SOA-C02 Deployment, Provisioning, and Automation Practice Test 8 — 15 Questions

Question 1

A company uses AWS Systems Manager to automate patching of EC2 instances. The instances are in an Auto Scaling group. The company wants to ensure that patching does not affect application availability. Which feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Maintenance Windows. Systems Manager Maintenance Windows allow scheduling patching during specific time windows, and can be configured to work with Auto Scaling to maintain availability by ensuring instances are patched without affecting the overall application availability. Option A is wrong because State Manager is used for maintaining consistent configuration of instances, not for scheduling patching. Option C is wrong because Patch Manager is the service that applies patches, but it is typically run within a Maintenance Window to control timing and availability. Option D is wrong because Run Command is for executing ad-hoc commands and scripts, not for scheduled patching with availability considerations.

Answer

State Manager

Answer

Patch Manager

Answer

Run Command

Question 2

A company is using AWS CodePipeline with a multi-branch strategy. They have a pipeline that deploys to a development environment. They want to create a new pipeline for a production environment that only deploys when code is merged to the 'main' branch. What is the most efficient way to set up the production pipeline?

Accepted Answer

Create a new pipeline using a CloudFormation template that defines the pipeline with the main branch as the source.. The most efficient because using a CloudFormation template allows infrastructure as code, making it easy to replicate the pipeline with only the source branch changed. Option A (cloning manually) is error-prone and not as maintainable. Option C is incorrect because CodeCommit triggers cannot directly control the source branch in CodePipeline; the pipeline source stage itself determines the branch. Option D is incorrect because a single pipeline with multiple stages would still deploy to development on every push, which is not desired; also, manual approval for production is not the most efficient way and would still trigger the pipeline on non-main branches.

Answer

Clone the existing pipeline and modify the source stage to use the main branch.

Answer

Use CodeCommit triggers to start the pipeline only on pushes to main.

Answer

Modify the existing pipeline to include both development and production stages, with the production stage only running on manual approval.

Question 3

A company needs to deploy a new version of an application to an Auto Scaling group. The deployment must ensure that the new version is deployed to all instances, and if any instance fails, the deployment should roll back. Which deployment strategy should be used?

Accepted Answer

Rolling deployment with rollback. A rolling deployment with rollback is the correct choice because it updates instances incrementally, replacing the old version with the new one across the Auto Scaling group while monitoring for failures. If any instance fails to become healthy (e.g., failing an ELB health check), the deployment automatically rolls back to the previous version, ensuring no partial or failed deployment persists. This strategy balances safety and speed, directly meeting the requirement to deploy to all instances with automatic rollback on failure.

Answer

Blue/green deployment

Answer

All-at-once deployment

Answer

Canary deployment

Question 4

A company is using AWS CloudFormation to manage infrastructure. They have a stack that creates an EC2 instance and an Elastic IP. The instance is in a VPC with an internet gateway. The stack creation succeeds, but the instance does not have internet connectivity. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route to the internet gateway.. The instance has an Elastic IP, so it has a public IP address. The most likely cause is that the subnet's route table does not have a route to the internet gateway, preventing traffic from reaching the internet. Option A is correct. Option B is wrong because the instance does have a public IP via the Elastic IP. Option C is wrong because the instance could be in a private subnet, but that would also require a NAT device; the question does not indicate private subnet. Option D is wrong because security groups allow outbound traffic by default unless explicitly denied.

Answer

The instance does not have a public IP address.

Answer

The instance is in a private subnet.

Answer

The security group does not allow outbound traffic.

Question 5

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with Multi-AZ enabled. During a stack update, the database engine version is changed. The update fails with a rollback. What is the most likely cause?

Accepted Answer

The engine version upgrade is not supported for Multi-AZ deployments.. Changing the database engine version on a Multi-AZ RDS instance is not supported directly through a CloudFormation stack update without additional steps. Multi-AZ deployments require both primary and standby instances to be upgraded, and if the new engine version is not compatible or the upgrade path is not supported, the update fails and triggers a rollback. Option B is incorrect because instance class availability is not the primary issue; the error relates to the engine version change, not the instance class. Option C is incorrect because storage type compatibility is not the relevant factor; the storage type remains unchanged. Option D is incorrect because the DB subnet group is not involved in engine version upgrades, and IP address availability is not a typical cause for this failure.

Answer

The DB instance class is not available for the new engine version.

Answer

The storage type is not compatible with the new engine version.

Answer

The DB subnet group does not have enough IP addresses.

Question 6

A company uses AWS CodeBuild to compile code and run unit tests. The build environment requires a specific version of Java that is not available in the default build images. What should the administrator do?

Accepted Answer

Create a custom build image with the required Java version and push it to Amazon ECR.. Create a custom build image with the required Java version, push it to Amazon ECR, and specify that image in the CodeBuild project's environment configuration. Option A is wrong because AWS Support does not modify default build images for individual customers. Option B is wrong because using AWS Lambda to set up the build environment is not a supported integration for CodeBuild. Option C is possible but inefficient because the Java version would need to be installed on every build; the recommended approach is to use a custom image.

Answer

Request AWS Support to add the Java version to the default build image.

Answer

Use an AWS Lambda function to set up the build environment before CodeBuild runs.

Answer

Install the required Java version in the buildspec file using a command.

Question 7

A company is using AWS CodeDeploy to deploy an application to an EC2 instances in an Auto Scaling group. The deployment fails because the instances are not reporting to CodeDeploy. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed on the instances.. The most likely cause is that the CodeDeploy agent is not installed on the instances. The agent is required to communicate with the CodeDeploy service and execute deployments. Option A is incorrect because the security group needs to allow outbound traffic from the instances to CodeDeploy, not inbound. Option B is incorrect because the IAM role is necessary for the instances to access CodeDeploy, but the immediate issue of not reporting is the agent. Option C is incorrect because the application not running is a symptom, not the cause of the reporting failure.

Answer

The security group does not allow inbound traffic from CodeDeploy.

Answer

The instances do not have the correct IAM role to allow CodeDeploy to access them.

Answer

The application is not running on the instances.

Question 8

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with automated backups enabled. The stack is deleted and then recreated. The administrator wants to restore data from the backup of the original DB instance. How can this be achieved?

Accepted Answer

Data cannot be restored because automated backups are deleted when the DB instance is deleted.. Automated backups are deleted when the DB instance is deleted; however, final snapshots can be taken before deletion. Since the stack was deleted without a final snapshot, the data is lost. Option A is wrong because snapshots from automated backups are deleted with the instance. Option B is wrong because RDS does not have a recycle bin. Option C is wrong because automated backups are deleted.

Answer

Restore from the latest automated backup stored in S3.

Answer

Restore from the automated backup snapshot that is retained after deletion.

Answer

Use the RDS recycle bin to recover the deleted DB instance.

Question 9

A company uses AWS Elastic Beanstalk to deploy a web application. The company wants to update the application to a new version with zero downtime. Which deployment policy should be used?

Accepted Answer

Immutable deployment. Immutable deployment (Option B) is the correct choice because it creates a new set of instances with the updated application version and then swaps the environment's CNAME to point to the new environment, ensuring absolutely zero downtime. Rolling deployment (Option A) also provides zero downtime by updating instances in batches, but it modifies existing instances and can cause a temporary reduction in capacity. All at once (Option C) causes downtime, and canary (Option D) is not a standard Elastic Beanstalk deployment policy for zero downtime.

Answer

Rolling deployment

Answer

All at once deployment

Answer

Canary deployment

Question 10

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls code from an Amazon S3 bucket. The company wants to automatically trigger the pipeline when a new object is uploaded to the S3 bucket. How should this be configured?

Accepted Answer

Configure a CloudWatch Events rule that matches S3 object creation events and triggers the pipeline.. Amazon S3 can send events to Amazon CloudWatch Events (EventBridge). A CloudWatch Events rule can be configured to match S3 object creation events and trigger an AWS CodePipeline pipeline directly. This is the recommended method. Option B is incorrect because polling with Lambda adds unnecessary complexity and latency. Option C is incorrect because SNS cannot directly trigger CodePipeline; it would require additional integration. Option D is incorrect because SQS cannot directly trigger CodePipeline; it would also need additional components.

Answer

Use an AWS Lambda function to poll the S3 bucket and start the pipeline.

Answer

Configure the S3 bucket to send events to an Amazon SNS topic that triggers the pipeline.

Answer

Configure the S3 bucket to send events to an Amazon SQS queue that triggers the pipeline.

Question 11

A company is using AWS CodeDeploy to automate deployments to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The instances are running Amazon Linux 2 and the CodeDeploy agent is installed. Which of the following is the MOST likely cause of this failure?

Accepted Answer

The CodeDeploy agent requires ruby and wget, which are not installed by default on Amazon Linux 2.. The CodeDeploy agent needs the ruby and wget packages to function correctly on Amazon Linux 2. Without them, the agent may fail to download or execute the deployment scripts, causing instance failures. Option B is incorrect because S3 bucket policies do not affect CodeDeploy agent functionality directly; the agent uses HTTPS to download revision files. Option C is incorrect because the deployment configuration controls how many instances can fail, but does not cause individual instance failures. Option D is incorrect because the deployment group can be configured with any number of instances; the error is not due to group size but individual instance failures.

Answer

The S3 bucket containing the deployment artifacts has a bucket policy that denies access to the instances.

Answer

The deployment configuration is set to 'OneAtATime', causing insufficient healthy instances during the first deployment.

Answer

The Auto Scaling group has a minimum of 0 instances, so the deployment cannot start.

Question 12

A DevOps engineer is designing a CI/CD pipeline for a microservices application hosted on Amazon ECS with Fargate. The team wants to deploy updates to the services without downtime. The current pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service using AWS CodeDeploy with a blue/green deployment. However, during the deployment, the new tasks fail to start due to an incorrect environment variable. The engineer wants to validate the task definition before the actual deployment. What should the engineer do?

Accepted Answer

Configure CodeDeploy to use a validation hook with an AWS Lambda function that tests the new task definition before shifting traffic.. CodeDeploy allows you to specify a validation hook (e.g., BeforeAllowTraffic) that triggers an AWS Lambda function to test the new task definition. If the Lambda function fails, the deployment can be rolled back automatically. This validates the task definition before any traffic is shifted, preventing downtime due to misconfigurations. Option A is incorrect because CloudWatch Synthetics canaries are used for post-deployment monitoring, not pre-validation. Option B is incorrect because running a Docker container locally does not replicate the exact ECS Fargate environment, making the validation unreliable. Option C is incorrect because Service Auto Scaling adjusts the number of tasks based on load, not for validating task definitions.

Answer

Use Amazon CloudWatch Synthetics canaries to monitor the health of the new tasks after deployment.

Answer

Run the Docker container locally using 'docker run' with the same environment variables to verify the configuration.

Answer

Use Amazon ECS Service Auto Scaling to gradually increase the number of tasks and monitor CPU utilization.

Question 13

An organization is using AWS OpsWorks for Chef Automate to manage configuration of EC2 instances. The administrator notices that a new cookbook version is not being applied to existing instances in a layer. The cookbook is stored in a private Amazon S3 bucket and the instances have an instance profile that allows read access. What is the MOST likely reason for this issue?

Accepted Answer

The 'Update Cookbooks' stack command needs to be run manually to apply the new cookbook version to existing instances.. In OpsWorks, cookbooks are not automatically applied to existing instances when a new version is published. To force an update on existing instances, the administrator must run the 'Update Cookbooks' stack command. Option A is incorrect because rebooting instances does not automatically download or apply new cookbook versions. Option B is incorrect because the instance profile already has read access to the S3 bucket as stated, so the bucket policy is not the issue. Option D is incorrect because the Chef client runs automatically, but it does not fetch new cookbooks unless told to do so via the Update Cookbooks command.

Answer

The cookbook version is not being automatically downloaded because the instances are not rebooted.

Answer

The S3 bucket policy does not grant the necessary permissions to the instance profile.

Answer

The Chef client on the instances is not configured to run automatically.

Question 14

A SysOps administrator is troubleshooting a CloudFormation stack creation failure. The stack is designed to create an Amazon RDS DB instance with a specific parameter group. The error message indicates that the DB instance could not be created because the parameter group does not exist. The administrator has verified that the parameter group exists in the same region and account. What is the MOST likely issue?

Accepted Answer

The parameter group name in the template has a typo or does not match the actual resource name.. The correct answer is A. Since the administrator verified that the parameter group exists in the same region and account, the error 'parameter group does not exist' indicates the name specified in the template does not match the actual parameter group name (e.g., a typo). Option D would only be valid if the parameter group were defined in the same template and not yet created, but that contradicts the verification that it exists.

Answer

The VPC security group specified for the DB instance does not allow inbound traffic from the application tier.

Answer

The DB instance class requires a different parameter group family.

Answer

The parameter group resource is defined in the same template but is not linked to the DB instance using the 'DependsOn' attribute.

Question 15

A company is deploying a microservices application on Amazon ECS with Fargate. The SysOps administrator needs to implement a deployment strategy that minimizes downtime and allows for automated rollbacks if the new version fails health checks. Which TWO options should the administrator choose? (Choose TWO.)

Accepted Answer

Use a rolling update with the ECS service scheduler.. Option A (rolling update with the ECS service scheduler) minimizes downtime by gradually replacing old tasks with new ones while keeping the service available. Option B (configuring the ECS service to automatically roll back on deployment failure) enables the ECS deployment circuit breaker, which automatically reverts to the previous task definition if the new version fails health checks. Together, these two options satisfy both requirements. Option D (blue/green with CodeDeploy) is also a valid approach, but it already includes automatic rollback handling, so it does not need Option B; since the question asks for TWO options that together form the strategy, A and B are the coherent pair. Option E (canary with CodeDeploy) is also a valid deployment type for ECS, contradicting the original explanation.

Answer

Use an immutable deployment by replacing the entire Auto Scaling group.

Answer

Use a blue/green deployment with AWS CodeDeploy.

Answer

Use a canary deployment with AWS CodeDeploy.