SOA-C02 Deployment, Provisioning, and Automation Practice Test 7 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS Multi-AZ DB instance. The stack creation fails with the error 'The DB instance already exists'. The SysOps Administrator needs to resolve this issue without modifying the template. Which TWO steps should the administrator take? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delete the existing DB instance from the AWS account.. The error occurs because CloudFormation is trying to create an RDS DB instance whose identifier already exists in the account, so the administrator must reconcile the existing resource with the stack without editing the template. Option B is correct: deleting the existing DB instance removes the naming conflict so CloudFormation can create the instance as defined in the template during the next stack operation. Option C is correct: the resource import feature (via the console, CLI, or CreateChangeSet with the IMPORT type) lets the administrator adopt the pre-existing DB instance into the stack so CloudFormation manages it instead of attempting to recreate it. Option A is incorrect because changing the deletion policy to Retain only affects what happens on stack deletion or replacement; it does not resolve a create-time 'already exists' conflict. Option D is incorrect because the stack name is unrelated to the RDS DB instance identifier, so a new stack name would still hit the same conflict. Option E is incorrect because it requires modifying the template, which the scenario explicitly forbids.

Answer

Update the CloudFormation stack to change the deletion policy of the DB instance to Retain.

Answer

Use a different stack name in the CloudFormation template.

Answer

Change the DB instance identifier in the CloudFormation template to a unique value.

Question 2

A SysOps Administrator attached the IAM policy shown in the exhibit to a user. The user is unable to terminate an EC2 instance. What is the MOST likely reason?

Accepted Answer

An explicit Deny statement overrides the Allow statement.. The policy includes an Allow statement for ec2:* actions, but also an explicit Deny statement for ec2:TerminateInstances. An explicit Deny overrides any Allow, so the user is unable to terminate instances. Option A is incorrect because the Allow does include ec2:TerminateInstances via ec2:*. Option B is incorrect because the resource ARN is not the issue; the Deny applies to all resources. Option C is incorrect because the policy does allow ec2:* but the Deny takes precedence.

Answer

The policy does not include ec2:TerminateInstances in the Allow statement.

Answer

The policy does not specify the correct resource ARN.

Answer

The policy does not allow ec2:* actions.

Question 3

A company uses AWS CloudFormation to manage its infrastructure. The SysOps Administrator needs to update a stack that contains an Amazon RDS DB instance. The update requires changing the DB instance class from db.t2.medium to db.t3.medium. The RDS instance has a deletion policy of 'Snapshot' in the current template. The administrator wants to minimize downtime and ensure no data loss. The current stack update fails because CloudFormation attempts to replace the DB instance, causing a long downtime. What should the administrator do to successfully update the stack with minimal downtime?

Accepted Answer

Modify the DB instance class directly in RDS using the AWS CLI or console, then update the CloudFormation stack to match.. The correct approach is to modify the DB instance class directly in RDS using the AWS CLI or console, then update the CloudFormation stack to match. This avoids CloudFormation performing a replacement because it detects that the instance already matches the desired state, resulting in no downtime. Option B (changing the deletion policy to 'Retain') does not prevent replacement; it only affects deletion behavior. Option C (creating a new stack and migrating data) causes additional downtime and complexity. Option D (deleting and recreating the stack) leads to downtime and potential data loss. Therefore, option A is the best solution to minimize downtime and ensure no data loss.

Answer

Change the deletion policy to 'Retain' in the template and then update the stack.

Answer

Create a new CloudFormation stack with the new instance class and migrate the data.

Answer

Delete the stack, modify the template, and recreate the stack.

Question 4

A SysOps Administrator is responsible for deploying a new microservice using AWS Elastic Beanstalk. The microservice requires an Amazon RDS MySQL database. The administrator creates an Elastic Beanstalk environment and adds an RDS DB instance using the Elastic Beanstalk console. However, during the next deployment of the application, the database connection string in the environment properties gets overwritten, causing the application to fail to connect to the database. The administrator needs to ensure that the database configuration persists across deployments. What should the administrator do?

Accepted Answer

Provision the RDS instance separately using AWS CloudFormation and pass the connection string as an environment property using a custom resource.. When you provision an RDS instance separately using AWS CloudFormation, the database is decoupled from the Elastic Beanstalk environment lifecycle. The connection string can then be passed as an environment property via a custom resource or directly in the Elastic Beanstalk environment configuration, ensuring it persists across deployments because it is not managed by Elastic Beanstalk's internal RDS integration. This approach prevents the console-based integration from overwriting the property during deployments.

Answer

Add the database configuration to the application source code using .ebextensions.

Answer

Store the database connection string in AWS Systems Manager Parameter Store and retrieve it in the application code.

Answer

Use the Elastic Beanstalk RDS integration but lock the environment properties using a configuration file.

Question 5

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline has three stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). Recently, the deployment stage started failing with the error 'The deployment failed because a deployment already exists for the deployment group'. The SysOps Administrator needs to fix the pipeline to allow deployments to proceed without manual intervention. The pipeline should only deploy if the previous deployment is successful. What should the administrator do?

Accepted Answer

Configure the CodePipeline Deploy action to wait for the previous deployment to finish before starting a new one.. The error occurs because CodePipeline triggers a new CodeDeploy deployment while a previous deployment in the same deployment group is still in progress, and the deployment group is configured to allow only one deployment at a time. Configuring the CodePipeline Deploy action to wait for the previous deployment to complete (for example, by ensuring the pipeline does not start a new execution until the prior one finishes, or by using the 'wait' behavior) prevents the conflict. This satisfies the requirement that the pipeline only deploy if the previous deployment is successful.

Answer

Disable the concurrent deployment setting in the CodeDeploy deployment group.

Answer

Modify the pipeline to use a new deployment group for each execution.

Answer

Enable automatic rollback in the CodeDeploy deployment group.

Question 6

A SysOps Administrator is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with an AWS Systems Manager Association that installs software. The stack creation fails because the association fails to apply, and the stack rolls back. The administrator needs to ensure that the stack creation succeeds even if the association fails, and then fix the association later. What should the administrator do?

Accepted Answer

Modify the CloudFormation template to set the AWS::SSM::Association resource's 'ComplianceSeverity' or 'WaitForSuccessTimeout' to a value that allows the stack to continue.. By setting the 'WaitForSuccessTimeoutSeconds' property of the AWS::SSM::Association resource to 0, or setting 'ComplianceSeverity' to 'UNSPECIFIED', CloudFormation will not mark the stack as failed if the association fails to apply. This allows the stack creation to succeed, and the administrator can fix the association later. Option A is incorrect because 'DependsOn' only ensures resource ordering, not failure behavior. Option C is incorrect because removing the association from the template means it is no longer managed by CloudFormation. Option D is incorrect because deletion policy only affects resource deletion, not creation failures.

Answer

Add a 'DependsOn' attribute to the association to ensure it runs after the instance is fully ready.

Answer

Remove the association from the CloudFormation template and apply it manually after stack creation.

Answer

Set the deletion policy of the association to 'Retain' in the template.

Question 7

A SysOps administrator manages a three-tier web application deployed with AWS CloudFormation. The team wants to update the production stack to use a new AMI ID for the web tier Auto Scaling group. The update must not replace the Auto Scaling group or cause any application downtime. The administrator prepares a change set to preview the changes. Which of the following modifications to the AWS::AutoScaling::LaunchConfiguration resource will allow the update to proceed without replacing the Auto Scaling group?

Accepted Answer

Modify the ImageId property of the LaunchConfiguration and set the UpdatePolicy attribute on the AutoScalingGroup to AutoScalingRollingUpdate with MinInstancesInService set to 2 and PauseTime set to PT5M.. To update the AMI for an Auto Scaling group without downtime, you must modify the ImageId in the LaunchConfiguration and apply an AutoScalingRollingUpdate policy to the AutoScalingGroup. This policy instructs CloudFormation to perform a rolling update, maintaining a minimum number of instances in service. Other attributes like CreationPolicy or UpdateReplacePolicy do not manage the update process for Auto Scaling groups and would not prevent downtime.

Answer

Modify the ImageId property of the LaunchConfiguration and add a CreationPolicy attribute to the AutoScalingGroup to wait for the new instances to signal success.

Answer

Modify the ImageId property of the LaunchConfiguration and set the UpdateReplacePolicy attribute on the LaunchConfiguration to Retain.

Answer

Modify the ImageId property of the LaunchConfiguration and change the logical ID of the LaunchConfiguration to force a new resource creation.

Question 8

A company uses AWS Systems Manager to manage a fleet of Amazon EC2 instances. The SysOps administrator needs to apply a patch baseline to a group of instances that are tagged with Environment=Production. The instances are in an Auto Scaling group and are regularly replaced. The administrator wants to ensure that any new instances automatically receive the correct patch baseline. Which action should the administrator take?

Accepted Answer

Create a patch baseline and a patch group named after the tag value, then register the baseline with the patch group. Use a maintenance window to target instances by tag.. To ensure new instances automatically receive the correct patch baseline, you must use Systems Manager Patch Manager with patch groups. A patch group is a tag key-value pair that you associate with a patch baseline. Instances with that tag are automatically associated with the baseline. Then, a maintenance window targets instances by tag to run patching. This dynamic association ensures new instances are patched according to the baseline without manual intervention.

Answer

Create a patch baseline and use AWS Config rules to automatically apply the baseline to instances that have the tag Environment=Production.

Answer

Create a patch baseline and associate it with the tag key Environment and value Production using the AWS-RunPatchBaseline document.

Answer

Create a patch baseline, set it as the default baseline for the operating system, and ensure that new instances are tagged appropriately.

Question 9

A SysOps administrator is using AWS Elastic Beanstalk to deploy a web application. The administrator needs to configure the environment to use a custom AMI for the EC2 instances. The environment is currently running and must not be recreated. Which method should the administrator use to apply the custom AMI?

Accepted Answer

Use the EB CLI command 'eb config' to edit the environment configuration and set the 'ImageId' option in the 'aws:autoscaling:launchconfiguration' namespace.. To apply a custom AMI to an existing Elastic Beanstalk environment without recreating it, you can use the EB CLI 'eb config' command to edit the environment configuration. Setting the 'ImageId' option in the 'aws:autoscaling:launchconfiguration' namespace updates the launch configuration with the custom AMI. This triggers a rolling update of the instances, but the environment itself is not recreated.

Answer

Create a new environment with the custom AMI and perform a blue/green deployment using swap environment URLs.

Answer

Use AWS CloudFormation to update the underlying stack with the new AMI ID and then rebuild the environment.

Answer

Use the Elastic Beanstalk console to modify the environment configuration and specify the custom AMI ID in the 'Image' section.

Question 10

A team uses AWS CodeDeploy with a deployment configuration of CodeDeployDefault.OneAtATime to deploy a web application to an Auto Scaling group. Instances are behind an Application Load Balancer. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment.' What is the most likely cause?

Accepted Answer

The health check grace period on the Auto Scaling group is too short.. The deployment fails because the health check grace period on the Auto Scaling group is too short. When CodeDeploy deploys one instance at a time (CodeDeployDefault.OneAtATime), the instance is taken out of service, updated, and then returned to the load balancer. If the grace period expires before the instance passes its health checks, the Auto Scaling group marks it as unhealthy and terminates it, causing the deployment to fail with 'too many individual instances failed.'

Answer

The target group deregistration delay is too long.

Answer

The CodeDeploy agent is not installed on the instances.

Answer

The deployment group is configured to skip the ELB health check.

Question 11

A development team uses AWS CloudFormation to deploy infrastructure. They want to update a stack but first need to review how the changes will impact existing resources before applying them. Which CloudFormation feature should they use?

Accepted Answer

Change sets. Change sets allow you to preview how proposed changes to a CloudFormation stack will affect your running resources before you apply them. They generate a summary of the changes (additions, modifications, deletions) based on the new template and parameters, enabling you to assess impact such as resource replacement or updates without executing the changes. This directly addresses the team's requirement to review changes before applying them.

Answer

Stack policies

Answer

Condition functions

Answer

Custom resources

Question 12

A company uses AWS CodeDeploy to deploy a new version of an application to EC2 instances in an Auto Scaling group behind an Application Load Balancer. The company requires zero downtime during the deployment. Which deployment configuration should be used?

Accepted Answer

Create a blue/green deployment by configuring CodeDeploy to launch new instances and shift traffic after validation.. A blue/green deployment with CodeDeploy, where new instances are launched and traffic is shifted only after validation, ensures zero downtime by keeping the old environment (blue) fully serving traffic until the new environment (green) is verified healthy. This approach avoids any in-place updates that could temporarily reduce capacity or cause service disruption, meeting the requirement for zero downtime during deployment.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.EC2/OnPremises: BlueGreenDeployment

Question 13

A company uses AWS CloudFormation to deploy a three-tier web application. The SysOps administrator wants to update a critical parameter, such as the instance type, and ensure that the change is applied without recreating the EC2 instance, if possible. Which CloudFormation stack update feature should be used to achieve this?

Accepted Answer

Change sets. Change sets allow you to preview the changes that will be made to your stack resources before executing them. For an update that modifies an instance type, the change set will show whether the change causes replacement. In this case, AWS::EC2::Instance does not support in-place updates for InstanceType and will require replacement, so the change set would confirm that. By using a change set, you can review the impact before applying the update.

Answer

Stack policy

Answer

Update with drift detection

Answer

Directly edit the stack template and use the update stack action

Question 14

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?

Accepted Answer

Modify the Auto Scaling group's health check type to ELB. Setting the Auto Scaling group's health check type to ELB (Elastic Load Balancer) ensures that the Auto Scaling group uses the ELB's health check status to determine instance health. When the test lifecycle hook fails, the new instances are not marked as healthy by the ELB, causing the Auto Scaling group to automatically terminate and replace them. This aligns with the requirement to automatically replace failed instances, as the default EC2 health check only considers instance status (e.g., running vs. stopped) and does not reflect application-level health.

Answer

Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count

Answer

Modify the Auto Scaling group's health check grace period to a lower value

Answer

Modify the CodeDeploy deployment to ignore the lifecycle hook failure

Question 15

A company uses AWS CloudFormation to deploy a web application. The template currently hard-codes the EC2 instance type (e.g., t3.medium). The SysOps administrator wants to make the instance type configurable so that different environments (dev, test, prod) can use different instance types without modifying the template each time. Which CloudFormation feature enables this?

Accepted Answer

Parameters. CloudFormation Parameters allow you to pass custom values into a template at stack creation or update time. By defining a parameter for the instance type (e.g., with allowed values like t3.micro, t3.medium, t3.large), you can reuse the same template across dev, test, and prod environments without editing the template file itself.

Answer

Mappings

Answer

Conditions

Answer

Outputs