SOA-C02 Deployment, Provisioning, and Automation Practice Test 16 — 15 Questions

Question 1

A SysOps administrator updates a CloudFormation stack to change the EC2 instance type from t2.micro to t3.medium. The update fails with the error shown. What is the MOST likely cause?

Accepted Answer

The t3.medium instance type is not available in the specified Availability Zone.. The error indicates that the t3.medium instance type is not available in the specified Availability Zone (AZ). AWS instance types are offered on a per-AZ basis, and not all instance types are available in every AZ. When a CloudFormation stack update fails with this error, it typically means the template explicitly or implicitly specifies an AZ that does not support the target instance type.

Answer

The account does not have service limits to launch a t3.medium instance.

Answer

The AMI used does not support the t3.medium instance type.

Answer

The CloudFormation template has a parameter constraint that rejects t3.medium.

Question 2

A CloudFormation template launches an EC2 instance with the user data script shown. The instance launches successfully but the web server does not serve PHP pages. What is the MOST likely reason?

Accepted Answer

The script does not install PHP.. The user data script installs Apache (httpd) and starts the service but never installs PHP or the PHP module for Apache. Without PHP installed, Apache cannot serve .php files — it will either download them as plain text or return a 500 error. This makes option A the most likely reason.

Answer

The script does not have execute permissions.

Answer

The CloudFormation template is missing a DependsOn clause for the instance.

Answer

The user data script is not base64 encoded correctly.

Question 3

A SysOps administrator is automating the creation of Amazon RDS DB instances using AWS CloudFormation. The template includes a DB instance with a Multi-AZ deployment. During a stack update, the administrator changes the DB instance class from db.t3.small to db.t3.medium. What is the expected behavior during the update?

Accepted Answer

RDS will modify the standby instance first, then fail over to it, and finally modify the original primary, resulting in minimal downtime.. When updating a Multi-AZ RDS DB instance class via CloudFormation, AWS performs a 'rolling upgrade' to minimize downtime. RDS first modifies the standby instance to the new class, then initiates a failover to make the standby the new primary, and finally modifies the original primary (now the standby) to the new class. This results in only a brief outage during the failover, typically lasting 60–120 seconds.

Answer

RDS will create a new DB instance with the new class and delete the old one.

Answer

RDS will modify both instances simultaneously, causing a brief outage.

Answer

The update will fail because CloudFormation cannot modify a Multi-AZ DB instance class.

Question 4

An organization wants to automate the creation of AWS resources using AWS CloudFormation. They need to ensure that certain resources, such as an Amazon S3 bucket, are not accidentally deleted when the stack is deleted. Which CloudFormation feature should they use?

Accepted Answer

DeletionPolicy attribute with value 'Retain'. The DeletionPolicy attribute with value 'Retain' instructs AWS CloudFormation to preserve a resource when its stack is deleted. This is the correct feature to prevent accidental deletion of critical resources like an S3 bucket, as the bucket and its contents will remain in the account even after the stack is removed.

Answer

DeletionPolicy attribute with value 'Protect'

Answer

DeletionPolicy attribute with value 'Delete'

Answer

Stack policy

Question 5

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. The Auto Scaling group has 4 instances. What should the SysOps administrator check first?

Accepted Answer

Check the Auto Scaling group's health check type and ensure it is set to ELB.. The error message indicates that too few healthy instances are available for deployment. In an Auto Scaling group integrated with CodeDeploy, the health check type must be set to ELB to allow CodeDeploy to use Elastic Load Balancing health checks to determine instance health. If the health check type is set to EC2 (default), CodeDeploy may consider instances healthy even when they are not passing ELB health checks, causing the deployment to fail due to insufficient healthy instances.

Answer

Review the deployment configuration to ensure it allows enough time for deployment.

Answer

Verify that the AppSpec file includes the correct hooks.

Answer

Check the IAM role for CodeDeploy to ensure it has sufficient permissions.

Question 6

A SysOps administrator is using AWS OpsWorks to manage a stack of web servers. The administrator wants to automate the installation of custom software on all new instances that are added to the layer. What is the best approach?

Accepted Answer

Assign a custom Chef recipe to the layer's Setup lifecycle event.. AWS OpsWorks uses Chef to manage configuration. Assigning a custom Chef recipe to the layer's Setup lifecycle event ensures the recipe runs automatically on every new instance when it boots, installing the custom software consistently. This is the native, best-practice approach within OpsWorks for automating software installation on new instances.

Answer

Use AWS CloudFormation to install software on new instances.

Answer

Create a custom AMI with the software pre-installed and use that in the layer.

Answer

Use EC2 user data scripts in the layer configuration.

Question 7

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running low on memory, and the administrator needs to change the instance type from t2.micro to t3.small. What is the correct way to perform this change with minimal downtime?

Accepted Answer

Modify the instance type in the Elastic Beanstalk environment's configuration.. Modifying the instance type in the Elastic Beanstalk environment's configuration triggers a rolling update or immutable update, which replaces instances with the new type while keeping the environment running. This approach minimizes downtime because Elastic Beanstalk manages the instance replacement process automatically, ensuring that traffic continues to be served during the transition.

Answer

Terminate the environment and create a new one with the desired instance type.

Answer

Create a new environment and perform a swap URL.

Answer

Manually modify the Auto Scaling group's launch configuration.

Question 8

A SysOps administrator is deploying a new version of an application using AWS CodeDeploy with an in-place deployment configuration. The deployment group consists of EC2 instances behind an Application Load Balancer. The administrator wants to ensure that traffic is gradually shifted to the new version. Which CodeDeploy feature should be used?

Accepted Answer

Configure the load balancer deregistration delay and re-registration in the deployment group.. Configuring the load balancer deregistration delay and re-registration in the deployment group allows CodeDeploy to control how instances are gradually removed from and added back to the ALB target group. This enables a controlled traffic shift during an in-place deployment by waiting for in-flight requests to complete (via deregistration delay) before rerouting traffic to the new version, and then re-registering instances after the new application is healthy.

Answer

Use a canary deployment instead of in-place.

Answer

Define a BeforeInstall hook to deregister instances.

Answer

Use a linear deployment configuration.

Question 9

An organization uses AWS CloudFormation to manage infrastructure. They have a stack that includes an Amazon RDS DB instance. The administrator wants to update the DB instance's allocated storage without downtime. The DB instance is currently using gp2 storage. Which action should the administrator take?

Accepted Answer

Modify the storage size in the CloudFormation template and update the stack.. Modifying the allocated storage size in the CloudFormation template and updating the stack triggers a storage modification on the RDS DB instance. For gp2 storage, increasing allocated storage does not require downtime; RDS performs the modification while the instance remains available. This approach aligns with the requirement to avoid downtime and leverages CloudFormation's infrastructure-as-code capabilities.

Answer

Create a read replica with the new storage size and promote it.

Answer

Stop the DB instance, modify the storage, and start it.

Answer

Take a manual snapshot and restore it with the new storage size.

Question 10

A SysOps administrator needs to deploy a microservices application using AWS Elastic Beanstalk. The application consists of multiple services that need to communicate with each other. Which Elastic Beanstalk environment type should the administrator choose?

Accepted Answer

Load-balanced environment. A load-balanced environment (option C) is the correct choice because it provisions an Elastic Load Balancer (ELB) in front of Amazon EC2 instances, enabling the multiple microservices to communicate via HTTP/HTTPS endpoints. This environment type supports horizontal scaling and distributes incoming traffic across instances, which is essential for inter-service communication in a microservices architecture.

Answer

Worker environment

Answer

Web server environment

Answer

Single-instance environment

Question 11

A SysOps administrator is automating the deployment of a web application using AWS CloudFormation. The application requires an Application Load Balancer (ALB) and an Auto Scaling group. The administrator wants to ensure that the Auto Scaling group registers instances with the ALB automatically. Which of the following are required? (Choose TWO.)

Accepted Answer

A launch template or launch configuration that defines the AMI and instance type.. A launch template or launch configuration is required because it defines the AMI, instance type, and other configuration details that the Auto Scaling group uses to launch EC2 instances. Without it, the Auto Scaling group cannot provision instances to register with the ALB.

Answer

A health check grace period set in the Auto Scaling group.

Answer

A security group that allows traffic from the ALB.

Answer

An Application Load Balancer created in the same stack.

Question 12

A SysOps administrator is troubleshooting a CodeDeploy deployment that uploads artifacts to an S3 bucket. The deployment fails with an 'AccessDenied' error. The IAM policy for the CodeDeploy service role includes the statement shown in the exhibit. What is the most likely cause of the failure?

Accepted Answer

The upload does not set the ACL to 'bucket-owner-full-control'.. The policy includes a condition that requires the object's ACL to be set to 'bucket-owner-full-control'. If the upload does not specify this ACL in the request, the condition is not met, and the request fails with AccessDenied. Therefore, option A is correct. Option B is incorrect because the resource ARN does include the bucket (the policy grants access to objects within the bucket). Option C is incorrect because the policy does not mention encryption headers; the condition is about ACL. Option D is incorrect because the s3:PutObject action is allowed by the policy; the failure is due to the condition on ACL.

Answer

The resource ARN does not include the bucket itself.

Answer

The policy does not allow encryption headers.

Answer

The policy does not allow the s3:PutObject action.

Question 13

A SysOps administrator is creating a CloudFormation stack and receives the error shown in the exhibit. The template snippet for the Auto Scaling group is:

"MyAutoScalingGroup": {
  "Type": "AWS::AutoScaling::AutoScalingGroup",
  "Properties": {
    "MinSize": "1",
    "MaxSize": "5",
    "DesiredCapacity": "2",
    ...
  }
}

Accepted Answer

The MinSize value must be specified as an integer, not a string.. The `MinSize`, `MaxSize`, and `DesiredCapacity` properties in an `AWS::AutoScaling::AutoScalingGroup` resource must be specified as integer values, not strings. In the provided template snippet, `"1"` is a string literal, which causes CloudFormation to fail validation because it expects a numeric type (e.g., `1` without quotes).

Answer

The DesiredCapacity value must be less than MinSize.

Answer

The MinSize value exceeds the MaxSize value.

Answer

The Auto Scaling group must have a scaling policy.

Question 14

A DevOps engineer needs to automate the creation of an Amazon RDS for MySQL DB instance in a VPC. The solution must use infrastructure as code. Which AWS service should be used to provision the database?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the infrastructure-as-code service that allows you to define and provision AWS resources, including RDS DB instances, using declarative templates. It supports the full lifecycle management of RDS instances, including creation, updates, and deletion, and integrates with other AWS services for automation. The other options are not designed for general-purpose infrastructure as code provisioning of databases.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

EC2 Auto Scaling

Question 15

An organization needs to enforce that all Amazon EC2 instances launched in a specific AWS account are created from a baseline Amazon Machine Image (AMI) that includes required security patches. The AMI ID is ami-0abcdef1234567890. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use an IAM policy that denies the ec2:RunInstances action unless the AMI ID matches the approved one.. An IAM policy with a condition that denies ec2:RunInstances unless the AMI ID matches the approved one (ami-0abcdef1234567890) prevents non-compliant instances from being launched at all. This is the most efficient approach as it enforces the requirement proactively at the API level, avoiding the need for reactive detection or termination.

Answer

Use an AWS Config rule to mark non-compliant instances and automatically terminate them.

Answer

Use an AWS Lambda function that is triggered by EC2 launch events to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor and alert on any instance launched with a different AMI.