloudFront origin access identity (OAI) and configure it in the bucket policy.

Question 5

A SysOps administrator wants to automate the creation of an Amazon RDS database instance using AWS CloudFormation. The database must be created in a specific VPC and must be Multi-AZ. Which CloudFormation resource property should the administrator configure to meet these requirements?

Accepted Answer

DBSubnetGroupName and MultiAZ. The correct answer is D because the AWS::RDS::DBInstance resource has properties for DBSubnetGroupName (to specify VPC subnets) and MultiAZ (to enable Multi-AZ). Option A is wrong because the DBInstanceIdentifier is just a name. Option B is wrong because the DBInstanceClass determines the instance type, not the VPC or Multi-AZ. Option C is wrong because the Engine property specifies the database engine type.

Answer

Engine

Answer

DBInstanceClass

Answer

DBInstanceIdentifier

Question 6

A company uses AWS Elastic Beanstalk for a Java application. The environment uses a custom platform. The SysOps administrator wants to update the environment's configuration to use a larger instance type to handle increased load. What is the correct way to perform this change with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to update the instance type and choose a rolling update strategy.. The correct answer is C because Elastic Beanstalk supports rolling updates or immutable updates that update instances gradually, minimizing downtime. Option A is wrong because terminating all instances causes downtime. Option B is wrong because manually updating each instance is not recommended and may not persist. Option D is wrong because creating a new environment and swapping URLs can work but is more complex than necessary.

Answer

SSH into each instance and modify the instance type manually.

Answer

Terminate all instances and launch new ones with the larger instance type.

Answer

Create a new environment with the larger instance type and swap the environment URLs.

Question 7

A SysOps administrator is responsible for deploying a critical application using AWS CloudFormation. The stack creation fails during the creation of an Amazon EC2 instance. The error message indicates that the instance type is not supported in the specified Availability Zone. What should the administrator do to prevent this issue in future deployments?

Accepted Answer

Use an AWS Systems Manager parameter to dynamically select an available instance type based on the Availability Zone.. The correct answer is A because using an AWS Systems Manager parameter can provide the latest supported instance types per Availability Zone. Option B is wrong because specifying a specific Availability Zone does not solve the unsupported instance type issue. Option C is wrong because changing the region may not be feasible. Option D is wrong because selecting a different instance type may not meet requirements.

Answer

Hardcode the Availability Zone in the template to one that supports the instance type.

Answer

Use a different instance type that is available in all Availability Zones.

Answer

Change the AWS region to one where the instance type is supported.

Question 8

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must include a build stage, a test stage, and a deployment stage. The administrator wants to ensure that if the build stage fails, the pipeline stops and notifies the team. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure the pipeline to stop on failure in the build stage.. The correct answers are A and D. CodePipeline automatically stops on failure (A). Amazon SNS can be used to send notifications (D). Option B is wrong because CodeBuild does not stop the pipeline; it only runs the build. Option C is wrong because CloudWatch Events can trigger notifications but are not the only way; SNS is simpler. Option E is wrong because manual approval is not automatic.

Answer

Set up an Amazon CloudWatch Events rule to detect build failures and send an email.

Answer

Add a manual approval action after the build stage to review results.

Answer

Use AWS CodeBuild as the build provider and configure it to stop the pipeline on failure.

Question 9

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator wants to update a stack that contains an Amazon RDS DB instance. The update involves changing the DB instance class. Which THREE steps should the administrator take to perform this update with minimal downtime? (Choose three.)

Accepted Answer

Update the CloudFormation stack with a new parameter value for the DB instance class.. The correct answers are B, C, and E. Using a snapshot ensures data is backed up (B). Modifying the DB instance class with Multi-AZ enabled allows a rolling update (C). Updating the CloudFormation stack with the new instance class triggers the change (E). Option A is wrong because deleting the stack is not necessary. Option D is wrong because modifying the DB instance directly outside CloudFormation may cause drift.

Answer

Modify the RDS instance class directly in the RDS console and then update the CloudFormation template.

Answer

Delete the existing stack and create a new one with the updated instance class.

Question 10

A SysOps administrator is using AWS System Manager Automation to patch a fleet of Amazon EC2 instances. The administrator wants to ensure that instances are patched during a maintenance window and that they are rebooted only if required. Which TWO steps should the administrator include in the automation document? (Choose two.)

Accepted Answer

Set the 'RebootIfNeeded' parameter to 'True' or 'False' as appropriate.. The correct answers are A and B. The 'AWS-RunPatchBaseline' document applies patches (A). The 'RebootIfNeeded' parameter controls reboot behavior (B). Option C is wrong because the maintenance window is scheduled separately, not in the document. Option D is wrong because CloudWatch alarms are not part of the patching document. Option E is wrong because the document does not handle snapshot creation.

Answer

Create an Amazon EBS snapshot of each instance before patching.

Answer

Schedule a maintenance window in the Systems Manager console.

Answer

Configure an Amazon CloudWatch alarm to detect failed patches.

Question 11

A SysOps administrator has created the IAM policy shown in the exhibit. The policy is attached to a role used by an automation script that manages Amazon EBS snapshots. The script is failing when it tries to delete snapshots. What is the likely cause?

Accepted Answer

The script is trying to delete snapshots in a different region or account.. The correct answer is D because the 'ec2:DeleteSnapshot' action is allowed only for snapshots in the specified account and region, but the script may be trying to delete snapshots in another region. Option A is wrong because 'ec2:Describe*' can describe snapshots. Option B is wrong because 'ec2:CreateTags' is allowed on any resource. Option C is wrong because the policy allows 'ec2:DeleteSnapshot' but with a resource restriction.

Answer

The script does not have permission to delete any snapshots.

Answer

The script does not have permission to describe snapshots.

Answer

The script does not have permission to create tags on snapshots.

Question 12

A SysOps administrator ran a CloudFormation stack update that failed and rolled back. The stack status is UPDATE_ROLLBACK_FAILED. The administrator needs to fix the issue and bring the stack to a stable state. What should the administrator do FIRST?

Accepted Answer

Identify and resolve the resource issue that caused the rollback failure, then continue the rollback.. The correct answer is B because when a rollback fails, the administrator must resolve the underlying issue (e.g., permissions, resource conflict) and then continue the rollback. Option A is wrong because attempting a new update without fixing the issue may fail again. Option C is wrong because deleting the stack may cause data loss. Option D is wrong because CloudFormation does not automatically retry.

Answer

Wait for CloudFormation to automatically retry the rollback.

Answer

Execute a new stack update to overwrite the failed resources.

Answer

Delete the stack and recreate it from the template.

Question 13

A SysOps administrator wants to automate the deployment of an application to an EC2 instance. The instance is running, but the deployment script fails because the instance is not reachable via SSH. The administrator checks the instance state as shown in the exhibit. What should the administrator check NEXT to troubleshoot the SSH connectivity issue?

Accepted Answer

Check the security group rules to ensure SSH (port 22) is allowed from the administrator's IP.. The correct answer is C because the instance is running, so the issue is likely network-related. Checking the security group rules ensures the correct inbound SSH rule exists. Option A is wrong because the instance is running, so no need to start it. Option B is wrong because the instance ID is correct. Option D is wrong because the subnet is likely correct if the instance is running.

Answer

Verify the instance is in a public subnet with an internet gateway.

Answer

Verify the instance ID is correct.

Answer

Check if the instance is in a stopped state.

Question 14

A company uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. During a deployment, the pipeline fails at the Deploy stage with an error indicating that the CodeDeploy agent is not responding. The instances are in an Auto Scaling group. What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed on the EC2 instances.. The CodeDeploy agent must be installed and running on the EC2 instances to receive deployment instructions. If the agent is not installed or is not running, the deployment will fail. Option B is correct because the agent is required for CodeDeploy to deploy to EC2. Option A is wrong because CodePipeline does not require a VPC endpoint. Option C is wrong because IAM roles are assigned to the instance profile, not directly to instances. Option D is wrong because CodeDeploy can deploy to instances without an Application Load Balancer.

Answer

The pipeline does not have a VPC endpoint to connect to the instances.

Answer

The IAM role attached to the instances does not have permissions for CodeDeploy.

Answer

The Application Load Balancer is not configured with a target group.

Question 15

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an Amazon RDS DB instance with a custom DB parameter group. The error message states: 'The following resource(s) failed to create: [DBParameterGroup].' The administrator checks the CloudFormation template and sees that the DBParameterGroup resource has a property 'Parameters' with a list of parameters. What is the MOST likely reason for the failure?

Accepted Answer

The parameter group is configured with parameters that are not compatible with the DB engine version.. Custom DB parameter groups must be associated with an engine version that matches the DB instance. A mismatch can cause creation failure. Option D is correct. Option A is wrong because the DB subnet group is not involved. Option B is wrong because RDS does not require a VPC endpoint. Option C is wrong because the parameter group name can be any valid name.

Answer

The parameter group name contains invalid characters.

Answer

The DB subnet group specified for the DB instance does not exist.

Answer

The VPC does not have an RDS VPC endpoint enabled.