SOA-C02 Deployment, Provisioning, and Automation Practice Test 3 — 15 Questions

Question 1

A CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED. Which two actions are appropriate next steps? (Choose 2.)

Accepted Answer

Review stack events to identify the resource that blocked rollback.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED, the stack events provide detailed error messages for each resource that failed during rollback. Reviewing these events is essential to identify the specific resource that blocked the rollback, such as a resource that could not be deleted or updated due to permissions, dependencies, or configuration issues. This diagnosis is the first step before attempting a continue-update-rollback operation.

Answer

Delete the CloudFormation service role from IAM.

Answer

Rename the stack to force rollback completion.

Question 2

A company uses AWS CodeDeploy to deploy an application to Amazon EC2 instances. The SysOps administrator wants to implement a deployment strategy that minimizes risk by deploying the new version to a small number of instances first, verifying that the deployment is successful, and then deploying to the remaining instances. If the initial deployment fails, the process should stop and roll back. Which CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime, is correct because it deploys the new application revision to one instance at a time, checking for success before proceeding to the next. If any deployment step fails, the process stops and automatically rolls back, minimizing risk by limiting the blast radius of a bad deployment.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.Canary10Percent10Minutes

Question 3

Match each AWS networking concept to its description.

Accepted Answer

VPC: A logically isolated virtual network in the AWS cloud.. Correct matches: VPC is a virtual network, Subnet is an IP range segment, Internet Gateway enables internet access, Route Table controls traffic routing. Common confusions include mixing VPC with VPN and NAT Gateway direction.

Answer

VPC: A managed VPN service for connecting on-premises networks to AWS.

Answer

NAT Gateway: A component that allows inbound internet traffic to reach private instances.

Question 4

Match each AWS support plan to its key feature.

Accepted Answer

Basic: Access to AWS Support Community and forums. Basic provides community access, Developer provides business hours email, Business provides 24/7 support with 1-hour response, and Enterprise adds a TAM and faster response. Common confusions include swapping Business and Enterprise features.

Answer

Enterprise: 24/7 phone, email, and chat with 1-hour response to impaired production systems

Answer

Developer: 15-minute response to business-critical systems and a Technical Account Manager

Question 5

A DevOps engineer wants to automate the creation of an Amazon EC2 instance with a specific security group and IAM role. Which AWS service should be used to define the infrastructure as code?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service for provisioning infrastructure as code. AWS OpsWorks is for configuration management, CodeDeploy is for application deployment, and Elastic Beanstalk is a PaaS service.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Question 6

A company is using AWS CloudFormation to manage its infrastructure. A stack update fails because a change set includes a modification to an RDS database that triggers a replacement. The engineer needs to allow updates that may cause a replacement but wants to be warned first. What should the engineer do?

Accepted Answer

Create a change set and review it before executing the update.. Using a change set allows the engineer to review the changes before executing them. Disabling rollback on failure is not a warning mechanism, and using a nested stack does not provide a warning. The '--parameters' option does not warn about replacements.

Answer

Use the '--disable-rollback' flag when updating the stack.

Answer

Use a nested stack to isolate the RDS resource.

Answer

Use the '--parameters' option to specify a parameter that controls replacement.

Question 7

A SysOps administrator is troubleshooting a failed Auto Scaling group launch. The group uses a launch template that specifies an Amazon Linux 2 AMI. The instances fail to pass the EC2 health check and are terminated. The administrator checks the system log and finds that the instance boots but the cloud-init script fails due to a missing package repository. What is the most likely cause?

Accepted Answer

The AMI used by the launch template is outdated and the repositories are no longer valid.. If the AMI is outdated, the package repository URLs may be deprecated, causing cloud-init failures. The launch template version is not directly related to repository access. User data script problems could cause failures but the log points to a missing repository, which is often due to an outdated AMI. IAM role issues would affect API calls, not package repos.

Answer

The launch template is using an incorrect version.

Answer

The IAM instance profile does not have sufficient permissions.

Answer

The Auto Scaling group is in a private subnet without a NAT gateway.

Question 8

A company wants to deploy a new version of a web application to an Auto Scaling group of EC2 instances behind an Application Load Balancer. The deployment should be automated and must not cause downtime. Which AWS service should be used?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is the correct service because it is specifically designed for automated application deployments to EC2 instances, including those in Auto Scaling groups. It supports rolling updates to ensure zero downtime by gradually replacing instances. AWS CloudFormation is for infrastructure provisioning, not application deployment. AWS OpsWorks and AWS Elastic Beanstalk are higher-level services that abstract deployment but are not the dedicated deployment service that meets the requirement of automated, zero-downtime deployment to an existing Auto Scaling group.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 9

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The Security Team requires that all instances have a specific security patch installed. A SysOps administrator needs to verify compliance across all instances. What is the MOST efficient way to accomplish this?

Accepted Answer

Use AWS Systems Manager Patch Manager to scan and generate a compliance report.. AWS Systems Manager Patch Manager is designed to scan instances for missing patches and generate compliance reports, making it the most direct and efficient tool for verifying patch compliance. State Manager can enforce patch baselines but does not produce compliance reports. Inventory collects installed software data but not specifically patch compliance status. AWS Config requires custom rules and is less efficient than Patch Manager's built-in reporting.

Answer

Use AWS Config rules to check for the patch.

Answer

Use AWS Systems Manager State Manager to enforce the patch.

Answer

Use AWS Systems Manager Inventory to collect software inventory.

Question 10

A company is using AWS Elastic Beanstalk to deploy a web application. The application uses a custom Amazon Machine Image (AMI) that must be updated periodically. The SysOps administrator creates a new AMI and updates the Elastic Beanstalk environment's configuration. However, new instances are still launched with the old AMI. What is the most likely cause?

Accepted Answer

The environment is configured to use a launch template, and the AMI was not updated in the launch template.. Elastic Beanstalk uses a launch configuration or launch template. If the environment is configured to use a launch template, updating the AMI in the environment configuration may not update the template. The environment's platform version is separate from the AMI. The old AMI might not be deregistered, but that doesn't cause new instances to use it. Immutable updates are not relevant.

Answer

The environment is using an immutable update policy.

Answer

The environment's platform version is pinned to an older version.

Answer

The old AMI was not deregistered.

Question 11

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template references the secret using a dynamic reference. However, the stack creation fails with an error that the secret cannot be retrieved. What is the most likely cause?

Accepted Answer

The CloudFormation service role lacks permissions to read the secret.. To use dynamic references, the CloudFormation service role must have permission to read the secret. The stack name and parameters are not related to secret retrieval. The secret must be in the same region. The template syntax might be incorrect, but the most common issue is missing permissions.

Answer

The secret is in a different AWS Region.

Answer

The stack name does not match the secret name.

Answer

The template uses the wrong dynamic reference syntax.

Question 12

A company has a mission-critical application running on EC2 instances in an Auto Scaling group. The application stores state locally on the instance. The company wants to update the application to a new version with minimal downtime. The update requires a change to the instance configuration. What deployment strategy should be used?

Accepted Answer

Blue/green deployment. A blue/green deployment creates a new environment (green) with the new version and then switches traffic. This minimizes downtime and allows state to be handled by offloading to an external service. Rolling updates would cause downtime and state loss if instances are replaced. Immutable updates replace instances, causing state loss. Canary deployments are for testing, not full production updates.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 13

A SysOps administrator is creating a CloudFormation template to provision an Amazon S3 bucket with versioning enabled and server access logging. Which TWO properties must be configured in the AWS::S3::Bucket resource?

Accepted Answer

VersioningConfiguration. The `VersioningConfiguration` property must be set to `Enabled` to enable versioning on the S3 bucket. Option C is correct because the `LoggingConfiguration` property must specify the target bucket and prefix to enable server access logging. Both are explicit properties of the `AWS::S3::Bucket` resource in CloudFormation.

Answer