SOA-C02 Deployment, Provisioning, and Automation Practice Test 5 — 15 Questions

Question 1

A company wants to deploy a new version of a web application to an Auto Scaling group of EC2 instances behind an Application Load Balancer. The deployment should be automated and must not cause downtime. Which AWS service should be used?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy integrates with Auto Scaling groups and supports rolling updates to minimize downtime. CloudFormation can manage infrastructure but not application deployment directly. OpsWorks and Elastic Beanstalk are options but CodeDeploy is the dedicated service for application deployment.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 2

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The Security Team requires that all instances have a specific security patch installed. A SysOps administrator needs to verify compliance across all instances. What is the MOST efficient way to accomplish this?

Accepted Answer

Use AWS Systems Manager Patch Manager to scan and generate a compliance report.. AWS Systems Manager Patch Manager can scan instances for missing patches and report compliance. State Manager and Inventory collect data but do not specifically report patch compliance. OpsCenter is for operational issues. Config rules can check compliance but require custom rules.

Answer

Use AWS Config rules to check for the patch.

Answer

Use AWS Systems Manager State Manager to enforce the patch.

Answer

Use AWS Systems Manager Inventory to collect software inventory.

Question 3

A company is using AWS Elastic Beanstalk to deploy a web application. The application uses a custom Amazon Machine Image (AMI) that must be updated periodically. The SysOps administrator creates a new AMI and updates the Elastic Beanstalk environment's configuration. However, new instances are still launched with the old AMI. What is the most likely cause?

Accepted Answer

The environment is configured to use a launch template, and the AMI was not updated in the launch template.. Elastic Beanstalk uses a launch configuration or launch template. If the environment is configured to use a launch template, updating the AMI in the environment configuration may not update the template. The environment's platform version is separate from the AMI. The old AMI might not be deregistered, but that doesn't cause new instances to use it. Immutable updates are not relevant.

Answer

The environment is using an immutable update policy.

Answer

The environment's platform version is pinned to an older version.

Answer

The old AMI was not deregistered.

Question 4

A SysOps administrator needs to deploy an application to a set of EC2 instances in an Auto Scaling group. The deployment must be performed in batches, with each batch health-checked before proceeding. Which AWS CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeploy has predefined deployment configurations. 'CodeDeployDefault.OneAtATime' deploys one instance at a time, allowing health checks. 'AllAtOnce' deploys to all simultaneously, 'HalfAtATime' deploys to half, and 'Custom' is a user-defined configuration.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.Custom

Question 5

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template references the secret using a dynamic reference. However, the stack creation fails with an error that the secret cannot be retrieved. What is the most likely cause?

Accepted Answer

The CloudFormation service role lacks permissions to read the secret.. To use dynamic references, the CloudFormation service role must have permission to read the secret. The stack name and parameters are not related to secret retrieval. The secret must be in the same region. The template syntax might be incorrect, but the most common issue is missing permissions.

Answer

The secret is in a different AWS Region.

Answer

The stack name does not match the secret name.

Answer

The template uses the wrong dynamic reference syntax.

Question 6

A company has a mission-critical application running on EC2 instances in an Auto Scaling group. The application stores state locally on the instance. The company wants to update the application to a new version with minimal downtime. The update requires a change to the instance configuration. What deployment strategy should be used?

Accepted Answer

Blue/green deployment. A blue/green deployment creates a new environment (green) with the new version and then switches traffic. This minimizes downtime and allows state to be handled by offloading to an external service. Rolling updates would cause downtime and state loss if instances are replaced. Immutable updates replace instances, causing state loss. Canary deployments are for testing, not full production updates.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 7

A SysOps administrator is creating a CloudFormation template to provision an Amazon S3 bucket with versioning enabled and server access logging. Which TWO properties must be configured in the AWS::S3::Bucket resource?

Accepted Answer

VersioningConfiguration. VersioningConfiguration enables versioning, and LoggingConfiguration enables server access logging. AccessControl, Tags, and LifecycleConfiguration are optional and not required for the described purpose.

Answer

Tags

Answer

LifecycleConfiguration

Answer

AccessControl

Question 8

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances do not have the CodeDeploy agent installed. Which THREE actions are required to resolve this issue?

Accepted Answer

Install the CodeDeploy agent on the instances using user data in the launch configuration.. The CodeDeploy agent must be installed on each instance. This can be done by installing it via user data, using a pre-built AMI with the agent, or using AWS Systems Manager Run Command. Changing the deployment configuration does not install the agent. Updating the Auto Scaling group launch configuration alone does not install the agent on existing instances.

Answer

Change the deployment configuration to 'OneAtATime'.

Answer

Update the Auto Scaling group's launch configuration to use a different instance type.

Question 9

A SysOps administrator is troubleshooting a slow deployment with AWS CloudFormation. The stack update is taking a long time because it is waiting for a resource to be created. Which TWO CloudFormation features can help speed up the deployment?

Accepted Answer

Use nested stacks to create resources in parallel.. CreationPolicy with a short timeout can reduce waiting time for signals. WaitCondition can be used with a timeout. '--disable-rollback' does not speed up deployment. Nested stacks can parallelize resource creation. DependsOn is required for dependencies but does not speed up; it can actually increase time if not needed.

Answer

Remove DependsOn clauses to allow parallel resource creation.

Answer

Set the '--disable-rollback' flag.

Answer

Increase the timeout on the WaitCondition.

Question 10

A SysOps administrator is deploying a new version of an application using AWS CodeDeploy. The deployment to an Auto Scaling group fails, and the instances are rolled back. What is the most likely reason for the failure?

Accepted Answer

The IAM instance profile does not have permission to download the revision from S3.. The correct answer is B because CodeDeploy requires the IAM instance profile to have permissions to read from the S3 bucket where the revision is stored. Option A is incorrect because CodeDeploy agent does not need internet access if using VPC endpoints. Option C is incorrect because the application's load balancer health check is separate. Option D is incorrect because CodeDeploy does not require the instance to be in a public subnet.

Answer

The instances are in a private subnet without a NAT gateway.

Answer

The instances do not have internet access.

Answer

The application's health check is failing on the target group.

Question 11

A company uses AWS CloudFormation to manage infrastructure. A developer accidentally deletes a resource from the stack template, and the next stack update attempts to delete the resource. The SysOps administrator wants to prevent accidental deletion of critical resources. Which CloudFormation feature should be used?

Accepted Answer

Set a DeletionPolicy attribute to 'Retain' on the resource.. The correct answer is C because DeletionPolicy: Retain preserves the resource when the stack is deleted or the resource is removed from the template. Option A is incorrect because StackPolicy controls updates, not deletions. Option B is incorrect because TerminationProtection is for EC2 instances, not CloudFormation. Option D is incorrect because ResourcePolicy is not a CloudFormation feature.

Answer

Enable termination protection on the stack.

Answer

Stack policy to deny delete actions.

Answer

Attach an IAM policy that denies cloudformation:DeleteStack.

Question 12

An organization uses AWS OpsWorks for configuration management. The SysOps administrator notices that a stack's instances are not receiving the updated custom cookbooks after a new deployment. The cookbooks are stored in a private GitHub repository. What is the most likely cause?

Accepted Answer

The SSH key for the Git repository is not configured in the stack.. The correct answer is D because OpsWorks uses the SSH key stored in the stack to clone private repositories. If the key is missing or invalid, the cookbook update fails silently. Option A is incorrect because the agent typically checks periodically. Option B is incorrect because cookbooks are downloaded via Git, not S3, unless using S3 archives. Option C is incorrect because instances need outbound access to GitHub, but that would be a different symptom.

Answer

The cookbooks are not stored in an S3 bucket.

Answer

The OpsWorks agent is not running on the instances.

Answer

The instances do not have internet access.

Question 13

A SysOps administrator is automating the deployment of an application across multiple AWS accounts using AWS CodePipeline. The pipeline must deploy to different environments (dev, test, prod) sequentially. Which deployment approach should be used?

Accepted Answer

Use separate CodePipeline stages with cross-account actions using IAM roles.. The correct answer is B because CodePipeline supports cross-account actions by assuming a role in the target account. Option A is incorrect because it would be insecure. Option C is incorrect because CodeCommit is for source code, not deployment targets. Option D is incorrect because cross-region replication is for S3, not deployment.

Answer

Use AWS CodeCommit repositories in each account and trigger builds.

Answer

Use AWS CLI scripts with cross-region replication.

Answer

Create a single pipeline with all deployment stages in the same account.

Question 14

A company is using AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during peak hours. The SysOps administrator wants to automatically scale the environment based on CPU utilization. Which configuration change is required?

Accepted Answer

Configure a scaling trigger based on a CloudWatch alarm for CPU utilization.. The correct answer is A because Elastic Beanstalk uses Auto Scaling triggers based on CloudWatch alarms. Option B is incorrect because the load balancer handles traffic distribution, not scaling. Option C is incorrect because Elastic Beanstalk manages the Auto Scaling group automatically. Option D is incorrect because modifying the instance type manually does not enable auto scaling.

Answer

Manually add EC2 instances to the Auto Scaling group.

Answer

Modify the instance type to a larger size.

Answer

Increase the number of load balancers.

Question 15

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?

Accepted Answer

Use Run Command with a target based on the tag.. The correct answer is D because Run Command allows immediate execution of commands on targeted instances by tag. Option A is incorrect because State Manager is for recurring configurations. Option C is incorrect because Patch Manager is for patching. Option B is incorrect because Automation is for multi-step workflows, not simple script execution.

Answer

Use Patch Manager to apply the script as a patch baseline.

Answer

Create an Automation document and execute it.

Answer

Create a State Manager association with the script.