SOA-C02 Deployment, Provisioning, and Automation Practice Test 4 — 15 Questions

Question 1

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance. The administrator wants to ensure that if the stack is updated, the EC2 instance is not accidentally replaced if its properties change. The administrator wants the stack update to fail when a property change would require replacement. Which CloudFormation feature should the administrator use?

Accepted Answer

StackPolicy. Option C, StackPolicy, is correct because a stack policy is a JSON document that defines which stack resources can be updated or replaced during a stack update. By setting a Deny effect on update actions for the EC2 instance, the administrator can prevent any property change that would cause replacement, causing the update to fail instead of replacing the instance. This directly meets the requirement to block accidental replacement.

Answer

CreationPolicy

Answer

DeletionPolicy

Answer

UpdateReplacePolicy

Question 2

A CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED. Which two actions are appropriate next steps? (Choose 2.)

Accepted Answer

Review stack events to identify the resource that blocked rollback.. Option A is correct because when a CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED, the stack events provide detailed error messages for each resource that failed during rollback. Reviewing these events is essential to identify the specific resource that blocked the rollback, such as a resource that could not be deleted or updated due to permissions, dependencies, or configuration issues. This diagnosis is the first step before attempting a continue-update-rollback operation.

Answer

Delete the CloudFormation service role from IAM.

Answer

Rename the stack to force rollback completion.

Question 3

A company uses AWS CodeDeploy to deploy an application to Amazon EC2 instances. The SysOps administrator wants to implement a deployment strategy that minimizes risk by deploying the new version to a small number of instances first, verifying that the deployment is successful, and then deploying to the remaining instances. If the initial deployment fails, the process should stop and roll back. Which CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.OneAtATime. Option C, CodeDeployDefault.OneAtATime, is correct because it deploys the new application revision to one instance at a time, checking for success before proceeding to the next. If any deployment step fails, the process stops and automatically rolls back, minimizing risk by limiting the blast radius of a bad deployment.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.Canary10Percent10Minutes

Question 4

A company runs 200 EC2 Linux instances across three accounts. The security team requires that critical OS patches are applied automatically every Sunday at 2 AM UTC. Currently patches are applied manually and inconsistently. What is the recommended AWS-native solution?

Accepted Answer

Configure a Patch Manager patch baseline and maintenance window scheduled for Sunday 02:00 UTC; associate the Run Patch Baseline task with all EC2 instance targets. Option A is correct because AWS Systems Manager Patch Manager, combined with a Maintenance Window, provides a fully AWS-native, automated solution for patching EC2 instances on a schedule. The Patch Manager service uses a patch baseline to define which patches are approved (e.g., critical OS patches), and the Maintenance Window triggers the 'AWS-RunPatchBaseline' SSM document at the specified time (Sunday 02:00 UTC) against all targeted instances. This eliminates manual effort and ensures consistent, auditable patching across multiple accounts and instances.

Answer

Create a cron job on each instance that runs 'yum update -y' every Sunday at 2 AM

Answer

Use AWS Config managed rules to detect unpatched instances and send SNS notifications for manual remediation

Answer

Build a CodePipeline that runs weekly, creates new AMIs with the latest patches, and replaces all instances via an Auto Scaling instance refresh

Question 5

Operators have been making direct changes to AWS resources (security group rules, IAM policy modifications) that were originally created by CloudFormation stacks. The team wants to identify which stacks and specific resources have drifted from their template definitions. What is the correct tool and operation sequence?

Accepted Answer

Run drift detection on each CloudFormation stack; review the results in the Drift status panel to see which resources have MODIFIED or DELETED status. AWS CloudFormation drift detection is the correct tool because it directly compares the current state of resources in a stack (including security group rules and IAM policies) against the stack's template definitions. Running drift detection on each stack and reviewing the Drift status panel reveals which resources have been modified or deleted outside of CloudFormation, providing the exact identification the team needs.

Answer

Enable AWS Config conformance packs that check CloudFormation stack compliance against desired template states

Answer

Re-deploy all stacks with the original templates using CloudFormation update-stack to overwrite any manual changes

Answer

Use AWS Trusted Advisor to identify resources that have been modified outside of their originating CloudFormation stacks

Question 6

A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?

Accepted Answer

Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket. SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.

Answer

Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script

Answer

Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script

Answer

Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in

Question 7

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

Accepted Answer

Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional. Option A is correct because a CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Answer

Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it

Answer

Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement

Answer

Add a DeletionPolicy: Retain attribute to the RDS resource in the template

Question 8

A containerized API runs on Amazon ECS with an Application Load Balancer. The team wants to deploy new container versions with zero downtime, automatically route traffic to the new version only after health checks pass, and automatically roll back if error rates spike within 10 minutes of the shift. Which deployment strategy and configuration implements all three requirements?

Accepted Answer

Use CodeDeploy with the ECS blue/green deployment type, configure a Canary or Linear traffic shifting strategy, and attach a CloudWatch alarm for error rate as a deployment alarm. Option A is correct because CodeDeploy's ECS blue/green deployment type supports canary or linear traffic shifting, which automatically routes traffic to the new version only after health checks pass. By attaching a CloudWatch alarm for error rate as a deployment alarm, CodeDeploy can automatically trigger a rollback if error rates spike within the specified monitoring period (e.g., 10 minutes), meeting all three requirements: zero downtime, health-check-gated traffic shifting, and automatic rollback on error rate spikes.

Answer

Update the ECS service with a rolling update deployment configuration and set the minimum healthy percent to 100

Answer

Create a second ECS service with the new task definition and use Route 53 weighted routing to shift traffic at the DNS level

Answer

Enable ECS circuit breaker on the service to roll back failed deployments automatically

Question 9

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot into the correct order.

Question 10

Drag and drop the steps to troubleshoot high CPU usage on an Amazon EC2 instance into the correct order.

Question 11

Match each AWS networking concept to its description.

Question 12

Match each AWS support plan to its key feature.

Question 13

A DevOps engineer wants to automate the creation of an Amazon EC2 instance with a specific security group and IAM role. Which AWS service should be used to define the infrastructure as code?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service for provisioning infrastructure as code. AWS OpsWorks is for configuration management, CodeDeploy is for application deployment, and Elastic Beanstalk is a PaaS service.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Question 14

A company is using AWS CloudFormation to manage its infrastructure. A stack update fails because a change set includes a modification to an RDS database that triggers a replacement. The engineer needs to allow updates that may cause a replacement but wants to be warned first. What should the engineer do?

Accepted Answer

Create a change set and review it before executing the update.. Using a change set allows the engineer to review the changes before executing them. Disabling rollback on failure is not a warning mechanism, and using a nested stack does not provide a warning. The '--parameters' option does not warn about replacements.

Answer

Use the '--disable-rollback' flag when updating the stack.

Answer

Use a nested stack to isolate the RDS resource.

Answer

Use the '--parameters' option to specify a parameter that controls replacement.

Question 15

A SysOps administrator is troubleshooting a failed Auto Scaling group launch. The group uses a launch template that specifies an Amazon Linux 2 AMI. The instances fail to pass the EC2 health check and are terminated. The administrator checks the system log and finds that the instance boots but the cloud-init script fails due to a missing package repository. What is the most likely cause?

Accepted Answer

The AMI used by the launch template is outdated and the repositories are no longer valid.. If the AMI is outdated, the package repository URLs may be deprecated, causing cloud-init failures. The launch template version is not directly related to repository access. User data script problems could cause failures but the log points to a missing repository, which is often due to an outdated AMI. IAM role issues would affect API calls, not package repos.

Answer

The launch template is using an incorrect version.

Answer

The IAM instance profile does not have sufficient permissions.

Answer

The Auto Scaling group is in a private subnet without a NAT gateway.