SOA-C02 Deployment, Provisioning, and Automation Practice Test 2 — 15 Questions

Question 1

A SysOps administrator uses AWS CloudFormation to deploy a three-tier application. The administrator has a single template that can be used for development, test, and production environments. The only differences between environments are the EC2 instance type and the RDS DB instance class. Which CloudFormation feature should the administrator use to define these environment-specific values without duplicating the template?

Accepted Answer

Parameters. Parameters allow you to input environment-specific values (e.g., EC2 instance type, RDS DB instance class) at stack creation or update time without modifying the template. This is the correct feature because the question explicitly requires defining values that differ per environment while reusing a single template.

Answer

Conditions

Answer

Mappings

Answer

Outputs

Question 2

A company uses AWS CloudFormation to deploy infrastructure. The SysOps administrator has a template that creates an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to reuse the same template for development, test, and production environments, where the only differences are the EC2 instance type and the RDS DB instance class. Which CloudFormation feature should be used to define these environment-specific values?

Accepted Answer

Parameters. Parameters are the correct CloudFormation feature because they allow you to pass environment-specific values (such as EC2 instance type and RDS DB instance class) into the template at stack creation or update time. This enables reuse of the same template across development, test, and production environments without modifying the template itself, simply by providing different parameter values for each environment.

Answer

Nested stacks

Answer

Mappings

Answer

Conditions

Question 3

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The admin has a template that creates an EC2 instance with a custom software stack. The software stack must be installed and configured using PowerShell scripts. The admin wants to minimize operational overhead by automating the creation of an AMI that includes the software stack, and the AMI should be rebuilt on a weekly basis to include the latest security patches. Which combination of AWS services should be used?

Accepted Answer

Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.. EC2 Image Builder is purpose-built for automating the creation, patching, and testing of custom AMIs. By defining a component that encapsulates the PowerShell scripts, creating a recipe that references that component, and scheduling a pipeline to run weekly, the administrator achieves fully automated, repeatable AMI builds with minimal operational overhead. This directly meets the requirement for weekly rebuilds with the latest security patches.

Answer

Use AWS Systems Manager Automation to run a PowerShell script on an existing EC2 instance, then manually create an AMI each week.

Answer

Use AWS CodePipeline with CodeBuild to run the PowerShell scripts and create an AMI using the AWS CLI, triggered by a weekly CloudWatch Events schedule.

Answer

Use Amazon EC2 Auto Scaling with a lifecycle hook to run the PowerShell script on instance launch, and schedule a weekly instance refresh.

Question 4

A company uses AWS CodeDeploy to deploy a new version of a web application to a fleet of Amazon EC2 instances. The SysOps administrator wants to shift 10% of traffic to the new version first, monitor for errors, and then after manual approval, deploy to the remaining 90%. Which CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.Canary10Percent5Minutes. Option C is correct because the Canary10Percent5Minutes deployment configuration shifts 10% of traffic to the new version, waits 5 minutes for monitoring, and then automatically deploys to the remaining 90%. This matches the requirement for a 10% traffic shift with a monitoring window, though the question specifies manual approval—CodeDeploy does not natively support manual approval within a deployment configuration; instead, you would combine this configuration with a manual approval step in a CodePipeline or use a lifecycle hook. However, among the given options, this is the only one that provides the 10% traffic shift and a built-in wait period.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

Custom configuration with 10% and manual approval

Question 5

A company uses AWS CloudFormation to deploy a multi-tier application. The template uses nested stacks. One of the nested stacks creates an Auto Scaling group. The administrator wants to update the Auto Scaling group's launch configuration to use a new AMI ID. The AMI ID is stored in AWS Systems Manager Parameter Store. The administrator wants to ensure that the stack update automatically uses the latest AMI ID value from Parameter Store. What should the administrator do?

Accepted Answer

Use a CloudFormation dynamic reference to the parameter store in the template.. Option A is correct because CloudFormation dynamic references for Systems Manager Parameter Store (using the `{{resolve:ssm:/parameter-name}}` syntax) automatically resolve the latest parameter value at stack creation or update time. This ensures that the launch configuration always uses the current AMI ID from Parameter Store without manual intervention or hardcoding.

Answer

Use a CloudFormation mapping to map the AMI ID.

Answer

Use a custom resource to call Systems Manager to retrieve the AMI ID.

Answer

Use a CloudFormation parameter with a default value that matches the AMI ID.

Question 6

A SysOps administrator needs to automatically deploy a new version of an application to a fleet of Amazon EC2 instances every time changes are pushed to the main branch of a code repository hosted on AWS CodeCommit. Which combination of AWS services should be used?

Accepted Answer

AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy.. AWS CodePipeline orchestrates the continuous delivery workflow by detecting changes in the CodeCommit repository, then automatically triggering AWS CodeBuild to compile and package the application, and finally deploying the new version to EC2 instances using AWS CodeDeploy. This combination provides a fully managed, end-to-end CI/CD pipeline that meets the requirement of deploying on every push to the main branch.

Answer

AWS CloudFormation and AWS CodeDeploy.

Answer

Amazon EventBridge and AWS Systems Manager.

Answer

AWS CloudTrail and AWS Lambda.

Question 7

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The administrator needs to store and reference sensitive data such as database passwords in the stack without hardcoding them in the template. Which CloudFormation feature should be used?

Accepted Answer

Use AWS Systems Manager Parameter Store secure strings and dynamic references in the CloudFormation template. Option A is correct because AWS CloudFormation supports dynamic references (using the `resolve:ssm` or `resolve:ssm-secure` syntax) that allow you to reference Systems Manager Parameter Store secure strings directly in the template. This keeps sensitive data like database passwords out of the template and the stack's metadata, ensuring they are not exposed in plaintext during stack operations or in the console.

Answer

Use AWS Secrets Manager and reference the secret using a static reference in the template

Answer

Define plaintext parameters in the template and mark them as NoEcho

Answer

Store the secrets in an encrypted S3 object and reference it via a URL in the template

Question 8

A SysOps administrator deploys a web application using AWS Elastic Beanstalk. The administrator wants to deploy a new application version with zero downtime and minimize the risk of failure by launching a completely new set of instances before swapping traffic. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option D) is correct because it launches a completely new set of instances in a separate Auto Scaling group, deploys the new application version to them, and then swaps the Elastic Load Balancer (ELB) traffic from the old instances to the new ones in a single, atomic swap. This ensures zero downtime and minimizes risk by keeping the original environment fully intact until the new instances pass health checks, allowing an immediate rollback by simply swapping traffic back.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 9

A company has multiple AWS accounts managed under AWS Organizations. The SysOps administrator needs to deploy a common AWS CloudFormation template to all accounts in a specific organizational unit (OU), ensuring consistent security group configurations across the organization. Which AWS service should the administrator use to perform this deployment?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy a common template across multiple accounts and regions from a single management account. In this scenario, the administrator can target the specific organizational unit (OU) within AWS Organizations, ensuring consistent security group configurations are applied to all member accounts without manual intervention.

Answer

AWS CodePipeline with cross-account actions

Answer

AWS Service Catalog portfolio

Answer

AWS Systems Manager Automation

Question 10

A company uses AWS CodePipeline to deploy a web application. The pipeline includes a stage that runs a database migration script. The SysOps administrator wants to ensure that if the migration script fails, the entire pipeline stops and the previous version of the application remains deployed. Which pipeline stage configuration should be used to achieve this behavior?

Accepted Answer

Configure the migration step as a sequential action and set the OnFailure to ABORT.. Option B is correct because setting the migration step as a sequential action with OnFailure set to ABORT ensures that if the migration script fails, the pipeline immediately stops and does not proceed to any subsequent stages. This prevents the deployment of a new application version that depends on a failed database migration, thereby keeping the previous version deployed.

Answer

Use a parallel action group for the migration step so other steps continue.

Answer

Configure the migration step as a sequential action and set the OnFailure to ROLLBACK.

Answer

Use a manual approval step after the migration to verify success.

Question 11

A SysOps administrator uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The administrator wants to ensure that during deployment, traffic is shifted from the original instances to the new instances incrementally in 10-minute intervals. The deployment should automatically roll back if any health check fails. Which deployment configuration should the administrator choose?

Accepted Answer

Custom deployment configuration with 25% every 10 minutes and traffic routing enabled. Option D is correct because it allows a custom deployment configuration that shifts traffic in 10-minute intervals (e.g., 25% every 10 minutes) with automatic rollback on health check failure. The built-in configurations (AllAtOnce, OneAtATime, HalfAtATime) do not support incremental traffic shifting with time-based intervals; only a custom configuration can achieve the specified 10-minute interval requirement.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.HalfAtATime

Question 12

A SysOps administrator maintains an AWS CloudFormation stack for a web application. The administrator needs to update the stack to change the instance type of an Amazon EC2 instance. The administrator wants to review the changes before applying them and ensure that any updates that would replace the instance are clearly identified. Which CloudFormation feature should the administrator use?

Accepted Answer

Change Sets. Change Sets allow the administrator to preview the proposed changes to a CloudFormation stack before executing them. They clearly indicate whether a resource will be updated without replacement (e.g., modifying an attribute that supports in-place update) or replaced (e.g., changing the instance type of an EC2 instance, which requires recreation). This gives the administrator the ability to review the exact impact and identify any resource replacements before applying the update.

Answer

Stack Policies

Answer

Resource Signals

Answer

Nested Stacks

Question 13

A company uses AWS Elastic Beanstalk for a Java web application. The SysOps administrator needs to deploy a new version of the application with zero downtime and minimize the risk of failure. The administrator wants to deploy the new version to a completely new set of instances, test them, and then swap the environment's CNAME to point to the new instances. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option D) is correct because it launches a completely new set of instances in a separate Auto Scaling group, deploys the new application version to them, and then swaps the environment's CNAME to point to the new instances. This ensures zero downtime and minimizes risk by allowing full testing of the new instances before traffic is switched, and if the deployment fails, the original instances remain untouched.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 14

A SysOps administrator is updating an AWS CloudFormation stack that contains an Amazon RDS DB instance. The administrator wants to prevent accidental replacement of the database during the update. Which CloudFormation feature should be used?

Accepted Answer

Stack policies. Stack policies are the correct feature because they allow you to define explicit deny statements that prevent CloudFormation from updating or replacing specific resources, such as an RDS DB instance, during a stack update. By setting a stack policy that denies replacement actions on the database resource, the administrator ensures that even if the template changes would normally trigger a replacement, the update will fail rather than accidentally recreate the database.

Answer

Change sets

Answer

Resource signals

Answer

Nested stacks

Question 15

A SysOps administrator needs to deploy a new version of a web application to Amazon EC2 instances using AWS Elastic Beanstalk. The administrator wants to deploy the new version with zero downtime and validate the new version before routing production traffic to it. Which deployment policy should be used?

Accepted Answer

Immutable. Immutable deployment is correct because it launches a completely new set of EC2 instances in a separate Auto Scaling group, deploys the new application version to them, and passes health checks before swapping the environment's CNAME record to point to the new instances. This ensures zero downtime and allows validation of the new version before any production traffic is routed to it, as the old instances remain untouched until the swap is complete.

Answer

All at once

Answer

Rolling

Answer

Traffic splitting