SOA-C02 Deployment, Provisioning, and Automation Practice Test 7 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The administrator wants to update a stack that contains an RDS DB instance. The update requires replacing the DB instance. What should the administrator do to minimize downtime?

Accepted Answer

Use a CloudFormation stack update with a Replacement update policy and a snapshot. Option C is correct because using CloudFormation's update policy with a snapshot and replacement can minimize downtime. Option A is wrong because deletion will cause downtime. Option B is wrong because modifying the endpoint manually is not automated. Option D is wrong because disabling deletion protection is not enough.

Answer

Delete the stack and create a new one with the updated template

Answer

Disable deletion protection on the DB instance before the update

Answer

Modify the DB instance endpoint in the application configuration after update

Question 2

An administrator is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS Elastic Beanstalk. The build succeeds, but the deployment fails with 'Access Denied' when Elastic Beanstalk tries to read the artifact from S3. What should the administrator check?

Accepted Answer

The IAM role assumed by the Elastic Beanstalk environment. Option A is correct because the Elastic Beanstalk service role needs permissions to read the artifact bucket. Option B is wrong because the CodeBuild role is for building, not deploying. Option C is wrong because S3 bucket policies are not the most likely issue. Option D is wrong because the artifact bucket is internal.

Answer

The IAM role used by CodeBuild

Answer

Whether the artifact bucket is in the same region as the pipeline

Answer

The S3 bucket policy for the artifact bucket

Question 3

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource that depends on an AWS::IAM::Role. The error message is 'Resource handler returned message: "The role defined for the function cannot be assumed by Lambda" (Service: Lambda, Status Code: 400).' What is the most likely cause?

Accepted Answer

The trust policy of the IAM role does not include 'lambda.amazonaws.com' as a trusted entity. Option C is correct because the role's trust policy must allow the Lambda service principal to assume the role. Option A is wrong because permissions are about actions, not trust. Option B is wrong because resource-based policies are for the function, not the role. Option D is wrong because the function name is not the issue.

Answer

The Lambda function name conflicts with an existing function

Answer

The IAM role does not have sufficient permissions to execute the Lambda function

Answer

The Lambda function has a resource-based policy that denies access

Question 4

Which TWO options are best practices for automating deployments using AWS CodeDeploy? (Choose two.)

Accepted Answer

Use a blue/green deployment strategy. Options B and C are correct. Option A is incorrect because automated rollback is better. Option D is incorrect because large batch size increases risk. Option E is incorrect because manual approval is not a best practice for automation.

Answer

Use a single deployment group for all environments

Answer

Deploy to all instances simultaneously

Answer

Require manual approval for every deployment

Question 5

Which THREE steps are required to deploy a serverless application using AWS CloudFormation? (Choose three.)

Accepted Answer

Use the AWS::Serverless::Transform to enable SAM. Options A, C, and E are correct. Option B is incorrect because it is not a step; it is a prerequisite. Option D is incorrect because a VPC is optional.

Answer

Define a VPC and subnets for the Lambda function

Answer

Create an S3 bucket for the deployment artifact

Question 6

Which TWO actions should a SysOps administrator take to automate the deployment of a multi-tier application with AWS CloudFormation? (Choose two.)

Accepted Answer

Use nested stacks to separate concerns such as network, app, and database. Options B and D are correct. Option A is incorrect because nested stacks are not always necessary. Option C is incorrect because hardcoding CIDR blocks reduces flexibility. Option E is incorrect because parameters should be used for dynamic values.

Answer

Hardcode CIDR blocks and instance types to avoid parameter input

Answer

Use AWS::Include to reuse snippets instead of parameters

Answer

Define all resources in a single template to simplify management

Question 7

An administrator attempts to deploy an application using AWS CodeDeploy. The deployment fails with 'Access Denied' when trying to download the revision from the S3 bucket 'example-bucket'. The IAM policy attached to the instance profile is shown in the exhibit. What is the cause of the failure?

Accepted Answer

The policy is missing the s3:GetObjectVersion action for the bucket. Option A is correct because the policy grants s3:GetObject on the bucket contents, but CodeDeploy also needs s3:GetObjectVersion for versioned buckets or the deployment may be using a specific version. However, the exhibit shows only s3:GetObject, not s3:GetObjectVersion. Additionally, the policy does not include s3:GetObjectTagging or other actions that might be required. But the most common issue is that the policy is missing s3:GetObjectVersion. Option B is wrong because the policy does have s3:ListBucket. Option C is wrong because the policy is attached to the instance profile. Option D is wrong because s3:ListBucket is present.

Answer

The policy does not include s3:ListBucket

Answer

The policy grants s3:ListBucket but not s3:GetObject

Answer

The policy is attached to the wrong IAM role

Question 8

A CloudFormation stack creation failed. The administrator runs the command shown in the exhibit. What is the most likely reason for the failure?

Accepted Answer

The AMI ID specified in the template does not exist in the region. Option A is correct because the error explicitly states the AMI ID is invalid. Option B is wrong because the error mentions the AMI ID, not instance type. Option C is wrong because there is no indication of missing permissions. Option D is wrong because the error is about the AMI, not the region.

Answer

The IAM role for CloudFormation does not have permission to launch EC2 instances

Answer

The stack is being created in a region that does not support the specified AMI

Answer

The instance type t2.micro is not supported in the target Availability Zone

Question 9

An administrator deploys a CloudFormation template that includes the snippet shown in the exhibit. Later, the administrator deletes the stack. What happens to the S3 bucket?

Accepted Answer

The bucket is retained but no longer managed by CloudFormation. Option B is correct because DeletionPolicy: Retain preserves the bucket even after stack deletion. Option A is wrong because the bucket is retained. Option C is wrong because the bucket is not deleted. Option D is wrong because the bucket is retained, not emptied.

Answer

The bucket is deleted only if it contains no objects

Answer

The bucket is emptied and then deleted

Answer

The bucket is deleted along with the stack

Question 10

A company is using AWS CloudFormation to deploy a multi-tier web application. After updating the stack template, the update fails with a stack creation rollback in progress error. The SysOps administrator needs to identify the specific resource that caused the failure. What is the MOST efficient way to accomplish this?

Accepted Answer

Run the AWS CLI command aws cloudformation describe-stack-events --stack-name <stack-name> and review the resource status reason.. Option B is correct because the describe-stack-events command lists stack events in reverse chronological order, showing the specific resource failure reason. Option A is incorrect because it only shows the overall status not details. Option C is incorrect because viewing the stack will not show event details. Option D is incorrect because the change set was not used for the update.

Answer

Use the AWS Management Console to view the stack status and check the stack policy.

Answer

Use the aws cloudformation describe-change-set command to review the proposed changes.

Answer

Check the CloudTrail logs for the UpdateStack API call to see the error message.

Question 11

An organization is using OpsWorks to manage a stack of application servers. They need to automatically scale out based on CPU utilization. Which configuration should the SysOps administrator use to achieve this?

Accepted Answer

Add a load-based layer and configure the scaling thresholds for CPU utilization.. Option A is correct because OpsWorks uses time-based and load-based instances; load-based uses CloudWatch alarms to automatically add/remove instances. Option B is incorrect because a scheduled scaling is time-based, not based on CPU. Option C is incorrect because auto-healing replaces failed instances, not scales. Option D is incorrect because a lifecycle event hook is for custom scripts during events, not scaling.

Answer

Enable auto-healing on the layer to replace unhealthy instances automatically.

Answer

Create a custom Chef recipe that runs on a lifecycle event to launch new instances.

Answer

Configure a time-based instance with a recurring schedule to add instances during peak hours.

Question 12

A SysOps administrator needs to deploy an application to a fleet of EC2 instances in an Auto Scaling group. The application code is stored in an S3 bucket. The administrator wants to automate the deployment so that new instances automatically download the latest code on launch. Which approach should the administrator use?

Accepted Answer

Create a lifecycle hook in the Auto Scaling group that triggers a Lambda function or runs a Systems Manager command to download the code.. Option C is correct because a lifecycle hook can execute a custom script via EC2 Run Command to download code from S3. Option A is incorrect because CloudFormation does not run scripts on instances. Option B is incorrect because OpsWorks Stacks is not being used. Option D is incorrect because Systems Manager Automation runs remotely but not automatically on instance launch without a lifecycle hook.

Answer

Use AWS CloudFormation with a user data script that downloads the code from S3.

Answer

Use AWS Systems Manager Automation to run a document that downloads the code each time the instance is started.

Answer

Use AWS OpsWorks Stacks with a custom layer and a Chef recipe that downloads the code.

Question 13

A company is using Elastic Beanstalk to deploy a web application. Recently, a deployment failed due to a missing environment variable. The administrator fixed the configuration and wants to redeploy the same application version without rebuilding the source bundle. What is the MOST efficient way to redeploy?

Accepted Answer

Use the AWS CLI command aws elasticbeanstalk update-environment to update the environment, then use the same version label to deploy again.. Option B is correct because the aws elasticbeanstalk update-environment command can update environment configuration and then the same application version can be deployed again. Option A is incorrect because it creates a new environment. Option C is incorrect because it creates a new application version. Option D is incorrect because it replaces the environment, which is unnecessary.

Answer

Terminate the environment and create a new environment with the same configuration.

Answer

Upload a new application version with the same source bundle and deploy it to the environment.

Answer

Use the Elastic Beanstalk console to create a new environment with the same application version.

Question 14

A SysOps administrator is troubleshooting a CloudFormation stack that failed to create. The stack includes an Amazon RDS DB instance. The error message indicates that the DB instance name already exists. The stack uses a parameter for the DB instance identifier. What should the administrator do to resolve this issue and create the stack?

Accepted Answer

Delete the failed stack, change the DB instance identifier parameter to a unique name, and recreate the stack.. Option D is correct because the stack creation failed due to a naming conflict. Updating the stack is not possible since it failed. The best approach is to delete the failed stack, change the parameter value to a unique name, and recreate the stack. Option A is incorrect because updating a failed stack requires a different approach and the parameter change might not be allowed. Option B is incorrect because continuing update rollback does not change the parameter. Option C is incorrect because the stack failed creation; there is no existing resource to update.

Answer

Manually delete the DB instance from the AWS Management Console and then retry the stack creation.

Answer

Use the AWS CLI command aws cloudformation update-stack with a new parameter value.

Answer

Execute ContinueUpdateRollback on the stack to retry the creation.

Question 15

A SysOps administrator needs to deploy a CloudFormation stack across multiple AWS accounts in an organization using AWS Organizations. The administrator wants to use a single template and a single deployment operation. Which AWS service should be used to centrally manage the deployment?

Accepted Answer

AWS CloudFormation StackSets. Option A is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts and regions from a single template. Option B is incorrect because OpsWorks is for configuration management. Option C is incorrect because CodePipeline is for CI/CD pipelines. Option D is incorrect because Systems Manager is for operational management.

Answer

AWS Systems Manager

Answer

AWS OpsWorks Stacks

Answer

AWS CodePipeline