Deployment, Provisioning, and Automation (22%)

SOA-C03 · 66 questions

• A game studio keeps creating the next production AMI by snapshotting a live EC2 instance that operators patch by hand. Last month that image shipped a temporary debug package and one person's SSH key. Which change makes every new instance start from a known build?
• A retailer's CloudFormation stack includes the production order database. A small template edit is ready, and the team needs to know whether the update will replace that database before anything changes. What should they do first?
• A game studio patched a container by running docker commit on a live ECS task and pushing that image. The next task picked up a debug shell that was only meant for the incident. How should operations produce the next image?
• EC2 Image Builder published a new AMI for a game studio, but the Auto Scaling group still launches last month's AMI. The group uses a launch template. What should operations update so the next instance uses the new image?
• An EC2 Image Builder pipeline for a bank's golden AMI failed in the test component. The build instance is already gone. What should the operator read before changing the VPC?
• A factory's new AMI must be launched by an application account in the same Organization. The image must not be public. How should the platform team share it?
• An Image Builder pipeline meant for a hospital's Windows fleet fails while applying a component. The recipe is a Windows image, and the component that fails is marked for Linux. What should the team change in the build?
• A CloudFormation stack for a studio fails with CREATEFAILED. The first failed event is an IAM role, and the status reason says the deploying user is not authorized to perform iam:CreateRole. What should be fixed?
• A university's new EC2 instances never appear as managed nodes in Systems Manager. The golden AMI used by the launch template does not include the SSM agent. Network paths and instance profiles were copied from a fleet that does show up. What should the image build change?
• A bank's EC2 Image Builder pipeline must download packages and reach Image Builder service endpoints without a path to the public internet. The build subnet is private. What should the network team add?
• A studio changed an instance type in the console on a host that CloudFormation created. The template still names the old type. Before the next stack update, what should operations do so they can see that difference without applying it?
• A hospital's CloudFormation stack includes the production RDS instance. The team must be able to delete the stack later without deleting that database. Which template setting does that?
• A CloudFormation update failed and the stack rolled back to UPDATEROLLBACKCOMPLETE. Several events are marked rollback. Where is the cause of the failure?
• An operator resized a CloudFormation-managed instance in the console during an incident. The template still lists the smaller type. What will a drift-aware change set (REVERTDRIFT mode) do to that instance if the template is not edited?
• An approved change to a production database is blocked during a CloudFormation update. The stack policy denies updates to that database resource. The database must stay. What should operations change?
• A CDK deploy for a retailer fails. The command prints a CloudFormation stack error and stops. The team is about to rewrite the application code that the stack was not changing. What should they read first?
• A parent CloudFormation stack shows the nested stack resource as failed and nothing else useful. The workload that broke is defined in the nested stack. Where is the resource error?
• Two CloudFormation stacks in a university account both create workloads in the same VPC. Each template currently pastes its own copy of the VPC id, and the copies have already diverged. How should both stacks get the id?
• New ECS tasks stay pending. The service event says the subnet has no free IP addresses. The tasks use awsvpc mode, one address each. A teammate wants a larger instance type. What should change instead?
• A CloudFormation deploy fails immediately and says the template is not valid. No resource events are created. A teammate starts hunting for a missing iam:CreateRole permission. What should be checked first?
• A CloudFormation create fails with a message that the named resource already exists. The same name works in a template in another account. Health Dashboard shows no Regional event. What is the failure?
• A CloudFormation stack is UPDATEROLLBACKFAILED. One resource that CloudFormation tried to roll back was modified by hand and now blocks the rollback. The team is about to create a second stack with the same resources. What should they do instead?
• A new CloudFormation stack fails because an S3 bucket name is already taken. The previous stack was deleted with DeletionPolicy Retain, so the bucket is still in the account. Retrying the same template fails the same way. What should they do?
• A CDK application deploys in the home Region and fails in a new Region on the first attempt. The error says the environment is not bootstrapped. The template itself was not changed. What should run in the new Region before the deploy is retried?
• A university CloudFormation stack launches instances in a private subnet, then waits until the helper signals success. The instances boot and the application listens, but the signal never arrives and the subnet has no path to CloudFormation. What should be added?
• An ECS service on a port-8080 container never reaches steady state. The target group health check uses port 80. The tasks start and then fail the check. What should be aligned?
• A CloudFormation stack fails while creating an instance. The event says the deployer is not authorized to perform ec2:RunInstances. A teammate wants to pick a smaller AMI first. What should be fixed?
• A bank's deploy role has an identity policy allowing the KMS actions a stack needs, but CloudFormation still fails with AccessDenied on the customer managed key. The key policy names no statement for this role and does not delegate to IAM in the account. What is missing?
• A game studio's Lambda deploy fails when the console tries to upload the zip directly, and the message says the package is too large for a direct upload. A teammate wants to raise the function's memory setting. How should the package be published?
• CloudFormation replaced an instance during an update. The Elastic IP that had been associated by hand stayed behind on nothing, and the new instance has no public address. The template never mentioned the address. What should the template include?
• A parcel carrier's application account must launch instances into a subnet that stays owned by the network account. Both accounts are in the same organization. What should they configure?
• An auto-parts maker wants every new account that joins a specific organizational unit to receive a baseline stack, without an operator registering that account on the StackSet. What meets that requirement?
• A hospital's CloudFormation stack is stuck rolling back because it cannot delete a security group that is still attached to a network interface an operator created outside the stack. What should the operator do?
• A hospital reviews a CloudFormation change set that would replace the production database. The only intended edit was a tag. The change set has not been executed. What should the operator do?
• One account in a grocery chain's StackSet failed an update that succeeded in every other account. The template and parameters were the same. What should the operator inspect first?
• A SaaS platform must run one CloudFormation template as the same stack in three Regions and stop those copies from being edited separately. What should they use?
• A broadcast network is changing a StackSet that already has stack instances in several Regions. A bad template should affect one Region before any other. How should they deploy the change?
• Drift detection on a university StackSet shows that one account's stack instance has drifted. Every other stack instance still matches the template. Rebuilding every account was proposed. What should be fixed?
• An animation studio created a RAM resource share for an account that is not in its organization. The share stays pending, and the other account cannot use the resource. What must happen next?
• A media company deploys by replacing targets inside its only target group. The last bad build left no prior group for the listener to return to. How should the next deploy make rollback a listener change?
• A game studio must replace Auto Scaling instances with a new launch template version without dropping below the healthy capacity the team requires. Deleting the group and creating it again was proposed. What should perform the replacement?
• A regional health system owns a transit gateway in its network account and wants a second account to attach a VPC to that same gateway. Ownership of the gateway should stay put. How should they share it?
• A city portal must send a small share of Application Load Balancer requests to a new target group and leave the rest on the current group. Changing the public DNS record and waiting out a long TTL was proposed. What should carry the canary?
• An ECS service rolling deployment stops every running task before any replacement is healthy. The service is configured so the minimum healthy percent is zero. What should change so the service keeps serving?
• A warehouse patch must be reversible by returning to the previous machine image. Operators currently install that patch on the live instances with a remote command. Which deployment gives that rollback?
• A storefront Auto Scaling group rolled out a new AMI, and the application is misbehaving. Database metrics look normal and recent writes are intact. What should the rollback be?
• A Lambda alias was moved entirely onto a new published version, and errors spiked. The previous version is still published. How should a small share of traffic reach the new version while the rest stays on the known-good version?
• A rolling CloudFormation update replaces Auto Scaling instances that never start the application, and the stack still finishes successfully. The template does not wait for a success signal from those instances. What should the template require so a failed boot rolls the update back?
• A library still patches a tagged Linux fleet by copying one SSH script onto every instance. Patching should run only inside an approved window and should select instances by tag. Which approach meets that requirement?
• A parks department hotfix changed a security group rule in the console. The nightly pipeline applies that stack from a Git repository and will run again tonight. How should the team keep the hotfix after the next apply?
• An OpenTofu apply for a shared network account failed because the provider rejected the credential. The remote state still lists the existing VPC and its subnets. What should the operator do before applying again?
• An operator needs a command shell on an instance that has no public address. Allowing port 22 from the office would publish SSH on the subnet. How should the operator open the shell?
• A Terraform plan says the billing database will be destroyed. The database block was deleted from the configuration by mistake, and the data is still required. What should the operator do?
• A Terraform apply crashed halfway through and left the state lock held. A teammate wants the lock cleared and a new apply started immediately. What is the safe handling of that lock?
• Operators use Session Manager to reach private instances. A later review asks which commands ran in a session, and nothing was recorded. What should be configured so later sessions can be reviewed?
• A water utility's maintenance window patched the wrong instances. Its target is a tag those instances do not share with the group that should have been patched, and the window has not been widened. What should be fixed first?
• A shipping line wants the CloudWatch agent to stay installed on its instances, including instances that lose the agent later. A user-data script installed it once at first boot and does not run again. What keeps the agent installed?
• Transit-agency instances need a non-secret boot setting, the name of their log bucket, and that name changes without building a new image. Where should the name live?
• A Run Command update reached most of a factory fleet and skipped several EC2 instances. Those instances do not appear as managed nodes. What should the operator check?
• A research lab's inventory lists a compiler package that the build standard does not allow. The team wants the service that produced that package list. Which service is it?
• An EventBridge rule is enabled and its target is healthy, but the target never runs. A real event from the application was captured. What should be compared to explain the miss?
• Billing, paging, and inventory each need the same event when a deployment finishes. The pipeline makes one synchronous call and stops when that single consumer is down. How should the event be routed?
• An S3 bucket is configured to send object-created events to an SQS queue. S3 cannot publish to the queue, and the queue exists in the same Region. What is missing?
• A change workflow must wait for an approval, retry a step that failed, and then run a follow-up step. One Lambda function sleeps between the steps and sometimes stops halfway. What should own the workflow?
• A billing job should start when a partner uploads a CSV into an S3 bucket. A host lists that bucket every minute, sometimes processes the same object twice, and sometimes misses a quiet stretch. What should start the job instead?
• When a new configuration object is written to a specific S3 bucket, a reviewed Systems Manager Automation runbook should run against a tagged fleet. Operators currently reboot every instance in the Region. What should start the runbook?