SOA-C02 Deployment, Provisioning, and Automation Practice Test 17 — 15 Questions

Question 1

A SysOps administrator needs to deploy a new version of a web application to Amazon EC2 instances using AWS Elastic Beanstalk. The administrator wants to deploy the new version with zero downtime and validate the new version before routing production traffic to it. Which deployment policy should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immutable. Immutable deployment is correct because it launches a completely new set of EC2 instances in a separate Auto Scaling group, deploys the new application version to them, and passes health checks before swapping the environment's CNAME record to point to the new instances. This ensures zero downtime and allows validation of the new version before any production traffic is routed to it, as the old instances remain untouched until the swap is complete.

Answer

All at once

Answer

Rolling

Answer

Traffic splitting

Question 2

A company manages multiple AWS accounts under AWS Organizations. The SysOps administrator needs to deploy a baseline set of AWS Config rules and an Amazon SNS topic to each account in the organization. The deployment must be centrally managed from the management account and automatically applied to any new member account added in the future. Which solution should the administrator use?

Accepted Answer

Create an AWS CloudFormation StackSet with the template containing the AWS Config rules and SNS topic. Configure the StackSet to deploy to the organization and enable automatic deployment to new accounts.. AWS CloudFormation StackSets can be deployed to an entire AWS Organizations organization or organizational units (OUs), and they support automatic deployment to new accounts added to the organization. By creating a StackSet with a template that defines the AWS Config rules and SNS topic, and enabling automatic deployment, the administrator ensures that every current and future member account receives the baseline configuration without manual intervention.

Answer

Use AWS Service Catalog to create a product that bundles the AWS Config rules and SNS topic. Grant each account access to launch the product.

Answer

Configure AWS Config conformance packs in the management account and use AWS Resource Access Manager to share them with member accounts.

Answer

Create an AWS Organizations Service Control Policy (SCP) that enforces the creation of AWS Config rules and SNS topics in every account.

Question 3

A SysOps administrator maintains an AWS CloudFormation stack that deploys an Amazon EC2 instance. The administrator needs to change the instance type from t2.micro to t3.micro. The administrator wants to review the proposed changes before applying them to ensure no unexpected resource replacement occurs. Which CloudFormation feature should the administrator use?

Accepted Answer

Create a change set from the updated template, review the changes, and then execute the change set.. A change set allows the administrator to review the proposed modifications (including whether any resource replacement will occur) before applying them. By creating a change set from the updated template, the administrator can inspect the list of changes, such as the instance type update, and confirm that no unexpected resource replacement (e.g., a new EC2 instance being created) will happen. Only after reviewing the change set can the administrator safely execute it to apply the changes.

Answer

Use the AWS CloudFormation console to directly update the stack with the new instance type and monitor the events.

Answer

Use the AWS CloudFormation drift detection feature to check for differences between the stack and the template.

Answer

Modify the CloudFormation template locally and use the AWS CLI to validate it with 'aws cloudformation validate-template'.

Question 4

A SysOps administrator wants to deploy a new version of an application to an existing Auto Scaling group of Amazon EC2 instances. The deployment must minimize disruption by launching new instances, performing health checks, and shifting traffic to the new instances before terminating the old ones. Which AWS CodeDeploy deployment configuration should the administrator choose?

Accepted Answer

Blue/green. The blue/green deployment configuration in AWS CodeDeploy is designed to minimize disruption by provisioning a new set of instances (green environment), performing health checks against them, and then shifting traffic from the old instances (blue environment) to the new ones before terminating the old instances. This matches the requirement of launching new instances, health-checking, and shifting traffic before termination, which is not possible with in-place deployment types like rolling or all-at-once.

Answer

Rolling

Answer

AllAtOnce

Answer

Canary

Question 5

A SysOps administrator manages a CloudFormation stack that deploys a web application. The stack includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to update the stack to change the EC2 instance type. The administrator wants to ensure that the update does not accidentally replace the RDS database. Which CloudFormation feature should the administrator use to protect the RDS resource from being replaced during the stack update?

Accepted Answer

Use a stack policy that denies updates to the RDS resource.. A stack policy is an AWS CloudFormation feature that explicitly denies update or replacement actions on specified resources. By applying a stack policy that denies updates to the RDS resource, the administrator prevents any stack update operation (including changing the EC2 instance type) from modifying or replacing the database, even if the template changes would otherwise affect it. This is the correct approach because it provides a guardrail specifically against accidental replacement during updates.

Answer

Use a DeletionPolicy of Retain on the RDS resource.

Answer

Use the Resource Signal and CreationPolicy attributes.

Answer

Use a Change Set to review changes before executing.

Question 6

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS Systems Manager

Question 7

A company uses AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The SysOps administrator needs to implement a deployment strategy that ensures zero downtime by creating a new set of instances alongside the current ones, then gradually shifting traffic to the new instances after they pass health checks. If a problem is detected, traffic can be instantly redirected back to the original instances. Which deployment configuration should the administrator use?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct choice because it creates a completely new set of instances (green environment) alongside the existing ones (blue environment), shifts traffic gradually to the new instances after health checks pass, and allows instant rollback by redirecting traffic back to the original instances. AWS CodeDeploy supports this strategy natively with a blue/green deployment configuration, ensuring zero downtime during the transition.

Answer

Rolling update

Answer

All at once deployment

Answer

Canary deployment

Question 8

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and a security group. The administrator wants to ensure that when the stack is updated, the security group is not accidentally replaced if its properties change. The administrator wants to receive a failure if an update would require replacement of the security group. Which CloudFormation feature should the administrator use?

Accepted Answer

Define a stack policy that denies replacement of the security group resource.. A stack policy can explicitly deny update actions that would replace a resource, such as the security group. By defining a stack policy with a Deny statement for the 'Replace' effect on the security group's logical resource ID, CloudFormation will fail the update if any property change triggers a replacement, preventing accidental deletion and recreation.

Answer

Add a 'DeletionPolicy' attribute set to 'Retain' on the security group resource.

Answer

Add a 'CreationPolicy' attribute to the security group resource.

Answer

Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' on the security group.

Question 9

A company runs 200 EC2 Linux instances across three accounts. The security team requires that critical OS patches are applied automatically every Sunday at 2 AM UTC. Currently patches are applied manually and inconsistently. What is the recommended AWS-native solution?

Accepted Answer

Configure a Patch Manager patch baseline and maintenance window scheduled for Sunday 02:00 UTC; associate the Run Patch Baseline task with all EC2 instance targets. AWS Systems Manager Patch Manager, combined with a Maintenance Window, provides a fully AWS-native, automated solution for patching EC2 instances on a schedule. The Patch Manager service uses a patch baseline to define which patches are approved (e.g., critical OS patches), and the Maintenance Window triggers the 'AWS-RunPatchBaseline' SSM document at the specified time (Sunday 02:00 UTC) against all targeted instances. This eliminates manual effort and ensures consistent, auditable patching across multiple accounts and instances.

Answer

Create a cron job on each instance that runs 'yum update -y' every Sunday at 2 AM

Answer

Use AWS Config managed rules to detect unpatched instances and send SNS notifications for manual remediation

Answer

Build a CodePipeline that runs weekly, creates new AMIs with the latest patches, and replaces all instances via an Auto Scaling instance refresh

Question 10

Operators have been making direct changes to AWS resources (security group rules, IAM policy modifications) that were originally created by CloudFormation stacks. The team wants to identify which stacks and specific resources have drifted from their template definitions. What is the correct tool and operation sequence?

Accepted Answer

Run drift detection on each CloudFormation stack; review the results in the Drift status panel to see which resources have MODIFIED or DELETED status. AWS CloudFormation drift detection is the correct tool because it directly compares the current state of resources in a stack (including security group rules and IAM policies) against the stack's template definitions. Running drift detection on each stack and reviewing the Drift status panel reveals which resources have been modified or deleted outside of CloudFormation, providing the exact identification the team needs.

Answer

Enable AWS Config conformance packs that check CloudFormation stack compliance against desired template states

Answer

Re-deploy all stacks with the original templates using CloudFormation update-stack to overwrite any manual changes

Answer

Use AWS Trusted Advisor to identify resources that have been modified outside of their originating CloudFormation stacks

Question 11

A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?

Accepted Answer

Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket. SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.

Answer

Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script

Answer

Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script

Answer

Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in

Question 12

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

Accepted Answer

Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional. A CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Answer

Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it

Answer

Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement

Answer

Add a DeletionPolicy: Retain attribute to the RDS resource in the template

Question 13

A containerized API runs on Amazon ECS with an Application Load Balancer. The team wants to deploy new container versions with zero downtime, automatically route traffic to the new version only after health checks pass, and automatically roll back if error rates spike within 10 minutes of the shift. Which deployment strategy and configuration implements all three requirements?

Accepted Answer

Use CodeDeploy with the ECS blue/green deployment type, configure a Canary or Linear traffic shifting strategy, and attach a CloudWatch alarm for error rate as a deployment alarm. CodeDeploy's ECS blue/green deployment type supports canary or linear traffic shifting, which automatically routes traffic to the new version only after health checks pass. By attaching a CloudWatch alarm for error rate as a deployment alarm, CodeDeploy can automatically trigger a rollback if error rates spike within the specified monitoring period (e.g., 10 minutes), meeting all three requirements: zero downtime, health-check-gated traffic shifting, and automatic rollback on error rate spikes.

Answer

Update the ECS service with a rolling update deployment configuration and set the minimum healthy percent to 100

Answer

Create a second ECS service with the new task definition and use Route 53 weighted routing to shift traffic at the DNS level

Answer

Enable ECS circuit breaker on the service to roll back failed deployments automatically

Question 14

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot into the correct order.

Accepted Answer

Select the snapshot, then configure instance details, then configure security and parameters, then initiate restore.. Restoration starts by selecting the snapshot, then configuring instance details, security, and parameters, then initiating the restore.

Answer

Select the snapshot, then configure security and parameters, then configure instance details, then initiate restore.

Answer

Configure instance details, then select the snapshot, then configure security and parameters, then initiate restore.

Answer

Select the snapshot, then initiate restore, then configure instance details, then configure security and parameters.

Question 15

Drag and drop the steps to troubleshoot high CPU usage on an Amazon EC2 instance into the correct order.

Accepted Answer

Check CloudWatch metrics, then Connect to instance, then Identify high CPU process, then Analyze process behavior, then Take corrective action. The correct order for troubleshooting high CPU usage on an EC2 instance starts with checking CloudWatch metrics to confirm the issue and gain initial insights. Next, connect to the instance using SSH or Systems Manager to access the operating system. Then, identify the process causing high CPU using tools like top or ps. After identification, analyze the process to understand its behavior, such as checking logs or memory usage. Finally, take corrective action, which may include stopping, killing, or optimizing the process, or scaling the instance up. This sequence ensures efficient and accurate troubleshooting.

Answer

Connect to instance, then Check CloudWatch metrics, then Identify high CPU process, then Analyze process behavior, then Take corrective action

Answer

Check CloudWatch metrics, then Identify high CPU process, then Connect to instance, then Analyze process behavior, then Take corrective action

Answer

Check CloudWatch metrics, then Connect to instance, then Analyze process behavior, then Identify high CPU process, then Take corrective action