SOA-C02 Deployment, Provisioning, and Automation Practice Test 5 — 15 Questions

Question 1

A SysOps administrator is troubleshooting a failed AWS CodeBuild build. The build project uses an Amazon S3 source. The buildspec.yml file includes commands that require internet access to download dependencies. The build is failing with a timeout error when trying to download from an external repository. The VPC configuration for the build project uses a private subnet with no NAT gateway. What change should be made to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a NAT gateway to the private subnet's route table.. The build project runs in a private subnet with no NAT gateway, so it has no route to the internet. AWS CodeBuild VPC-configured builds use elastic network interfaces in the specified subnets; without a NAT gateway (or NAT instance) in the route table, outbound traffic to external repositories times out. Attaching a NAT gateway to the private subnet's route table provides the required egress path while keeping the build resources private.

Answer

Configure an HTTP proxy in the build project.

Answer

Create a VPC endpoint for the external repository.

Answer

Move the build project to a public subnet with an internet gateway.

Question 2

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running in a VPC with public and private subnets. The SysOps administrator needs to update the environment to use a new platform version. Which TWO steps should be taken to ensure a smooth update with minimal downtime? (Select TWO.)

Accepted Answer

Perform a blue/green deployment by cloning the environment and swapping the CNAME.. Option C is correct because a blue/green deployment in Elastic Beanstalk is performed by cloning the current environment, deploying the new platform version to the clone, validating it, and then swapping the CNAMEs so traffic shifts to the new environment with minimal downtime and an easy rollback path. Option D is correct because immutable updates launch a new set of instances in the environment with the updated configuration or platform version and only replace the old instances after the new ones pass health checks, which reduces downtime and avoids in-place update failures. Option A is not required because cloning an environment copies its security group configuration, so no manual security group change is needed for the swap. Option B is not a required step for a platform version update, though backups are generally good practice; it does not itself ensure a smooth, low-downtime update. Option E is unnecessary because Elastic Beanstalk's CNAME swap and immutable update mechanisms handle traffic transition and connection draining automatically.

Answer

Update the security groups to allow traffic from the new environment.

Answer

Take a snapshot of the attached Amazon RDS database before starting the update.

Answer

Manually drain connections from the current environment before swapping.

Question 3

A company uses AWS CodePipeline with AWS CodeBuild and AWS CodeDeploy. The pipeline is failing because the build stage produces artifacts that are too large for CodeDeploy. Which TWO actions can resolve this issue? (Select TWO.)

Accepted Answer

Use Amazon S3 as the source for CodeDeploy instead of the pipeline artifact.. Option B is correct because CodeDeploy has a limit on the size of artifacts it can deploy directly from the pipeline, and using Amazon S3 as the source allows CodeDeploy to retrieve the artifact from S3, bypassing the pipeline artifact size constraint. Option D is correct because compressing the application files reduces the artifact size, which can bring it under CodeDeploy's limit and allow the deployment to succeed. Option A is incorrect because increasing the CodeBuild timeout only affects how long the build can run, not the artifact size. Option C is incorrect because storing artifacts in CodeCommit does not address the size limitation and CodeCommit has its own repository size limits. Option E is incorrect because CodeDeploy does not provide a configurable maximum artifact size limit that can be increased.

Answer

Increase the timeout for the CodeBuild stage.

Answer

Store the artifacts in an AWS CodeCommit repository.

Answer

Increase the maximum artifact size limit in CodeDeploy.

Question 4

A company is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The SysOps administrator wants to ensure that the RDS instance is created before the EC2 instance and that the EC2 instance receives the database endpoint as a user data parameter. Which THREE steps should be taken? (Select THREE.)

Accepted Answer

Add a DependsOn attribute to the EC2 instance resource referencing the RDS instance.. Option B is correct because adding a DependsOn attribute to the EC2 instance resource that references the RDS instance forces CloudFormation to create the RDS instance first, establishing the required creation order. Option E is correct because Fn::GetAtt can retrieve the RDS instance's Endpoint.Address attribute and inject it into the EC2 instance's UserData property, satisfying the requirement that the EC2 instance receives the database endpoint as a user data parameter. Option C is correct because the cfn-init helper script processes the AWS::CloudFormation::Init metadata and UserData on the EC2 instance, allowing the endpoint value passed via UserData to be used to configure the application. Option A is not correct because AWS::CloudFormation::Init metadata is used by cfn-init for bootstrapping and configuration, not for controlling resource creation order. Option D is not correct because adding DependsOn to the RDS instance referencing the EC2 instance would reverse the required order, causing the EC2 instance to be created before the RDS instance.

Answer

Use the AWS::CloudFormation::Init metadata to set the creation order.

Answer

Add a DependsOn attribute to the RDS instance resource referencing the EC2 instance.

Question 5

A SysOps administrator is responsible for deploying a critical application using AWS CloudFormation. The stack creation fails during the creation of an Amazon EC2 instance. The error message indicates that the instance type is not supported in the specified Availability Zone. What should the administrator do to prevent this issue in future deployments?

Accepted Answer

Use an AWS Systems Manager parameter to dynamically select an available instance type based on the Availability Zone.. AWS Systems Manager parameters (including public parameters like /aws/service/ami-amazon-linux-latest/... and custom parameters) can be referenced dynamically inside CloudFormation templates via the ssm dynamic reference syntax ({{resolve:ssm:...}}), allowing the template to resolve values such as instance type or AMI ID at deploy time based on the target AZ or region. This makes the template portable and resilient to per-AZ instance-type availability differences, which is the root cause of the failure. Hardcoding or switching regions only masks the problem for one deployment.

Answer

Hardcode the Availability Zone in the template to one that supports the instance type.

Answer

Use a different instance type that is available in all Availability Zones.

Answer

Change the AWS region to one where the instance type is supported.

Question 6

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must include a build stage, a test stage, and a deployment stage. The administrator wants to ensure that if the build stage fails, the pipeline stops and notifies the team. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure the pipeline to stop on failure in the build stage.. The correct answers are A and B. AWS CodePipeline automatically stops execution on failure when a stage fails (A). To notify the team, you can configure an Amazon SNS topic to send notifications on pipeline stage failures (B). Option C is wrong because while CloudWatch Events can detect build failures, the question asks for an action that the administrator should take; directly configuring an SNS topic is the recommended approach. Option D is wrong because manual approval is not used for automatic notification; it is for manual review. Option E is wrong because CodeBuild itself does not stop the pipeline; the pipeline stops automatically on failure.

Answer

Set up an Amazon CloudWatch Events rule to detect build failures and send an email.

Answer

Add a manual approval action after the build stage to review results.

Answer

Use AWS CodeBuild as the build provider and configure it to stop the pipeline on failure.

Question 7

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator wants to update a stack that contains an Amazon RDS DB instance. The update involves changing the DB instance class. Which THREE steps should the administrator take to perform this update with minimal downtime? (Choose three.)

Accepted Answer

Update the CloudFormation stack with a new parameter value for the DB instance class.. Option B is correct because updating the CloudFormation stack with a new parameter value for the DB instance class is the proper declarative way to change the RDS instance class; CloudFormation will generate a change set and apply the modification to the DBInstance resource, triggering an in-place modification rather than a replacement. Option D is correct because taking a manual snapshot of the RDS instance before making changes provides a rollback point; if the instance class modification fails or causes issues, the snapshot can be restored, which is a standard best practice for minimizing risk during RDS modifications. Option E is correct because enabling Multi-AZ on the RDS instance allows RDS to perform the instance class change using a rolling upgrade: the standby is modified first, a failover occurs, and then the original primary is modified, resulting in minimal downtime compared to a single-AZ instance which would be unavailable during the modification. Option A is incorrect because modifying the RDS instance class directly in the RDS console creates drift from the CloudFormation template, and the subsequent stack update would either fail or attempt to revert the change, defeating the purpose of using CloudFormation. Option C is incorrect because deleting and recreating the stack would destroy the existing DB instance and its data (unless snapshots are restored), causing significant downtime and data loss risk, which contradicts the minimal downtime requirement.

Answer

Modify the RDS instance class directly in the RDS console and then update the CloudFormation template.

Answer

Delete the existing stack and create a new one with the updated instance class.

Question 8

A SysOps administrator is using AWS System Manager Automation to patch a fleet of Amazon EC2 instances. The administrator wants to ensure that instances are patched during a maintenance window and that they are rebooted only if required. Which TWO steps should the administrator include in the automation document? (Choose two.)

Accepted Answer

Set the 'RebootIfNeeded' parameter to 'True' or 'False' as appropriate.. Option B is correct because the AWS-RunPatchBaseline automation/runbook supports a RebootOption parameter (values such as RebootIfNeeded or NoReboot) that controls whether an instance is rebooted only when the patch baseline requires it, directly satisfying the requirement to reboot only if required. Option D is correct because AWS-RunPatchBaseline is the AWS-managed document that scans for and installs missing patches on EC2 instances using the associated patch baseline, which is exactly the patching action the administrator needs in the automation document. Option A is not required by the scenario; EBS snapshots are a backup precaution, not a patching or reboot-control step. Option C is unnecessary because the question asks which steps belong in the automation document, and maintenance window scheduling is configured separately in Systems Manager, not as a document step. Option E is also unnecessary since CloudWatch alarms are for monitoring/notification and do not perform the patching or conditional reboot behavior required.

Answer

Create an Amazon EBS snapshot of each instance before patching.

Answer

Schedule a maintenance window in the Systems Manager console.

Answer

Configure an Amazon CloudWatch alarm to detect failed patches.

Question 9

A SysOps administrator has created the IAM policy shown in the exhibit. The policy is attached to a role used by an automation script that manages Amazon EBS snapshots. The script is failing when it tries to delete snapshots. What is the likely cause?

Accepted Answer

The script is trying to delete snapshots in a different region or account.. IAM policies that grant EBS snapshot permissions without specifying a resource ARN or with a resource ARN scoped to a specific region/account will fail when the script operates on snapshots outside that scope. The most likely cause is that the policy's Resource element restricts actions to snapshots in one region or account, while the script targets snapshots elsewhere. IAM evaluates the resource ARN against the actual snapshot being acted upon, and a mismatch results in implicit deny.

Answer

The script does not have permission to delete any snapshots.

Answer

The script does not have permission to describe snapshots.

Answer

The script does not have permission to create tags on snapshots.

Question 10

A company uses AWS Elastic Beanstalk to deploy a Node.js application. The application requires a specific version of Node.js that is not the default version provided by the Elastic Beanstalk platform. How can the administrator ensure that the correct Node.js version is installed on the environment's EC2 instances?

Accepted Answer

Include a configuration file in the .ebextensions folder that specifies the desired Node.js version.. Including a configuration file in the .ebextensions folder allows you to customize the Elastic Beanstalk environment, including installing specific software versions. You can use commands or packages directives to install the desired Node.js version on the EC2 instances during deployment.

Answer

Use the AWS CLI to run a command on each instance to install the desired Node.js version.

Answer

Use the Elastic Beanstalk console to change the platform version after the environment is created.

Answer

Set an environment property 'NODE_VERSION' to the desired version.

Question 11

A company has a production AWS CloudFormation stack that creates an Amazon EC2 instance with an AWS Systems Manager Association to install software. The stack creation succeeds, but the association does not apply to the instance. The instance is in a private subnet with a VPC endpoint for Systems Manager. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not installed or is not running on the EC2 instance.. The association is created at stack creation, but if the instance does not have the SSM Agent installed and running, the association will not apply. Option A is correct. Option B is wrong because the VPC endpoint is configured. Option C is wrong because the instance profile is not directly related to the association application. Option D is wrong because the Systems Manager automation document is not needed for state manager associations.

Answer

The VPC endpoint for Systems Manager is not in the same subnet as the instance.

Answer

The instance does not have an IAM instance profile that allows Systems Manager actions.

Answer

The association uses an Automation document that requires a different type of instance.

Question 12

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target instances are not passing the health checks. The administrator reviews the CodeDeploy deployment logs and finds that the application installation succeeded but the built-in health check failed. What should the administrator do to resolve this issue?

Accepted Answer

Modify the AppSpec file to include a script in the 'Validate Service' lifecycle event that performs a custom health check.. The 'Validate Service' lifecycle event is the final hook in a CodeDeploy deployment and is specifically designed to run custom validation logic after the application has been installed and started. Since the built-in health check is failing even though installation succeeded, the administrator needs to override or supplement that check with a custom health check script placed in the ValidateService event. This allows CodeDeploy to verify the service is actually healthy using application-specific criteria before marking the deployment successful.

Answer

Modify the AppSpec file to set the 'healthCheckGracePeriod' to a higher value.

Answer

Modify the AppSpec file to include a script in the 'AfterInstall' lifecycle event that restarts the web server.

Answer

Modify the AppSpec file to run a script in the 'ApplicationStop' lifecycle event.

Question 13

A company uses AWS OpsWorks for Chef Automate to manage its EC2 instances. The administrator needs to deploy a new cookbook to all instances in a stack. The cookbook is stored in an S3 bucket. What is the MOST efficient way to deploy the cookbook to the instances?

Accepted Answer

Configure the OpsWorks stack to use the S3 bucket as the custom cookbook source and run the 'Update Custom Cookbooks' stack command.. AWS OpsWorks for Chef Automate supports a custom cookbook source, and the most efficient way to deploy a cookbook stored in S3 is to configure the stack to use that S3 bucket as the custom cookbook source, then run the 'Update Custom Cookbooks' stack command. This triggers the instances to fetch and apply the cookbook via the Chef run, avoiding manual per-instance work. It leverages OpsWorks orchestration rather than ad hoc scripts.

Answer

Upload the cookbook to the Chef Server and have the instances pull from there.

Answer

SSH into each instance and manually download the cookbook from S3.

Answer

Configure a lifecycle event in the OpsWorks layer to run a script that downloads the cookbook from S3.

Question 14

A company uses AWS Elastic Beanstalk to deploy a Python web application. The administrator needs to update the environment's configuration to use a larger instance type. What is the correct way to perform this update with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to change the instance type and select a rolling update policy.. Elastic Beanstalk supports rolling updates, which allow you to change the instance type without downtime by updating instances in batches. Option B is incorrect because creating a new environment and swapping URLs is more complex and can still cause disruption. Option C is incorrect because applying the change immediately without a rolling update policy would cause downtime. Option D is incorrect because terminating all instances would cause downtime.

Answer

Create a new Elastic Beanstalk environment with the larger instance type and swap the environment URLs.

Answer

Use the Elastic Beanstalk console to change the instance type and apply the change immediately.

Answer

Terminate all instances and launch new ones with the larger instance type.

Question 15

An administrator is using AWS CloudFormation to create a stack that includes an Auto Scaling group and a launch template. The launch template specifies an AMI ID. Which TWO changes to the launch template will trigger an update to the Auto Scaling group? (Choose TWO.)

Accepted Answer

Changing the instance type.. Option C is correct because changing the instance type in a launch template alters the instance configuration that the Auto Scaling group uses, so CloudFormation detects the difference and triggers an update to the Auto Scaling group. Option D is correct because changing the AMI ID in the launch template also changes the instance configuration, causing CloudFormation to update the Auto Scaling group. Options A, B, and E are not correct in this context because modifying security group IDs, changing the key pair name, or adding a tag to the launch template does not by itself trigger an Auto Scaling group update in the same way as changes to the instance type or AMI ID.

Answer

Modifying the security group IDs.

Answer

Changing the key pair name.

Answer

Adding a new tag to the launch template.