SOA-C02 Deployment, Provisioning, and Automation Practice Test 7 — 15 Questions

Question 1

A company has a CloudFormation stack that creates an Amazon EC2 instance with a user data script that installs software from the internet. The stack creation is failing with a timeout. The SysOps administrator suspects that the user data script is taking too long or failing. How can the administrator configure the stack to wait for the user data script to complete successfully before marking the instance as CREATE_COMPLETE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a CreationPolicy with a resource signal to the EC2 instance resource and have the user data script send a success signal using cfn-signal.. The correct method is to use a CreationPolicy with a resource signal on the EC2 instance. The user data script must send a success signal to CloudFormation using cfn-signal, which causes the stack to wait for that signal before marking the instance as CREATE_COMPLETE.

Option B is incorrect because DependsOn only waits for another resource to be created, not for the user data script to finish.

Option C is incorrect because UpdatePolicy is used during stack updates, not creation, and it does not handle user data completion.

Option D is a valid approach in general—using a WaitCondition resource and WaitHandle allows the stack to wait for an external signal. However, the question specifically asks for a method to wait for the user data script to complete before marking the instance as CREATE_COMPLETE. While WaitCondition can be used for that purpose, CreationPolicy is the simpler and more direct approach because it is applied directly to the EC2 instance resource without needing a separate wait handle. Therefore, option A is the best answer.

Answer

Add a DependsOn attribute to the EC2 instance resource to wait for another resource.

Answer

Add an UpdatePolicy with a resource signal to the EC2 instance resource.

Answer

Add a WaitCondition resource and a WaitHandle, and have the user data script send a signal to the WaitHandle.

Question 2

A SysOps administrator needs to deploy a new version of an application that runs on Amazon EC2 instances in an Auto Scaling group. The deployment should minimize downtime and roll back automatically if health checks fail. Which deployment method should the administrator use?

Accepted Answer

Blue/green deployment using a new Auto Scaling group and an Application Load Balancer. Blue/green deployment with an Auto Scaling group and an Application Load Balancer allows switching traffic to the new version and rolling back if health checks fail. Option A is wrong because canary deployment is a type of blue/green but typically used for canary testing, not automatic rollback based on health checks. Option C is wrong because rolling update is an in-place method. Option D is wrong because in-place deployments update existing instances and can cause downtime.

Answer

Canary deployment

Answer

Rolling update via an Auto Scaling group

Answer

In-place deployment

Question 3

A company is using AWS Elastic Beanstalk to manage a web application. The SysOps administrator needs to update the application to a new version with zero downtime. Which THREE steps should the administrator take to achieve this? (Choose three.)

Accepted Answer

Create a new Elastic Beanstalk environment with the new application version, then swap the environment URLs.. To achieve zero downtime with Elastic Beanstalk, a blue/green deployment (B) creates a new environment and swaps URLs, avoiding downtime. Alternatively, a rolling update strategy can be used, which requires setting a health check grace period (D) to allow new instances to warm up, and performing a rolling update with a batch size of 1 and pause (E) to gradually replace instances while verifying health. Option A causes downtime. Option C increases the health check interval, which delays detection and does not help achieve zero downtime.

Answer

Terminate all existing instances and replace them with new ones.

Answer

Set the load balancer's health check interval to 300 seconds to allow more time for the new instances to become healthy.

Question 4

A company is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS database. The administrator needs to modify the DB instance class but wants to avoid downtime. Which TWO options should the administrator consider? (Choose two.)

Accepted Answer

Apply the change during the RDS maintenance window to control when the modification occurs.. Applying the change during the RDS maintenance window allows AWS to perform the modification during a scheduled time, minimizing potential downtime as the database is briefly unavailable. Option B is correct because if the RDS instance is deployed as Multi-AZ, the modification can be applied to the standby first, then a failover occurs, reducing downtime. Option C is incorrect because setting DeletionPolicy to Retain affects what happens when the stack is deleted, not updates. Option D is incorrect because deleting and recreating the instance would cause significant downtime. Option E is incorrect because taking a snapshot and restoring does not help modify the instance class without downtime; it is a migration method that also causes downtime.

Answer

Set the DeletionPolicy attribute to Retain on the RDS instance.

Answer

Delete the current RDS instance and create a new one with the desired instance class.

Answer

Take a snapshot of the database and restore it with the new instance class.

Question 5

A company wants to automatically start and stop an EC2 instance on a schedule to reduce costs. The instance runs a critical application that must be available from 8 AM to 6 PM weekdays. Which AWS service should be used to implement this scheduling?

Accepted Answer

AWS Instance Scheduler. AWS Instance Scheduler is a solution that enables scheduling EC2 and RDS instances to start and stop at predefined times. In this scenario, it can be configured to run the instance from 8 AM to 6 PM weekdays. Option B (AWS OpsWorks) is incorrect because it is a configuration management service, not for scheduling. Option C (AWS Systems Manager Automation) is incorrect because it automates maintenance and remediation tasks, not scheduled start/stop. Option D (AWS CloudFormation) is incorrect because it is used for infrastructure as code, not scheduling.

Answer

AWS OpsWorks

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation

Question 6

A DevOps engineer is troubleshooting a failed CloudFormation stack update. The stack includes an Auto Scaling group with a launch template. The update changed the AMI ID in the launch template, but the new instances launched with the old AMI. What is the most likely cause?

Accepted Answer

The launch template version is not set to use the latest version.. The most likely cause is that the launch template version used by the Auto Scaling group is not set to the latest version. When CloudFormation updates a launch template, it creates a new version, but the Auto Scaling group continues to use the previous version unless explicitly updated. Therefore, new instances launched by the Auto Scaling group will use the old launch template version with the old AMI. Option A is incorrect because the issue is not about rolling updates for existing instances but about new instances using the incorrect template version. Option B is incorrect because an invalid AMI would cause launch failures, not the use of the old AMI. Option C is incorrect because the stack update may have completed successfully without updating the launch template version reference in the Auto Scaling group.

Answer

The Auto Scaling group is not configured to perform a rolling update.

Answer

The new AMI ID is invalid or not available in the region.

Answer

The CloudFormation stack update did not successfully complete.

Question 7

A company needs to deploy a new version of a Lambda function. The deployment must be gradual, shifting 10% of traffic to the new version every 10 minutes until all traffic is served by the new version. If errors occur, the deployment should roll back immediately. Which deployment strategy should be used?

Accepted Answer

Canary deployment with AWS Lambda. A canary deployment with AWS Lambda allows traffic to be shifted gradually in increments (e.g., 10% every 10 minutes) and supports automatic rollback if errors are detected. Option A (blue/green with CodeDeploy) is not inherently gradual; it typically switches all traffic at once unless configured with a canary, but the question asks for the strategy, and 'canary' is the correct term. Option B (all-at-once) deploys immediately. Option C (rolling with ECS) is for container services, not Lambda. Therefore, option D is correct.

Answer

Blue/green deployment with AWS CodeDeploy

Answer

All-at-once deployment

Answer

Rolling deployment with Amazon ECS

Question 8

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance. The database is in a VPC with public and private subnets. The DB instance is in a private subnet. When the stack is created, the DB instance is not accessible from an EC2 instance in the same VPC. What is the most likely cause?

Accepted Answer

The security group for the DB instance does not allow inbound traffic from the EC2 instance.. The DB instance is in a private subnet, so it does not have a public IP address. However, communication within the VPC between the EC2 instance and the DB instance relies on security group rules. The most likely cause is that the security group associated with the DB instance does not allow inbound traffic from the EC2 instance's security group. The DB subnet group configuration is likely correct, and an internet gateway is not needed for internal VPC communication. Therefore, option B is correct.

Answer

The DB subnet group does not include the correct subnets.

Answer

The VPC does not have an internet gateway attached.

Answer

The DB instance does not have a public IP address.

Question 9

A company uses AWS OpsWorks to manage a stack of web servers. They need to deploy a configuration change that updates the /etc/nginx/nginx.conf file on all instances. Which OpsWorks feature should be used?

Accepted Answer

Custom Chef recipes. Custom Chef recipes are the correct choice because OpsWorks uses Chef to manage configuration, and deploying a specific file change like /etc/nginx/nginx.conf requires a custom recipe that directly modifies the file using Chef resources (e.g., template or file resource). This allows precise, idempotent configuration management across all instances in the stack.

Answer

OpsWorks layers

Answer

Lifecycle events

Answer

Custom cookbooks

Question 10

An administrator uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error: "The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems." The deployment group has a minimum of 2 instances. What should the administrator check first?

Accepted Answer

The deployment logs on the individual EC2 instances.. The deployment logs on the instances will show specific failure reasons. Option A is wrong because the error message does not specifically indicate an OS incompatibility; it indicates a general failure of instances. Option B is wrong because Auto Scaling group health checks monitor instance health, not deployment success. Option C is wrong because deployment configuration settings (such as minimum healthy hosts) are not the first thing to check; the error suggests checking the instances directly.

Answer

The application revision's compatibility with the instance operating system.

Answer

The Auto Scaling group's health check settings.

Answer

The deployment group's deployment configuration settings.

Question 11

A company uses AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket. The stack creation fails because the S3 bucket name already exists. What should the administrator do to resolve this issue?

Accepted Answer

Change the S3 bucket name in the CloudFormation template to a unique name.. S3 bucket names must be globally unique. To resolve the conflict, change the bucket name in the CloudFormation template to a unique name (Option B). Option A is incorrect because adding a tag does not resolve the name conflict. Option C is incorrect because deleting the existing bucket could cause data loss and is not recommended. Option D is incorrect because updating the bucket policy does not affect bucket name uniqueness.

Answer

Add a tag to the existing bucket to make it available for the stack.

Answer

Delete the existing S3 bucket and recreate the stack.

Answer

Update the bucket policy to allow the stack to use the bucket.

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not hard-coded in the application code. Which approach should be used?

Accepted Answer

Use Elastic Beanstalk environment properties to pass the credentials, referencing them from AWS Secrets Manager.. Elastic Beanstalk environment properties can reference values from AWS Secrets Manager, allowing the application to retrieve database credentials securely without hard-coding them. Option A is wrong because EC2 user data is not encrypted and can be viewed in the console. Option B is wrong because storing credentials in a configuration file within the source code exposes them in version control and is insecure. Option D is wrong because while S3 can store credentials, it requires additional access management and is not the recommended approach for Elastic Beanstalk; Secrets Manager or Systems Manager Parameter Store is preferred.

Answer

Pass the credentials via EC2 user data when the instance launches.

Answer

Store the credentials in a configuration file in the application source code.

Answer

Store the credentials in an S3 bucket and retrieve them at runtime.

Question 13

A company uses AWS CloudFormation with nested stacks. The parent stack creates a child stack that launches an Auto Scaling group. The child stack fails to create, and the parent stack rolls back. The administrator wants to debug the child stack. What is the most efficient way to view the child stack's events?

Accepted Answer

Navigate to the child stack in the AWS CloudFormation console and view its events.. After a nested stack fails, it remains in a FAILED state and is visible in the AWS CloudFormation console. You can navigate directly to the child stack to view its events and identify the cause of failure. Option B is incorrect because rerunning the parent stack with a different name would create a new child stack, not help debug the original failed child stack. Option C is incorrect because CloudWatch Logs are not automatically enabled for CloudFormation stacks; you would need to configure logging. Option D is incorrect because the parent stack's events only show aggregated status or a failure message for the child stack, not the detailed events inside the child stack.

Answer

Rerun the parent stack with a different name to see the child stack creation.

Answer

Check the CloudWatch Logs for the parent stack.

Answer

View the parent stack's events in the AWS Management Console.

Question 14

A company is using AWS CodeDeploy to deploy a new version of an application to an Amazon ECS service. The deployment must be gradual to minimize impact. Which deployment type should be used?

Accepted Answer

Rolling update deployment. Amazon ECS supports rolling update deployments, which gradually replace running tasks with the new version to minimize impact. Option A is incorrect because linear deployments are a CodeDeploy deployment type for Lambda, not for ECS. Option C is incorrect because canary deployments are also typically used for Lambda or CodeDeploy, not for ECS services. Option D is incorrect because while ECS supports blue/green deployments, they involve a complete traffic shift after testing rather than a gradual process.

Answer

Linear deployment

Answer

Canary deployment

Answer

Blue/green deployment

Question 15

A company wants to use AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Linux 2 AMI with specific security agents installed. The company wants to ensure that all environment instances use this custom AMI. Which combination of steps should be taken? (Choose three.)

Accepted Answer

Configure the Elastic Beanstalk environment to use the custom AMI by specifying the AMI ID in the .ebextensions configuration.. To use a custom AMI with Elastic Beanstalk, you must first create the AMI from the Elastic Beanstalk platform image (option C) to ensure compatibility. Then, you must configure the environment to use this AMI, which can be done by specifying the AMI ID in the .ebextensions configuration (option A) and by using a configuration file in the .ebextensions folder to set the AMI ID for the Auto Scaling launch configuration (option E). Option B is incorrect because a CloudFormation template is not required; Elastic Beanstalk natively supports custom AMIs. Option D is incorrect because while AWS Image Builder can create AMIs, the custom AMI must be based on the Elastic Beanstalk platform image, not built from scratch. Therefore, the correct combination is A, C, and E.

Answer

Create a CloudFormation template to deploy the environment with the custom AMI.

Answer

Create a custom AMI using AWS Image Builder.