SOA-C02 Deployment, Provisioning, and Automation Practice Test 2 — 15 Questions

Question 1

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The administrator needs to store and reference sensitive data such as database passwords in the stack without hardcoding them in the template. Which CloudFormation feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Systems Manager Parameter Store secure strings and dynamic references in the CloudFormation template. AWS CloudFormation supports dynamic references (using the `resolve:ssm` or `resolve:ssm-secure` syntax) that allow you to reference Systems Manager Parameter Store secure strings directly in the template. This keeps sensitive data like database passwords out of the template and the stack's metadata, ensuring they are not exposed in plaintext during stack operations or in the console.

Answer

Use AWS Secrets Manager and reference the secret using a static reference in the template

Answer

Define plaintext parameters in the template and mark them as NoEcho

Answer

Store the secrets in an encrypted S3 object and reference it via a URL in the template

Question 2

A SysOps administrator deploys a web application using AWS Elastic Beanstalk. The administrator wants to deploy a new application version with zero downtime and minimize the risk of failure by launching a completely new set of instances before swapping traffic. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option D) is correct because it launches a completely new set of instances in a separate Auto Scaling group, deploys the new application version to them, and then swaps the Elastic Load Balancer (ELB) traffic from the old instances to the new ones in a single, atomic swap. This ensures zero downtime and minimizes risk by keeping the original environment fully intact until the new instances pass health checks, allowing an immediate rollback by simply swapping traffic back.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 3

A company has multiple AWS accounts managed under AWS Organizations. The SysOps administrator needs to deploy a common AWS CloudFormation template to all accounts in a specific organizational unit (OU), ensuring consistent security group configurations across the organization. Which AWS service should the administrator use to perform this deployment?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy a common template across multiple accounts and regions from a single management account. In this scenario, the administrator can target the specific organizational unit (OU) within AWS Organizations, ensuring consistent security group configurations are applied to all member accounts without manual intervention.

Answer

AWS CodePipeline with cross-account actions

Answer

AWS Service Catalog portfolio

Answer

AWS Systems Manager Automation

Question 4

A SysOps administrator uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The administrator wants to ensure that during deployment, traffic is shifted from the original instances to the new instances incrementally in 10-minute intervals. The deployment should automatically roll back if any health check fails. Which deployment configuration should the administrator choose?

Accepted Answer

Custom deployment configuration with 25% every 10 minutes and traffic routing enabled. It allows a custom deployment configuration that shifts traffic in 10-minute intervals (e.g., 25% every 10 minutes) with automatic rollback on health check failure. The built-in configurations (AllAtOnce, OneAtATime, HalfAtATime) do not support incremental traffic shifting with time-based intervals; only a custom configuration can achieve the specified 10-minute interval requirement.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.HalfAtATime

Question 5

A SysOps administrator maintains an AWS CloudFormation stack for a web application. The administrator needs to update the stack to change the instance type of an Amazon EC2 instance. The administrator wants to review the changes before applying them and ensure that any updates that would replace the instance are clearly identified. Which CloudFormation feature should the administrator use?

Accepted Answer

Change Sets. Change Sets allow the administrator to preview the proposed changes to a CloudFormation stack before executing them. They clearly indicate whether a resource will be updated without replacement (e.g., modifying an attribute that supports in-place update) or replaced (e.g., changing the instance type of an EC2 instance, which requires recreation). This gives the administrator the ability to review the exact impact and identify any resource replacements before applying the update.

Answer

Stack Policies

Answer

Resource Signals

Answer

Nested Stacks

Question 6

A company uses AWS Elastic Beanstalk for a Java web application. The SysOps administrator needs to deploy a new version of the application with zero downtime and minimize the risk of failure. The administrator wants to deploy the new version to a completely new set of instances, test them, and then swap the environment's CNAME to point to the new instances. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option D) is correct because it launches a completely new set of instances in a separate Auto Scaling group, deploys the new application version to them, and then swaps the environment's CNAME to point to the new instances. This ensures zero downtime and minimizes risk by allowing full testing of the new instances before traffic is switched, and if the deployment fails, the original instances remain untouched.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 7

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The administrator needs to store and reference sensitive data such as database passwords in the stack without hardcoding them in the template. Which CloudFormation feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stack policy. A stack policy is a CloudFormation feature that defines which stack resources can be updated or replaced during a stack update. By setting a stack policy that explicitly denies replacement updates on the RDS DB instance, the administrator can prevent accidental replacement while still allowing other updates. This is the correct approach because it directly controls the update behavior at the resource level without requiring manual intervention.

Answer

Change sets

Answer

Resource-level permissions

Answer

Stack sets

Question 8

A SysOps administrator needs to deploy a new version of a web application using AWS Elastic Beanstalk. The deployment must achieve zero downtime and allow the administrator to validate the new version by running tests before routing production traffic to it. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option C) is correct because it launches a completely new set of instances in a new Auto Scaling group, deploys the new application version to them, and then swaps the environment's CNAME record from the old instances to the new ones only after all health checks pass. This ensures zero downtime and allows the administrator to run validation tests against the new instances before any production traffic is routed to them, as the old environment remains fully operational during the process.

Answer

Rolling

Answer

Rolling with additional batch

Answer

All at once

Question 9

A SysOps administrator is creating an AWS CloudFormation template to deploy a web server. The template must define an Amazon EC2 instance, a security group, and an Elastic IP. In which section of the template should these resources be declared?

Accepted Answer

Resources. In an AWS CloudFormation template, the Resources section is the mandatory block where all AWS resources (such as EC2 instances, security groups, and Elastic IPs) are declared and configured. The template's logic for creating, updating, and deleting these infrastructure components is defined exclusively within this section, making B the correct choice.

Answer

Parameters

Answer

Outputs

Answer

Mappings

Question 10

A SysOps administrator manages a fleet of Amazon EC2 instances that run critical software. The administrator needs to automatically apply security patches every Tuesday at 2 AM. The instances are part of an Auto Scaling group and must be patched without downtime. Which AWS Systems Manager feature should be used?

Accepted Answer

Maintenance Windows. Maintenance Windows is the correct choice because it allows you to schedule a recurring window (every Tuesday at 2 AM) during which Systems Manager actions, such as patching, can be executed on EC2 instances. This feature is specifically designed to coordinate patching across Auto Scaling groups without downtime by ensuring instances are patched in a controlled manner, often using a patching rate or concurrency limit to maintain availability.

Answer

State Manager

Answer

Patch Manager

Answer

Run Command

Question 11

A SysOps administrator needs to deploy a set of AWS Lambda functions and an Amazon API Gateway API using infrastructure as code. The administrator wants to manage the deployment across multiple environments (dev, test, prod) with consistent resource configurations. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define and provision AWS resources, including Lambda functions and API Gateway APIs, using templates. It supports managing deployments across multiple environments (dev, test, prod) by using parameters, mappings, and stacks, ensuring consistent resource configurations through repeatable, version-controlled templates.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Question 12

A SysOps administrator is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to ensure that updates to the stack do not accidentally replace the RDS instance if the RDS configuration is changed in a way that would require replacement. Which CloudFormation attribute should be added to the RDS resource?

Accepted Answer

UpdateReplacePolicy with Retain. The `UpdateReplacePolicy` attribute with `Retain` tells CloudFormation to preserve the existing RDS DB instance if a stack update would otherwise require its replacement. This prevents accidental deletion and recreation of the RDS instance when its configuration changes in a way that forces a new physical resource, such as modifying the DB engine version or storage type. The `UpdateReplacePolicy` is specifically designed for update scenarios, unlike `DeletionPolicy` which only applies during stack deletion.

Answer

DeletionPolicy with Retain

Answer

StackPolicy

Answer

CreationPolicy

Question 13

A SysOps administrator needs to deploy a web application stack consisting of an Amazon EC2 instance, an Amazon RDS database, and an Application Load Balancer. The administrator wants to define the infrastructure as code and version control it. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define and provision AWS resources—such as EC2 instances, RDS databases, and Application Load Balancers—using declarative templates (JSON or YAML). These templates can be version-controlled in a repository like Git, enabling repeatable, auditable deployments. Elastic Beanstalk abstracts infrastructure management but does not give you the same level of granular control over individual resources as CloudFormation.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 14

A SysOps administrator needs to deploy the same AWS CloudFormation template across multiple AWS accounts and Regions in a single operation. The administrator wants to manage the deployment from a single management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy the same template across multiple accounts and Regions from a single management account. StackSets uses a self-managed or service-managed permission model to create, update, and delete stacks across target accounts in a single operation, making it the correct choice for this multi-account, multi-Region deployment requirement.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog

Question 15

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The administrator needs to store and reference sensitive data such as database passwords in the stack without hardcoding them in the template. Which CloudFormation feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

StackPolicy. StackPolicy, is correct because a stack policy is a JSON document that defines which stack resources can be updated or replaced during a stack update. By setting a Deny effect on update actions for the EC2 instance, the administrator can prevent any property change that would cause replacement, causing the update to fail instead of replacing the instance. This directly meets the requirement to block accidental replacement.

Answer

CreationPolicy

Answer

DeletionPolicy

Answer

UpdateReplacePolicy