Deployment, Provisioning, and Automation

A SysOps administrator is authoring a CloudFormation template that provisions EC2 instances running a web application. The instances must install packages, write configuration files, and start services in a specific, ordered sequence during launch. The administrator also wants the CloudFormation stack to wait until the bootstrap process completes successfully before marking the resource CREATE_COMPLETE, and to report a failure if the configuration does not finish. Which approach best meets these requirements?

A SysOps administrator deploys an EC2 instance via AWS CloudFormation. A UserData script installs and configures a large application that takes several minutes to finish. The team notices that CloudFormation reports CREATE_COMPLETE for the instance almost immediately, before the application is actually ready, causing dependent resources to fail. What is the correct way to ensure CloudFormation waits until the application setup completes before marking the resource successful?

A SysOps administrator manages a production application using a single CloudFormation stack. The stack contains an RDS DB instance, an EC2 Auto Scaling group, and several security groups. Before applying a template update that modifies the RDS instance class and adds a new parameter, the administrator must understand exactly which resources will be modified, replaced, or deleted — without actually applying any changes to the running environment. What is the MOST appropriate way to obtain this information?

A SysOps administrator manages an Auto Scaling group defined in a CloudFormation template. The team needs to deploy a new AMI by updating the launch template referenced in the stack. Business requirements state that during the update, at least 75% of instances must remain in service to handle live traffic, and CloudFormation should wait for each batch of replacement instances to signal successful application startup before proceeding. Which CloudFormation configuration meets these requirements?

A SysOps administrator manages two separate CloudFormation stacks. A networking stack creates a VPC and subnets and exposes their IDs using the Export field in its Outputs section. An application stack references these values with Fn::ImportValue. When the administrator attempts to delete the networking stack, the deletion fails. What is the cause, and how should the administrator resolve it?

A SysOps administrator manages a CloudFormation stack that provisions an application tier and an RDS DB instance holding production data. During a planned decommissioning of the application, the team will delete the stack, but they must ensure the RDS DB instance and its data are NOT destroyed when the stack is deleted. What is the MOST appropriate way to guarantee the database survives stack deletion?

A SysOps administrator manages production infrastructure using an AWS CloudFormation stack. During an incident, another engineer manually modified a security group's inbound rules directly in the EC2 console to restore service quickly. The administrator now needs to identify every resource in the stack whose live configuration no longer matches the template, without modifying or replacing any resources. Which approach accomplishes this?

A SysOps administrator is building a CloudFormation architecture for a multi-tier application. A parent stack must provision a shared VPC and subnets, and several child stacks (application, database, and cache tiers) must reference the VPC ID and subnet IDs created by the networking layer. The administrator wants the tiers deployed and managed as a single deployable unit, so that updating or deleting the parent stack automatically manages all tiers together. Which approach meets these requirements?

A SysOps administrator manages a production CloudFormation stack that includes an RDS DB instance and several EC2 instances. During routine stack updates, developers occasionally submit template changes that would inadvertently replace or delete the RDS DB instance, causing data loss. The administrator wants to prevent updates to the RDS resource specifically while still allowing updates to the EC2 resources through the normal update process. What should the administrator implement?

A SysOps administrator manages a standardized VPC baseline deployed to 40 accounts across an organization using a CloudFormation StackSet. During a security audit, the administrator discovers that in several member accounts, engineers manually modified security group rules and NACLs that were originally provisioned by the StackSet. The administrator needs to identify which stack instances no longer match their template configuration and then bring them back into compliance with the intended baseline. Which approach accomplishes this with the least manual effort?

A SysOps administrator manages an AWS Organizations environment with three organizational units (OUs): Dev, Staging, and Production. The security team wants to deploy a standardized IAM configuration and a CloudTrail baseline to every existing and future account in the Production OU. The administrator wants the deployments to happen automatically when new accounts are added to the OU, with minimal ongoing manual effort. Which approach meets these requirements?

A SysOps administrator manages a production application defined in an AWS CloudFormation stack. The stack includes an EC2 instance with an attached EBS data volume defined as a separate AWS::EC2::Volume resource, plus an AWS::EC2::VolumeAttachment. The team wants to change the EC2 instance type from t3.medium to m5.large by updating the template. During a change set review, they notice the instance will be replaced. The administrator must ensure that the data on the EBS data volume is NOT lost during this stack update. Which approach meets this requirement with the least risk?

A SysOps administrator must produce a new Amazon Linux 2 AMI every month that includes the latest OS patches, a hardened CIS baseline, and a preinstalled monitoring agent. The AMI must be tested automatically before it is distributed to three other accounts, and the entire process must run on a schedule with minimal custom scripting to maintain. Which AWS service should the administrator use to meet these requirements?

A SysOps administrator manages an Auto Scaling group that uses an EC2 launch template. The team bakes a new golden AMI every month and needs to roll it out to newly launched instances while keeping the ability to quickly revert if the new image causes problems. They also want to avoid editing the Auto Scaling group configuration each month. What is the MOST operationally efficient approach?

A SysOps administrator is building an AWS Systems Manager Automation runbook that stops production EC2 instances, resizes them to a larger instance type, and restarts them during a scheduled change window. Company policy requires that a change manager explicitly authorize the resize before it proceeds, but all other steps must run without human interaction. How should the administrator implement this requirement within the Automation runbook?

A SysOps administrator manages resources across 12 AWS accounts organized under an AWS Organizations OU, spanning three Regions. They have built an AWS Systems Manager Automation runbook that stops non-production EC2 instances outside business hours. The administrator wants to execute this single runbook from a central management account so it runs against all target accounts and Regions in one operation, without manually assuming a role in each account. What is the MOST operationally efficient way to achieve this?

A SysOps administrator manages a fleet of EC2 instances launched from custom AMIs. The team wants to automatically create a new AMI from a designated 'builder' instance every night, tag it with the build date, and then deregister any AMIs (and delete their associated snapshots) that are older than 30 days to control costs. The solution must be fully serverless and require no standing infrastructure. Which approach best meets these requirements?

A SysOps administrator must build a repeatable process that produces a hardened, fully patched 'golden' AMI every month. The process should launch a temporary EC2 instance from the current base AMI, apply the latest OS patches, run a hardening script, create a new AMI, and then terminate the temporary instance — all without manual intervention. Which AWS service and feature should the administrator use to orchestrate this multi-step workflow?

A SysOps administrator manages a fleet of EC2 instances launched from a launch template. A separate automated pipeline builds a new hardened AMI weekly and needs a reliable way to publish the latest AMI ID so that new instance launches always reference the current image without requiring manual edits to the launch template each week. The team wants a low-cost, native solution that also lets other automation reference the AMI ID programmatically. Which approach best meets these requirements?

A SysOps administrator manages a fleet of 300 EC2 instances running various Linux distributions. The compliance team needs a centralized, regularly updated record of all installed applications, OS versions, and network configurations across every instance so they can query which hosts have a specific vulnerable software package installed. The solution must require minimal ongoing manual effort. Which AWS Systems Manager capability should the administrator use?