SOA-C02 Deployment, Provisioning, and Automation Practice Test 18 — 15 Questions

Question 1

A SysOps administrator is deploying a CloudFormation stack that includes an AWS::ECS::Service resource. The service uses a task definition that references a container image stored in Amazon ECR. The stack creation fails with the error: 'Unable to assume the service-linked role.' What is the MOST likely cause?

Accepted Answer

The ECS service-linked role does not exist in the account.. Option B is correct because ECS requires a service-linked role (AWSServiceRoleForECS) to manage resources, and if it does not exist, CloudFormation will fail. Option A is wrong because the task execution role is separate from the service-linked role. Option C is wrong because ECR permissions are for pulling images, not for the service role. Option D is wrong because CloudFormation uses its own role, not the service-linked role.

Answer

The task execution role does not have permissions to pull the container image from ECR.

Answer

The CloudFormation service role does not have permission to create ECS resources.

Answer

The ECR repository policy does not grant access to the ECS service.

Question 2

A SysOps administrator is creating an Auto Scaling group using a launch template. The administrator wants to ensure that instances are automatically registered with an Application Load Balancer (ALB) target group. Which TWO steps are required? (Choose TWO.)

Accepted Answer

Configure the instance security group to allow traffic from the ALB.. Option B is correct because the target group ARN must be specified in the Auto Scaling group to enable automatic registration. Option D is correct because the security group must allow traffic from the ALB to the instance. Option A is wrong because health checks are configured on the target group, not the Auto Scaling group. Option C is wrong because the launch template does not attach to target groups. Option E is wrong because the ALB does not need a security group for health checks.

Answer

Configure health checks on the Auto Scaling group to use ELB.

Answer

Create a security group for the ALB and attach it to the Auto Scaling group.

Answer

Include the target group ARN in the launch template.

Question 3

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The update attempted to modify an Amazon RDS DB instance's storage type from gp2 to io1. The error message indicates that the modification is not supported. Which TWO reasons could cause this error? (Choose TWO.)

Accepted Answer

The DB instance is using an Oracle DB engine version that does not support storage type modification.. Option A is correct because CloudFormation stack updates that require replacement will fail if 'DeletionPolicy' is set to 'Retain' and the resource is replaced. Option C is correct because some storage modifications require a migration that is not supported for certain DB engine versions. Option B is wrong because storage type changes are generally allowed without enabling backup. Option D is wrong because maintenance windows do not affect the feasibility of modification. Option E is wrong because the allocated storage size can be changed during modification.

Answer

The DB instance does not have automated backups enabled.

Answer

The stack update is occurring during the DB instance's maintenance window.

Answer

The allocated storage size is below the minimum required for io1.

Question 4

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must deploy a serverless application using AWS SAM. The administrator wants to run integration tests after the deployment. Which THREE services should be used together? (Choose THREE.)

Accepted Answer

AWS CodePipeline. Option A is correct because CodePipeline orchestrates the pipeline. Option B is correct because AWS SAM is used to deploy serverless applications. Option C is correct because CodeBuild can run integration tests as part of the pipeline. Option D is wrong because CodeDeploy is for EC2/Lambda, but SAM is more appropriate for serverless. Option E is wrong because CodeCommit is a source repository, not for testing.

Answer

AWS CodeCommit

Answer

AWS CodeDeploy

Question 5

A company runs a critical production workload on a fleet of EC2 instances managed by an Auto Scaling group. The instances are behind an Application Load Balancer (ALB). Recently, the company experienced a regional outage that caused all instances to become unhealthy. The SysOps administrator must design a solution to automatically recover from such an outage with minimal downtime. The solution must be cost-effective and not require manual intervention. The administrator considers four options. Which option meets the requirements?

Accepted Answer

Configure the Auto Scaling group to launch instances across multiple Availability Zones and configure the ALB to route traffic to healthy targets.. Option C is correct because using an Auto Scaling group across multiple Availability Zones ensures that if one AZ fails, the ASG can launch instances in other AZs, and the ALB will route traffic to healthy instances. Option A is wrong because a warm standby in another region can be costly and may not be fully automated. Option B is wrong because increasing instance size does not provide AZ failover. Option D is wrong because manual scripts introduce single points of failure and latency.

Answer

Increase the desired capacity of the Auto Scaling group and use larger instance types to absorb the load during failover.

Answer

Create a warm standby environment in another AWS Region with a smaller Auto Scaling group. Use Route53 failover routing to switch traffic.

Answer

Use AWS Lambda to periodically check the health of instances and automatically relaunch failed instances in another region.

Question 6

A SysOps administrator is deploying a new web application using AWS Elastic Beanstalk. The application requires a high-performance relational database that can scale read capacity. The administrator needs to ensure that the database is highly available and can handle read replicas. The administrator creates an Elastic Beanstalk environment and adds an Amazon RDS DB instance. However, the database is deployed in a single Availability Zone. The administrator wants to modify the environment to use a Multi-AZ deployment for high availability and add read replicas. The administrator has the following options. Which option should the administrator choose?

Accepted Answer

Create a new Multi-AZ RDS DB instance with read replicas outside of Elastic Beanstalk. Update the environment's environment properties to point to the new database. Then delete the old DB instance.. Option A is correct because Elastic Beanstalk cannot add Multi-AZ or read replicas to an RDS instance that was created as part of the environment; the recommended approach is to decouple the database by creating a separate RDS instance outside of Elastic Beanstalk and then configuring the environment to connect to it. Option B is wrong because Elastic Beanstalk does not support converting a single-AZ DB to Multi-AZ after creation. Option C is wrong because read replicas require Multi-AZ or single-AZ with backups, but the environment's DB is not easily modified. Option D is wrong because increasing DB instance class does not provide Multi-AZ.

Answer

Increase the DB instance class size to improve performance and then create a read replica.

Answer

Create a read replica of the existing DB instance and then modify the environment to use the replica.

Answer

Modify the Elastic Beanstalk environment configuration to enable Multi-AZ for the existing DB instance.

Question 7

A SysOps administrator needs to automate the deployment of a three-tier web application. The application consists of an Application Load Balancer, a fleet of EC2 instances running a web server, and an Amazon RDS MySQL database. The administrator must ensure that the database credentials are securely stored and automatically rotated. The administrator also needs to version the infrastructure configuration. Which combination of AWS services should the administrator use?

Accepted Answer

AWS CloudFormation for infrastructure and AWS Secrets Manager for secrets.. Option C is correct because AWS CloudFormation provides infrastructure as code for versioning, and AWS Secrets Manager securely stores and rotates database credentials. Option A is wrong because AWS Systems Manager Parameter Store can store secrets but does not natively rotate RDS credentials. Option B is wrong because AWS OpsWorks is a configuration management service, not primarily for IaC. Option D is wrong because AWS CodeCommit is a source control service, not for secret management.

Answer

AWS CloudFormation for infrastructure and AWS Systems Manager Parameter Store for secrets.

Answer

AWS OpsWorks for infrastructure and AWS Secrets Manager for secrets.

Answer

AWS CodeCommit for infrastructure versioning and AWS KMS for secrets.

Question 8

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon EC2 instance and an associated security group. The stack creation fails with the error: 'Resource creation cancelled' after the security group is created but before the instance is launched. What is the MOST likely cause?

Accepted Answer

The EC2 instance resource configuration has an error.. Option D is correct because CloudFormation typically creates resources in parallel, but if one resource fails, it cancels others. The error indicates a dependency issue or a misconfiguration in the instance resource. Option A is wrong because the security group was created successfully. Option B is wrong because the stack was not deleted. Option C is wrong because AWS CloudFormation does not require a rollback trigger for a failed resource creation; it automatically rolls back.

Answer

The security group failed to create.

Answer

The stack was manually deleted during creation.

Answer

The stack's rollback trigger was not configured.

Question 9

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The application consists of several Docker containers that run on Amazon ECS with Fargate launch type. The engineer wants to automate the deployment of new container versions. Which AWS service should be used to orchestrate the build, test, and deployment stages?

Accepted Answer

AWS CodePipeline. Option B is correct because AWS CodePipeline is a fully managed continuous delivery service that helps automate the build, test, and deploy phases of the release process. Option A is wrong because AWS CodeBuild is for building and testing code, not for orchestrating the entire pipeline. Option C is wrong because AWS CodeDeploy is for deploying applications to compute services but does not orchestrate the entire pipeline. Option D is wrong because AWS CloudFormation is for infrastructure as code, not CI/CD orchestration.

Answer

AWS CodeDeploy

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Question 10

A company uses AWS OpsWorks to manage a stack of EC2 instances running a web application. They recently migrated to AWS Elastic Beanstalk for easier deployments. However, after the migration, some users report that the application is responding slowly during peak hours. The Elastic Beanstalk environment is configured with a load balancer and auto scaling based on average CPU utilization. What should the SysOps Administrator do to troubleshoot the performance issue?

Accepted Answer

Review the CloudWatch metrics and logs for the Elastic Beanstalk environment.. Option C is correct because reviewing CloudWatch metrics and logs from the Elastic Beanstalk environment can identify if the auto scaling policy is not aggressive enough or if there are other bottlenecks. Option A is wrong because OpsWorks is no longer used. Option B is wrong because switching to manual scaling is not a best practice. Option D is wrong because increasing instance size without analysis may be inefficient.

Answer

Manually scale the environment to add more instances.

Answer

Revert to the OpsWorks stack configuration.

Answer

Increase the instance size in the environment configuration.

Question 11

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Accepted Answer

Auto Scaling group. Option A and Option D are correct. An Auto Scaling group is used to maintain a desired number of instances across AZs, and an Application Load Balancer distributes traffic across those instances. Option B (NAT Gateway) is for outbound internet access, not high availability. Option C (S3 bucket) is for storage, not compute. Option E (Route 53 hosted zone) is for DNS, not directly for high availability of the application tiers.

Answer

NAT Gateway

Answer

Amazon S3 bucket

Answer

Amazon Route 53 hosted zone

Question 12

A company is using AWS CodeDeploy to deploy a new version of an application to a fleet of EC2 instances. The deployment is configured with a Blue/Green deployment type. During the deployment, the new instances pass all health checks, but the old instances are not being terminated automatically. The SysOps Administrator needs to ensure that the old instances are terminated after a successful deployment. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Configure the Blue/Green deployment settings to automatically terminate the original instances after a specified wait time.. Option A and Option C are correct. To automatically terminate old instances, the deployment group must be configured to re-use the original load balancer, and the original load balancer must be deregistered and then terminated after a specified wait time. Option B (registering instances to a new load balancer) is for green environment, not for termination. Option D (modifying the deployment group to not use load balancer) would break the deployment. Option E (changing deployment config to AllAtOnce) affects speed, not termination behavior.

Answer

Register the old instances to a new load balancer.

Answer

Change the deployment configuration to AllAtOnce.

Answer

Modify the deployment group to not use a load balancer.

Question 13

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS Multi-AZ DB instance. The stack creation fails with the error 'The DB instance already exists'. The SysOps Administrator needs to resolve this issue without modifying the template. Which THREE steps should the administrator take? (Choose THREE.)

Accepted Answer

Update the CloudFormation stack to change the deletion policy of the DB instance to Retain.. Option A, Option C, and Option E are correct. Deleting the existing DB instance allows CloudFormation to create a new one. Changing the deletion policy to Retain (Option C) ensures the existing DB instance is not deleted if the stack is updated. Changing the DB instance identifier (Option E) avoids the name conflict. Option B (importing the resource) is not possible without modifying the template. Option D (using a different stack name) does not resolve the resource conflict.

Answer

Use the CloudFormation resource import feature to bring the existing DB instance into the stack.

Answer

Use a different stack name in the CloudFormation template.

Question 14

A SysOps Administrator attached the IAM policy shown in the exhibit to a user. The user is unable to terminate an EC2 instance. What is the MOST likely reason?

Accepted Answer

An explicit Deny statement overrides the Allow statement.. Option C is correct. The Deny statement explicitly denies the ec2:TerminateInstances action, and an explicit Deny overrides any Allow. Option A is wrong because the policy allows ec2:* but the Deny takes precedence. Option B is wrong because ec2:* includes all ec2 actions. Option D is wrong because the policy allows all ec2 actions; the Deny is the cause.

Answer

The policy does not include ec2:TerminateInstances in the Allow statement.

Answer

The policy does not specify the correct resource ARN.

Answer

The policy does not allow ec2:* actions.

Question 15

A SysOps Administrator attempted to update a CloudFormation stack. The stack update failed and is now in UPDATE_ROLLBACK_IN_PROGRESS state as shown in the exhibit. What should the administrator do to recover the stack to a stable state?

Accepted Answer

Wait for the rollback to complete and then investigate the failure reason.. Option D is correct. Since the stack is in rollback, waiting for the rollback to complete is the appropriate action. The stack will attempt to roll back to the previous state. Option A is wrong because deleting the stack is not necessary; the rollback will restore the previous state. Option B is wrong because continuing the update would fail. Option C is wrong because executing a change set would require the stack to be in a stable state.

Answer

Delete the stack and recreate it.

Answer

Manually update the Auto Scaling group to correct the issue.

Answer

Execute a change set to fix the failed resource.