SOA-C02 Deployment, Provisioning, and Automation Practice Test 17 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator needs to update a stack that contains a critical database. The update may require a replacement of the database resource. The administrator wants to review the changes before they are applied. What is the BEST way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the AWS CloudFormation create-change-set command and then review the changes before executing.. Creating a change set allows you to review all changes, including replacements, before executing them. Option A is incorrect because the '--no-fail-on-empty-changeset' flag does not provide a review. Option B is incorrect because a stack policy can protect resources but does not allow reviewing changes. Option D is incorrect because the drift detection feature detects drift, not planned changes.

Answer

Use the AWS CloudFormation update-stack command with the --no-fail-on-empty-changeset flag.

Answer

Apply a stack policy that prevents replacement of the database resource.

Answer

Use the AWS CloudFormation detect-stack-drift command to check for differences.

Question 2

A company is using AWS OpsWorks for configuration management. They have a stack with multiple layers, and they want to automate the deployment of a custom configuration file to all instances in a specific layer. What is the MOST efficient way to achieve this?

Accepted Answer

Create a custom cookbook and assign it to the layer.. OpsWorks custom cookbooks allow you to run recipes that can deploy files to instances in a layer. Option A is incorrect because the AWS::OpsWorks::App resource is used to deploy applications, not configuration files, and it does not directly add custom configuration files to instances. Option C is incorrect because AWS Systems Manager Run Command can execute commands but is not specific to OpsWorks layers and is less efficient for automating deployments tied to a specific layer's lifecycle. Option D is incorrect because user data scripts run at boot time only, not on demand, and they are not directly associated with OpsWorks layers.

Answer

Define the file in an AWS CloudFormation template using the AWS::OpsWorks::App resource.

Answer

Use AWS Systems Manager Run Command to execute a script on each instance.

Answer

Add the configuration file as user data in the layer's Auto Scaling group.

Question 3

A company runs a critical application on a fleet of EC2 instances in an Auto Scaling group. The application is deployed using a blue/green deployment strategy with AWS CodeDeploy. The green environment fails immediately after deployment, and the deployment is automatically rolled back. However, the rollback also fails because the original blue environment's Auto Scaling group has been scaled down. What should the SysOps administrator do to prevent this issue in future deployments?

Accepted Answer

Set the original environment termination delay to a longer duration in the CodeDeploy deployment group.. Setting the original environment termination delay in the CodeDeploy deployment group ensures that the blue Auto Scaling group instances are not terminated immediately after a successful deployment. This delay keeps the blue environment available during the rollback window, preventing the rollback failure that occurs when the original environment has already been scaled down. The termination delay is a configurable setting in CodeDeploy that holds the old instances for a specified period, allowing a safe fallback if the new environment fails.

Answer

Configure the deployment to automatically delete the green environment after rollback.

Answer

Increase the minimum size of the Auto Scaling group.

Answer

Change the deployment type to in-place.

Question 4

A company uses AWS Elastic Beanstalk to deploy a web application. After updating the environment configuration, the deployment fails and the environment health turns red. The SysOps administrator checks the logs and finds a permission error related to the EC2 instance profile. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM instance profile associated with the environment to include the required permissions.. Elastic Beanstalk uses an IAM instance profile for the EC2 instances. The instance profile must have the necessary permissions to access resources like S3 buckets or DynamoDB tables. Updating the instance profile with the required permissions resolves the issue. Option A is wrong because rebuilding the environment from scratch using a saved configuration template does not address the underlying permission issue; it would only recreate the same problem. Option C is wrong because the security group controls network access, not IAM permissions; modifying it would not resolve the permission error. Option D is wrong because updating the application version does not fix permission issues; the application version itself does not grant or modify IAM permissions.

Answer

Rebuild the environment from scratch using a saved configuration template.

Answer

Modify the security group attached to the environment to allow outbound traffic.

Answer

Update the application version to the latest build.

Question 5

A SysOps administrator is automating the deployment of a three-tier web application using AWS CloudFormation. The administrator wants to ensure that the database tier is created before the application tier. How should the administrator define this dependency in the CloudFormation template?

Accepted Answer

Use the DependsOn attribute on the application tier resources to reference the database tier resources.. CloudFormation supports the DependsOn attribute to specify resource dependencies. The application tier resources must wait for the database tier resources to be created. Option A is wrong because the Conditions section determines whether resources are created based on conditions, not the creation order. Option B is wrong because the Outputs section exports values for use in other stacks, but does not control the order of creation within the same stack. Option D is wrong because the Parameters section defines input values passed to the template, not dependencies.

Answer

Use the Conditions section to check if the database exists before creating the application tier.

Answer

Use the Outputs section to export the database endpoint and import it in the application tier.

Answer

Use the Parameters section to pass the database instance identifier to the application stack.

Question 6

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances in the Auto Scaling group are not registered with the target group of an Application Load Balancer. The SysOps administrator needs to ensure that new instances launched by the Auto Scaling group are automatically registered with the target group. What should the administrator do?

Accepted Answer

Attach the target group to the Auto Scaling group.. To ensure that instances launched by an Auto Scaling group are automatically registered with an Application Load Balancer target group, the target group must be attached to the Auto Scaling group. This is done by specifying the target group ARN in the Auto Scaling group's configuration (via the console, CLI, or CloudFormation). When attached, the Auto Scaling group automatically registers new instances with the target group and deregisters terminated ones.

Answer

Use Amazon Inspector to automatically register instances with the target group.

Answer

Create a lifecycle hook in the Auto Scaling group to register instances with the target group.

Answer

Configure the Auto Scaling group to launch instances with a user data script that registers the instance with the target group.

Question 7

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to a stack. What is the recommended way to update the application on the instances?

Accepted Answer

Update the custom cookbook and run the 'deploy' recipe on the stack.. AWS OpsWorks uses recipes and custom cookbooks to manage application deployment. To deploy a new version, the SysOps administrator should update the custom cookbook with the new application code or configuration and then run the 'deploy' recipe on the stack. This triggers the deployment process on all instances automatically. Option A is incorrect because creating a new CloudFormation stack is not the recommended approach for updating an existing OpsWorks stack; CloudFormation is a different service for infrastructure as code. Option C is incorrect because the OpsWorks built-in 'deploy' command is meant for straightforward deployments and may not support custom cookbooks or complex application logic. Option D is incorrect because manually SSH-ing into each instance is not scalable and defeats the purpose of automation.

Answer

Create a new CloudFormation stack to replace the OpsWorks stack.

Answer

Use the OpsWorks built-in 'deploy' command on each instance.

Answer

SSH into each instance and manually update the application files.

Question 8

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The error message indicates that a resource failed to create due to insufficient IAM permissions. The administrator used a service role for CloudFormation. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM policy attached to the CloudFormation service role to include the necessary permissions.. When CloudFormation assumes a service role to perform stack operations, all API calls made on behalf of the stack use that role's permissions — not the administrator's user permissions. The fix is to attach or update the IAM policy on the CloudFormation service role to grant the missing permissions (e.g., ec2:CreateInstance, s3:CreateBucket). This is the least-privilege, correct remediation.

Answer

Add the required permissions to the administrator's IAM user.

Answer

Request a limit increase for IAM roles in the AWS account.

Answer

Modify the resource's IAM policy to allow CloudFormation to create it.

Question 9

A company uses AWS CodePipeline with AWS CodeBuild to build and deploy a static website to an S3 bucket. The website is served via Amazon CloudFront. The deployment fails intermittently because the S3 bucket policy does not allow CloudFront access after the bucket is updated. What is the BEST way to automate the bucket policy update during the deployment?

Accepted Answer

Use AWS CloudFormation to manage the S3 bucket and its policy, and update the stack as part of the pipeline.. AWS CloudFormation can manage the S3 bucket and its policy as part of the infrastructure. Using CloudFormation, the bucket policy can be updated automatically when the stack is updated, ensuring that CloudFront access is maintained. Option A is incorrect because including an AWS CLI command in the buildspec may work but is less robust and not as automated as using CloudFormation. Option C is incorrect because manually adding a bucket policy statement in the S3 management console is not automated and prone to errors. Option D is incorrect because while using a CloudFront origin access identity (OAI) and configuring it in the bucket policy is a best practice, it does not automate the policy update during deployment; CloudFormation handles this automatically.

Answer

Include an AWS CLI command in the buildspec to update the bucket policy after the build.

Answer

Add a bucket policy statement in the S3 management console to grant CloudFront access.

Answer

Use a CloudFront origin access identity (OAI) and configure it in the bucket policy.

Question 10

A SysOps administrator wants to automate the creation of an Amazon RDS database instance using AWS CloudFormation. The database must be created in a specific VPC and must be Multi-AZ. Which CloudFormation resource property should the administrator configure to meet these requirements?

Accepted Answer

DBSubnetGroupName and MultiAZ. The DBSubnetGroupName property specifies the VPC subnets for the RDS instance, ensuring it is created in the desired VPC. The MultiAZ property enables Multi-AZ deployment for high availability. Other options: DBInstanceIdentifier (D) is only a name, Engine (B) defines the database engine type, and DBInstanceClass (C) specifies the instance size; none affect VPC placement or Multi-AZ functionality.

Answer

Engine

Answer

DBInstanceClass

Answer

DBInstanceIdentifier

Question 11

A company uses AWS Elastic Beanstalk for a Java application. The environment uses a custom platform. The SysOps administrator wants to update the environment's configuration to use a larger instance type to handle increased load. What is the correct way to perform this change with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to update the instance type and choose a rolling update strategy.. Elastic Beanstalk allows you to update the environment's configuration, such as instance type, via the console or CLI. To minimize downtime, you can choose a rolling update strategy, which updates instances in batches, ensuring that the environment remains available throughout the process. Option B is incorrect because manually SSHing into instances is not a scalable or persistent solution; Elastic Beanstalk manages the instances and changes may not survive environment updates. Option C is incorrect because terminating all instances causes complete downtime until the new instances are launched. Option D is incorrect because while creating a new environment and swapping URLs (blue/green deployment) can achieve zero downtime, it is more complex and resource-intensive than necessary for a simple instance type change, and the question asks for minimal downtime with correct method.

Answer

SSH into each instance and modify the instance type manually.

Answer

Terminate all instances and launch new ones with the larger instance type.

Answer

Create a new environment with the larger instance type and swap the environment URLs.

Question 12

A SysOps administrator ran a CloudFormation stack update that failed and rolled back. The stack status is UPDATE_ROLLBACK_FAILED. The administrator needs to fix the issue and bring the stack to a stable state. What should the administrator do FIRST?

Accepted Answer

Identify and resolve the resource issue that caused the rollback failure, then continue the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED, the rollback itself failed because a resource could not be reverted. The administrator must first identify and resolve the underlying resource issue (e.g., a deleted S3 bucket, a modified IAM role, or a resource in an inconsistent state), then use the ContinueUpdateRollback API to resume the rollback and bring the stack to UPDATE_ROLLBACK_COMPLETE.

Answer

Wait for CloudFormation to automatically retry the rollback.

Answer

Execute a new stack update to overwrite the failed resources.

Answer

Delete the stack and recreate it from the template.

Question 13

A SysOps administrator wants to automate the deployment of an application to an EC2 instance. The instance is running, but the deployment script fails because the instance is not reachable via SSH. The administrator checks the instance state as shown in the exhibit. What should the administrator check NEXT to troubleshoot the SSH connectivity issue?

Accepted Answer

Check the security group rules to ensure SSH (port 22) is allowed from the administrator's IP.. When an EC2 instance is running but SSH is unreachable, the most common cause is that the security group does not permit inbound TCP/22 from the administrator's source IP. Security groups are stateful virtual firewalls evaluated before traffic reaches the instance, so a missing or overly restrictive SSH rule silently drops the connection attempt. Checking the security group's inbound rules is the correct next troubleshooting step after confirming the instance is running.

Answer

Verify the instance is in a public subnet with an internet gateway.

Answer

Verify the instance ID is correct.

Answer

Check if the instance is in a stopped state.

Question 14

A company uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. During a deployment, the pipeline fails at the Deploy stage with an error indicating that the CodeDeploy agent is not responding. The instances are in an Auto Scaling group. What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed on the EC2 instances.. The CodeDeploy agent is a software package that must be installed and running on each EC2 instance to receive deployment instructions from the CodeDeploy service. If the agent is absent, the service cannot communicate with the instance, producing the 'agent not responding' error. Auto Scaling group instances launched from an AMI that lacks the agent will exhibit exactly this symptom.

Answer

The pipeline does not have a VPC endpoint to connect to the instances.

Answer

The IAM role attached to the instances does not have permissions for CodeDeploy.

Answer

The Application Load Balancer is not configured with a target group.

Question 15

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an Amazon RDS DB instance with a custom DB parameter group. The error message states: 'The following resource(s) failed to create: [DBParameterGroup].' The administrator checks the CloudFormation template and sees that the DBParameterGroup resource has a property 'Parameters' with a list of parameters. What is the MOST likely reason for the failure?

Accepted Answer

The parameter group is configured with parameters that are not compatible with the DB engine version.. Custom DB parameter groups must be configured with parameters that are compatible with the DB engine and version specified for the RDS instance. If the parameter group includes parameters that are not supported by the chosen engine version, the stack creation will fail with an error for the DBParameterGroup resource. In this case, the most likely cause is that one or more parameters in the 'Parameters' list are incompatible with the DB engine version. Option B is correct. Option A is incorrect because parameter group names can contain letters, numbers, and hyphens; they are not restricted. Option C is incorrect because the DB subnet group is not related to parameter group creation failure. Option D is incorrect because RDS does not require a VPC endpoint to create a parameter group.

Answer

The parameter group name contains invalid characters.

Answer

The DB subnet group specified for the DB instance does not exist.

Answer

The VPC does not have an RDS VPC endpoint enabled.