SOA-C02 Deployment, Provisioning, and Automation Practice Question
A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?
⚠ Common exam trap
It's easy for candidates to confuse AWS CodeDeploy (which can deploy Lambda code) with the ability to create the Lambda function and its IAM role, but CodeDeploy does not provision the underlying infrastructure resources—it only handles the deployment of the code to an existing function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudFormation
AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudFormation
Why this is correct
AWS CloudFormation is the native infrastructure-as-code service that lets you define the Lambda function, IAM role, and every related resource in a declarative JSON or YAML template. CloudFormation automatically handles resource dependencies, creation order, and rollback on failure, making it ideal for automating repeatable, consistent environments. It is the correct tool because you need to provision the resources themselves, not just deploy code to existing infrastructure.
- ✗
AWS Elastic Beanstalk
Why it's wrong here
AWS Elastic Beanstalk is a PaaS service that abstracts the provisioning of web application environments—it manages EC2 instances, load balancers, auto scaling groups, and health monitoring for platforms such as Node.js, Java, and Python. While it does automate resource creation, it does so only within the context of a web application environment, not as a general-purpose template for arbitrary resources. You cannot use Elastic Beanstalk to declaratively define a standalone Lambda function and a separate IAM role; its model is environment-centric and opinionated.
- ✗
AWS CodeDeploy
Why it's wrong here
AWS CodeDeploy is specifically a deployment and release automation service that pushes application revisions to existing compute services such as EC2, Lambda, or ECS. It assumes the Lambda function and the IAM execution role already exist—it only orchestrates how new application versions are rolled out and tracked. CodeDeploy has no mechanism to create or configure infrastructure resources, so it cannot automate the creation of a Lambda function or its IAM role from scratch.
- ✗
AWS Systems Manager
Why it's wrong here
AWS Systems Manager is an operations management suite (including Run Command, State Manager, Maintenance Windows, and Parameter Store) that helps you patch, configure, and operate existing instances and resources. Its Automation feature runs pre-defined or custom documents to perform operational tasks, but those tasks operate against already-provisioned resources and are not declarative infrastructure definitions. Systems Manager cannot define and provision a new Lambda function and IAM role via a template; it is designed for post-provisioning management and remediation.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 247-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.