SOA-C02 Deployment, Provisioning, and Automation Practice Test 16 — 15 Questions

Question 1

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application is deployed using AWS Elastic Beanstalk with a rolling update deployment policy. Recently, the development team pushed a new application version that introduced a memory leak. Within minutes, the instances started failing health checks, and Elastic Beanstalk initiated a replacement of the instances. However, during the replacement, the application experienced downtime because the new instances were not passing health checks, and the old instances were already terminated. The SysOps Administrator must modify the deployment to prevent downtime during future failed deployments. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a Blue/Green deployment using a separate Elastic Beanstalk environment and swap CNAMEs after testing.. Blue/Green deployment with Elastic Beanstalk creates a separate environment running the new version. Health checks validate the new instances before swapping the CNAME. If the new environment fails, the old environment continues serving traffic, eliminating downtime. Option A is wrong because increasing Auto Scaling sizes does not change the deployment policy; it only affects scaling limits. Option C is wrong because Classic Load Balancer lacks advanced health check features and does not address the deployment strategy. Option D is wrong because All at once deployment would replace all instances simultaneously, causing downtime even without failure, and does not provide a rollback mechanism.

Answer

Increase the Auto Scaling group's minimum and maximum size to handle more instances.

Answer

Replace the ALB with a Classic Load Balancer to reduce complexity.

Answer

Change the deployment policy to All at once to speed up the deployment.

Question 2

A company uses AWS CloudFormation to manage its infrastructure. The SysOps Administrator needs to update a stack that contains an Amazon RDS DB instance. The update requires changing the DB instance class from db.t2.medium to db.t3.medium. The RDS instance has a deletion policy of 'Snapshot' in the current template. The administrator wants to minimize downtime and ensure no data loss. The current stack update fails because CloudFormation attempts to replace the DB instance, causing a long downtime. What should the administrator do to successfully update the stack with minimal downtime?

Accepted Answer

Modify the DB instance class directly in RDS using the AWS CLI or console, then update the CloudFormation stack to match.. The correct approach is to modify the DB instance class directly in RDS using the AWS CLI or console, then update the CloudFormation stack to match. This avoids CloudFormation performing a replacement because it detects that the instance already matches the desired state, resulting in no downtime. Option B (changing the deletion policy to 'Retain') does not prevent replacement; it only affects deletion behavior. Option C (creating a new stack and migrating data) causes additional downtime and complexity. Option D (deleting and recreating the stack) leads to downtime and potential data loss. Therefore, option A is the best solution to minimize downtime and ensure no data loss.

Answer

Change the deletion policy to 'Retain' in the template and then update the stack.

Answer

Create a new CloudFormation stack with the new instance class and migrate the data.

Answer

Delete the stack, modify the template, and recreate the stack.

Question 3

A SysOps Administrator is responsible for deploying a new microservice using AWS Elastic Beanstalk. The microservice requires an Amazon RDS MySQL database. The administrator creates an Elastic Beanstalk environment and adds an RDS DB instance using the Elastic Beanstalk console. However, during the next deployment of the application, the database connection string in the environment properties gets overwritten, causing the application to fail to connect to the database. The administrator needs to ensure that the database configuration persists across deployments. What should the administrator do?

Accepted Answer

Provision the RDS instance separately using AWS CloudFormation and pass the connection string as an environment property using a custom resource.. When you add an RDS DB instance using the Elastic Beanstalk console, the database is tied to the environment's lifecycle. During deployments, environment properties like the connection string can be overwritten, causing application failures. To persist the database configuration, provision the RDS instance separately using AWS CloudFormation. Then, use a custom resource to pass the connection string as an environment property to Elastic Beanstalk. This decouples the database from the Elastic Beanstalk environment, ensuring the connection string persists across deployments. Option A is incorrect because .ebextensions configurations are part of the application source and can be overwritten during deployments. Option B is incorrect because storing the connection string in Parameter Store does not prevent the environment property from being overwritten; the application would still rely on the overwritten property. Option C is incorrect because Elastic Beanstalk does not support 'locking' environment properties, and the RDS integration still creates a dependency on the environment lifecycle.

Answer

Add the database configuration to the application source code using .ebextensions.

Answer

Store the database connection string in AWS Systems Manager Parameter Store and retrieve it in the application code.

Answer

Use the Elastic Beanstalk RDS integration but lock the environment properties using a configuration file.

Question 4

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline has three stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). Recently, the deployment stage started failing with the error 'The deployment failed because a deployment already exists for the deployment group'. The SysOps Administrator needs to fix the pipeline to allow deployments to proceed without manual intervention. The pipeline should only deploy if the previous deployment is successful. What should the administrator do?

Accepted Answer

Configure the CodePipeline Deploy action to wait for the previous deployment to finish before starting a new one.. The error 'a deployment already exists' occurs because CodePipeline triggers a new deployment while a previous one is still running. By configuring the CodePipeline Deploy action to wait for the previous deployment to finish, the pipeline will only proceed when the deployment group is idle. Option A is incorrect because disabling concurrent deployments in the CodeDeploy deployment group prevents simultaneous deployments but does not stop the pipeline from attempting to start a new deployment while one is in progress; it would still result in a failure. Option C is impractical and adds unnecessary complexity. Option D addresses rollback behavior, not concurrency.

Answer

Disable the concurrent deployment setting in the CodeDeploy deployment group.

Answer

Modify the pipeline to use a new deployment group for each execution.

Answer

Enable automatic rollback in the CodeDeploy deployment group.

Question 5

A company has a multi-account AWS environment using AWS Organizations. The SysOps Administrator needs to deploy a standardized set of baseline resources (VPC, subnets, security groups, and an S3 bucket for logs) into each new member account as soon as the account is created. The administrator wants to automate this process using AWS CloudFormation and ensure that the baseline resources are deployed without manual intervention. The organization uses AWS CloudTrail and AWS Config for governance. What solution should the administrator implement?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to accounts in the organization.. AWS CloudFormation StackSets allow you to deploy CloudFormation stacks across multiple accounts and regions from a management account. When integrated with AWS Organizations, StackSets can automatically deploy to new member accounts as they are created, ensuring baseline resources are provisioned without manual intervention. This meets the requirement of automated deployment upon account creation. Option B is incorrect because AWS Config rules are for evaluating resource compliance, not for provisioning resources. Option C is incorrect because S3 event notifications require the S3 bucket to exist and the template to be uploaded, which does not trigger on new account creation. Option D is incorrect because AWS Service Catalog requires users to launch products manually from the portfolio; it does not automatically deploy when an account is created.

Answer

Create an AWS Config rule that triggers an AWS Lambda function to deploy the baseline resources when a new account is created.

Answer

Store the CloudFormation template in Amazon S3 and use S3 event notifications to trigger a Lambda function that deploys the stack into the new account.

Answer

Use AWS Service Catalog to create a portfolio with the baseline products and grant access to the organization.

Question 6

A company is using AWS OpsWorks for configuration management of their EC2 instances. The SysOps Administrator wants to migrate to AWS Systems Manager for a more modern approach. The administrator needs to ensure that existing instances running Amazon Linux 2 can be managed by Systems Manager without downtime. The instances are currently in a running state and are critical to operations. What should the administrator do?

Accepted Answer

Install the SSM Agent on the existing instances using a script or AWS Systems Manager Run Command.. The AWS Systems Manager Agent (SSM Agent) can be installed on existing running Amazon Linux 2 instances using a script or AWS Systems Manager Run Command, enabling management by Systems Manager without any downtime. Option A is incorrect because changing the OpsWorks stack configuration does not install the SSM Agent; the stack would still rely on the OpsWorks agent. Option B is incorrect because creating a custom AMI and launching new instances would require replacing the existing instances, causing downtime. Option C is incorrect because deleting and recreating the OpsWorks stack would be disruptive and does not address the need to manage existing instances without downtime.

Answer

Change the OpsWorks stack configuration to use Systems Manager instead of OpsWorks agent.

Answer

Create a custom AMI with the SSM Agent pre-installed and launch new instances from it.

Answer

Delete the OpsWorks stack and recreate it with Systems Manager integration.

Question 7

A SysOps Administrator is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with an AWS Systems Manager Association that installs software. The stack creation fails because the association fails to apply, and the stack rolls back. The administrator needs to ensure that the stack creation succeeds even if the association fails, and then fix the association later. What should the administrator do?

Accepted Answer

Modify the CloudFormation template to set the AWS::SSM::Association resource's 'ComplianceSeverity' or 'WaitForSuccessTimeout' to a value that allows the stack to continue.. By setting the 'WaitForSuccessTimeoutSeconds' property of the AWS::SSM::Association resource to 0, or setting 'ComplianceSeverity' to 'UNSPECIFIED', CloudFormation will not mark the stack as failed if the association fails to apply. This allows the stack creation to succeed, and the administrator can fix the association later. Option A is incorrect because 'DependsOn' only ensures resource ordering, not failure behavior. Option C is incorrect because removing the association from the template means it is no longer managed by CloudFormation. Option D is incorrect because deletion policy only affects resource deletion, not creation failures.

Answer

Add a 'DependsOn' attribute to the association to ensure it runs after the instance is fully ready.

Answer

Remove the association from the CloudFormation template and apply it manually after stack creation.

Answer

Set the deletion policy of the association to 'Retain' in the template.

Question 8

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?

Accepted Answer

Modify the Auto Scaling group's health check type to ELB. Setting the Auto Scaling group's health check type to ELB (Elastic Load Balancer) ensures that the Auto Scaling group uses the ELB's health check status to determine instance health. When the test lifecycle hook fails, the new instances are not marked as healthy by the ELB, causing the Auto Scaling group to automatically terminate and replace them. This aligns with the requirement to automatically replace failed instances, as the default EC2 health check only considers instance status (e.g., running vs. stopped) and does not reflect application-level health.

Answer

Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count

Answer

Modify the Auto Scaling group's health check grace period to a lower value

Answer

Modify the CodeDeploy deployment to ignore the lifecycle hook failure

Question 9

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline consists of a source stage (AWS CodeCommit) and a deploy stage (AWS CodeDeploy) that deploys to an Auto Scaling group. The SysOps administrator needs to add a stage to run automated unit tests before the deployment proceeds. The tests must be executed in an isolated environment, and if they fail, the pipeline must stop and notify the development team. Which action should the administrator take?

Accepted Answer

Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.. AWS CodeBuild is natively integrated with CodePipeline to run automated tests defined in a buildspec file. When the build action fails, CodePipeline automatically stops the pipeline execution and can send notifications via Amazon SNS, meeting the requirement for an isolated test environment and automatic failure notification without manual intervention.

Answer

Add a manual approval action between the source and deploy stages. The development team will manually run the tests on their local machines and then approve the pipeline to proceed.

Answer

Insert a test stage after the source stage with an AWS CloudFormation action that deploys a test stack and runs tests using a custom resource Lambda function.

Answer

Add a Lambda function as an action in the pipeline that runs the unit tests. The Lambda function writes the test results to an S3 bucket, and a subsequent approval action checks the results.

Question 10

A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon EC2 instance. The administrator wants to update the instance type from t3.medium to t3.large without recreating the instance. The instance type change is supported as a simple update in CloudFormation. Which stack update method should the administrator use to apply this change with the least disruption?

Accepted Answer

Directly update the stack by modifying the template and submitting the update via the AWS Management Console, AWS CLI, or API.. Changing an EC2 instance type from t3.medium to t3.large is a supported simple update in CloudFormation, meaning the resource can be updated in-place without replacement. By directly updating the stack via the AWS Management Console, AWS CLI, or API, the administrator applies the change immediately with minimal disruption, as CloudFormation will stop the instance, modify the instance type, and restart it. This method avoids the overhead of creating a change set or deleting and recreating the stack, which would cause unnecessary downtime or complexity.

Answer

Create a change set to review the changes, then execute the change set.

Answer

Apply a stack policy to the EC2 instance to allow the update, then update the stack.

Answer

Delete the existing stack and create a new stack with the updated instance type.

Question 11

A company uses AWS Systems Manager Patch Manager to automate patching of Amazon EC2 instances. The SysOps administrator needs to configure a maintenance window that will patch instances on the second Tuesday of every month at 2:00 AM. The administrator wants to ensure that patches are automatically applied but reboots are only performed if required. Which combination of configurations should the administrator use?

Accepted Answer

Create a maintenance window with a cron schedule of cron(0 2 ? * TUE#2 *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.. It uses the cron expression `cron(0 2 ? * TUE#2 *)` to schedule the maintenance window for the second Tuesday of every month at 2:00 AM, and the `AWS-RunPatchBaseline` document with operation `Install` and reboot option `RebootIfNeeded` ensures patches are applied automatically and reboots only occur when required by the patch installation.

Answer

Create a maintenance window with a rate schedule of 30 days and use an AWS-ApplyPatchBaseline document with operation 'Scan' and reboot option 'RebootIfNeeded'.

Answer

Create a maintenance window with a cron schedule of cron(0 2 14 * ? *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.

Answer

Create a maintenance window with a cron schedule of cron(0 2 2 * 2 *) and use an AWS-InstallPatchBaseline document with operation 'Install' and reboot option 'NoReboot'.

Question 12

A company uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The SysOps administrator wants to deploy a new version of the application by first shifting 10% of traffic to the new version, monitoring for errors, and then after manual approval, shifting the remaining 90%. Which deployment configuration should be used?

Accepted Answer

Blue/green deployment with Canary10Percent configuration. A Blue/green deployment with Canary10Percent configuration shifts 10% of traffic to the new version, waits for a specified period (default 10 minutes), and then automatically shifts the remaining 90%. Note that manual approval is not natively supported by this configuration; it would need to be implemented separately (e.g., via a lifecycle hook). The question's requirement for manual approval is not directly met by the deployment configuration itself, but among the options, Canary10Percent is the only one that shifts traffic in the described pattern of 10% first then 90%.

Answer

In-place deployment

Answer

Blue/green deployment with Linear10PercentEvery10Minutes configuration

Answer

Blue/green deployment with AllAtOnce configuration

Question 13

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The admin has a template that creates an EC2 instance with a custom software stack. The software stack must be installed and configured using PowerShell scripts. The admin wants to minimize operational overhead by automating the creation of an AMI that includes the software stack, and the AMI should be rebuilt on a weekly basis to include the latest security patches. Which combination of AWS services should be used?

Accepted Answer

Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.. EC2 Image Builder is purpose-built for automating the creation, patching, and testing of custom AMIs. By defining a component that encapsulates the PowerShell scripts, creating a recipe that references that component, and scheduling a pipeline to run weekly, the administrator achieves fully automated, repeatable AMI builds with minimal operational overhead. This directly meets the requirement for weekly rebuilds with the latest security patches.

Answer

Use AWS Systems Manager Automation to run a PowerShell script on an existing EC2 instance, then manually create an AMI each week.

Answer

Use AWS CodePipeline with CodeBuild to run the PowerShell scripts and create an AMI using the AWS CLI, triggered by a weekly CloudWatch Events schedule.

Answer

Use Amazon EC2 Auto Scaling with a lifecycle hook to run the PowerShell script on instance launch, and schedule a weekly instance refresh.

Question 14

A company uses AWS CodePipeline to deploy a web application. The pipeline includes a stage that runs a database migration script. The SysOps administrator wants to ensure that if the migration script fails, the entire pipeline stops and the previous version of the application remains deployed. Which pipeline stage configuration should be used to achieve this behavior?

Accepted Answer

Configure the migration step as a sequential action and set the OnFailure to ABORT.. Setting the migration step as a sequential action with OnFailure set to ABORT ensures that if the migration script fails, the pipeline immediately stops and does not proceed to any subsequent stages. This prevents the deployment of a new application version that depends on a failed database migration, thereby keeping the previous version deployed.

Answer

Use a parallel action group for the migration step so other steps continue.

Answer

Configure the migration step as a sequential action and set the OnFailure to ROLLBACK.

Answer

Use a manual approval step after the migration to verify success.

Question 15

A SysOps administrator is updating an AWS CloudFormation stack that contains an Amazon RDS DB instance. The administrator wants to prevent accidental replacement of the database during the update. Which CloudFormation feature should be used?

Accepted Answer

Stack policies. Stack policies are the correct feature because they allow you to define explicit deny statements that prevent CloudFormation from updating or replacing specific resources, such as an RDS DB instance, during a stack update. By setting a stack policy that denies replacement actions on the database resource, the administrator ensures that even if the template changes would normally trigger a replacement, the update will fail rather than accidentally recreate the database.

Answer

Change sets

Answer

Resource signals

Answer

Nested stacks