SOA-C02 Deployment, Provisioning, and Automation Practice Test 15 — 15 Questions

Question 1

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The solution must track changes and allow rollbacks. Which AWS service should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudFormation. AWS CloudFormation provides infrastructure as code with change tracking and rollback capabilities. Option B (AWS Config) is for compliance and auditing, not provisioning. Option C (AWS Service Catalog) is for managing approved products, not general IaC. Option D (AWS OpsWorks) is a configuration management service, not primarily IaC.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Question 2

A company uses AWS Systems Manager to automate patching of EC2 instances. The SysOps administrator creates a Maintenance Window that targets a list of instances. The patching task fails with the error: 'Instance is not in a supported state.' What should the administrator check FIRST?

Accepted Answer

Verify that the SSM Agent is installed and running on the instance.. Systems Manager requires the SSM Agent to be installed and running on the instance to execute patching commands. Option A is incorrect because patching does not require a public IP address; instances can be in a private subnet with appropriate VPC endpoints. Option B is incorrect because the security group does not need to allow inbound traffic from Systems Manager; Systems Manager uses outbound traffic initiated by the SSM Agent. Option D is incorrect because while an IAM instance profile with appropriate permissions is necessary for Systems Manager, the error 'Instance is not in a supported state' specifically indicates that the SSM Agent is not installed or running, so the first thing to check is the agent status.

Answer

Verify that the instance has a public IP address.

Answer

Verify that the instance's security group allows inbound traffic from Systems Manager.

Answer

Verify that the instance has an IAM instance profile attached with the necessary permissions.

Question 3

A SysOps administrator is deploying a CloudFormation stack that includes an AWS::ECS::Service resource. The service uses a task definition that references a container image stored in Amazon ECR. The stack creation fails with the error: 'Unable to assume the service-linked role.' What is the MOST likely cause?

Accepted Answer

The ECS service-linked role does not exist in the account.. The error 'Unable to assume the service-linked role' indicates that the ECS service-linked role (AWSServiceRoleForECS) does not exist in the account. CloudFormation attempts to create or use this role when deploying an ECS service, but if it is missing, the stack creation fails. Option A is incorrect because the task execution role is used for pulling images, not for assuming the service-linked role. Option B is incorrect because the CloudFormation service role is not directly involved in the service-linked role assumption. Option C is incorrect because the ECR repository policy controls image access, not the service-linked role.

Answer

The task execution role does not have permissions to pull the container image from ECR.

Answer

The CloudFormation service role does not have permission to create ECS resources.

Answer

The ECR repository policy does not grant access to the ECS service.

Question 4

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The update attempted to modify an Amazon RDS DB instance's storage type from gp2 to io1. The error message indicates that the modification is not supported. Which TWO reasons could cause this error? (Choose TWO.)

Accepted Answer

The DB instance is using an Oracle DB engine version that does not support storage type modification.. Some storage modifications require a migration that is not supported for certain DB engine versions. Option C is correct because CloudFormation stack updates that require replacement will fail if 'DeletionPolicy' is set to 'Retain' and the resource is replaced. Option B is wrong because storage type changes are generally allowed without enabling backup. Option D is wrong because maintenance windows do not affect the feasibility of modification. Option E is wrong because the allocated storage size can be changed during modification.

Answer

The DB instance does not have automated backups enabled.

Answer

The stack update is occurring during the DB instance's maintenance window.

Answer

The allocated storage size is below the minimum required for io1.

Question 5

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must deploy a serverless application using AWS SAM. The administrator wants to run integration tests after the deployment. Which THREE services should be used together? (Choose THREE.)

Accepted Answer

AWS CodePipeline. AWS CodePipeline (B) orchestrates the deployment pipeline, defining stages and actions. AWS CodeBuild (C) can run integration tests as part of the pipeline. AWS SAM (E) is used to define and deploy serverless applications. Option A (CodeCommit) is a source repository but not required for this pipeline; Option D (CodeDeploy) is not used because SAM handles deployment via CloudFormation.

Answer

AWS CodeCommit

Answer

AWS CodeDeploy

Question 6

A company runs a critical production workload on a fleet of EC2 instances managed by an Auto Scaling group. The instances are behind an Application Load Balancer (ALB). Recently, the company experienced a regional outage that caused all instances to become unhealthy. The SysOps administrator must design a solution to automatically recover from such an outage with minimal downtime. The solution must be cost-effective and not require manual intervention. The administrator considers four options. Which option meets the requirements?

Accepted Answer

Create a warm standby environment in another AWS Region with a smaller Auto Scaling group. Use Route53 failover routing to switch traffic.. A regional outage affects all Availability Zones within a single AWS Region, so a multi-AZ architecture within the same region cannot recover from such an outage. A warm standby in another AWS Region provides disaster recovery across regions. Using Route53 failover routing, traffic is automatically redirected to the standby environment when the primary region becomes unhealthy. This solution is fully automated and cost-effective compared to a hot standby, as the standby can run at a smaller scale until needed. Option A is incorrect: spreading instances across AZs only protects against AZ failures, not a full regional outage. Option B is incorrect: increasing capacity or instance size does not provide cross-region failover. Option D is incorrect: using Lambda to relaunch instances in another region is less reliable and introduces a single point of failure; native services like Route53 and Auto Scaling are more robust.

Answer

Configure the Auto Scaling group to launch instances across multiple Availability Zones and configure the ALB to route traffic to healthy targets.

Answer

Increase the desired capacity of the Auto Scaling group and use larger instance types to absorb the load during failover.

Answer

Use AWS Lambda to periodically check the health of instances and automatically relaunch failed instances in another region.

Question 7

A SysOps administrator is deploying a new web application using AWS Elastic Beanstalk. The application requires a high-performance relational database that can scale read capacity. The administrator needs to ensure that the database is highly available and can handle read replicas. The administrator creates an Elastic Beanstalk environment and adds an Amazon RDS DB instance. However, the database is deployed in a single Availability Zone. The administrator wants to modify the environment to use a Multi-AZ deployment for high availability and add read replicas. The administrator has the following options. Which option should the administrator choose?

Accepted Answer

Create a new Multi-AZ RDS DB instance with read replicas outside of Elastic Beanstalk. Update the environment's environment properties to point to the new database. Then delete the old DB instance.. The correct approach is to decouple the RDS instance from Elastic Beanstalk. Elastic Beanstalk does not support modifying an existing RDS instance (created as part of the environment) to use Multi-AZ or adding read replicas after creation. Therefore, the administrator should create a new Multi-AZ RDS DB instance with read replicas outside of Elastic Beanstalk, update the environment's environment properties (e.g., RDS_HOSTNAME, RDS_PORT) to point to the new database, and then delete the old DB instance (Option C). Option A is incorrect because increasing the instance class does not provide Multi-AZ or read replicas. Option B is incorrect because a read replica does not provide Multi-AZ and the environment cannot directly use it. Option D is incorrect because Elastic Beanstalk does not allow enabling Multi-AZ on an existing environment-linked RDS instance.

Answer

Increase the DB instance class size to improve performance and then create a read replica.

Answer

Create a read replica of the existing DB instance and then modify the environment to use the replica.

Answer

Modify the Elastic Beanstalk environment configuration to enable Multi-AZ for the existing DB instance.

Question 8

A SysOps administrator needs to automate the deployment of a three-tier web application. The application consists of an Application Load Balancer, a fleet of EC2 instances running a web server, and an Amazon RDS MySQL database. The administrator must ensure that the database credentials are securely stored and automatically rotated. The administrator also needs to version the infrastructure configuration. Which combination of AWS services should the administrator use?

Accepted Answer

AWS CloudFormation for infrastructure and AWS Secrets Manager for secrets.. AWS CloudFormation provides infrastructure as code for versioning the infrastructure configuration, and AWS Secrets Manager securely stores and automatically rotates database credentials for Amazon RDS. Option A is incorrect because AWS Systems Manager Parameter Store stores secrets but does not natively support automatic rotation of RDS credentials without a custom Lambda function. Option B is incorrect because AWS OpsWorks is a configuration management service, not primarily designed for infrastructure as code. Option C is incorrect because AWS CodeCommit is a source control service and does not provision infrastructure, and AWS KMS manages encryption keys, not secret rotation.

Answer

AWS CloudFormation for infrastructure and AWS Systems Manager Parameter Store for secrets.

Answer

AWS OpsWorks for infrastructure and AWS Secrets Manager for secrets.

Answer

AWS CodeCommit for infrastructure versioning and AWS KMS for secrets.

Question 9

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon EC2 instance and an associated security group. The stack creation fails with the error: 'Resource creation cancelled' after the security group is created but before the instance is launched. What is the MOST likely cause?

Accepted Answer

The EC2 instance resource configuration has an error.. The error 'Resource creation cancelled' indicates that CloudFormation was unable to complete the creation of a resource. Since the security group was created successfully, the issue is likely with the EC2 instance. A common cause is a configuration error in the instance resource (e.g., invalid AMI ID, incorrect instance type, or missing required properties). CloudFormation cancels the creation when a resource fails due to such errors. Option A is incorrect because the security group creation succeeded. Option B is incorrect because the stack was not deleted; the creation process was cancelled. Option D is incorrect because CloudFormation automatically rolls back on failure without requiring a trigger.

Answer

The security group failed to create.

Answer

The stack was manually deleted during creation.

Answer

The stack's rollback trigger was not configured.

Question 10

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The application consists of several Docker containers that run on Amazon ECS with Fargate launch type. The engineer wants to automate the deployment of new container versions. Which AWS service should be used to orchestrate the build, test, and deployment stages?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed continuous delivery service that orchestrates the build, test, and deploy phases of the release process. Option A is wrong because AWS CodeDeploy is for deploying applications to compute services but does not orchestrate the entire pipeline. Option C is wrong because AWS CloudFormation is for infrastructure as code, not CI/CD orchestration. Option D is wrong because AWS CodeBuild is for building and testing code, not for orchestrating the entire pipeline.

Answer

AWS CodeDeploy

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Question 11

A company uses AWS OpsWorks to manage a stack of EC2 instances running a web application. They recently migrated to AWS Elastic Beanstalk for easier deployments. However, after the migration, some users report that the application is responding slowly during peak hours. The Elastic Beanstalk environment is configured with a load balancer and auto scaling based on average CPU utilization. What should the SysOps Administrator do to troubleshoot the performance issue?

Accepted Answer

Review the CloudWatch metrics and logs for the Elastic Beanstalk environment.. Reviewing CloudWatch metrics and logs from the Elastic Beanstalk environment can identify if the auto scaling policy is not aggressive enough or if there are other bottlenecks. Option A is wrong because manually scaling the environment is a reactive measure that does not help identify the root cause of the performance issue. Option B is wrong because reverting to the OpsWorks stack would be a step backward and does not address the current environment's performance problem. Option D is wrong because increasing instance size without analysis may be inefficient and not resolve the underlying issue.

Answer

Manually scale the environment to add more instances.

Answer

Revert to the OpsWorks stack configuration.

Answer

Increase the instance size in the environment configuration.

Question 12

A company is using AWS CodeDeploy to deploy a new version of an application to a fleet of EC2 instances. The deployment is configured with a Blue/Green deployment type. During the deployment, the new instances pass all health checks, but the old instances are not being terminated automatically. The SysOps Administrator needs to ensure that the old instances are terminated after a successful deployment. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Configure the Blue/Green deployment settings to automatically terminate the original instances after a specified wait time.. Options A and C are correct. In a Blue/Green deployment with AWS CodeDeploy, to automatically terminate the original (blue) instances after a successful deployment, you must configure the deployment group to use the original load balancer (Option C) and set a wait time for automatic termination (Option A). Option B is incorrect because registering old instances to a new load balancer is part of the green environment setup, not related to terminating blue instances. Option D is incorrect because changing the deployment configuration to AllAtOnce affects traffic routing speed, not the termination of instances. Option E is incorrect because omitting a load balancer would prevent the Blue/Green deployment from functioning properly; a load balancer is required for traffic shifting.

Answer

Register the old instances to a new load balancer.

Answer

Change the deployment configuration to AllAtOnce.

Answer

Modify the deployment group to not use a load balancer.

Question 13

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS Multi-AZ DB instance. The stack creation fails with the error 'The DB instance already exists'. The SysOps Administrator needs to resolve this issue without modifying the template. Which TWO steps should the administrator take? (Choose TWO.)

Accepted Answer

Delete the existing DB instance from the AWS account.. The requirement is to resolve the error without modifying the template. Option B (delete the existing DB instance) removes the conflict, allowing CloudFormation to create a new instance with the same identifier. Option C (resource import) enables the stack to adopt the existing instance without altering the template. Options A and E require template modifications (changing deletion policy or identifier), which contradicts the requirement. Option D (different stack name) does not resolve the identifier conflict.

Answer

Update the CloudFormation stack to change the deletion policy of the DB instance to Retain.

Answer

Use a different stack name in the CloudFormation template.

Answer

Change the DB instance identifier in the CloudFormation template to a unique value.

Question 14

A SysOps Administrator attached the IAM policy shown in the exhibit to a user. The user is unable to terminate an EC2 instance. What is the MOST likely reason?

Accepted Answer

An explicit Deny statement overrides the Allow statement.. The policy includes an Allow statement for ec2:* actions, but also an explicit Deny statement for ec2:TerminateInstances. An explicit Deny overrides any Allow, so the user is unable to terminate instances. Option A is incorrect because the Allow does include ec2:TerminateInstances via ec2:*. Option B is incorrect because the resource ARN is not the issue; the Deny applies to all resources. Option C is incorrect because the policy does allow ec2:* but the Deny takes precedence.

Answer

The policy does not include ec2:TerminateInstances in the Allow statement.

Answer

The policy does not specify the correct resource ARN.

Answer

The policy does not allow ec2:* actions.

Question 15

A SysOps Administrator attempted to update a CloudFormation stack. The stack update failed and is now in UPDATE_ROLLBACK_IN_PROGRESS state as shown in the exhibit. What should the administrator do to recover the stack to a stable state?

Accepted Answer

Wait for the rollback to complete and then investigate the failure reason.. When a CloudFormation stack update fails and enters the UPDATE_ROLLBACK_IN_PROGRESS state, AWS CloudFormation automatically attempts to roll back to the last known stable state. The administrator should wait for the rollback to complete, then investigate the failure reason. Deleting and recreating the stack (Option B) is unnecessary and may cause resource loss. Manually updating the Auto Scaling group (Option C) is not recommended because the rollback process is automated and manual changes may conflict. Executing a change set (Option D) requires the stack to be in a stable state, which it is not during rollback.

Answer

Delete the stack and recreate it.

Answer

Manually update the Auto Scaling group to correct the issue.

Answer

Execute a change set to fix the failed resource.