SOA-C02 Deployment, Provisioning, and Automation Practice Test 3 — 15 Questions

Question 1

A company manages multiple AWS accounts under AWS Organizations. The SysOps administrator needs to deploy a baseline set of AWS Config rules and an Amazon SNS topic to each account in the organization. The deployment must be centrally managed from the management account and automatically applied to any new member account added in the future. Which solution should the administrator use?

Accepted Answer

Create an AWS CloudFormation StackSet with the template containing the AWS Config rules and SNS topic. Configure the StackSet to deploy to the organization and enable automatic deployment to new accounts.. AWS CloudFormation StackSets can be deployed to an entire AWS Organizations organization or organizational units (OUs), and they support automatic deployment to new accounts added to the organization. By creating a StackSet with a template that defines the AWS Config rules and SNS topic, and enabling automatic deployment, the administrator ensures that every current and future member account receives the baseline configuration without manual intervention.

Answer

Use AWS Service Catalog to create a product that bundles the AWS Config rules and SNS topic. Grant each account access to launch the product.

Answer

Configure AWS Config conformance packs in the management account and use AWS Resource Access Manager to share them with member accounts.

Answer

Create an AWS Organizations Service Control Policy (SCP) that enforces the creation of AWS Config rules and SNS topics in every account.

Question 2

A SysOps administrator maintains an AWS CloudFormation stack that deploys an Amazon EC2 instance. The administrator needs to change the instance type from t2.micro to t3.micro. The administrator wants to review the proposed changes before applying them to ensure no unexpected resource replacement occurs. Which CloudFormation feature should the administrator use?

Accepted Answer

Create a change set from the updated template, review the changes, and then execute the change set.. Option B is correct because a change set allows the administrator to review the proposed modifications (including whether any resource replacement will occur) before applying them. By creating a change set from the updated template, the administrator can inspect the list of changes, such as the instance type update, and confirm that no unexpected resource replacement (e.g., a new EC2 instance being created) will happen. Only after reviewing the change set can the administrator safely execute it to apply the changes.

Answer

Use the AWS CloudFormation console to directly update the stack with the new instance type and monitor the events.

Answer

Use the AWS CloudFormation drift detection feature to check for differences between the stack and the template.

Answer

Modify the CloudFormation template locally and use the AWS CLI to validate it with 'aws cloudformation validate-template'.

Question 3

A SysOps administrator wants to deploy a new version of an application to an existing Auto Scaling group of Amazon EC2 instances. The deployment must minimize disruption by launching new instances, performing health checks, and shifting traffic to the new instances before terminating the old ones. Which AWS CodeDeploy deployment configuration should the administrator choose?

Accepted Answer

Blue/green. The blue/green deployment configuration in AWS CodeDeploy is designed to minimize disruption by provisioning a new set of instances (green environment), performing health checks against them, and then shifting traffic from the old instances (blue environment) to the new ones before terminating the old instances. This matches the requirement of launching new instances, health-checking, and shifting traffic before termination, which is not possible with in-place deployment types like rolling or all-at-once.

Answer

Rolling

Answer

AllAtOnce

Answer

Canary

Question 4

A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon RDS DB instance. The administrator needs to update the stack by changing a parameter that, if applied directly, would replace the database. The administrator wants to prevent accidental replacement during the update. Which CloudFormation feature should the administrator use?

Accepted Answer

Stack policy. A stack policy is a CloudFormation feature that defines which stack resources can be updated or replaced during a stack update. By setting a stack policy that explicitly denies replacement updates on the RDS DB instance, the administrator can prevent accidental replacement while still allowing other updates. This is the correct approach because it directly controls the update behavior at the resource level without requiring manual intervention.

Answer

Change sets

Answer

Resource-level permissions

Answer

Stack sets

Question 5

A SysOps administrator needs to deploy a new version of a web application using AWS Elastic Beanstalk. The deployment must achieve zero downtime and allow the administrator to validate the new version by running tests before routing production traffic to it. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option C) is correct because it launches a completely new set of instances in a new Auto Scaling group, deploys the new application version to them, and then swaps the environment's CNAME record from the old instances to the new ones only after all health checks pass. This ensures zero downtime and allows the administrator to run validation tests against the new instances before any production traffic is routed to them, as the old environment remains fully operational during the process.

Answer

Rolling

Answer

Rolling with additional batch

Answer

All at once

Question 6

A SysOps administrator is creating an AWS CloudFormation template to deploy a web server. The template must define an Amazon EC2 instance, a security group, and an Elastic IP. In which section of the template should these resources be declared?

Accepted Answer

Resources. In an AWS CloudFormation template, the Resources section is the mandatory block where all AWS resources (such as EC2 instances, security groups, and Elastic IPs) are declared and configured. The template's logic for creating, updating, and deleting these infrastructure components is defined exclusively within this section, making B the correct choice.

Answer

Parameters

Answer

Outputs

Answer

Mappings

Question 7

A SysOps administrator manages a fleet of Amazon EC2 instances that run critical software. The administrator needs to automatically apply security patches every Tuesday at 2 AM. The instances are part of an Auto Scaling group and must be patched without downtime. Which AWS Systems Manager feature should be used?

Accepted Answer

Maintenance Windows. Maintenance Windows is the correct choice because it allows you to schedule a recurring window (every Tuesday at 2 AM) during which Systems Manager actions, such as patching, can be executed on EC2 instances. This feature is specifically designed to coordinate patching across Auto Scaling groups without downtime by ensuring instances are patched in a controlled manner, often using a patching rate or concurrency limit to maintain availability.

Answer

State Manager

Answer

Patch Manager

Answer

Run Command

Question 8

A SysOps administrator manages a CloudFormation stack that deploys a web application. The stack includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to update the stack to change the EC2 instance type. The administrator wants to ensure that the update does not accidentally replace the RDS database. Which CloudFormation feature should the administrator use to protect the RDS resource from being replaced during the stack update?

Accepted Answer

Use a stack policy that denies updates to the RDS resource.. A stack policy is an AWS CloudFormation feature that explicitly denies update or replacement actions on specified resources. By applying a stack policy that denies updates to the RDS resource, the administrator prevents any stack update operation (including changing the EC2 instance type) from modifying or replacing the database, even if the template changes would otherwise affect it. This is the correct approach because it provides a guardrail specifically against accidental replacement during updates.

Answer

Use a DeletionPolicy of Retain on the RDS resource.

Answer

Use the Resource Signal and CreationPolicy attributes.

Answer

Use a Change Set to review changes before executing.

Question 9

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS Systems Manager

Question 10

A SysOps administrator needs to deploy a set of AWS Lambda functions and an Amazon API Gateway API using infrastructure as code. The administrator wants to manage the deployment across multiple environments (dev, test, prod) with consistent resource configurations. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define and provision AWS resources, including Lambda functions and API Gateway APIs, using templates. It supports managing deployments across multiple environments (dev, test, prod) by using parameters, mappings, and stacks, ensuring consistent resource configurations through repeatable, version-controlled templates.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Question 11

A SysOps administrator is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to ensure that updates to the stack do not accidentally replace the RDS instance if the RDS configuration is changed in a way that would require replacement. Which CloudFormation attribute should be added to the RDS resource?

Accepted Answer

UpdateReplacePolicy with Retain. Option A is correct because the `UpdateReplacePolicy` attribute with `Retain` tells CloudFormation to preserve the existing RDS DB instance if a stack update would otherwise require its replacement. This prevents accidental deletion and recreation of the RDS instance when its configuration changes in a way that forces a new physical resource, such as modifying the DB engine version or storage type. The `UpdateReplacePolicy` is specifically designed for update scenarios, unlike `DeletionPolicy` which only applies during stack deletion.

Answer

DeletionPolicy with Retain

Answer

StackPolicy

Answer

CreationPolicy

Question 12

A company uses AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The SysOps administrator needs to implement a deployment strategy that ensures zero downtime by creating a new set of instances alongside the current ones, then gradually shifting traffic to the new instances after they pass health checks. If a problem is detected, traffic can be instantly redirected back to the original instances. Which deployment configuration should the administrator use?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct choice because it creates a completely new set of instances (green environment) alongside the existing ones (blue environment), shifts traffic gradually to the new instances after health checks pass, and allows instant rollback by redirecting traffic back to the original instances. AWS CodeDeploy supports this strategy natively with a blue/green deployment configuration, ensuring zero downtime during the transition.

Answer

Rolling update

Answer

All at once deployment

Answer

Canary deployment

Question 13

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and a security group. The administrator wants to ensure that when the stack is updated, the security group is not accidentally replaced if its properties change. The administrator wants to receive a failure if an update would require replacement of the security group. Which CloudFormation feature should the administrator use?

Accepted Answer

Define a stack policy that denies replacement of the security group resource.. Option C is correct because a stack policy can explicitly deny update actions that would replace a resource, such as the security group. By defining a stack policy with a Deny statement for the 'Replace' effect on the security group's logical resource ID, CloudFormation will fail the update if any property change triggers a replacement, preventing accidental deletion and recreation.

Answer

Add a 'DeletionPolicy' attribute set to 'Retain' on the security group resource.

Answer

Add a 'CreationPolicy' attribute to the security group resource.

Answer

Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' on the security group.

Question 14

A SysOps administrator needs to deploy a web application stack consisting of an Amazon EC2 instance, an Amazon RDS database, and an Application Load Balancer. The administrator wants to define the infrastructure as code and version control it. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define and provision AWS resources—such as EC2 instances, RDS databases, and Application Load Balancers—using declarative templates (JSON or YAML). These templates can be version-controlled in a repository like Git, enabling repeatable, auditable deployments. Elastic Beanstalk abstracts infrastructure management but does not give you the same level of granular control over individual resources as CloudFormation.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 15

A SysOps administrator needs to deploy the same AWS CloudFormation template across multiple AWS accounts and Regions in a single operation. The administrator wants to manage the deployment from a single management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy the same template across multiple accounts and Regions from a single management account. StackSets uses a self-managed or service-managed permission model to create, update, and delete stacks across target accounts in a single operation, making it the correct choice for this multi-account, multi-Region deployment requirement.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog