SOA-C02 Deployment, Provisioning, and Automation Practice Test 6 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. The administrator needs to update a stack that includes an Amazon RDS DB instance. The update requires replacing the DB instance with a new one. What is the most efficient way to achieve this with minimal downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CloudFormation's UpdateReplace policy by modifying a property that requires replacement, such as DBInstanceClass, and take a snapshot before update.. By modifying a property that requires replacement (e.g., DBInstanceClass), CloudFormation will create a new DB instance while retaining the old one until the new one is fully operational. Taking a snapshot before the update ensures data is backed up. This approach minimizes downtime because the old instance remains available until the new instance is ready. Option A is incorrect because simply changing the DB instance identifier does not trigger replacement; it attempts to rename the instance, which is not supported for an existing RDS instance. Option B is incorrect because using a custom resource adds unnecessary complexity and does not leverage CloudFormation's native replacement capabilities. Option C is incorrect because deleting and recreating the stack would cause complete downtime during the entire process, which is not efficient.

Answer

Modify the stack template to change the DB instance identifier and update the stack.

Answer

Use a custom resource to create a new DB instance and delete the old one.

Answer

Delete the stack and create a new one with the updated DB instance.

Question 2

A SysOps administrator is deploying a CloudFormation stack that includes an Amazon EC2 instance. The instance needs to have the latest patch level at launch. Which TWO methods can accomplish this? (Choose TWO.)

Accepted Answer

Create a custom AMI with the latest patches.. Option A is correct because baking a custom AMI that already contains the latest patches guarantees the EC2 instance launches fully patched, since the patched state is captured in the AMI image itself. Option D is correct because a CloudFormation creation policy can be combined with an AWS::SSM::Association or Systems Manager Run Command to apply patches during stack creation, and the creation policy makes CloudFormation wait until the SSM command signals success before marking the resource complete. Option B is not ideal because user data scripts run asynchronously after launch and do not guarantee the instance is patched before it is considered ready, and they can fail silently. Option C is incorrect because CodeDeploy is an application deployment service, not a patching mechanism, and it does not ensure patches are applied at launch. Option E is incorrect because an AWS Config rule only detects and reports on compliance; it does not apply patches to the instance.

Answer

Include a user data script that runs the patch command.

Answer

Use AWS CodeDeploy to run a patch script.

Answer

Configure an AWS Config rule to enforce patching.

Question 3

A company is using AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The administrator wants to minimize costs while ensuring performance. Which THREE actions should the administrator take? (Choose THREE.)

Accepted Answer

Enable enhanced health reporting and monitoring for the environment.. Option A is correct because enabling enhanced health reporting gives Elastic Beanstalk detailed instance and environment metrics (CPU, memory, request latency, etc.) that let the administrator verify performance during peak hours and make informed scaling decisions, which supports the goal of maintaining performance while minimizing cost. Option B is correct because a scheduled scaling policy on the Auto Scaling group can proactively add capacity before business hours and remove it at night, matching the predictable traffic pattern and avoiding the cost of running excess instances around the clock. Option D is correct because CloudWatch alarms that trigger scaling on response time (e.g., a target-tracking or step-scaling policy based on latency metrics) provide dynamic, performance-driven scaling to handle unexpected spikes beyond the scheduled baseline. Option C is not correct because a launch template only defines instance configuration (AMI, instance type, security groups) and does not by itself reduce cost or improve performance for this traffic pattern. Option E is not correct because deploying multiple Elastic Beanstalk environments duplicates resources and increases cost rather than minimizing it, and it is not required to handle the described daily traffic variation.

Answer

Use a launch template to define instance configuration.

Answer

Deploy the application in multiple Elastic Beanstalk environments.

Question 4

A company uses AWS OpsWorks for configuration management. The administrator needs to deploy a new application version to a stack of EC2 instances. The instances are part of a layer that has a custom recipe. Which THREE steps are required to update the application? (Choose THREE.)

Accepted Answer

Run the 'Execute Recipes' stack command to run the new recipe.. Option E is correct because the new recipe that handles the application deployment must first be added to the custom cookbook repository so OpsWorks has the updated code to run. Option B is correct because running the 'Update Custom Cookbooks' stack command makes OpsWorks pull the latest cookbook version from the repository onto the stack's instances, ensuring the new recipe is available. Option A is correct because the 'Execute Recipes' stack command is then used to actually run the new custom recipe on the layer's instances, which performs the application update. Option C is not required here because the 'Deploy' stack command is used for standard OpsWorks deployment of an app defined in the console, not for executing a custom recipe-based deployment. Option D is not required because the scenario is about deploying via a custom recipe, not about changing the app version pointer in the OpsWorks console.

Answer

Run the 'Deploy' stack command to deploy the new application.

Answer

Update the app in the OpsWorks console to point to the new application version.

Question 5

A company wants to automate the creation of AWS resources based on tags. When a user tags an S3 bucket with 'Deploy: True', a Lambda function should trigger to create a corresponding CloudFront distribution. Which AWS service should be used to invoke the Lambda function when the tag is applied?

Accepted Answer

AWS Config. AWS Config is the correct service because it can evaluate resource configurations and trigger remediation actions or notifications when tags change. Specifically, AWS Config rules can monitor for the presence of a specific tag (e.g., 'Deploy: True') on S3 buckets and then invoke a Lambda function as a remediation action. This enables automated, tag-based resource creation, such as generating a CloudFront distribution when the tag is applied.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Events

Answer

Amazon S3 Events

Question 6

A company uses AWS CloudFormation to deploy infrastructure. The administrator needs to update a stack that includes an Amazon RDS DB instance. The update requires replacing the DB instance with a new one. What is the most efficient way to achieve this with minimal downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the DependsOn attribute on the application layer resources to depend on the database layer.. The DependsOn attribute in CloudFormation explicitly defines a dependency between resources, ensuring that the application layer resources are created only after the database layer resources are fully provisioned. This is the standard, declarative way to enforce ordering within a single stack. It guarantees the database is available before the application starts.

Answer

Create separate stacks for the database and application layers.

Answer

Use a CloudFormation creation policy on the application instances.

Answer

Use a CloudFormation wait condition in the database stack.

Question 7

A SysOps administrator is using AWS CodePipeline to automate the build and deploy process for a Java application. The build stage uses AWS CodeBuild, and the deploy stage uses AWS CodeDeploy to deploy to an Auto Scaling group. The deployment fails intermittently with a 'Timeout' error. What should the administrator check first?

Accepted Answer

The health check grace period on the load balancer.. The most likely cause of intermittent timeout errors during CodeDeploy deployment to an Auto Scaling group is an insufficient health check grace period on the load balancer. During deployment, new instances are launched and need time to warm up before passing health checks; if the grace period is too short, the load balancer may mark them unhealthy and cause deployment timeouts.

Answer

The IAM instance profile for the EC2 instances.

Answer

The buildspec.yml file for syntax errors.

Answer

The S3 bucket permissions for CodePipeline artifacts.

Question 8

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running a single instance. The SysOps administrator needs to update the application to a new version with zero downtime. What should the administrator do?

Accepted Answer

Perform an immutable update in the Elastic Beanstalk environment.. An immutable update launches a new instance with the updated application version and then terminates the old instance, providing zero downtime. This is ideal for a single-instance environment. Option A is incorrect because a rolling update with a batch size of 1 on a single instance would cause a brief downtime as the instance is updated in place. Option B (Blue/Green deployment) also achieves zero downtime but requires creating a separate environment and swapping URLs, which is more complex than necessary; the simplest solution with zero downtime is an immutable update. Option D is irrelevant because swapping an RDS database does not update the application version.

Answer

Perform a rolling update with a batch size of 1.

Answer

Perform a Blue/Green deployment by swapping environment URLs.

Answer

Update the application version and swap the RDS database.

Question 9

A SysOps administrator is managing a CloudFormation stack that creates an Amazon RDS DB instance. The stack uses the 'DBInstance' resource with a 'DeletionPolicy' attribute set to 'Delete'. The administrator wants to modify the stack to retain the DB instance when the stack is deleted, but the change fails because the DB instance is in a state that does not allow modification. What is the MOST likely reason?

Accepted Answer

The DeletionPolicy attribute cannot be changed after the stack is created.. The change fails because the DeletionPolicy attribute on an existing resource cannot be modified after the stack is created. CloudFormation does not allow updating the DeletionPolicy for an existing resource; to change it, you must create a new stack or use a different resource name. Option A is incorrect because a stack in CREATE_COMPLETE state can be updated for most attributes, but DeletionPolicy is an exception. Option B is incorrect because deletion protection on the DB instance would prevent deletion, but the issue here is modifying the DeletionPolicy, not deleting the instance. Option C is incorrect because maintenance windows do not affect CloudFormation updates to the DeletionPolicy.

Answer

The stack is in a 'CREATE_COMPLETE' state and cannot be updated.

Answer

The DB instance has deletion protection enabled.

Answer

The DB instance is in a maintenance window that prevents modifications.

Question 10

A company uses AWS Systems Manager to automate patching of EC2 instances. The SysOps administrator creates a Maintenance Window that targets a list of instances. The patching task fails with the error: 'Instance is not in a supported state.' What should the administrator check FIRST?

Accepted Answer

Verify that the SSM Agent is installed and running on the instance.. The error 'Instance is not in a supported state' typically indicates that the SSM Agent is not installed, not running, or not able to communicate with Systems Manager. The first thing to check is whether the SSM Agent is installed and running on the instance, as it is required for Systems Manager to manage the instance.

Answer

Verify that the instance has a public IP address.

Answer

Verify that the instance's security group allows inbound traffic from Systems Manager.

Answer

Verify that the instance has an IAM instance profile attached with the necessary permissions.

Question 11

A SysOps administrator is creating an Auto Scaling group using a launch template. The administrator wants to ensure that instances are automatically registered with an Application Load Balancer (ALB) target group. Which TWO steps are required? (Choose TWO.)

Accepted Answer

Configure the instance security group to allow traffic from the ALB.. Option B is correct because the Auto Scaling group itself must be associated with the ALB target group by specifying the target group ARN in the Auto Scaling group configuration (via the TargetGroupARNs parameter), which is what enables the group to automatically register its instances with that target group. Option A is correct because the instances' security group must allow inbound traffic from the ALB's security group on the listener/health-check port so the load balancer can reach and health-check the instances; without this, targets would be registered but marked unhealthy. Option C is not required because Auto Scaling group health checks using ELB (HealthCheckType=ELB) only control instance replacement based on ALB health, not automatic target registration. Option D is wrong because the ALB's security group should be attached to the load balancer, not to the Auto Scaling group or its instances. Option E is wrong because the target group ARN is specified on the Auto Scaling group, not in the launch template.

Answer

Configure health checks on the Auto Scaling group to use ELB.

Answer

Create a security group for the ALB and attach it to the Auto Scaling group.

Answer

Include the target group ARN in the launch template.

Question 12

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The update attempted to modify an Amazon RDS DB instance's storage type from gp2 to io1. The error message indicates that the modification is not supported. Which TWO reasons could cause this error? (Choose TWO.)

Accepted Answer

The DB instance is using an Oracle DB engine version that does not support storage type modification.. Some storage modifications require a migration that is not supported for certain DB engine versions. Option C is correct because CloudFormation stack updates that require replacement will fail if 'DeletionPolicy' is set to 'Retain' and the resource is replaced. Option B is wrong because storage type changes are generally allowed without enabling backup. Option D is wrong because maintenance windows do not affect the feasibility of modification. Option E is wrong because the allocated storage size can be changed during modification.

Answer

The DB instance does not have automated backups enabled.

Answer

The stack update is occurring during the DB instance's maintenance window.

Answer

The allocated storage size is below the minimum required for io1.

Question 13

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must deploy a serverless application using AWS SAM. The administrator wants to run integration tests after the deployment. Which THREE services should be used together? (Choose THREE.)

Accepted Answer

AWS CodePipeline. AWS CodePipeline (B) is correct because it is the orchestration service that models the pipeline's source, build, and deploy stages and triggers each action in sequence. AWS CodeBuild (C) is correct because it provides the managed build environment where the SAM application is packaged (for example, `sam package`/`aws cloudformation package`) and where integration tests can be executed as a build action after deployment. AWS SAM (E) is correct because it is the framework used to define, build, and deploy the serverless application, with `sam build` and `sam deploy` producing and releasing the CloudFormation stack. AWS CodeCommit (A) is not required, since CodePipeline can use other sources such as S3 or GitHub, and AWS CodeDeploy (D) is not needed because SAM deploys serverless applications through CloudFormation rather than CodeDeploy.

Answer

AWS CodeCommit

Answer

AWS CodeDeploy

Question 14

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon EC2 instance and an associated security group. The stack creation fails with the error: 'Resource creation cancelled' after the security group is created but before the instance is launched. What is the MOST likely cause?

Accepted Answer

The EC2 instance resource configuration has an error.. The error 'Resource creation cancelled' indicates that CloudFormation was unable to complete the creation of a resource. Since the security group was created successfully, the issue is likely with the EC2 instance. A common cause is a configuration error in the instance resource (e.g., invalid AMI ID, incorrect instance type, or missing required properties). CloudFormation cancels the creation when a resource fails due to such errors. Option A is incorrect because the security group creation succeeded. Option B is incorrect because the stack was not deleted; the creation process was cancelled. Option D is incorrect because CloudFormation automatically rolls back on failure without requiring a trigger.

Answer

The security group failed to create.

Answer

The stack was manually deleted during creation.

Answer

The stack's rollback trigger was not configured.

Question 15

A company is using AWS CodeDeploy to deploy a new version of an application to a fleet of EC2 instances. The deployment is configured with a Blue/Green deployment type. During the deployment, the new instances pass all health checks, but the old instances are not being terminated automatically. The SysOps Administrator needs to ensure that the old instances are terminated after a successful deployment. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Configure the Blue/Green deployment settings to automatically terminate the original instances after a specified wait time.. Option A is correct because AWS CodeDeploy Blue/Green deployments for EC2 include a setting that controls what happens to the original instances after the replacement instances are healthy; configuring it to automatically terminate the original instances after a specified wait time ensures the old fleet is cleaned up post-deployment. Option C is correct because Blue/Green deployments require a load balancer (or two target groups) to shift traffic from the original to the replacement instances; configuring the deployment group to use the original load balancer with distinct target groups lets CodeDeploy register new instances, reroute traffic, and then terminate the old instances once the deployment succeeds. Option B is wrong because registering old instances to a new load balancer does not trigger CodeDeploy to terminate them and is not part of a Blue/Green traffic shift. Option D is wrong because AllAtOnce is a deployment configuration controlling how many instances are updated simultaneously, not whether original instances are terminated. Option E is wrong because removing the load balancer from the deployment group breaks the Blue/Green traffic-shifting mechanism and does not cause old instances to be terminated.

Answer

Register the old instances to a new load balancer.

Answer

Change the deployment configuration to AllAtOnce.

Answer

Modify the deployment group to not use a load balancer.