SOA-C02 Deployment, Provisioning, and Automation Practice Test 2 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an EC2 instance, an RDS database, and an Application Load Balancer. The SysOps administrator wants to ensure that the database is not replaced during an update if the administrator accidentally changes a property that requires replacement. Which THREE actions should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a custom resource backed by a Lambda function to manage the database.. The correct answers are A, B, and E. A is correct because a custom resource backed by Lambda can manage the database outside the CloudFormation lifecycle, preventing accidental replacement. B is correct because setting DeletionPolicy: Retain on the RDS resource ensures that if the resource is deleted during a stack update (e.g., due to a property change requiring replacement), the actual database is retained. E is correct because a stack policy can deny updates to the RDS instance, preventing modifications that would trigger replacement. C is incorrect: placing the RDS instance in a separate nested stack does not prevent replacement; it only isolates the resource, but replacement can still occur. D is incorrect: termination protection prevents stack deletion, not resource replacement within an update.

Answer

Place the RDS instance in a separate nested stack.

Answer

Enable termination protection on the CloudFormation stack.

Question 2

A SysOps administrator creates an IAM policy that grants s3:PutObject permission to the bucket 'my-bucket' (arn:aws:s3:::my-bucket) and attaches it to an IAM role used by an application. The application needs to upload objects to a subfolder named 'uploads/' in the bucket. The uploads fail with an access denied error. What is the most likely cause?

Accepted Answer

The policy does not grant s3:PutObject permission to the 'uploads/' prefix.. The policy likely grants s3:PutObject permission only to the bucket root (arn:aws:s3:::my-bucket) or to a different prefix, not to the 'uploads/' subfolder. To allow uploads to the subfolder, the resource ARN must include the full path, e.g., arn:aws:s3:::my-bucket/uploads/*. Therefore, the correct answer is D.

Answer

The IAM role does not have permission to assume the role.

Answer

The application is using the wrong AWS credentials.

Answer

The policy does not include the 's3:PutObject' action for the bucket itself.

Question 3

A company uses AWS CloudFormation to deploy EC2 instances. The stack creation fails with the error 'Resource creation cancelled' after 20 minutes. What is the most likely cause?

Accepted Answer

The EC2 instance creation exceeded the CloudFormation timeout. The error 'Resource creation cancelled' typically occurs when the CloudFormation stack creation times out. CloudFormation allows you to set a stack creation timeout (via the TimeoutInMinutes parameter). If the time expires before resources are fully created, CloudFormation cancels the operation. In this scenario, the EC2 instance likely took longer than the 20-minute timeout configured for the stack, causing CloudFormation to cancel the resource creation. Option A is incorrect because an unsupported template format would cause a validation error before resource creation starts. Option C is incorrect because an unavailable instance type would cause an immediate API error. Option D is incorrect because insufficient IAM permissions would cause an immediate access denied error.

Answer

The CloudFormation template uses an unsupported template format

Answer

The instance type specified is not available in the chosen Availability Zone

Answer

Insufficient IAM permissions for CloudFormation to create EC2 instances

Question 4

A SysOps administrator is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. What should the administrator check FIRST?

Accepted Answer

The ApplicationStop lifecycle event hook script in the AppSpec file. The error message 'too many individual instances failed deployment' typically points to a lifecycle event hook failing on the instances. The ApplicationStop hook runs before the new revision is installed and is the most common culprit because a stale or buggy stop script prevents the deployment from proceeding. Checking the AppSpec's ApplicationStop script first is the fastest way to identify why instances are failing.

Answer

The CodeDeploy agent version on the instances

Answer

The Auto Scaling group's minimum size

Answer

The load balancer health check configuration

Question 5

A company uses AWS CloudFormation to manage infrastructure. The administrator wants to update a stack that contains an RDS DB instance. The update requires replacing the DB instance. What should the administrator do to minimize downtime?

Accepted Answer

Use a CloudFormation stack update with a Replacement update policy and a snapshot. To truly minimize downtime, you would need to create a new DB instance, restore data from a snapshot, and update the application to point to the new endpoint before removing the old instance. Simply setting `UpdateReplacePolicy: Snapshot` and updating the stack does not automatically populate the new instance or update the application. Therefore none of the provided options fully solves the requirement.

Answer

Delete the stack and create a new one with the updated template

Answer

Disable deletion protection on the DB instance before the update

Answer

Modify the DB instance endpoint in the application configuration after update

Question 6

An administrator is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS Elastic Beanstalk. The build succeeds, but the deployment fails with 'Access Denied' when Elastic Beanstalk tries to read the artifact from S3. What should the administrator check?

Accepted Answer

The IAM role assumed by the Elastic Beanstalk environment. When Elastic Beanstalk deploys, the environment's EC2 instances assume an instance profile (the environment's IAM role) to download the application artifact from the S3 bucket. If that role lacks s3:GetObject permission on the artifact bucket, the deployment fails with Access Denied. The administrator should verify the IAM role attached to the Elastic Beanstalk environment has the required S3 read permissions.

Answer

The IAM role used by CodeBuild

Answer

Whether the artifact bucket is in the same region as the pipeline

Answer

The S3 bucket policy for the artifact bucket

Question 7

Which THREE steps are required to deploy a serverless application using AWS CloudFormation? (Choose three.)

Accepted Answer

Use the AWS::Serverless::Transform to enable SAM. Option A is correct because deploying a serverless application with CloudFormation typically uses the AWS::Serverless::Transform (the SAM transform, i.e., AWS::Serverless-2016-10-31) to convert SAM syntax into standard CloudFormation resources. Option B is correct because the template must specify the path to the source code (for example, CodeUri pointing to the local or S3 location of the Lambda code) so CloudFormation/SAM can package and deploy it. Option C is correct because the AWS::Serverless::Function resource is the core SAM resource that defines the Lambda function, its runtime, handler, and related event sources. Option D is not required because a VPC and subnets are optional for Lambda functions and only needed when the function must access VPC resources. Option E is not required because an S3 bucket for deployment artifacts is created or referenced automatically by the packaging/deployment process, not a mandatory manual step in the template.

Answer

Define a VPC and subnets for the Lambda function

Answer

Create an S3 bucket for the deployment artifact

Question 8

A CloudFormation stack creation failed. The administrator runs the command shown in the exhibit. What is the most likely reason for the failure?

Accepted Answer

The AMI ID specified in the template does not exist in the region. The most common cause of a CloudFormation stack failing immediately during EC2 resource creation is that the AMI ID referenced in the template does not exist in the region where the stack is being deployed. AMI IDs are region-specific, so an ID copied from us-east-1 will not resolve in eu-west-1 or ap-southeast-1, producing an InvalidAMIID.NotFound error and rolling the stack back.

Answer

The IAM role for CloudFormation does not have permission to launch EC2 instances

Answer

The stack is being created in a region that does not support the specified AMI

Answer

The instance type t2.micro is not supported in the target Availability Zone

Question 9

A SysOps administrator needs to deploy an application to a fleet of EC2 instances in an Auto Scaling group. The application code is stored in an S3 bucket. The administrator wants to automate the deployment so that new instances automatically download the latest code on launch. Which approach should the administrator use?

Accepted Answer

Create a lifecycle hook in the Auto Scaling group that triggers a Lambda function or runs a Systems Manager command to download the code.. Auto Scaling lifecycle hooks allow you to pause an instance in a wait state during launch or termination, enabling custom actions. By configuring a lifecycle hook that triggers a Lambda function or Systems Manager command, the administrator can download the latest application code from S3 before the instance enters service. This ensures new instances automatically get the code on launch.

Answer

Use AWS CloudFormation with a user data script that downloads the code from S3.

Answer

Use AWS Systems Manager Automation to run a document that downloads the code each time the instance is started.

Answer

Use AWS OpsWorks Stacks with a custom layer and a Chef recipe that downloads the code.

Question 10

A company is using Elastic Beanstalk to deploy a web application. Recently, a deployment failed due to a missing environment variable. The administrator fixed the configuration and wants to redeploy the same application version without rebuilding the source bundle. What is the MOST efficient way to redeploy?

Accepted Answer

Use the AWS CLI command aws elasticbeanstalk update-environment to update the environment, then use the same version label to deploy again.. The most efficient redeploy is to update the environment configuration (which includes environment variables) using aws elasticbeanstalk update-environment, then deploy the existing application version again by its version label. This avoids rebuilding or re-uploading the source bundle and reuses the same version artifact. Elastic Beanstalk applies the new configuration and redeploys the specified version.

Answer

Terminate the environment and create a new environment with the same configuration.

Answer

Upload a new application version with the same source bundle and deploy it to the environment.

Answer

Use the Elastic Beanstalk console to create a new environment with the same application version.

Question 11

A company is using Lambda functions to process data from an S3 bucket. The SysOps administrator needs to update the Lambda function code with a new version. The administrator wants to ensure that during the deployment, any in-flight requests are completed with the old code, and new requests use the new code. Which deployment strategy should the administrator use?

Accepted Answer

Create a new Lambda version and update the alias to gradually shift traffic from the old version to the new version using weighted routing.. Creating a new Lambda version and updating the alias to gradually shift traffic using weighted routing allows in-flight requests to complete with the old code while new requests are routed to the new version according to the weights. This is the standard method for safe deployments with Lambda.

Answer

Update the Lambda function code directly using the AWS CLI.

Answer

Use AWS CodeDeploy with a canary deployment configuration on the Lambda function.

Answer

Create a new Lambda function and update the S3 event notification to trigger the new function.

Question 12

A company is using AWS Elastic Beanstalk with a Blue/Green deployment strategy. After deploying a new version to the green environment and verifying it, the administrator wants to swap the CNAMEs to route production traffic to the green environment. However, the swap operation fails due to a CNAME already in use error. What is the MOST likely cause?

Accepted Answer

The CNAME prefix for the green environment is already in use by another environment in the same region.. Elastic Beanstalk requires each environment's CNAME prefix to be unique within an AWS region. If the green environment's CNAME prefix collides with an existing environment (including the blue one or any other), the swap fails with a 'CNAME already in use' error. This is the most likely cause of the described failure.

Answer

The green environment is using the same environment URL as the blue environment.

Answer

The load balancer is not configured to handle the traffic.

Answer

The green environment has failing health checks.

Question 13

A SysOps administrator is planning to deploy a web application using AWS Elastic Beanstalk. The application requires high availability across multiple Availability Zones. The administrator needs to configure the environment to automatically replace a failed instance. Which TWO configuration options should the administrator enable? (Choose TWO.)

Accepted Answer

Enable the environment's health check and set the health check path to a valid endpoint.. Option A is correct because Elastic Beanstalk relies on environment health checks (with a valid health check path/endpoint) to detect instance or application failures; when the environment health degrades, Elastic Beanstalk can replace unhealthy instances automatically. Option C is correct because configuring the environment's Auto Scaling group with a minimum of 2 instances across multiple Availability Zones provides high availability and lets Auto Scaling automatically replace a failed instance to maintain the desired capacity. Option B is not required for automatic instance replacement, since the load balancer distributes traffic but does not itself replace failed instances. Option D is incorrect because AWS OpsWorks Stacks is a separate configuration management service and is not used to manage Elastic Beanstalk instance lifecycle. Option E is incorrect because a CloudWatch alarm with an SNS notification only alerts on failure; it does not automatically replace the failed instance.

Answer

Attach an Application Load Balancer to distribute traffic to healthy instances.

Answer

Use AWS OpsWorks Stacks to manage the instance lifecycle.

Answer

Create a CloudWatch alarm that triggers an SNS notification when an instance fails.

Question 14

A SysOps administrator wants to deploy a new version of an application to an existing Elastic Beanstalk environment. The administrator runs the command shown in the exhibit and sees that the environment is healthy. What should the administrator do next to deploy the new version?

Accepted Answer

Run aws elasticbeanstalk update-environment --environment-name my-env --version-label v2.0. After creating an application version (which the exhibit implies was already done or is the prerequisite), the next step to deploy it to an existing Elastic Beanstalk environment is to update the environment with the new version label. The update-environment command with --version-label v2.0 tells Elastic Beanstalk to deploy that version to the running environment. This is the standard deployment workflow: create application version, then update environment.

Answer

Run aws elasticbeanstalk create-application-version --application-name my-app --version-label v2.0 --source-bundle S3Bucket="my-bucket",S3Key="app-v2.zip"

Answer

Run aws elasticbeanstalk update-application-version --application-name my-app --version-label v2.0 --environment-name my-env

Answer

Run aws elasticbeanstalk create-environment --application-name my-app --environment-name my-env-v2 --version-label v2.0

Question 15

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error 'CREATE_FAILED - Resource handler returned message: 'Invalid instance type specified'. The template uses a parameter for InstanceType. What is the most likely cause of this failure?

Accepted Answer

The InstanceType parameter is set to a value that is not allowed in the parameter's AllowedValues list.. The error indicates that EC2 rejected the specified instance type during resource creation. This can happen if the instance type is not a valid EC2 instance type, is not supported by the chosen AMI, or is not available in the target Availability Zone. CloudFormation's AllowedValues would not produce a resource handler error; it would cause a parameter validation failure before any resource is created.

Answer

The VPC specified in the template does not have internet access.

Answer

The Auto Scaling group's desired capacity exceeds the instance limit.

Answer

The template uses a DependsOn clause that creates a circular dependency.