SOA-C02 Deployment, Provisioning, and Automation Practice Test 5 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The administrator wants to update a stack that contains an RDS DB instance. The update requires replacing the DB instance. What should the administrator do to minimize downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a CloudFormation stack update with a Replacement update policy and a snapshot. To truly minimize downtime, you would need to create a new DB instance, restore data from a snapshot, and update the application to point to the new endpoint before removing the old instance. Simply setting `UpdateReplacePolicy: Snapshot` and updating the stack does not automatically populate the new instance or update the application. Therefore none of the provided options fully solves the requirement.

Answer

Delete the stack and create a new one with the updated template

Answer

Disable deletion protection on the DB instance before the update

Answer

Modify the DB instance endpoint in the application configuration after update

Question 2

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource that depends on an AWS::IAM::Role. The error message is 'Resource handler returned message: "The role defined for the function cannot be assumed by Lambda" (Service: Lambda, Status Code: 400).' What is the most likely cause?

Accepted Answer

The trust policy of the IAM role does not include 'lambda.amazonaws.com' as a trusted entity. The error 'The role defined for the function cannot be assumed by Lambda' indicates that the IAM role's trust policy does not allow the Lambda service to assume the role. For Lambda to invoke a function with a given role, the role's trust policy must include 'lambda.amazonaws.com' as a trusted entity. Option B is correct because it correctly identifies this issue. Option A is wrong because a function name conflict would produce a different error. Option C is wrong because insufficient permissions affect what actions the function can perform, not whether Lambda can assume the role. Option D is wrong because resource-based policies control who can invoke the function, not role assumption.

Answer

The Lambda function name conflicts with an existing function

Answer

The IAM role does not have sufficient permissions to execute the Lambda function

Answer

The Lambda function has a resource-based policy that denies access

Question 3

Which TWO options are best practices for automating deployments using AWS CodeDeploy? (Choose two.)

Accepted Answer

Use a blue/green deployment strategy. A blue/green deployment strategy minimizes downtime and risk by running two identical environments (blue for current, green for new) and shifting traffic after validation. This approach allows instant rollback by switching traffic back to the blue environment if issues arise, making it a best practice for critical production deployments.

Answer

Use a single deployment group for all environments

Answer

Deploy to all instances simultaneously

Answer

Require manual approval for every deployment

Question 4

Which THREE steps are required to deploy a serverless application using AWS CloudFormation? (Choose three.)

Accepted Answer

Use the AWS::Serverless::Transform to enable SAM. Options A, B, and C are correct. To deploy a serverless application using AWS CloudFormation with the AWS Serverless Application Model (SAM), you must: (A) add the `AWS::Serverless::Transform` to the template to enable SAM processing; (B) specify the path to the source code (e.g., via `CodeUri`) in the `AWS::Serverless::Function` resource; and (C) define the `AWS::Serverless::Function` resource. Option D is incorrect because a VPC and subnets are optional for a Lambda function. Option E is incorrect because an S3 bucket for the deployment artifact is automatically created and managed by SAM; you do not need to define it manually.

Answer

Define a VPC and subnets for the Lambda function

Answer

Create an S3 bucket for the deployment artifact

Question 5

Which TWO actions should a SysOps administrator take to automate the deployment of a multi-tier application with AWS CloudFormation? (Choose two.)

Accepted Answer

Use nested stacks to separate concerns such as network, app, and database. Options B and D are correct. Using nested stacks (B) helps separate concerns like network, application, and database layers, promoting modularity and reusability. Cross-stack references (D) allow outputs from one stack to be used as inputs in another, enabling efficient resource sharing and dependency management. Option A is incorrect because hardcoding CIDR blocks and instance types reduces flexibility; parameters should be used to make templates reusable. Option C is incorrect because AWS::Include includes template snippets, not dynamic values; parameters are still needed for customization. Option E is incorrect because a single monolithic template is harder to manage and update; breaking resources into multiple stacks improves maintainability.

Answer

Hardcode CIDR blocks and instance types to avoid parameter input

Answer

Use AWS::Include to reuse snippets instead of parameters

Answer

Define all resources in a single template to simplify management

Question 6

An administrator attempts to deploy an application using AWS CodeDeploy. The deployment fails with 'Access Denied' when trying to download the revision from the S3 bucket 'example-bucket'. The IAM policy attached to the instance profile is shown in the exhibit. What is the cause of the failure?

Accepted Answer

The policy is missing the s3:GetObjectVersion action for the bucket. The deployment fails with 'Access Denied' when trying to download the revision from S3. The IAM policy attached to the instance profile must allow the s3:GetObject action to download objects. However, if the deployment uses a specific version of the revision (e.g., when using CodeDeploy with S3 versioning), the s3:GetObjectVersion action is also required. The exhibit shows the policy includes s3:GetObject but not s3:GetObjectVersion, causing the failure. Option B is correct because the missing s3:GetObjectVersion action is the cause. Option A is incorrect because s3:ListBucket is present in the policy. Option C is incorrect because the policy does include s3:GetObject. Option D is incorrect because the policy is attached to the correct instance profile.

Answer

The policy does not include s3:ListBucket

Answer

The policy grants s3:ListBucket but not s3:GetObject

Answer

The policy is attached to the wrong IAM role

Question 7

A CloudFormation stack creation failed. The administrator runs the command shown in the exhibit. What is the most likely reason for the failure?

Accepted Answer

The AMI ID specified in the template does not exist in the region. The error message indicates the AMI ID is invalid or does not exist in the specified region. Options A, B, and D are incorrect: the error is about the AMI ID, not permissions (A), the region is not mentioned as the issue (B), and instance type support is not referenced (D).

Answer

The IAM role for CloudFormation does not have permission to launch EC2 instances

Answer

The stack is being created in a region that does not support the specified AMI

Answer

The instance type t2.micro is not supported in the target Availability Zone

Question 8

An administrator deploys a CloudFormation template that includes the snippet shown in the exhibit. Later, the administrator deletes the stack. What happens to the S3 bucket?

Accepted Answer

The bucket is retained but no longer managed by CloudFormation. The DeletionPolicy attribute set to 'Retain' on the S3 bucket resource causes CloudFormation to preserve the bucket when the stack is deleted. The bucket will still exist in the account but will no longer be under CloudFormation management. Therefore, option D is correct. Option A is incorrect because the bucket is retained regardless of its contents. Option B is incorrect because the bucket is not emptied or deleted. Option C is incorrect because the bucket is not deleted along with the stack.

Answer

The bucket is deleted only if it contains no objects

Answer

The bucket is emptied and then deleted

Answer

The bucket is deleted along with the stack

Question 9

A company is using AWS CloudFormation to deploy a multi-tier web application. After updating the stack template, the update fails with a stack creation rollback in progress error. The SysOps administrator needs to identify the specific resource that caused the failure. What is the MOST efficient way to accomplish this?

Accepted Answer

Run the AWS CLI command aws cloudformation describe-stack-events --stack-name <stack-name> and review the resource status reason.. The `aws cloudformation describe-stack-events` command provides a detailed list of events for the stack, including the status reason for each resource. This allows the SysOps administrator to identify the specific resource that caused the failure and the reason for the failure. Option A is incorrect because the stack policy controls permissions, not failure details. Option B is incorrect because `describe-change-set` shows proposed changes but does not provide error details for a failed update. Option C is incorrect because CloudTrail logs the API call but may not include the specific resource failure reason as quickly or conveniently as stack events.

Answer

Use the AWS Management Console to view the stack status and check the stack policy.

Answer

Use the aws cloudformation describe-change-set command to review the proposed changes.

Answer

Check the CloudTrail logs for the UpdateStack API call to see the error message.

Question 10

An organization is using OpsWorks to manage a stack of application servers. They need to automatically scale out based on CPU utilization. Which configuration should the SysOps administrator use to achieve this?

Accepted Answer

Add a load-based layer and configure the scaling thresholds for CPU utilization.. OpsWorks load-based layers automatically scale instances based on CloudWatch alarms, such as CPU utilization thresholds. Option A is incorrect because auto-healing replaces failed instances, not scales out. Option B is incorrect because custom Chef recipes run on lifecycle events (setup, configure, etc.) but do not directly handle automatic scaling. Option D is incorrect because time-based instances scale on a schedule, not based on CPU utilization.

Answer

Enable auto-healing on the layer to replace unhealthy instances automatically.

Answer

Create a custom Chef recipe that runs on a lifecycle event to launch new instances.

Answer

Configure a time-based instance with a recurring schedule to add instances during peak hours.

Question 11

A SysOps administrator needs to deploy an application to a fleet of EC2 instances in an Auto Scaling group. The application code is stored in an S3 bucket. The administrator wants to automate the deployment so that new instances automatically download the latest code on launch. Which approach should the administrator use?

Accepted Answer

Create a lifecycle hook in the Auto Scaling group that triggers a Lambda function or runs a Systems Manager command to download the code.. Lifecycle hooks in Auto Scaling groups allow you to execute custom actions (via Lambda or Systems Manager Run Command) when instances launch, enabling automatic download of the latest code from S3. Option A is incorrect because CloudFormation user data scripts are static and require updating the launch configuration when code changes. Option B is incorrect because Systems Manager Automation is designed for runbook-style automation, not automatic execution on every instance launch without a lifecycle hook. Option C is incorrect because OpsWorks Stacks adds unnecessary complexity; lifecycle hooks provide a simpler, native solution.

Answer

Use AWS CloudFormation with a user data script that downloads the code from S3.

Answer

Use AWS Systems Manager Automation to run a document that downloads the code each time the instance is started.

Answer

Use AWS OpsWorks Stacks with a custom layer and a Chef recipe that downloads the code.

Question 12

A company is using Elastic Beanstalk to deploy a web application. Recently, a deployment failed due to a missing environment variable. The administrator fixed the configuration and wants to redeploy the same application version without rebuilding the source bundle. What is the MOST efficient way to redeploy?

Accepted Answer

Use the AWS CLI command aws elasticbeanstalk update-environment to update the environment, then use the same version label to deploy again.. The aws elasticbeanstalk update-environment command can update the environment configuration (e.g., add missing environment variables) and then redeploy the same application version using its label without rebuilding the source bundle. Option A is incorrect because terminating and creating a new environment is wasteful and unnecessary. Option B is incorrect because uploading a new application version with the same source bundle is redundant; you can reuse the existing version. Option D is incorrect because creating a new environment is unnecessary; you only need to update and redeploy to the existing environment.

Answer

Terminate the environment and create a new environment with the same configuration.

Answer

Upload a new application version with the same source bundle and deploy it to the environment.

Answer

Use the Elastic Beanstalk console to create a new environment with the same application version.

Question 13

A SysOps administrator is troubleshooting a CloudFormation stack that failed to create. The stack includes an Amazon RDS DB instance. The error message indicates that the DB instance name already exists. The stack uses a parameter for the DB instance identifier. What should the administrator do to resolve this issue and create the stack?

Accepted Answer

Delete the failed stack, change the DB instance identifier parameter to a unique name, and recreate the stack.. When a CloudFormation stack creation fails due to a naming conflict (e.g., DB instance identifier already exists), the failed stack must be deleted because it cannot be updated or continued. Changing the parameter to a unique name and recreating the stack resolves the conflict. Option B is incorrect because, while deleting the conflicting DB instance would resolve the name conflict, the failed stack still exists and must be deleted before recreating the stack; in addition, deleting an existing DB instance is not the recommended approach — you should use a unique identifier. Option C is incorrect because `update-stack` cannot be applied to a failed stack creation; the stack is in a failed state and must be recreated. Option D is incorrect because `ContinueUpdateRollback` is used for update rollbacks, not for failed creations.

Answer

Manually delete the DB instance from the AWS Management Console and then retry the stack creation.

Answer

Use the AWS CLI command aws cloudformation update-stack with a new parameter value.

Answer

Execute ContinueUpdateRollback on the stack to retry the creation.

Question 14

A SysOps administrator needs to deploy a CloudFormation stack across multiple AWS accounts in an organization using AWS Organizations. The administrator wants to use a single template and a single deployment operation. Which AWS service should be used to centrally manage the deployment?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets allow deploying stacks across multiple accounts and regions from a single template. Option A is incorrect because Systems Manager is for operational management. Option B is incorrect because OpsWorks is for configuration management. Option C is incorrect because CodePipeline is for CI/CD pipelines.

Answer

AWS Systems Manager

Answer

AWS OpsWorks Stacks

Answer

AWS CodePipeline

Question 15

A company is using Lambda functions to process data from an S3 bucket. The SysOps administrator needs to update the Lambda function code with a new version. The administrator wants to ensure that during the deployment, any in-flight requests are completed with the old code, and new requests use the new code. Which deployment strategy should the administrator use?

Accepted Answer

Create a new Lambda version and update the alias to gradually shift traffic from the old version to the new version using weighted routing.. Lambda aliases support weighted routing, allowing you to gradually shift traffic from the old version to the new version, ensuring in-flight requests complete on the old code. Option A is incorrect because updating the function directly immediately changes all invocations without a transition period. Option B is incorrect because AWS CodeDeploy can deploy to Lambda functions, but the question asks for a strategy that uses native Lambda features; weighted routing via aliases is the simplest and most appropriate method. Option C is incorrect because it creates a new function, which is unnecessary and does not provide gradual traffic shifting.

Answer

Update the Lambda function code directly using the AWS CLI.

Answer

Use AWS CodeDeploy with a canary deployment configuration on the Lambda function.

Answer

Create a new Lambda function and update the S3 event notification to trigger the new function.