SOA-C02 Deployment, Provisioning, and Automation Practice Test 4 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. A developer accidentally deletes a resource from the stack template, and the next stack update attempts to delete the resource. The SysOps administrator wants to prevent accidental deletion of critical resources. Which CloudFormation feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a DeletionPolicy attribute to 'Retain' on the resource.. Setting the DeletionPolicy attribute to 'Retain' on a resource instructs CloudFormation to keep that resource when the resource is removed from the stack template or the stack itself is deleted. Option A is incorrect because termination protection is a feature for EC2 instances to prevent accidental termination, not for CloudFormation stacks. Option B is incorrect because a stack policy controls which stack resources can be updated or deleted, but it applies during stack operations; however, the question specifically asks for a feature that prevents deletion when the resource is removed from the template, which is best achieved with DeletionPolicy. Option D is incorrect because an IAM policy denying cloudformation:DeleteStack would block entire stack deletion, but it does not protect individual resources from being deleted during a stack update when the resource is removed from the template.

Answer

Enable termination protection on the stack.

Answer

Stack policy to deny delete actions.

Answer

Attach an IAM policy that denies cloudformation:DeleteStack.

Question 2

A SysOps administrator is automating the deployment of an application across multiple AWS accounts using AWS CodePipeline. The pipeline must deploy to different environments (dev, test, prod) sequentially. Which deployment approach should be used?

Accepted Answer

Use separate CodePipeline stages with cross-account actions using IAM roles.. CodePipeline supports cross-account actions by assuming an IAM role in the target account, allowing a single pipeline to deploy to different accounts sequentially. Option A is incorrect because CodeCommit repositories in each account would require separate pipelines and lack cross-account coordination. Option B is incorrect because AWS CLI scripts with cross-region replication are not a native CodePipeline deployment mechanism and add complexity without pipeline integration. Option D is incorrect because a single pipeline in one account cannot deploy to resources in another account without cross-account roles.

Answer

Use AWS CodeCommit repositories in each account and trigger builds.

Answer

Use AWS CLI scripts with cross-region replication.

Answer

Create a single pipeline with all deployment stages in the same account.

Question 3

A company is using AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during peak hours. The SysOps administrator wants to automatically scale the environment based on CPU utilization. Which configuration change is required?

Accepted Answer

Configure a scaling trigger based on a CloudWatch alarm for CPU utilization.. AWS Elastic Beanstalk integrates with Amazon CloudWatch and Auto Scaling to allow you to define a scaling trigger based on a CloudWatch alarm for CPU utilization. When the alarm threshold is breached, the Auto Scaling group automatically adds or removes EC2 instances, enabling the environment to handle high traffic during peak hours without manual intervention.

Answer

Manually add EC2 instances to the Auto Scaling group.

Answer

Modify the instance type to a larger size.

Answer

Increase the number of load balancers.

Question 4

A company is deploying a serverless application using AWS SAM. The SysOps administrator wants to automate the build and deployment process whenever code is pushed to the main branch of an AWS CodeCommit repository. Which service should be used to trigger the pipeline?

Accepted Answer

AWS CodePipeline.. CodePipeline can be configured to start on changes to a CodeCommit repository. Option A is incorrect because CloudWatch Events can trigger but is not the primary service for CI/CD pipelines. Option B is incorrect because CodeBuild is a build service, not a trigger. Option D is incorrect because Lambda would require custom integration.

Answer

AWS Lambda.

Answer

AWS CodeBuild.

Answer

Amazon CloudWatch Events.

Question 5

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The error message indicates that an IAM role creation failed because the role already exists. The administrator wants to ensure the stack creation can proceed without manual intervention. What should the administrator do?

Accepted Answer

Modify the template to use a unique name for the IAM role.. The error indicates a naming conflict: the IAM role name in the template already exists in the account. By modifying the template to use a unique name (e.g., appending a random string or using `AWS::NoValue` with `Fn::Sub`), CloudFormation can create the role without conflicting with the existing resource. This approach avoids manual intervention and allows the stack creation to proceed automatically.

Answer

Use the 'Retain' deletion policy on the IAM role resource.

Answer

Manually delete the existing IAM role and retry the stack creation.

Answer

Use a stack policy to prevent the creation of the IAM role.

Question 6

A SysOps administrator is designing an automated deployment pipeline using AWS CodePipeline. The pipeline must include a manual approval step before deploying to production. Which TWO actions are required to implement this?

Accepted Answer

Create an Amazon SNS topic for approval notifications.. The correct answers are B and D. A manual approval action in CodePipeline requires an SNS topic to send approval notifications (B). Additionally, the CodePipeline service role must have IAM permissions to publish to that SNS topic (D). Option A is incorrect because the approval action is added as an action within an existing stage, not as a separate stage. Option C is incorrect because approval must be manual, not automated via Lambda. Option E is incorrect because CloudWatch Logs is not required for manual approvals.

Answer

Add a separate stage for approval in the pipeline.

Answer

Configure an AWS Lambda function to approve automatically.

Answer

Enable CloudWatch Logs for the pipeline.

Question 7

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an EC2 instance, an RDS database, and an Application Load Balancer. The SysOps administrator wants to ensure that the database is not replaced during an update if the administrator accidentally changes a property that requires replacement. Which THREE actions should the administrator take?

Accepted Answer

Use a custom resource backed by a Lambda function to manage the database.. The correct answers are A, B, and E. A is correct because a custom resource backed by Lambda can manage the database outside the CloudFormation lifecycle, preventing accidental replacement. B is correct because setting DeletionPolicy: Retain on the RDS resource ensures that if the resource is deleted during a stack update (e.g., due to a property change requiring replacement), the actual database is retained. E is correct because a stack policy can deny updates to the RDS instance, preventing modifications that would trigger replacement. C is incorrect: placing the RDS instance in a separate nested stack does not prevent replacement; it only isolates the resource, but replacement can still occur. D is incorrect: termination protection prevents stack deletion, not resource replacement within an update.

Answer

Place the RDS instance in a separate nested stack.

Answer

Enable termination protection on the CloudFormation stack.

Question 8

A SysOps administrator creates an IAM policy that grants s3:PutObject permission to the bucket 'my-bucket' (arn:aws:s3:::my-bucket) and attaches it to an IAM role used by an application. The application needs to upload objects to a subfolder named 'uploads/' in the bucket. The uploads fail with an access denied error. What is the most likely cause?

Accepted Answer

The policy does not grant s3:PutObject permission to the 'uploads/' prefix.. The policy likely grants s3:PutObject permission only to the bucket root (arn:aws:s3:::my-bucket) or to a different prefix, not to the 'uploads/' subfolder. To allow uploads to the subfolder, the resource ARN must include the full path, e.g., arn:aws:s3:::my-bucket/uploads/*. Therefore, the correct answer is D.

Answer

The IAM role does not have permission to assume the role.

Answer

The application is using the wrong AWS credentials.

Answer

The policy does not include the 's3:PutObject' action for the bucket itself.

Question 9

Refer to the exhibit. A SysOps administrator creates this CloudFormation template. The stack creation fails with the error: 'The security group 'default' does not exist'. What is the most likely cause?

Accepted Answer

The instance is launched in a VPC, but the security group is specified by name instead of group ID.. The error occurs because the template launches the instance in a VPC, where security groups must be referenced by their GroupId, not by name. The template uses 'default' (a name), but CloudFormation interprets it as a GroupId, which does not exist, causing the failure. Option C correctly identifies this issue.

Answer

The VPC does not have a default security group.

Answer

The instance is launched in EC2-Classic, which does not support security groups.

Answer

The 'default' security group is not present in the account.

Question 10

Refer to the exhibit. A SysOps administrator ran the describe-stack-events command for a CloudFormation stack named 'my-stack'. The stack creation failed with 'Resource creation cancelled'. What is the most likely reason?

Accepted Answer

The nested stack creation timed out and was cancelled.. When a CloudFormation stack creation fails with 'Resource creation cancelled', it typically indicates that a nested stack creation was cancelled due to a timeout. CloudFormation sets a default timeout of 60 minutes for stack creation; if a nested stack does not complete within that period, the parent stack cancels the nested stack creation and reports this error. This is distinct from manual cancellation, which would show a different status.

Answer

The stack creation was manually cancelled by the administrator.

Answer

The IAM role for the stack does not have sufficient permissions.

Answer

The nested stack creation failed due to an invalid template.

Question 11

A company uses AWS CloudFormation to deploy EC2 instances. The stack creation fails with the error 'Resource creation cancelled' after 20 minutes. What is the most likely cause?

Accepted Answer

The EC2 instance creation exceeded the CloudFormation timeout. The error 'Resource creation cancelled' typically occurs when the CloudFormation stack creation times out. CloudFormation allows you to set a stack creation timeout (via the TimeoutInMinutes parameter). If the time expires before resources are fully created, CloudFormation cancels the operation. In this scenario, the EC2 instance likely took longer than the 20-minute timeout configured for the stack, causing CloudFormation to cancel the resource creation. Option A is incorrect because an unsupported template format would cause a validation error before resource creation starts. Option C is incorrect because an unavailable instance type would cause an immediate API error. Option D is incorrect because insufficient IAM permissions would cause an immediate access denied error.

Answer

The CloudFormation template uses an unsupported template format

Answer

The instance type specified is not available in the chosen Availability Zone

Answer

Insufficient IAM permissions for CloudFormation to create EC2 instances

Question 12

A SysOps administrator needs to deploy a new version of a Lambda function while minimizing downtime. The function is behind an API Gateway endpoint. What is the MOST effective approach?

Accepted Answer

Create a new Lambda version, then use an alias with weighted routing to shift traffic gradually. Lambda aliases support weighted routing, allowing traffic to be gradually shifted between function versions. This enables zero-downtime deployments by initially sending a small percentage of requests to the new version, monitoring for errors, and then increasing traffic. Option A is incorrect because updating the function code in-place would directly overwrite the existing version and risk a brief outage with no easy rollback. Option C is incorrect because manually updating the API Gateway integration to point to a new version causes a complete cutover, which may result in a short outage or require careful timing. Option D is incorrect because using Route 53 weighted records adds unnecessary latency and complexity; it is not the optimal approach for a single Lambda function behind API Gateway.

Answer

Update the Lambda function code in-place and publish a new version

Answer

Create a new Lambda version and update the API Gateway integration to point to it

Answer

Deploy a new Lambda function and use an Amazon Route 53 weighted record set to distribute traffic

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. During a deployment, the environment's health turns from Green to Red, and the deployment fails. The logs show 'ERROR: Failed to download the application version from Amazon S3.' What is the MOST likely cause?

Accepted Answer

The EC2 instance profile does not have an IAM policy granting s3:GetObject on the application version. The error 'Failed to download the application version from Amazon S3' indicates that the EC2 instances cannot retrieve the application source from S3. The EC2 instance profile associated with the Elastic Beanstalk environment must have an IAM policy that grants s3:GetObject permission on the S3 bucket containing the application version. Without this permission, the instances cannot download the application, causing deployment failure. Option A is correct because the instance profile lacks the required IAM policy. Option B is incorrect because the Elastic Beanstalk service role is used by the service to manage resources, not by instances to access S3. Option C is incorrect because S3 supports cross-region access; a bucket in a different region can still be accessed. Option D is incorrect because disabling public access is a security best practice; the instances should rely on IAM permissions, not public access.

Answer

The Elastic Beanstalk service role does not have permissions to access S3

Answer

The S3 bucket is in a different AWS Region

Answer

The S3 bucket containing the application version has public read access disabled

Question 14

A SysOps administrator wants to automate the creation of an Amazon RDS MySQL instance using AWS CloudFormation. Which CloudFormation resource type should be used?

Accepted Answer

AWS::RDS::DBInstance. AWS CloudFormation uses resource types to define infrastructure components. For an Amazon RDS MySQL instance, the correct resource type is `AWS::RDS::DBInstance`, which directly maps to creating and configuring a relational database instance, including engine selection (MySQL), allocated storage, and backup settings. This resource type supports all RDS engines and is the standard way to provision RDS databases via CloudFormation. Option A is correct because `AWS::RDS::DBInstance` is the appropriate resource for creating an RDS MySQL instance. Option B is incorrect because `AWS::DynamoDB::Table` is for Amazon DynamoDB, a NoSQL database service, not a relational MySQL database. Option C is incorrect because `AWS::AppStream::DirectoryConfig` is used for Amazon AppStream 2.0 directory configuration, unrelated to RDS. Option D is incorrect because `AWS::Redshift::Cluster` is for Amazon Redshift, a data warehouse service, not a relational MySQL database.

Answer

AWS::DynamoDB::Table

Answer

AWS::AppStream::DirectoryConfig

Answer

AWS::Redshift::Cluster

Question 15

An organization uses AWS OpsWorks to manage a stack of application servers. The stack uses a custom cookbook that is stored in a private GitHub repository. When deploying new instances, the cookbook download fails. What should the administrator do to resolve this?

Accepted Answer

Configure an SSH key in the OpsWorks stack to access the private repository. AWS OpsWorks supports using an SSH key (e.g., a deploy key) to securely access private GitHub repositories for custom cookbooks. Option A is incorrect: although you can store cookbooks in S3, the question specifies a private GitHub repo, and OpsWorks can authenticate via SSH. Option B is incorrect: making the repository public introduces security risks and is unnecessary. Option D is incorrect: OpsWorks does not store GitHub credentials directly; it requires an SSH key configured at the stack level.

Answer

Upload the cookbook to Amazon S3 and reference the S3 URL

Answer

Make the GitHub repository public

Answer

Store the GitHub credentials in the OpsWorks stack settings