SOA-C02 Deployment, Provisioning, and Automation Practice Test 4 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is configured with a load balancer and an Auto Scaling group. Recently, the development team updated the application code and deployed it via Elastic Beanstalk. After the deployment, users report intermittent 503 errors. The SysOps administrator checks the environment health and sees that it is 'Severe' with many instances being replaced. The administrator notices that the new instances are being launched with the old application version. The deployment was a rolling update with a batch size of 1. What is the MOST likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deployment failed health checks on the first instance and rolled back, replacing all instances with the old version.. During a rolling update with batch size 1, Elastic Beanstalk updates instances one at a time. After deploying the new version to the first instance, if that instance fails health checks, Elastic Beanstalk treats the deployment as failed and initiates a rollback. The rollback replaces all instances with the old application version, causing intermittent 503 errors as instances are being replaced. This matches the symptoms: severe health, new instances launched with old version, and 503 errors. Option B is incorrect because sticky sessions do not cause version mismatches; they only affect request routing. Option C is incorrect because changing the environment URL is not part of a deployment and would not cause version mismatches. Option D is incorrect because, while an outdated health check URL could cause health check failures on the new version and potentially trigger a rollback, the scenario provides no indication that the health check URL is outdated; the most likely cause is the generic health check failure that led to the rollback, as described in option A.

Answer

The load balancer is configured with sticky sessions, causing requests to go to outdated instances.

Answer

The Elastic Beanstalk environment URL was changed during the deployment.

Answer

The health check URL was not updated to reflect the new application version.

Question 2

A company uses AWS CodeCommit to store its source code and AWS CodeBuild to compile and test the code. The SysOps administrator is setting up a new build project that needs to access a private Amazon S3 bucket to download build dependencies. The build project runs in a VPC. The administrator has attached an IAM role to the build project with permissions to access the S3 bucket. However, the build fails with an access denied error when trying to download the dependencies. The S3 bucket is in the same region and account. What should the administrator do to resolve the issue?

Accepted Answer

Create a VPC endpoint for Amazon S3 and associate it with the VPC where CodeBuild runs.. CodeBuild running inside a VPC has no route to the public S3 endpoint unless the VPC has either a NAT gateway with internet access or an S3 gateway VPC endpoint. The recommended, cost-effective, and secure solution is to create an S3 gateway VPC endpoint and associate it with the VPC's route tables, which lets the build project reach S3 privately over the AWS backbone. This resolves the access denied/timeout because the traffic no longer needs to traverse the public internet.

Answer

Attach an internet gateway to the VPC to provide internet access.

Answer

Configure the security group for CodeBuild to allow outbound traffic to the S3 bucket.

Answer

Update the IAM role to include 's3:ListBucket' permission.

Question 3

A company uses AWS CloudFormation to deploy EC2 instances across multiple environments. The operations team notices that stack updates fail when parameter values change. What is the MOST likely cause?

Accepted Answer

The parameter has the NoEcho property set to true, and the previous value is not provided.. When a parameter has the NoEcho property set to true, CloudFormation masks the parameter value in stack events and outputs. During a stack update, if the parameter value changes, CloudFormation requires the previous value to be provided to verify the change. If the previous value is not supplied, the update fails because CloudFormation cannot confirm the intended modification, leading to a validation error.

Answer

The parameter uses the AWS::NoValue condition.

Answer

A change set is required but not generated.

Answer

A stack policy prevents parameter updates.

Question 4

A company uses AWS OpsWorks for configuration management of EC2 instances. The administrator needs to ensure that a custom recipe runs on all instances after the instance is fully configured. Which lifecycle event should the recipe be associated with?

Accepted Answer

Configure. The Configure lifecycle event in AWS OpsWorks runs after every instance enters the online state, including after the Setup event completes. Associating a custom recipe with Configure ensures it executes on all instances once they are fully configured and operational, as Configure fires repeatedly on state changes, not just during initial provisioning.

Answer

Undeploy

Answer

Deploy

Answer

Setup

Question 5

A company is using AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) that includes specific software. The administrator creates a custom AMI and configures the Elastic Beanstalk environment to use it. However, new instances launched during scaling use the default platform AMI instead. What is the MOST likely cause?

Accepted Answer

The custom AMI is configured in the environment's launch configuration, but the environment has not been updated to replace existing instances.. When you update the launch configuration in an Elastic Beanstalk environment to use a custom AMI, existing instances are not automatically replaced. The new AMI only applies to instances launched during scaling or environment updates that trigger instance replacement. Since the administrator did not perform an environment update that replaces existing instances, the running instances continue to use the default platform AMI.

Answer

The custom AMI ID is specified in the environment properties instead of the launch configuration.

Answer

The custom AMI is encrypted, and the instance profile does not have permissions to decrypt it.

Answer

The Elastic Beanstalk platform version is incompatible with the custom AMI.

Question 6

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

Accepted Answer

Perform a rolling update based on health.. A rolling update based on health (Option D) is the correct method to minimize downtime when updating an instance type in Elastic Beanstalk. This approach updates instances in batches, replacing them with the new instance type only after the previous batch passes health checks, ensuring application availability throughout the process. Elastic Beanstalk's rolling update with health-based batching terminates and launches instances incrementally, avoiding full environment disruption.

Answer

Terminate all instances and let the Auto Scaling group launch new ones.

Answer

Perform an immutable update.

Answer

Clone the environment with the new configuration and swap URLs.

Question 7

A SysOps administrator is designing an automated deployment pipeline for a web application using AWS CodePipeline. The application is deployed to an Auto Scaling group behind an Application Load Balancer. The administrator wants to ensure zero downtime during deployments. Which TWO strategies should be combined? (Choose TWO.)

Accepted Answer

Use a blue/green deployment with CodeDeploy and an Elastic Load Balancer.. Option C is correct because a blue/green deployment with CodeDeploy and an Elastic Load Balancer shifts traffic from the original environment to a full replacement environment only after the new instances pass health checks, so the ALB never routes requests to unhealthy hosts and downtime is avoided. Option E is correct because CodeDeploy's immutable update launches an entirely new Auto Scaling group with the new application version, waits for the new instances to pass health checks, and then swaps them in while terminating the old group, which likewise prevents serving requests from a broken deployment. Option A is wrong because an all-at-once deployment replaces every instance simultaneously, so all capacity is offline during the update and downtime is likely. Option B is wrong because a canary deployment still updates existing in-place instances in phases, so the instances being replaced are unavailable and the approach alone does not guarantee zero downtime. Option D is wrong because an in-place rolling update takes instances out of service in batches, reducing capacity and risking downtime if health checks fail.

Answer

Use CodeDeploy with an all-at-once deployment.

Answer

Use CodeDeploy with a canary deployment.

Answer

Use CodeDeploy with an in-place update and a rolling batch configuration.

Question 8

A company is using AWS CloudFormation to manage infrastructure. The administrator needs to update a stack that contains a critical Amazon RDS database. The administrator wants to prevent accidental updates to the database while allowing updates to other resources. Which TWO steps should the administrator take? (Choose TWO.)

Accepted Answer

Apply a stack policy that denies updates to the RDS resource.. A stack policy explicitly denies updates to specified resources, such as the RDS database, while allowing updates to other resources in the CloudFormation stack. Option D is incorrect because setting the DeletionPolicy to 'Snapshot' does not prevent updates; it only ensures a final snapshot is taken if the resource is deleted during a stack update. The question specifically asks for steps to prevent accidental updates, so only Option B fulfills that requirement.

Answer

Use a condition to prevent the RDS resource from being updated.

Answer

Enable termination protection on the CloudFormation stack.

Answer

Set the DeletionPolicy attribute to 'Snapshot' on the RDS resource.

Answer

Remove the RDS resource from the CloudFormation template.

Question 9

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error 'Resource creation cancelled' for an EC2 instance. The instance type is t3.micro, and the AMI ID is specified in the template. Which of the following is the most likely cause of the failure?

Accepted Answer

The account has reached the vCPU limit for On-Demand Instances in the region.. The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource but the operation is aborted due to a service limit. In this case, the account has reached the vCPU limit for On-Demand Instances in the region, which prevents the t3.micro instance from being launched. CloudFormation does not automatically handle service limits; it will fail the stack creation with this error when the EC2 API returns an 'InstanceLimitExceeded' exception.

Answer

The instance type 't3.micro' is not available in the region.

Answer

The instance type is invalid for the specified AMI.

Answer

The AMI ID is not specified for the region.

Question 10

A company uses AWS OpsWorks to manage a stack of application servers. The administrator needs to automate the deployment of a new application version. Which of the following are valid methods to trigger a deployment in OpsWorks? (Choose THREE.)

Accepted Answer

Use AWS CodePipeline to directly deploy to OpsWorks.. Option B is correct because AWS CodePipeline natively supports AWS OpsWorks Stacks as a deployment action provider, allowing a pipeline stage to invoke a deployment of the specified app to the stack's instances. Option D is correct because the OpsWorks console provides a Deploy App action that lets an administrator manually start a deployment of an application version to the stack's layers. Option E is correct because the AWS CLI exposes the opsworks create-deployment command, which programmatically triggers a deployment by specifying the StackId, AppId, and optional InstanceIds or Command. Option A is not a valid trigger mechanism because Amazon SNS is a notification/pub-sub service and cannot itself initiate an OpsWorks deployment. Option C is incorrect because OpsWorks lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) run Chef recipes during instance lifecycle transitions, not as an automation trigger for starting a new application deployment.

Answer

Configure an Amazon SNS topic to trigger the deployment.

Answer

Use OpsWorks lifecycle events like 'Deploy' to run recipes.

Question 11

A SysOps administrator is setting up an AWS Elastic Beanstalk environment for a Node.js application. The administrator wants to ensure that environment variables are set for the application. Which of the following methods can be used to set environment variables in Elastic Beanstalk? (Choose TWO.)

Accepted Answer

Use the AWS CLI command update-environment.. Option A is correct because the AWS CLI command `aws elasticbeanstalk update-environment` accepts an `--option-settings` parameter (Namespace `aws:elasticbeanstalk:application:environment`) that sets environment variables directly on a running Elastic Beanstalk environment. Option B is correct because environment properties can be configured in the Elastic Beanstalk environment configuration itself, either through the console, saved configurations, or `.ebextensions` option settings under the `aws:elasticbeanstalk:application:environment` namespace. Option C is correct because an AWS CloudFormation template can define an `AWS::ElasticBeanstalk::Environment` resource with `OptionSettings` in the `aws:elasticbeanstalk:application:environment` namespace, thereby setting environment variables declaratively. Option D is incorrect because the AppSpec file is used by CodeDeploy to define deployment lifecycle hooks and file copy instructions, not Elastic Beanstalk environment variables. Option E is incorrect because the EB CLI configuration file (`.elasticbeanstalk/config.yml`) stores CLI defaults such as application, environment, and platform settings, not application environment variables.

Answer

Include them in the AppSpec file.

Answer

Define them in the EB CLI configuration file.

Question 12

A SysOps administrator sees the deployment failure shown in the exhibit. The deployment group has a minimum of 1 healthy instance. The Auto Scaling group has 2 instances. What is the most likely cause of the failure?

Accepted Answer

The deployment configuration only deploys to one instance at a time, and that instance failed.. With CodeDeployDefault.OneAtATime, only one instance is deployed at a time. If that instance fails, the deployment fails because no other instance has been deployed yet. Option A is correct. Option B is incorrect: the health check grace period does not cause the deployment failure described. Option C is incorrect: the deployment group does have enough instances (2), but the deployment is halted by the failure of the first instance before the second is deployed. Option D is incorrect: deploying to all at once would attempt both instances, which would not cause this specific failure pattern.

Answer

The Auto Scaling group's health check grace period is too long.

Answer

The deployment group does not have enough instances.

Answer

The deployment configuration is set to deploy to all instances at once.

Question 13

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The deployment uses AWS CodeDeploy with an in-place update. During a deployment, the new application version fails health checks, and CodeDeploy automatically rolls back. However, the rollback also fails. What is the MOST likely cause?

Accepted Answer

The health check path specified in the AppSpec file is not valid for the previous application version.. If the health check configuration in the CodeDeploy AppSpec file points to a path that is not valid in the previous version, the rollback will also fail health checks. Option A is incorrect because insufficient capacity would cause a different error. Option B is incorrect because CodeDeploy does not use Elastic Beanstalk. Option C is incorrect because the issue is with health checks, not with the agent.

Answer

The Auto Scaling group's minimum size is too low for a rollback.

Answer

The load balancer is configured with an incorrect target group for the Elastic Beanstalk environment.

Answer

The CodeDeploy agent on the EC2 instances is not running the latest version.

Question 14

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CloudFormation). The deploy stage uses a change set. Recently, the deploy stage fails with the error 'No updates are to be performed.' What is the MOST likely cause?

Accepted Answer

The source code in the S3 bucket has not changed since the last successful deployment.. The error 'No updates are to be performed' from AWS CloudFormation indicates that the change set contains no differences between the current stack and the new template. This typically occurs when the source code in the S3 bucket has not changed since the last successful deployment, so the pipeline attempts to deploy the same template, resulting in no updates.

Answer

The AWS CloudFormation stack was manually deleted outside of the pipeline.

Answer

The IAM role for the pipeline does not have sufficient permissions to update the stack.

Answer

The change set name specified in the pipeline configuration is incorrect.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The environment needs to be updated with a new application version. The SysOps administrator wants to minimize downtime during the deployment. Which deployment policy should be used?

Accepted Answer

Immutable. Immutable deployment (Option C) creates a completely new environment with the new application version and swaps the CNAME when ready, resulting in zero downtime. Rolling with an additional batch (Option B) maintains capacity but still involves a brief transitional period and is not as downtime-free as Immutable. Since the requirement is to minimize downtime, Immutable is the correct choice.

Answer

Rolling based on health

Answer

Rolling with an additional batch

Answer

All at once