SOA-C02 Deployment, Provisioning, and Automation Practice Test 3 — 15 Questions

Question 1

A company is deploying a critical application using AWS CloudFormation. The deployment must be resilient to failures and ensure that resources are created in a specific order. The template defines a stack that includes an Amazon RDS database and an Auto Scaling group. The Auto Scaling group depends on the database being available. Which CloudFormation feature should the SysOps administrator use to ensure the database is fully created and available before the Auto Scaling group is created?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use a CreationPolicy on the RDS instance to signal when it is ready.. The correct approach is to use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use a CreationPolicy on the RDS instance so that it sends a signal only after it is fully available. DependsOn alone only waits until CloudFormation marks the RDS as created, which may not mean it is ready to accept connections. The CreationPolicy ensures that the RDS signals its readiness, and the DependsOn then causes the Auto Scaling group to wait for that signal. Option A is wrong because reversing the DependsOn would not help. Option C is wrong because cfn-signal is used with CreationPolicy, but placing it on the Auto Scaling group would wait for a signal from the database, not the other way around. Option D is wrong because DeletionPolicy affects deletion behavior, not creation order.

Answer

Use the DependsOn attribute on the RDS instance to wait for the Auto Scaling group.

Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use cfn-signal on the Auto Scaling group to wait for the database.

Answer

Use the DeletionPolicy attribute on the Auto Scaling group to ensure it is not deleted.

Question 2

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.. Option B is correct because adding a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources explicitly forces CloudFormation to create the Auto Scaling group only after both the ALB and the RDS database resources have been created, which directly satisfies the requirement that the group is created after the ALB and RDS database are fully created and available. Option D is correct because a CreationPolicy on the RDS database resource makes CloudFormation wait for a specified number of success signals (via the cfn-signal helper or an equivalent signal) before considering the database resource creation complete, ensuring the database is actually available before dependent resources proceed. Option A is incorrect because it lists only the ALB resource, so the Auto Scaling group would not wait for the RDS database, violating the requirement. Option C is incorrect because an UpdatePolicy applies to updates of an Auto Scaling group (for example, rolling updates) and does not control initial creation ordering or wait for a signal during stack creation. Option E is incorrect because a CreationPolicy on the Auto Scaling group would make the group wait for signals from its instances, which is unrelated to ensuring the ALB and RDS database are created first and does not establish the required dependency ordering.

Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.

Answer

Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.

Answer

Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.

Question 3

A company is using AWS Elastic Beanstalk to manage a web application. The SysOps administrator needs to update the application to a new version with zero downtime. Which THREE steps should the administrator take to achieve this? (Choose three.)

Accepted Answer

Create a new Elastic Beanstalk environment with the new application version, then swap the environment URLs.. Option B is correct because creating a new Elastic Beanstalk environment with the new application version and then swapping the environment URLs (CNAME swap) is the blue/green deployment approach, which provides zero-downtime since the old environment keeps serving traffic until the new one is fully healthy. Option D is correct because setting the environment's health check grace period gives new instances enough time to warm up and pass health checks before Elastic Beanstalk considers them unhealthy, preventing premature instance replacement during deployment. Option E is correct because a rolling update with batch size 1 combined with the 'Rolling based on Health' deployment policy and a pause time ensures instances are updated in small batches, and the deployment pauses to verify health before continuing, maintaining availability throughout. Option A is incorrect because terminating all existing instances at once causes downtime, directly contradicting the zero-downtime requirement. Option C is incorrect because setting the load balancer health check interval to 300 seconds only delays health check frequency and does not by itself enable zero-downtime deployment; it can even slow detection of unhealthy instances.

Answer

Terminate all existing instances and replace them with new ones.

Answer

Set the load balancer's health check interval to 300 seconds to allow more time for the new instances to become healthy.

Question 4

A company is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS database. The administrator needs to modify the DB instance class but wants to avoid downtime. Which TWO options should the administrator consider? (Choose two.)

Accepted Answer

Apply the change during the RDS maintenance window to control when the modification occurs.. Option A is correct because scheduling the DB instance class modification during the RDS maintenance window lets the administrator control when the change is applied, and RDS will perform the modification at that time, minimizing unexpected disruption. Option B is correct because a Multi-AZ deployment maintains a standby replica in another Availability Zone; when the instance class is modified, RDS can fail over to the standby (or apply changes with minimal interruption), avoiding significant downtime for the primary endpoint. Option C is incorrect because DeletionPolicy: Retain only preserves the resource if the stack is deleted or the resource is removed from the template; it does not affect modifying the DB instance class or downtime. Option D is incorrect because deleting and recreating the RDS instance causes downtime and data loss unless restored, which is not the goal. Option E is incorrect because snapshot and restore creates a new DB instance and involves downtime/data cutover, rather than an in-place modification with minimal interruption.

Answer

Set the DeletionPolicy attribute to Retain on the RDS instance.

Answer

Delete the current RDS instance and create a new one with the desired instance class.

Answer

Take a snapshot of the database and restore it with the new instance class.

Question 5

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Linux 2 AMI with specific security agents installed. The company wants to ensure that all environment instances use this custom AMI. Which combination of steps should be taken? (Choose two.)

Accepted Answer

Create a custom AMI using the Elastic Beanstalk platform as the base.. Option C is correct because Elastic Beanstalk requires custom AMIs to be built from an existing Elastic Beanstalk platform image (e.g., the Amazon Linux 2 platform AMI) so that the platform's baked-in components, such as the host manager and platform hooks, remain compatible with the environment. Option D is correct because the AMI ID for the environment's instances is specified through the Auto Scaling launch configuration, and Elastic Beanstalk lets you override it using the aws:autoscaling:launchconfiguration option setting with the ImageId key, which can be declared in a .ebextensions configuration file. Option A is incorrect because Elastic Beanstalk does not let you swap in an arbitrary AMI by associating a CloudFormation template with the environment; the launch configuration must reference a platform-compatible AMI. Option B is incorrect because CodeDeploy is an application deployment service and does not control which AMI the environment instances launch from. Option E is incorrect because Packer can build AMIs, but a custom AMI for Elastic Beanstalk must be based on the Elastic Beanstalk platform AMI, not an arbitrary base image.

Answer

Set the AMI ID in a CloudFormation template and associate it with the environment.

Answer

Use AWS CodeDeploy to deploy the application to the custom AMI.

Answer

Use Packer to create the custom AMI from any base image.

Question 6

A company needs to deploy a new version of a Lambda function. The deployment must be gradual, shifting 10% of traffic to the new version every 10 minutes until all traffic is served by the new version. If errors occur, the deployment should roll back immediately. Which deployment strategy should be used?

Accepted Answer

Canary deployment with AWS Lambda. A canary deployment with AWS Lambda allows traffic to be shifted gradually in increments (e.g., 10% every 10 minutes) and supports automatic rollback if errors are detected. Option A (blue/green with CodeDeploy) is not inherently gradual; it typically switches all traffic at once unless configured with a canary, but the question asks for the strategy, and 'canary' is the correct term. Option B (all-at-once) deploys immediately. Option C (rolling with ECS) is for container services, not Lambda. Therefore, option D is correct.

Answer

Blue/green deployment with AWS CodeDeploy

Answer

All-at-once deployment

Answer

Rolling deployment with Amazon ECS

Question 7

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not hard-coded in the application code. Which approach should be used?

Accepted Answer

Use Elastic Beanstalk environment properties to pass the credentials, referencing them from AWS Secrets Manager.. Elastic Beanstalk environment properties are injected into the application as environment variables at runtime, and they can reference values stored in AWS Secrets Manager so the actual credentials never appear in source code or on disk. This keeps secrets centralized, auditable, and rotatable without redeploying code. It is the AWS-recommended pattern for externalizing database credentials in Beanstalk.

Answer

Pass the credentials via EC2 user data when the instance launches.

Answer

Store the credentials in a configuration file in the application source code.

Answer

Store the credentials in an S3 bucket and retrieve them at runtime.

Question 8

A company is using AWS CodeDeploy to deploy a new version of an application to an Amazon ECS service. The deployment must be gradual to minimize impact. Which deployment type should be used?

Accepted Answer

Rolling update deployment. Amazon ECS supports rolling update deployments, which gradually replace running tasks with the new version to minimize impact. Option A is incorrect because linear deployments are a CodeDeploy deployment type for Lambda, not for ECS. Option C is incorrect because canary deployments are also typically used for Lambda or CodeDeploy, not for ECS services. Option D is incorrect because while ECS supports blue/green deployments, they involve a complete traffic shift after testing rather than a gradual process.

Answer

Linear deployment

Answer

Canary deployment

Answer

Blue/green deployment

Question 9

A company wants to use AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Linux 2 AMI with specific security agents installed. The company wants to ensure that all environment instances use this custom AMI. Which combination of steps should be taken? (Choose three.)

Accepted Answer

Configure the Elastic Beanstalk environment to use the custom AMI by specifying the AMI ID in the .ebextensions configuration.. To use a custom AMI with Elastic Beanstalk, you must first create the AMI from the Elastic Beanstalk platform image (option C) to ensure compatibility. Then, you must configure the environment to use this AMI, which can be done by specifying the AMI ID in the .ebextensions configuration (option A) and by using a configuration file in the .ebextensions folder to set the AMI ID for the Auto Scaling launch configuration (option E). Option B is incorrect because a CloudFormation template is not required; Elastic Beanstalk natively supports custom AMIs. Option D is incorrect because while AWS Image Builder can create AMIs, the custom AMI must be based on the Elastic Beanstalk platform image, not built from scratch. Therefore, the correct combination is A, C, and E.

Answer

Create a CloudFormation template to deploy the environment with the custom AMI.

Answer

Create a custom AMI using AWS Image Builder.

Question 10

A company is using AWS CodePipeline with a multi-branch strategy. They have a pipeline that deploys to a development environment. They want to create a new pipeline for a production environment that only deploys when code is merged to the 'main' branch. What is the most efficient way to set up the production pipeline?

Accepted Answer

Create a new pipeline using a CloudFormation template that defines the pipeline with the main branch as the source.. The most efficient way is to create a new pipeline using a CloudFormation template that defines the pipeline with the main branch as the source. This allows infrastructure as code, consistent configuration, and easy replication. Cloning and modifying is manual and error-prone; triggers and modifying existing pipeline are less efficient or don't meet the requirement of a separate production pipeline.

Answer

Clone the existing pipeline and modify the source stage to use the main branch.

Answer

Use CodeCommit triggers to start the pipeline only on pushes to main.

Answer

Modify the existing pipeline to include both development and production stages, with the production stage only running on manual approval.

Question 11

A company uses AWS Elastic Beanstalk to deploy a web application. The company wants to update the application to a new version with zero downtime. Which deployment policy should be used?

Accepted Answer

Immutable deployment. Immutable deployment (Option B) is the correct choice because it creates a new set of instances with the updated application version and then swaps the environment's CNAME to point to the new environment, ensuring absolutely zero downtime. Rolling deployment (Option A) also provides zero downtime by updating instances in batches, but it modifies existing instances and can cause a temporary reduction in capacity. All at once (Option C) causes downtime, and canary (Option D) is not a standard Elastic Beanstalk deployment policy for zero downtime.

Answer

Rolling deployment

Answer

All at once deployment

Answer

Canary deployment

Question 12

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Moving session state out of the instance into ElastiCache for Redis decouples the application from any single EC2 instance, so any instance in the Auto Scaling group can serve any user's request. This requires only changing the session store configuration (a connection string and client library), not rewriting session-handling logic, satisfying the 'minimal code changes' constraint while enabling true horizontal scaling and high availability.

Answer

Configure the Application Load Balancer with sticky sessions (session affinity).

Answer

Disable the feature that stores session state locally.

Answer

Modify the application to store session data in an Amazon RDS database.

Question 13

A SysOps administrator is troubleshooting a CloudFormation stack creation failure. The stack is designed to create an Amazon RDS DB instance with a specific parameter group. The error message indicates that the DB instance could not be created because the parameter group does not exist. The administrator has verified that the parameter group exists in the same region and account. What is the MOST likely issue?

Accepted Answer

The parameter group name in the template has a typo or does not match the actual resource name.. The correct answer is A. Since the administrator verified that the parameter group exists in the same region and account, the error 'parameter group does not exist' indicates the name specified in the template does not match the actual parameter group name (e.g., a typo). Option D would only be valid if the parameter group were defined in the same template and not yet created, but that contradicts the verification that it exists.

Answer

The VPC security group specified for the DB instance does not allow inbound traffic from the application tier.

Answer

The DB instance class requires a different parameter group family.

Answer

The parameter group resource is defined in the same template but is not linked to the DB instance using the 'DependsOn' attribute.

Question 14

A company is deploying a microservices application on Amazon ECS with Fargate. The SysOps administrator needs to implement a deployment strategy that minimizes downtime and allows for automated rollbacks if the new version fails health checks. Which TWO options should the administrator choose? (Choose TWO.)

Accepted Answer

Use a rolling update with the ECS service scheduler.. Option A (rolling update with the ECS service scheduler) minimizes downtime by gradually replacing old tasks with new ones while keeping the service available. Option B (configuring the ECS service to automatically roll back on deployment failure) enables the ECS deployment circuit breaker, which automatically reverts to the previous task definition if the new version fails health checks. Together, these two options satisfy both requirements. Option D (blue/green with CodeDeploy) is also a valid approach, but it already includes automatic rollback handling, so it does not need Option B; since the question asks for TWO options that together form the strategy, A and B are the coherent pair. Option E (canary with CodeDeploy) is also a valid deployment type for ECS, contradicting the original explanation.

Answer

Use an immutable deployment by replacing the entire Auto Scaling group.

Answer

Use a blue/green deployment with AWS CodeDeploy.

Answer

Use a canary deployment with AWS CodeDeploy.

Question 15

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application is deployed using a custom AMI that is updated monthly. The SysOps administrator uses a launch template that references the latest AMI ID via an AWS Systems Manager parameter. During a recent deployment, the administrator updated the AMI ID in the parameter, but the new instances launched by the Auto Scaling group still use the old AMI. The administrator confirms that the launch template is configured to reference the parameter. The Auto Scaling group has a desired capacity of 5, and the administrator manually terminates one instance to trigger a replacement. The new instance also uses the old AMI. What is the MOST likely cause?

Accepted Answer

The Auto Scaling group is using a cached version of the launch template and needs to be updated or have its instances replaced.. The Auto Scaling group caches the resolved AMI ID from the launch template at the time of instance launch. When the SysOps administrator updates the AMI ID in the Systems Manager parameter, the launch template still references the parameter, but the Auto Scaling group does not re-resolve the parameter for existing instances or for new instances launched under the same launch template version. To use the new AMI, the launch template must be updated to a new version or the Auto Scaling group must be forced to use the latest version (e.g., by updating the group's launch template version). Option A is incorrect because CloudWatch alarm configuration affects scaling triggers, not AMI resolution. Option B is incorrect because the IAM role for the Auto Scaling group is not required for the launch template to resolve the Systems Manager parameter; resolution occurs at the account level. Option D is incorrect because instance metadata service settings control access to instance metadata, not the AMI used for launch.

Answer

The Amazon CloudWatch alarm that triggers scaling is not configured correctly.

Answer

The IAM role associated with the Auto Scaling group does not have permission to read the Systems Manager parameter.

Answer

The instance metadata service (IMDS) is disabled on the launch template.