SOA-C02 Deployment, Provisioning, and Automation Practice Question
An organization is using AWS OpsWorks for Chef Automate to manage configuration of EC2 instances. The administrator notices that a new cookbook version is not being applied to existing instances in a layer. The cookbook is stored in a private Amazon S3 bucket and the instances have an instance profile that allows read access. What is the MOST likely reason for this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'Update Cookbooks' stack command needs to be run manually to apply the new cookbook version to existing instances.
In OpsWorks, cookbooks are not automatically applied to existing instances when a new version is published. To force an update on existing instances, the administrator must run the 'Update Cookbooks' stack command. Option A is incorrect because rebooting instances does not automatically download or apply new cookbook versions. Option B is incorrect because the instance profile already has read access to the S3 bucket as stated, so the bucket policy is not the issue. Option D is incorrect because the Chef client runs automatically, but it does not fetch new cookbooks unless told to do so via the Update Cookbooks command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cookbook version is not being automatically downloaded because the instances are not rebooted.
Why it's wrong here
Rebooting an instance does not force AWS OpsWorks Stacks to re-download cookbooks. The boot process only starts the agent and runs any lifecycle events (such as Setup) that are configured for the instance; it does not compare or synchronize the installed cookbook version against the stack's current cookbook source. Cookbook updates on existing instances are only applied when the Update Cookbooks stack command is explicitly run, not after a reboot.
- ✗
The S3 bucket policy does not grant the necessary permissions to the instance profile.
Why it's wrong here
The private S3 bucket's policy is not the blocker, because the instance profile attached to the OpsWorks stack already grants s3:GetObject access, allowing the agent to retrieve cookbook archives. Even if the bucket policy were misconfigured, the Update Cookbooks command would fail with an access error, not silently ignore the newer version. The real reason the new cookbook is not applied is that OpsWorks only downloads cookbooks during initial setup or an explicit Update Cookbooks run—never automatically on a schedule.
- ✓
The 'Update Cookbooks' stack command needs to be run manually to apply the new cookbook version to existing instances.
Why this is correct
Correct. In AWS OpsWorks, cookbooks are only automatically applied during initial setup or when a Configure lifecycle event occurs. To apply a new cookbook version to existing instances, the administrator must manually run the 'Update Cookbooks' stack command.
- ✗
The Chef client on the instances is not configured to run automatically.
Why it's wrong here
This misidentifies the cause. AWS OpsWorks Stacks installs a Chef client on each instance that automatically runs on a schedule (typically every 15 minutes for Configure lifecycle events). However, those automatic runs execute recipes from the cookbooks already present on the instance; they do not refetch the cookbook from the S3 bucket or Git repository. Thus, a new cookbook version is not applied until an administrator manually triggers the Update Cookbooks stack command.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.