SOA-C02 Deployment, Provisioning, and Automation Practice Test 6 — 15 Questions

Question 1

A company is using AWS Elastic Beanstalk with a Blue/Green deployment strategy. After deploying a new version to the green environment and verifying it, the administrator wants to swap the CNAMEs to route production traffic to the green environment. However, the swap operation fails due to a CNAME already in use error. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CNAME prefix for the green environment is already in use by another environment in the same region.. Elastic Beanstalk requires CNAME prefixes to be unique within a region. When swapping CNAMEs between blue and green environments, the green environment's CNAME prefix must not already be in use by another environment. If it is, the swap fails with a 'CNAME already in use' error. Option A is incorrect because the green environment uses a different environment URL. Option C is incorrect because load balancer configuration does not affect CNAME swap. Option D is incorrect because health checks are not the direct cause of this error.

Answer

The green environment is using the same environment URL as the blue environment.

Answer

The load balancer is not configured to handle the traffic.

Answer

The green environment has failing health checks.

Question 2

A SysOps administrator needs to deploy a new application version to an Auto Scaling group without causing any downtime. The application runs on EC2 instances behind an Application Load Balancer. Which deployment method should the administrator use?

Accepted Answer

Use a rolling update with a batch size of 1 instance and enable the health check grace period.. A rolling update with a batch size of 1 instance replaces instances one at a time, ensuring that the Auto Scaling group always maintains the desired capacity minus one, which prevents downtime. Enabling the health check grace period allows the new instance to pass the ALB health checks before the next instance is terminated, ensuring traffic is only sent to healthy instances.

Answer

Perform an in-place update by updating the launch template and manually replacing instances one by one.

Answer

Use a rolling update with a batch size of 100% of the instances.

Answer

Create a new Auto Scaling group with the new launch template and gradually shift traffic using a load balancer target group.

Question 3

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The administrator wants to ensure that the code is version-controlled and that changes are reviewed before deployment. Which TWO AWS services should the administrator use together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudFormation. AWS CloudFormation (Option B) is correct because it allows you to define and provision AWS infrastructure using code (infrastructure as code). AWS CodeCommit (Option C) is correct because it provides a secure, scalable, managed source control service to version-control your CloudFormation templates and enforce code review processes. Option A (AWS Config) is incorrect because it is used for evaluating and auditing resource configurations, not for provisioning. Option D (AWS Service Catalog) is incorrect because it allows organizations to create and manage approved IT service catalogs, not for authoring infrastructure as code. Option E (AWS OpsWorks Stacks) is incorrect because it is a configuration management service using Chef and Puppet, not a tool for infrastructure as code deployment with version control and review workflows.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS OpsWorks Stacks

Question 4

A company is deploying a microservices application on AWS using Amazon ECS with Fargate launch type. The SysOps administrator needs to automate the deployment process so that when a new Docker image is pushed to Amazon ECR, the ECS service is updated with the new image. Which THREE AWS services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodePipeline. The correct combination to automate deployment when a new Docker image is pushed to Amazon ECR is AWS CodePipeline, Amazon ECR, and Amazon ECS. CodePipeline orchestrates the CI/CD pipeline triggered by an ECR push event. ECR stores the Docker images. ECS with Fargate runs the containers and updates the service with the new image. Option A (CloudFormation) is for infrastructure provisioning, not continuous deployment. Option E (Systems Manager) is for management and operations, not CI/CD.

Answer

AWS CloudFormation

Answer

AWS Systems Manager

Question 5

A SysOps administrator is planning to deploy a web application using AWS Elastic Beanstalk. The application requires high availability across multiple Availability Zones. The administrator needs to configure the environment to automatically replace a failed instance. Which TWO configuration options should the administrator enable? (Choose TWO.)

Accepted Answer

Enable the environment's health check and set the health check path to a valid endpoint.. Enabling the environment's health check with a valid endpoint allows Elastic Beanstalk to detect unhealthy instances and automatically replace them. Option C is correct because configuring the Auto Scaling group with a minimum of 2 instances across multiple Availability Zones ensures high availability and automatic replacement of failed instances to maintain the desired count. Option B is incorrect because an Application Load Balancer distributes traffic but does not automatically replace instances; that is handled by Auto Scaling. Option D is incorrect because AWS OpsWorks Stacks is a different service and is not required for this use case. Option E is incorrect because a CloudWatch alarm with SNS notification only alerts on failure but does not automatically replace instances without Auto Scaling integration.

Answer

Attach an Application Load Balancer to distribute traffic to healthy instances.

Answer

Use AWS OpsWorks Stacks to manage the instance lifecycle.

Answer

Create a CloudWatch alarm that triggers an SNS notification when an instance fails.

Question 6

A SysOps administrator is investigating a failed CloudFormation stack creation. The describe-stack-events output shows that the stack creation failed with the reason 'Resource creation cancelled'. What is the most likely cause of this failure?

Accepted Answer

A WaitCondition resource did not receive the required signal within the specified timeout period.. The WaitCondition timed out before receiving the required signal, causing CloudFormation to cancel the stack creation. Option A is incorrect because a parameter validation error would appear as a different reason. Option B is incorrect because there is no indication of missing IAM permissions. Option D is incorrect because the stack creation was cancelled due to the wait condition timeout, not a nested stack failure.

Answer

The stack template contains an invalid parameter value.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to create the resources.

Answer

A nested stack within the parent stack failed to create.

Question 7

A SysOps administrator is creating a CloudFormation stack that requires an IAM role to be passed to EC2 instances. The administrator is using the IAM policy shown in the exhibit. The stack creation fails with an error indicating insufficient permissions to pass the role. What is the most likely cause?

Accepted Answer

The iam:PassRole permission is restricted to a specific role ARN that does not match the role the administrator is trying to pass.. The IAM policy likely includes an iam:PassRole action restricted to a specific role ARN (e.g., 'arn:aws:iam::account:role/Admin'), but the CloudFormation stack is attempting to pass a different role. This causes an insufficient permissions error because the PassRole permission is scoped to that specific role. Option A is incorrect because cloudformation:* includes all CloudFormation actions, including creating stacks. Option B is incorrect because the policy uses cloudformation:*, which implicitly includes CreateStack. Option C is incorrect because ec2:RunInstances is not required for passing an IAM role; the necessary permission is iam:PassRole.

Answer

The cloudformation:* action does not include permission to create stacks.

Answer

The policy does not include the cloudformation:CreateStack action.

Answer

The ec2:RunInstances permission is missing from the policy.

Question 8

A SysOps administrator wants to deploy a new version of an application to an existing Elastic Beanstalk environment. The administrator runs the command shown in the exhibit and sees that the environment is healthy. What should the administrator do next to deploy the new version?

Accepted Answer

Run aws elasticbeanstalk update-environment --environment-name my-env --version-label v2.0. The `update-environment` command with a new version label deploys the new version to the existing environment. Option A is incorrect because it only creates a new application version without deploying it to any environment. Option C is incorrect because there is no `update-application-version` command in the AWS Elastic Beanstalk CLI; the correct command to update the environment is `update-environment`. Option D is incorrect because `create-environment` creates a new environment, not deploys to the existing one.

Answer

Run aws elasticbeanstalk create-application-version --application-name my-app --version-label v2.0 --source-bundle S3Bucket="my-bucket",S3Key="app-v2.zip"

Answer

Run aws elasticbeanstalk update-application-version --application-name my-app --version-label v2.0 --environment-name my-env

Answer

Run aws elasticbeanstalk create-environment --application-name my-app --environment-name my-env-v2 --version-label v2.0

Question 9

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error 'CREATE_FAILED - Resource handler returned message: 'Invalid instance type specified'. The template uses a parameter for InstanceType. What is the most likely cause of this failure?

Accepted Answer

The InstanceType parameter is set to a value that is not allowed in the parameter's AllowedValues list.. The error indicates that EC2 rejected the specified instance type during resource creation. This can happen if the instance type is not a valid EC2 instance type, is not supported by the chosen AMI, or is not available in the target Availability Zone. CloudFormation's AllowedValues would not produce a resource handler error; it would cause a parameter validation failure before any resource is created.

Answer

The VPC specified in the template does not have internet access.

Answer

The Auto Scaling group's desired capacity exceeds the instance limit.

Answer

The template uses a DependsOn clause that creates a circular dependency.

Question 10

A SysOps administrator needs to automate the creation of an Amazon RDS for MySQL database instance. The administrator wants to use AWS CloudFormation and ensure that the database password is not stored in plaintext in the template. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to generate a random password and reference it in the CloudFormation template using a dynamic reference (resolve:secretsmanager).. Using AWS Secrets Manager to generate a password and referencing it with a dynamic reference (resolve:secretsmanager) in a CloudFormation template is the secure and automated solution. Option A is incorrect because storing the password as a CloudFormation parameter with a default value would expose the password in plaintext in the template and parameter values. Option B is incorrect because storing the password in a text file in S3 and referencing the URL still exposes the password in plaintext when the file is accessed, and the S3 URL could be readable in the template. Option D is incorrect because using Systems Manager Parameter Store with String type also stores the parameter in plaintext and resolves to plaintext in the template; a SecureString parameter would be more secure but not specified, and the dynamic reference resolve:ssm still resolves to plaintext in the template at deployment time.

Answer

Store the password as a CloudFormation parameter with a default value and use the Ref intrinsic function.

Answer

Generate a password manually and store it in a text file in Amazon S3; reference the S3 URL in the template.

Answer

Use AWS Systems Manager Parameter Store (String type) and reference it with the dynamic reference resolve:ssm.

Question 11

A SysOps administrator is troubleshooting a failed AWS Elastic Beanstalk environment update. The update changed the configuration of the EC2 instances in the Auto Scaling group, but the new instances fail to launch. The administrator checks the Auto Scaling group's scaling activities and sees a 'Failed' status with the message: 'Instance failed to reach the desired state.' What should the administrator check next?

Accepted Answer

Check the CloudWatch logs for the failed instance to identify application or configuration errors.. The error 'Instance failed to reach the desired state' typically indicates that the new instances are failing health checks, often due to application or configuration issues. Checking CloudWatch logs is the most direct way to diagnose the problem. Option A is incorrect because an IAM role issue would usually result in a different error, such as missing permissions. Option B is incorrect because service quotas would cause a different error, such as insufficient capacity. Option D is incorrect because termination protection prevents accidental termination, not related to health checks.

Answer

Check the IAM role attached to the environment's EC2 instances for missing permissions.

Answer

Check the account service quotas for EC2 instances.

Answer

Check the termination protection setting on the Auto Scaling group.

Question 12

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to existing EC2 instances managed by OpsWorks. Which OpsWorks lifecycle event should the administrator trigger to install the new application?

Accepted Answer

Deploy. The 'Deploy' lifecycle event is specifically designed for deploying applications. Option B (Deploy) is correct because it triggers the deploy recipes to install the new application version. Option A (Configure) is incorrect because it runs when instances come online or leave the stack, not for application deployment. Option C (Shutdown) is incorrect because it runs when an instance is terminated. Option D (Setup) is incorrect because it runs only once when the instance is first booted, not for ongoing deployments.

Answer

Configure

Answer

Shutdown

Answer

Setup

Question 13

A company is deploying a critical application using AWS CloudFormation. The deployment must be resilient to failures and ensure that resources are created in a specific order. The template defines a stack that includes an Amazon RDS database and an Auto Scaling group. The Auto Scaling group depends on the database being available. Which CloudFormation feature should the SysOps administrator use to ensure the database is fully created and available before the Auto Scaling group is created?

Accepted Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use a CreationPolicy on the RDS instance to signal when it is ready.. The correct approach is to use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use a CreationPolicy on the RDS instance so that it sends a signal only after it is fully available. DependsOn alone only waits until CloudFormation marks the RDS as created, which may not mean it is ready to accept connections. The CreationPolicy ensures that the RDS signals its readiness, and the DependsOn then causes the Auto Scaling group to wait for that signal. Option A is wrong because reversing the DependsOn would not help. Option C is wrong because cfn-signal is used with CreationPolicy, but placing it on the Auto Scaling group would wait for a signal from the database, not the other way around. Option D is wrong because DeletionPolicy affects deletion behavior, not creation order.

Answer

Use the DependsOn attribute on the RDS instance to wait for the Auto Scaling group.

Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use cfn-signal on the Auto Scaling group to wait for the database.

Answer

Use the DeletionPolicy attribute on the Auto Scaling group to ensure it is not deleted.

Question 14

A SysOps administrator wants to deploy a serverless application using AWS Lambda functions, Amazon API Gateway, and Amazon DynamoDB. The deployment must be automated and repeatable. Which AWS service should the administrator use to define and manage this infrastructure as code?

Accepted Answer

AWS CloudFormation with the AWS Serverless Application Model (SAM). AWS CloudFormation with the AWS Serverless Application Model (SAM) is the correct choice for defining and managing serverless infrastructure as code, as SAM extends CloudFormation with shorthand syntax for Lambda, API Gateway, and DynamoDB. Option A is wrong because AWS CodeDeploy automates code deployment to running instances, not infrastructure provisioning. Option B is wrong because AWS OpsWorks manages Chef/Puppet-based application stacks. Option C is wrong because AWS Elastic Beanstalk is designed for deploying web applications on EC2, not serverless architectures.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 15

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The SysOps administrator checks the deployment logs and finds that the BeforeInstall lifecycle event script is failing on some instances. The instances are Amazon Linux 2. What should the administrator do to troubleshoot this issue?

Accepted Answer

Review the BeforeInstall script's output and exit code in the deployment logs or on the instance.. The error indicates that the BeforeInstall lifecycle script is failing. The correct first step is to examine the script's output and exit code, which can be found in the deployment logs (under the instance's CodeDeploy agent logs) or directly on the instance. This allows you to identify why the script is failing. Option A is not directly relevant because the issue is not agent connectivity but script execution. Option B is incorrect because changing the deployment configuration to 'OneAtATime' would only affect the pace of deployments, not fix a failing script. Option C is unnecessary because the appspec.yml syntax is likely correct if the script runs at all; the problem lies in the script itself.

Answer

Verify that the CodeDeploy agent on the instances is running and can communicate with the CodeDeploy service.

Answer

Ensure that the CodeDeploy deployment configuration is set to 'OneAtATime' to reduce instance failures.

Answer

Check the appspec.yml file for syntax errors in the hooks section.