SOA-C02 Deployment, Provisioning, and Automation Practice Test 8 — 15 Questions

Question 1

A company is using Lambda functions to process data from an S3 bucket. The SysOps administrator needs to update the Lambda function code with a new version. The administrator wants to ensure that during the deployment, any in-flight requests are completed with the old code, and new requests use the new code. Which deployment strategy should the administrator use?

Accepted Answer

Create a new Lambda version and update the alias to gradually shift traffic from the old version to the new version using weighted routing.. Option B is correct because Lambda aliases with weighted routing allow gradual traffic shifting. Option A is incorrect because updating the function directly immediately changes all invocations. Option C is incorrect because a new version can be created but without alias routing, all traffic goes to the new version. Option D is incorrect because canary deployments are not native to Lambda; weighted routing is the correct method.

Answer

Update the Lambda function code directly using the AWS CLI.

Answer

Use AWS CodeDeploy with a canary deployment configuration on the Lambda function.

Answer

Create a new Lambda function and update the S3 event notification to trigger the new function.

Question 2

A company is using AWS Elastic Beanstalk with a Blue/Green deployment strategy. After deploying a new version to the green environment and verifying it, the administrator wants to swap the CNAMEs to route production traffic to the green environment. However, the swap operation fails due to a CNAME already in use error. What is the MOST likely cause?

Accepted Answer

The CNAME prefix for the green environment is already in use by another environment in the same region.. Option D is correct because Elastic Beanstalk environment CNAMEs must be unique within a region. If the green environment's CNAME is the same as the blue environment's CNAME, the swap fails. Option A is incorrect because health checks are not directly related to CNAME swap. Option B is incorrect because load balancer health checks do not prevent CNAME swap. Option C is incorrect because the environment URL is not used for swap; it's the CNAME prefix that matters.

Answer

The green environment is using the same environment URL as the blue environment.

Answer

The load balancer is not configured to handle the traffic.

Answer

The green environment has failing health checks.

Question 3

A SysOps administrator needs to deploy a new application version to an Auto Scaling group without causing any downtime. The application runs on EC2 instances behind an Application Load Balancer. Which deployment method should the administrator use?

Accepted Answer

Use a rolling update with a batch size of 1 instance and enable the health check grace period.. Option C is correct because a rolling update with a batch size of 1 instance at a time minimizes impact and can be done without downtime if health checks are configured. Option A is incorrect because it does not use Auto Scaling. Option B is incorrect because it terminates all instances at once. Option D is incorrect because immutable updates launch new instances in a new Auto Scaling group, which is also zero-downtime but not the only option.

Answer

Perform an in-place update by updating the launch template and manually replacing instances one by one.

Answer

Use a rolling update with a batch size of 100% of the instances.

Answer

Create a new Auto Scaling group with the new launch template and gradually shift traffic using a load balancer target group.

Question 4

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The administrator wants to ensure that the code is version-controlled and that changes are reviewed before deployment. Which TWO AWS services should the administrator use together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudFormation. Option A (AWS CloudFormation) is correct for defining infrastructure as code. Option C (AWS CodeCommit) is correct for version control. Option B is incorrect because OpsWorks is configuration management. Option D is incorrect because Config is for compliance. Option E is incorrect because Service Catalog is for product portfolios.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS OpsWorks Stacks

Question 5

A company is deploying a microservices application on AWS using Amazon ECS with Fargate launch type. The SysOps administrator needs to automate the deployment process so that when a new Docker image is pushed to Amazon ECR, the ECS service is updated with the new image. Which THREE AWS services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodePipeline. Option A (Amazon ECR) is correct for storing Docker images. Option B (Amazon ECS) is correct for running containers. Option D (AWS CodePipeline) is correct for orchestrating the CI/CD pipeline triggered by ECR push. Option C is incorrect because CloudFormation is for infrastructure provisioning, not continuous deployment. Option E is incorrect because Systems Manager is for management, not CI/CD.

Answer

AWS CloudFormation

Answer

AWS Systems Manager

Question 6

A SysOps administrator is planning to deploy a web application using AWS Elastic Beanstalk. The application requires high availability across multiple Availability Zones. The administrator needs to configure the environment to automatically replace a failed instance. Which TWO configuration options should the administrator enable? (Choose TWO.)

Accepted Answer

Enable the environment's health check and set the health check path to a valid endpoint.. Option A (Auto Scaling group with a minimum of 2 instances) is correct for high availability. Option B (Load balancer) is correct for distributing traffic. Option D (Health check) is correct for detecting failures. Option C is incorrect because OpsWorks is a different service. Option E is incorrect because CloudWatch alarms alert but do not automatically replace instances without Auto Scaling.

Answer

Attach an Application Load Balancer to distribute traffic to healthy instances.

Answer

Use AWS OpsWorks Stacks to manage the instance lifecycle.

Answer

Create a CloudWatch alarm that triggers an SNS notification when an instance fails.

Question 7

A SysOps administrator is investigating a failed CloudFormation stack creation. The describe-stack-events output shows that the stack creation failed with the reason 'Resource creation cancelled'. What is the most likely cause of this failure?

Accepted Answer

A WaitCondition resource did not receive the required signal within the specified timeout period.. Option C is correct because the WaitCondition timed out before receiving the required signal, causing CloudFormation to cancel the stack creation. Option A is incorrect because there is no indication of missing IAM permissions. Option B is incorrect because a parameter validation error would appear as a different reason. Option D is incorrect because the stack creation was cancelled due to the wait condition timeout, not a nested stack failure.

Answer

The stack template contains an invalid parameter value.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to create the resources.

Answer

A nested stack within the parent stack failed to create.

Question 8

A SysOps administrator is creating a CloudFormation stack that requires an IAM role to be passed to EC2 instances. The administrator is using the IAM policy shown in the exhibit. The stack creation fails with an error indicating insufficient permissions to pass the role. What is the most likely cause?

Accepted Answer

The iam:PassRole permission is restricted to a specific role ARN that does not match the role the administrator is trying to pass.. Option B is correct because the iam:PassRole action is allowed only for the role 'Admin', but the stack may be using a different role. Option A is incorrect because the cloudformation:* action allows all CloudFormation operations. Option C is incorrect because the policy allows cloudformation:* which includes creating stacks. Option D is incorrect because the policy allows ec2:RunInstances and ec2:Create*.

Answer

The cloudformation:* action does not include permission to create stacks.

Answer

The policy does not include the cloudformation:CreateStack action.

Answer

The ec2:RunInstances permission is missing from the policy.

Question 9

A SysOps administrator wants to deploy a new version of an application to an existing Elastic Beanstalk environment. The administrator runs the command shown in the exhibit and sees that the environment is healthy. What should the administrator do next to deploy the new version?

Accepted Answer

Run aws elasticbeanstalk update-environment --environment-name my-env --version-label v2.0. Option B is correct because the deploy command uploads the source bundle and updates the environment. Option A is incorrect because it only creates a new version without deploying it. Option C is incorrect because it creates a new environment, not deploys to existing. Option D is incorrect because there is no 'update-version' command in Elastic Beanstalk.

Answer

Run aws elasticbeanstalk create-application-version --application-name my-app --version-label v2.0 --source-bundle S3Bucket="my-bucket",S3Key="app-v2.zip"

Answer

Run aws elasticbeanstalk update-application-version --application-name my-app --version-label v2.0 --environment-name my-env

Answer

Run aws elasticbeanstalk create-environment --application-name my-app --environment-name my-env-v2 --version-label v2.0

Question 10

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error 'CREATE_FAILED - Resource handler returned message: 'Invalid instance type specified'. The template uses a parameter for InstanceType. What is the most likely cause of this failure?

Accepted Answer

The InstanceType parameter is set to a value that is not allowed in the parameter's AllowedValues list.. The error indicates the instance type is invalid. Checking the allowed values in the parameter definition is the correct first step. Option A is wrong because Auto Scaling groups don't directly cause this error. Option B is wrong because the error is about instance type, not VPC. Option D is wrong because the error is not about template syntax or permissions.

Answer

The VPC specified in the template does not have internet access.

Answer

The Auto Scaling group's desired capacity exceeds the instance limit.

Answer

The template uses a DependsOn clause that creates a circular dependency.

Question 11

A SysOps administrator needs to automate the creation of an Amazon RDS for MySQL database instance. The administrator wants to use AWS CloudFormation and ensure that the database password is not stored in plaintext in the template. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to generate a random password and reference it in the CloudFormation template using a dynamic reference (resolve:secretsmanager).. Using AWS Secrets Manager to generate a password and referencing it with a dynamic reference is the secure, automated way. Option B is wrong because CloudFormation parameters also store values in plaintext in the template. Option C is wrong because it requires manual retrieval. Option D is wrong because Parameter Store also stores plaintext unless using SecureString, but the reference would still be resolved to plaintext in the template.

Answer

Store the password as a CloudFormation parameter with a default value and use the Ref intrinsic function.

Answer

Generate a password manually and store it in a text file in Amazon S3; reference the S3 URL in the template.

Answer

Use AWS Systems Manager Parameter Store (String type) and reference it with the dynamic reference resolve:ssm.

Question 12

A SysOps administrator is troubleshooting a failed AWS Elastic Beanstalk environment update. The update changed the configuration of the EC2 instances in the Auto Scaling group, but the new instances fail to launch. The administrator checks the Auto Scaling group's scaling activities and sees a 'Failed' status with the message: 'Instance failed to reach the desired state.' What should the administrator check next?

Accepted Answer

Check the CloudWatch logs for the failed instance to identify application or configuration errors.. The error 'failed to reach desired state' often indicates an issue with the instance's health checks, such as ELB health check failures. Checking the CloudWatch logs for the instance's application is the most direct way to diagnose why the instance is not passing health checks. Option A is wrong because IAM roles would cause a different error. Option B is wrong because the error is not about termination protection. Option D is wrong because the error is not about scaling limits.

Answer

Check the IAM role attached to the environment's EC2 instances for missing permissions.

Answer

Check the account service quotas for EC2 instances.

Answer

Check the termination protection setting on the Auto Scaling group.

Question 13

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to existing EC2 instances managed by OpsWorks. Which OpsWorks lifecycle event should the administrator trigger to install the new application?

Accepted Answer

Deploy. The 'Deploy' lifecycle event is specifically designed for deploying applications. Option A is wrong because 'Setup' runs only once when the instance boots. Option B is wrong because 'Configure' runs when instances join or leave the stack. Option D is wrong because 'Shutdown' runs when an instance is terminated.

Answer

Configure

Answer

Shutdown

Answer

Setup

Question 14

A company is deploying a critical application using AWS CloudFormation. The deployment must be resilient to failures and ensure that resources are created in a specific order. The template defines a stack that includes an Amazon RDS database and an Auto Scaling group. The Auto Scaling group depends on the database being available. Which CloudFormation feature should the SysOps administrator use to ensure the database is fully created and available before the Auto Scaling group is created?

Accepted Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use a CreationPolicy on the RDS instance to signal when it is ready.. Use DependsOn to specify that the Auto Scaling group depends on the database resource, and also use CreationPolicy or WaitCondition to wait for the database to be fully ready. DependsOn alone only waits for CloudFormation to mark the resource as created, not for the database to be 'available'. Therefore, combining DependsOn with a CreationPolicy (e.g., AWS::CloudFormation::WaitCondition) ensures the Auto Scaling group is created only after the database signals readiness. Option A is wrong because DependsOn alone is insufficient. Option B is wrong because cfn-signal is used with Auto Scaling group's CreationPolicy. Option D is wrong because DeletionPolicy affects deletion, not creation.

Answer

Use the DependsOn attribute on the RDS instance to wait for the Auto Scaling group.

Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use cfn-signal on the Auto Scaling group to wait for the database.

Answer

Use the DeletionPolicy attribute on the Auto Scaling group to ensure it is not deleted.

Question 15

A SysOps administrator wants to deploy a serverless application using AWS Lambda functions, Amazon API Gateway, and Amazon DynamoDB. The deployment must be automated and repeatable. Which AWS service should the administrator use to define and manage this infrastructure as code?

Accepted Answer

AWS CloudFormation with the AWS Serverless Application Model (SAM). AWS CloudFormation or the AWS Serverless Application Model (SAM) are the best choices for infrastructure as code. SAM is an extension of CloudFormation specifically for serverless applications. Option B is wrong because Elastic Beanstalk is for web applications on EC2, not serverless. Option C is wrong because OpsWorks is for Chef/Puppet. Option D is wrong because CodeDeploy is for deploying code, not infrastructure.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk