SOA-C02 Deployment, Provisioning, and Automation Practice Test 9 — 15 Questions

Question 1

An organization uses AWS CloudFormation to manage its infrastructure. The SysOps administrator is implementing a change management process that requires all stack updates to be reviewed and approved before execution. The administrator wants to use CloudFormation change sets to preview changes. Which THREE steps are necessary to implement this process? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the change set in the CloudFormation console.. To implement a review-and-approval process using CloudFormation change sets, the necessary steps are: create a change set from the updated template (E), review the change set in the CloudFormation console (C), and execute the change set after approval (D). Option A is incorrect because the 'Detect Drift' feature is used to check if the actual stack resources have drifted from the template, not to preview changes. Option B is incorrect because updating the stack directly bypasses the review process, which defeats the purpose of change management.

Answer

Use the 'Detect Drift' feature to compare the stack with the new template.

Answer

Update the stack directly using the updated template.

Question 2

A SysOps administrator is tasked with automating the provisioning of EC2 instances that must be able to access an Amazon S3 bucket. The administrator needs to ensure that the instances have the necessary permissions without using long-term access keys. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Attach the IAM role to the EC2 instances using an instance profile.. The correct answers are B and D. Option B: Attaching an IAM role to EC2 instances via an instance profile allows the instances to obtain temporary credentials automatically, eliminating the need for long-term access keys. Option D: Creating an IAM role that grants the necessary S3 permissions is a prerequisite for assigning that role to the instances. Option A is incorrect because storing AWS access keys in a configuration file on the instances introduces security risks and is not recommended. Option C is incorrect because S3 bucket policies based on private IP addresses are not a reliable method for granting instance access, as IP addresses can change and do not authenticate the instance identity. Option E is less secure than using an IAM role, as access keys stored in Parameter Store still require management and rotation, and do not provide automatic credential rotation like an instance profile does.

Answer

Store AWS access keys in a configuration file on the instances.

Answer

Create an S3 bucket policy that allows access from the instances' private IP addresses.

Answer

Store the access keys in AWS Systems Manager Parameter Store.

Question 3

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application is deployed using a custom AMI that is updated monthly. The SysOps administrator uses a launch template that references the latest AMI ID via an AWS Systems Manager parameter. During a recent deployment, the administrator updated the AMI ID in the parameter, but the new instances launched by the Auto Scaling group still use the old AMI. The administrator confirms that the launch template is configured to reference the parameter. The Auto Scaling group has a desired capacity of 5, and the administrator manually terminates one instance to trigger a replacement. The new instance also uses the old AMI. What is the MOST likely cause?

Accepted Answer

The Auto Scaling group is using a cached version of the launch template and needs to be updated or have its instances replaced.. The Auto Scaling group caches the resolved AMI ID from the launch template at the time of instance launch. When the SysOps administrator updates the AMI ID in the Systems Manager parameter, the launch template still references the parameter, but the Auto Scaling group does not re-resolve the parameter for existing instances or for new instances launched under the same launch template version. To use the new AMI, the launch template must be updated to a new version or the Auto Scaling group must be forced to use the latest version (e.g., by updating the group's launch template version). Option A is incorrect because CloudWatch alarm configuration affects scaling triggers, not AMI resolution. Option B is incorrect because the IAM role for the Auto Scaling group is not required for the launch template to resolve the Systems Manager parameter; resolution occurs at the account level. Option D is incorrect because instance metadata service settings control access to instance metadata, not the AMI used for launch.

Answer

The Amazon CloudWatch alarm that triggers scaling is not configured correctly.

Answer

The IAM role associated with the Auto Scaling group does not have permission to read the Systems Manager parameter.

Answer

The instance metadata service (IMDS) is disabled on the launch template.

Question 4

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is configured with a load balancer and an Auto Scaling group. Recently, the development team updated the application code and deployed it via Elastic Beanstalk. After the deployment, users report intermittent 503 errors. The SysOps administrator checks the environment health and sees that it is 'Severe' with many instances being replaced. The administrator notices that the new instances are being launched with the old application version. The deployment was a rolling update with a batch size of 1. What is the MOST likely cause of the issue?

Accepted Answer

The deployment failed health checks on the first instance and rolled back, replacing all instances with the old version.. During a rolling update with batch size 1, Elastic Beanstalk updates instances one at a time. After deploying the new version to the first instance, if that instance fails health checks, Elastic Beanstalk treats the deployment as failed and initiates a rollback. The rollback replaces all instances with the old application version, causing intermittent 503 errors as instances are being replaced. This matches the symptoms: severe health, new instances launched with old version, and 503 errors. Option B is incorrect because sticky sessions do not cause version mismatches; they only affect request routing. Option C is incorrect because changing the environment URL is not part of a deployment and would not cause version mismatches. Option D is incorrect because, while an outdated health check URL could cause health check failures on the new version and potentially trigger a rollback, the scenario provides no indication that the health check URL is outdated; the most likely cause is the generic health check failure that led to the rollback, as described in option A.

Answer

The load balancer is configured with sticky sessions, causing requests to go to outdated instances.

Answer

The Elastic Beanstalk environment URL was changed during the deployment.

Answer

The health check URL was not updated to reflect the new application version.

Question 5

A SysOps administrator needs to deploy a web application across multiple AWS Regions for disaster recovery. The application uses Amazon RDS for MySQL and requires a secondary database in a different Region. What is the MOST cost-effective and automated solution to keep the databases synchronized?

Accepted Answer

Create a cross-Region read replica of the primary RDS instance in the secondary Region. Amazon RDS Cross-Region Read Replicas automatically replicate data from the primary database to a secondary Region with minimal cost, as you only pay for the replica instance and data transfer. Option B is incorrect because AWS DMS with ongoing replication incurs additional costs for replication instances and is not as simple as a read replica for this use case. Option C is incorrect because a cron job on an EC2 instance is not fully automated and requires manual scripting, lacking the managed replication benefits. Option D is incorrect because Multi-AZ provides high availability within a single Region, not cross-Region replication, and adding a read replica to Multi-AZ is unnecessary and more expensive.

Answer

Use AWS Database Migration Service (DMS) with ongoing replication

Answer

Set up a cron job on an EC2 instance to export the database and import it into the secondary Region

Answer

Enable Multi-AZ on the primary RDS instance and configure a read replica in the secondary Region

Question 6

A company is using AWS CloudFormation to manage infrastructure. A recent stack update failed, and the SysOps administrator needs to roll back to the previous known good state. However, the stack is in UPDATE_ROLLBACK_FAILED state. What should the administrator do to recover the stack?

Accepted Answer

Use the ContinueUpdateRollback API or AWS Management Console to resume the rollback after addressing the failure cause. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, it means the automatic rollback after a failed update encountered an error. The correct action is to use the ContinueUpdateRollback API or console to resume the rollback after addressing the failure cause (e.g., manually deleting a resource that cannot be rolled back). Option A is correct. Option B (delete and recreate) would cause data loss and is not recommended. Option C (contact support) is unnecessary as the feature is available without support. Option D (execute another update) could compound errors and does not fix the rollback issue.

Answer

Delete the stack and recreate it from the previous template

Answer

Contact AWS Support to enable automatic rollback recovery

Answer

Execute another stack update with the same parameters to overwrite the failed state

Question 7

A company uses AWS CloudFormation to deploy EC2 instances across multiple environments. The operations team notices that stack updates fail when parameter values change. What is the MOST likely cause?

Accepted Answer

The parameter has the NoEcho property set to true, and the previous value is not provided.. When a parameter has the NoEcho property set to true, CloudFormation masks the parameter value in stack events and outputs. During a stack update, if the parameter value changes, CloudFormation requires the previous value to be provided to verify the change. If the previous value is not supplied, the update fails because CloudFormation cannot confirm the intended modification, leading to a validation error.

Answer

The parameter uses the AWS::NoValue condition.

Answer

A change set is required but not generated.

Answer

A stack policy prevents parameter updates.

Question 8

A SysOps administrator is automating the creation of Amazon RDS instances using AWS CloudFormation. The template includes a DBInstance resource with a DBSubnetGroupName property referencing a subnet group created in the same template. The stack creation fails with the error 'DBSubnetGroup not found'. What is the MOST likely reason?

Accepted Answer

A DependsOn clause is missing between the DBInstance and the DBSubnetGroup.. In AWS CloudFormation, resource creation order is not guaranteed unless explicitly defined. When a DBInstance resource references a DBSubnetGroup by name, CloudFormation may attempt to create the DBInstance before the DBSubnetGroup is fully created, resulting in a 'DBSubnetGroup not found' error. Adding a DependsOn clause to the DBInstance resource ensures the DBSubnetGroup is created first, resolving the dependency.

Answer

The VPC ID is incorrect or does not exist.

Answer

The DBSubnetGroup is not associated with a public subnet.

Answer

The DBSubnetGroup is defined in a different CloudFormation stack.

Question 9

A company uses AWS OpsWorks for configuration management of EC2 instances. The administrator needs to ensure that a custom recipe runs on all instances after the instance is fully configured. Which lifecycle event should the recipe be associated with?

Accepted Answer

Configure. The Configure lifecycle event in AWS OpsWorks runs after every instance enters the online state, including after the Setup event completes. Associating a custom recipe with Configure ensures it executes on all instances once they are fully configured and operational, as Configure fires repeatedly on state changes, not just during initial provisioning.

Answer

Undeploy

Answer

Deploy

Answer

Setup

Question 10

A company is using AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) that includes specific software. The administrator creates a custom AMI and configures the Elastic Beanstalk environment to use it. However, new instances launched during scaling use the default platform AMI instead. What is the MOST likely cause?

Accepted Answer

The custom AMI is configured in the environment's launch configuration, but the environment has not been updated to replace existing instances.. When you update the launch configuration in an Elastic Beanstalk environment to use a custom AMI, existing instances are not automatically replaced. The new AMI only applies to instances launched during scaling or environment updates that trigger instance replacement. Since the administrator did not perform an environment update that replaces existing instances, the running instances continue to use the default platform AMI.

Answer

The custom AMI ID is specified in the environment properties instead of the launch configuration.

Answer

The custom AMI is encrypted, and the instance profile does not have permissions to decrypt it.

Answer

The Elastic Beanstalk platform version is incompatible with the custom AMI.

Question 11

A SysOps administrator is tasked with automating the creation of IAM roles and policies using AWS CloudFormation. The template includes an IAM role and a managed policy. The stack creation fails with the error 'Policy arn:aws:iam::123456789012:policy/MyManagedPolicy not found'. The policy is created in the same template. What is the MOST likely solution?

Accepted Answer

Add a 'DependsOn' clause to the IAM role resource for the managed policy, and reference the policy ARN using the 'Ref' intrinsic function.. The error occurs because CloudFormation attempts to create the IAM role before the managed policy is fully created, even though both are defined in the same template. Adding a 'DependsOn' clause to the IAM role resource ensures that CloudFormation waits for the managed policy to be created first. Using the 'Ref' intrinsic function to reference the policy ARN is correct because 'Ref' for an AWS::IAM::ManagedPolicy returns the policy ARN, which is needed for the role's 'ManagedPolicyArns' property.

Answer

Remove the policy document from the template and create the policy separately.

Answer

Use a custom resource to create the policy before the role.

Answer

Create the IAM role in a separate stack.

Question 12

A company uses AWS CodeDeploy to automate deployments to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero exit code.. The error message indicates that the deployment failed because too many instances failed, and the logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. In AWS CodeDeploy, each lifecycle event script must exit with a zero exit code to indicate success; any non-zero exit code is treated as a failure, causing the deployment to fail on that instance. Since the logs explicitly point to the BeforeInstall script's non-zero exit, the most likely cause is a bug in that script.

Answer

The instance does not have the required permissions to download the application revision.

Answer

The instance is not healthy according to the Elastic Load Balancer health checks.

Answer

The CodeDeploy agent is not running on the instance.

Question 13

A SysOps administrator uses AWS Systems Manager Run Command to install software on a fleet of EC2 instances. The command fails on some instances with the error 'Instance ID not found'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not installed or configured on the instances, or the instances lack the required IAM role.. The error 'Instance ID not found' indicates that Systems Manager Run Command cannot communicate with the SSM Agent on the target instances. This typically occurs when the SSM Agent is not installed, is not running, or the instance does not have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) for Systems Manager to manage it. Without a valid agent and IAM role, the instance is not registered with Systems Manager, so Run Command cannot find its Instance ID.

Answer

The user data script has overridden the SSM Agent.

Answer

The instances are not tagged with the correct key-value pair.

Answer

The instances are in a stopped state.

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an AWS::RDS::DBInstance resource. The administrator wants to ensure that the database is not deleted when the stack is deleted. Which CloudFormation resource property should be set?

Accepted Answer

Set the 'DeletionPolicy' attribute to 'Retain' on the DBInstance resource.. The 'DeletionPolicy' attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. Setting 'DeletionPolicy' to 'Retain' on the AWS::RDS::DBInstance resource ensures the database is preserved and not deleted when the stack is deleted. This is the standard mechanism for preventing accidental deletion of critical resources during stack teardown.

Answer

Set the 'DeletionPolicy' attribute to 'Snapshot' on the DBInstance.

Answer

Set the 'RetainOnDeletion' property to 'true' on the DBInstance.

Answer

Set the 'DeletionProtection' property to 'true' on the DBInstance.

Question 15

A SysOps administrator is designing an automated deployment pipeline for a web application using AWS CodePipeline. The application is deployed to an Auto Scaling group behind an Application Load Balancer. The administrator wants to ensure zero downtime during deployments. Which TWO strategies should be combined? (Choose TWO.)

Accepted Answer

Use a blue/green deployment with CodeDeploy and an Elastic Load Balancer.. A blue/green deployment with CodeDeploy and an Elastic Load Balancer allows you to provision a new set of instances (green environment) alongside the existing ones (blue environment), then shift traffic from the blue to the green environment after validation. This approach ensures zero downtime because the old environment remains serving traffic until the new environment is fully healthy and traffic is switched over. Option E is correct because an immutable update in CodeDeploy launches a completely new Auto Scaling group with the updated application version, then deregisters the old instances from the load balancer, providing a clean cutover with no in-place disruption.

Answer

Use CodeDeploy with an all-at-once deployment.

Answer

Use CodeDeploy with a canary deployment.

Answer

Use CodeDeploy with an in-place update and a rolling batch configuration.