SOA-C02 Deployment, Provisioning, and Automation Practice Test 17 — 15 Questions

Question 1

A company uses AWS OpsWorks for configuration management. The administrator needs to deploy a new application version to a stack of EC2 instances. The instances are part of a layer that has a custom recipe. Which THREE steps are required to update the application? (Choose THREE.)

Accepted Answer

Run the 'Execute Recipes' stack command to run the new recipe.. Options B, D, and E are correct. Updating the custom cookbook with the new recipe, running the 'Update Custom Cookbooks' stack command to fetch the latest cookbook, and then running the recipe via 'Execute Recipes' stack command are the required steps. Option A (update app) is for OpsWorks for Chef Automate, not for custom recipes. Option C (deploy command) is for built-in deployment, not custom recipes.

Answer

Run the 'Deploy' stack command to deploy the new application.

Answer

Update the app in the OpsWorks console to point to the new application version.

Question 2

A SysOps administrator ran the above AWS CLI command to update an existing CloudFormation stack. The command failed with the error shown. What is the most likely cause?

Accepted Answer

The stack is in a failed state from a previous operation and must be deleted or rollback continued.. Option C is correct. The error indicates the stack is in ROLLBACK_COMPLETE state, which means a previous stack creation or update failed and rolled back. To update a stack in ROLLBACK_COMPLETE, you must first delete it or execute a continue update rollback. Option A (template syntax) is not indicated; the error is about stack state. Option B (permissions) would give a different error. Option D (parameter values) would also give a different error.

Answer

The template file has a syntax error.

Answer

The parameter values provided are invalid.

Answer

The IAM role specified lacks permissions.

Question 3

A company wants to automate the creation of AWS resources based on tags. When a user tags an S3 bucket with 'Deploy: True', a Lambda function should trigger to create a corresponding CloudFront distribution. Which AWS service should be used to invoke the Lambda function when the tag is applied?

Accepted Answer

AWS Config. Option B is correct. AWS Config rules can be configured to trigger on resource changes, including tag changes. CloudTrail (A) logs API calls but does not directly trigger Lambda. CloudWatch Events (C) can match API calls, but Config is more straightforward for tag compliance. S3 Events (D) only trigger on object-level events, not bucket tagging.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Events

Answer

Amazon S3 Events

Question 4

A SysOps administrator needs to deploy a new version of an application to an Auto Scaling group using a blue/green deployment strategy. The application runs on EC2 instances behind an Application Load Balancer. Which AWS service should be used to automate this deployment?

Accepted Answer

AWS CodeDeploy. Option C is correct. AWS CodeDeploy supports blue/green deployments for EC2 instances behind a load balancer, allowing traffic to be shifted gradually. Option A (Elastic Beanstalk) is a PaaS service, not for existing Auto Scaling groups. Option B (CloudFormation) can create infrastructure but not manage traffic shifting natively. Option D (CodePipeline) orchestrates steps but relies on CodeDeploy for the deployment.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CloudFormation

Question 5

A company uses AWS CloudFormation to deploy a multi-tier application. The administrator wants to ensure that the database layer is fully provisioned and available before the application layer starts. How can this be achieved?

Accepted Answer

Use the DependsOn attribute on the application layer resources to depend on the database layer.. Option D is correct. Using CloudFormation's DependsOn attribute ensures that the database resource is created before the application resource. Option A (wait conditions) is used for external signals, not for resource dependencies. Option B (creation policy) is for signaling from within an instance. Option C (nested stacks) does not inherently order resources across stacks.

Answer

Create separate stacks for the database and application layers.

Answer

Use a CloudFormation creation policy on the application instances.

Answer

Use a CloudFormation wait condition in the database stack.

Question 6

A company needs to deploy a set of microservices using Docker containers on AWS. The deployment should be automated and support scaling based on demand. Which AWS service should be used to orchestrate the containers?

Accepted Answer

Amazon ECS. Option D is correct. Amazon ECS is a fully managed container orchestration service that integrates with Auto Scaling and CloudWatch. Option A (Lambda) is for serverless functions, not containers. Option B (Elastic Beanstalk) can deploy containers but is less flexible for microservices. Option C (CodeDeploy) is for application deployments, not orchestration.

Answer

AWS Lambda

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 7

A SysOps administrator is using AWS CodePipeline to automate the build and deploy process for a Java application. The build stage uses AWS CodeBuild, and the deploy stage uses AWS CodeDeploy to deploy to an Auto Scaling group. The deployment fails intermittently with a 'Timeout' error. What should the administrator check first?

Accepted Answer

The health check grace period on the load balancer.. Option A is correct. The most common cause of timeout in CodeDeploy is the health check grace period on the load balancer being too short. Increasing the grace period allows the new instances to pass health checks. Option B (buildspec) is for CodeBuild, not deployment. Option C (S3 bucket) would cause a different error. Option D (instance profile) would cause permission errors.

Answer

The IAM instance profile for the EC2 instances.

Answer

The buildspec.yml file for syntax errors.

Answer

The S3 bucket permissions for CodePipeline artifacts.

Question 8

A SysOps administrator is deploying a new application using AWS CloudFormation. The template includes an EC2 instance with a UserData script that installs software from a private S3 bucket. What is the BEST way to ensure the EC2 instance can access the S3 bucket without storing long-term credentials on the instance?

Accepted Answer

Create an IAM role with S3 access and associate it with the instance profile.. Option D is correct because assigning an IAM role to the EC2 instance allows it to obtain temporary credentials via the instance metadata service, which is the recommended secure method. Option A is wrong because storing access keys in UserData is insecure. Option B is wrong because instance profiles require IAM roles, not direct IAM user credentials. Option C is wrong because security groups control network access, not authentication to S3.

Answer

Create an IAM user with S3 access and attach the access key to the instance profile.

Answer

Store the access key ID and secret access key in the UserData script.

Answer

Configure a security group rule that allows the instance to reach S3 via VPC endpoint.

Question 9

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running a single instance. The SysOps administrator needs to update the application to a new version with zero downtime. What should the administrator do?

Accepted Answer

Perform an immutable update in the Elastic Beanstalk environment.. Option A is correct because an immutable update launches a new instance with the new version and then swaps the old instance, ensuring zero downtime. Option B is wrong because rolling updates on a single instance still cause a brief downtime. Option C is wrong because Blue/Green deployment requires two environments. Option D is wrong because the RDS instance is separate; swapping it does not update the application.

Answer

Perform a rolling update with a batch size of 1.

Answer

Perform a Blue/Green deployment by swapping environment URLs.

Answer

Update the application version and swap the RDS database.

Question 10

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource. The error message states: 'The runtime parameter of nodejs8.10 is no longer supported.' The administrator needs to resolve this with minimal changes. What should the administrator do?

Accepted Answer

Update the CloudFormation template to use a supported Node.js runtime, such as nodejs14.x.. Option B is correct because the error indicates the runtime is deprecated; updating the runtime to a supported version (e.g., nodejs14.x) resolves the issue. Option A is wrong because the Lambda function code is likely compatible with a newer runtime. Option C is wrong because the runtime is specified in the CloudFormation template, not in the Lambda console. Option D is wrong because waiting will not fix the deprecated runtime.

Answer

Modify the Lambda function code to use Python 3.8.

Answer

Manually update the runtime in the AWS Lambda console after the stack creation fails.

Answer

Wait for AWS to re-enable the nodejs8.10 runtime.

Question 11

A SysOps administrator is provisioning an Auto Scaling group (ASG) for a stateless web application. The ASG should launch EC2 instances in multiple Availability Zones. The administrator needs to ensure that instances are evenly distributed across Availability Zones. Which configuration should the administrator use?

Accepted Answer

Create subnets in multiple Availability Zones and specify them in the Auto Scaling group.. Option C is correct because setting the Auto Scaling group to use multiple subnets in different Availability Zones and the 'balanced best effort' distribution policy ensures even distribution. Option A is wrong because a single subnet limits to one AZ. Option B is wrong because same-AZ subnets don't provide multi-AZ. Option D is wrong because 'availability-zone' health check is not a distribution policy.

Answer

Use an 'availability-zone' health check type in the Auto Scaling group.

Answer

Create the Auto Scaling group with a single subnet in one Availability Zone.

Answer

Create subnets in multiple Availability Zones but assign them to the same placement group.

Question 12

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The SysOps administrator checks the deployment logs and finds that the application installation script exits with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The AppSpec file contains a lifecycle hook that fails.. Option D is correct because a non-zero exit code from the AppSpec lifecycle hook (e.g., ApplicationStop, BeforeInstall) causes the deployment to fail. Option A is wrong because insufficient capacity would trigger a different error. Option B is wrong because an outdated agent would show a different error. Option C is wrong because security groups do not affect script execution exit codes.

Answer

The Auto Scaling group does not have enough instances to meet the minimum capacity.

Answer

The security group for the instances blocks outbound traffic to CodeDeploy endpoints.

Answer

The CodeDeploy agent is outdated on the instances.

Question 13

A SysOps administrator is managing a CloudFormation stack that creates an Amazon RDS DB instance. The stack uses the 'DBInstance' resource with a 'DeletionPolicy' attribute set to 'Delete'. The administrator wants to modify the stack to retain the DB instance when the stack is deleted, but the change fails because the DB instance is in a state that does not allow modification. What is the MOST likely reason?

Accepted Answer

The DeletionPolicy attribute cannot be changed after the stack is created.. Option A is correct because the DeletionPolicy attribute is immutable after the resource is created; to change it, you must create a new stack or use a different resource name. Option B is wrong because RDS does not have a backup window restriction for DeletionPolicy changes. Option C is wrong because the DeletionPolicy is applied at deletion, not creation. Option D is wrong because deletion protection is a separate property.

Answer

The stack is in a 'CREATE_COMPLETE' state and cannot be updated.

Answer

The DB instance has deletion protection enabled.

Answer

The DB instance is in a maintenance window that prevents modifications.

Question 14

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The solution must track changes and allow rollbacks. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. Option B is correct because AWS CloudFormation provides infrastructure as code with change tracking and rollback capabilities. Option A is wrong because AWS Config is for compliance and auditing, not provisioning. Option C is wrong because AWS OpsWorks is a configuration management service, not primarily IaC. Option D is wrong because AWS Service Catalog is for managing approved products, not general IaC.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Question 15

A company uses AWS Systems Manager to automate patching of EC2 instances. The SysOps administrator creates a Maintenance Window that targets a list of instances. The patching task fails with the error: 'Instance is not in a supported state.' What should the administrator check FIRST?

Accepted Answer

Verify that the SSM Agent is installed and running on the instance.. Option C is correct because Systems Manager requires the SSM Agent to be installed and running on the instance to execute commands. Option A is wrong because instance profiles are for IAM roles, not patching. Option B is wrong because security groups affect network access, not the agent. Option D is wrong because patching does not require a public IP.

Answer

Verify that the instance has a public IP address.

Answer

Verify that the instance's security group allows inbound traffic from Systems Manager.

Answer

Verify that the instance has an IAM instance profile attached with the necessary permissions.