Deployment, Provisioning, and Automation — SOA-C03 Practice Quiz

Question 1

A CloudOps engineer is deploying a fleet of EC2 web servers using an AWS CloudFormation template. The requirement is that after each instance launches, it must install packages, write configuration files, and start services in a defined order, and the CloudFormation stack must not report CREATE_COMPLETE until the instances have finished their configuration and signaled success. Which approach best meets these requirements?

Accepted Answer

Use AWS::CloudFormation::Init metadata with cfn-init in UserData, and pair a CreationPolicy on the instance with cfn-signal to report bootstrap completion.

Answer

Place all installation commands in the instance UserData script and rely on the default stack timeout to determine when configuration completes.

Answer

Use a DependsOn attribute between the EC2 instances and a wait resource so CloudFormation pauses until packages are installed.

Answer

Configure an SSM State Manager association to bootstrap the instances after the stack reaches CREATE_COMPLETE.

Question 2

A CloudOps engineer manages a production application using a single AWS CloudFormation stack that includes an RDS instance, an EC2 Auto Scaling group, and several security groups. Before applying an update to the template that modifies the RDS parameter group and instance class, the team wants to know exactly which resources will be modified, replaced, or deleted so they can avoid an unexpected database replacement during the deployment. What should the engineer do?

Accepted Answer

Create a CloudFormation change set from the updated template and review it before executing the update.

Answer

Run CloudFormation drift detection on the stack to identify which resources would be affected by the update.

Answer

Enable termination protection on the stack and then execute the update directly.

Answer

Deploy the updated template to a new stack and manually compare resources against the production stack.

Question 3

A CloudOps engineer uses AWS CloudFormation to launch a single EC2 instance that runs a lengthy application installation script via UserData. Currently CloudFormation marks the stack as CREATE_COMPLETE as soon as the instance launches, but before the application finishes installing, causing downstream resources to fail because the app is not yet ready. The engineer needs the stack to wait until the application setup completes successfully before reporting the resource as created. What is the MOST appropriate way to achieve this?

Accepted Answer

Add a CreationPolicy with a ResourceSignal timeout to the EC2 instance and call cfn-signal from the UserData script once installation succeeds

Answer

Add a DependsOn attribute referencing the EC2 instance to all downstream resources

Answer

Configure a DeletionPolicy of Retain on the EC2 instance so CloudFormation waits before completing

Answer

Enable termination protection on the stack and use drift detection to confirm the application is ready

Question 4

A CloudOps engineer manages infrastructure using multiple CloudFormation stacks. A networking stack creates a VPC and subnets, and several application stacks need to reference the subnet IDs from the networking stack. The engineer wants a solution where application stacks can consume these values by name, and CloudFormation prevents the networking stack from being deleted or its exported values from being changed while they are still in use. Which approach meets these requirements?

Accepted Answer

Use the Outputs section of the networking stack with the Export field, and reference the values in application stacks using the Fn::ImportValue intrinsic function.

Answer

Store the subnet IDs in the Mappings section of each application stack and update them manually whenever the networking stack changes.

Answer

Pass the subnet IDs as CloudFormation parameters to each application stack manually at deployment time.

Answer

Use nested stacks so the networking resources are created as part of each application stack's template.

Question 5

A CloudOps engineer manages a production RDS database that was provisioned as part of a CloudFormation stack. The company has a policy requiring that database data must never be lost when infrastructure is decommissioned or when stacks are updated in ways that would replace the database. During a recent stack update, a change to the DB instance identifier caused CloudFormation to replace the resource, and the original data was deleted. What should the engineer configure to ensure the database and its data are preserved even if the resource is removed or replaced?

Accepted Answer

Set the DeletionPolicy attribute to Retain and the UpdateReplacePolicy attribute to Retain on the RDS resource

Answer

Enable termination protection on the CloudFormation stack

Answer

Add a Snapshot value to the DeletionPolicy attribute only

Answer

Enable drift detection on the stack and configure automatic remediation

Question 6

A CloudOps team maintains a single CloudFormation template that provisions an application stack. They must deploy it to dev, staging, and production, where each environment uses a different EC2 instance type and a different number of instances, but the underlying resource structure is identical across environments. The team wants to keep one template file and avoid hardcoding environment-specific values inside the resource definitions. Which approach best meets these requirements?

Accepted Answer

Use a Parameter for the environment name and a Mappings section that returns the correct instance type and count per environment, referenced with Fn::FindInMap.

Answer

Create three separate CloudFormation templates, one per environment, each with the values hardcoded into the resource properties.

Answer

Use a single template with the production values hardcoded, then manually edit the resources in the console after each dev and staging deployment.

Answer

Store all environment values in the Metadata section and reference them directly from the Resources section using Fn::GetAtt.

Question 7

A CloudOps engineer manages production infrastructure using an AWS CloudFormation stack. During a recent incident, another team member modified a security group's inbound rules directly in the EC2 console instead of updating the template. The engineer needs to identify all resources in the stack whose actual configuration no longer matches the template definition, without modifying or redeploying any resources. Which action should the engineer take?

Accepted Answer

Run drift detection on the stack and review the drift status of each resource in the results

Answer

Perform a stack update with the original template to reset all resources to their defined state

Answer

Enable termination protection on the stack to prevent further manual changes

Answer

Create a change set from the current template and review the proposed changes

Question 8

A CloudOps engineer applies a stack update to a production CloudFormation stack that provisions an RDS database and application tier. During the update, one resource fails to create and CloudFormation begins rolling back. The rollback also fails because a security group cannot be deleted (it is still referenced by a resource created outside the template). The stack is now in UPDATE_ROLLBACK_FAILED state. What is the correct way to recover the stack so future updates can proceed?

Accepted Answer

Manually resolve the underlying issue (remove the external reference to the security group), then call ContinueUpdateRollback, optionally skipping the resource that cannot roll back.

Answer

Delete the stack entirely and redeploy from the template, accepting recreation of the RDS database.

Answer

Run drift detection on the stack to force CloudFormation to reconcile the failed resource automatically.

Answer

Create a change set against the failed stack to preview and apply the corrective update.

Question 9

A CloudOps team maintains a large CloudFormation template that has grown to over 400 resources, including a VPC, subnets, security groups, an RDS database, and an ECS cluster. Deployments now frequently fail because the template exceeds resource limits and is hard to maintain. The team wants to break the template into reusable, independently testable components while keeping a single deployment entry point that provisions everything together. Which approach best meets these requirements?

Accepted Answer

Split the template into separate child templates stored in S3 and reference them from a parent template using nested stacks (AWS::CloudFormation::Stack resources).

Answer

Convert each component into a separate standalone stack and use the AWS CLI to deploy them in sequence with a shell script.

Answer

Use a single CloudFormation StackSet to deploy the components across multiple accounts and regions from one template.

Answer

Export values from each standalone stack with Outputs and import them into other stacks using Fn::ImportValue cross-stack references.

Question 10

A CloudOps team maintains a large CloudFormation template that provisions a standardized logging configuration (a CloudWatch log group, an IAM role, and a subscription filter) reused across dozens of separate application stacks. When they update the logging pattern, they must currently copy the revised resource definitions into every application template and redeploy each one. They want a way to define the logging pattern once, version it in a registry, and reference it as a reusable building block inside each application template so updates propagate through normal stack updates. Which approach best meets this requirement?

Accepted Answer

Package the logging resources as a CloudFormation module, register it in the CloudFormation registry, and reference the module resource type from each application template

Answer

Convert each application template into a StackSet and deploy the logging resources as a stack instance to every account

Answer

Export the logging resource ARNs from a shared stack and use Fn::ImportValue in each application template

Answer

Create a nested stack that hardcodes the logging resources and copy the AWS::CloudFormation::Stack block into every application template

Question 11

A CloudOps engineer manages a web application deployed via a CloudFormation stack that includes an Auto Scaling group and an Application Load Balancer. During stack updates, the team has occasionally deployed a bad application version that passes CloudFormation resource creation but causes elevated HTTP 5xx errors in production. The engineer wants CloudFormation to automatically roll back a stack update if the application's error rate spikes during and shortly after the update completes. Which approach meets this requirement with the least custom code?

Accepted Answer

Configure rollback triggers on the stack update referencing a CloudWatch alarm that monitors ALB 5xx errors, and set a monitoring time period after resources are provisioned.

Answer

Add a CreationPolicy with a wait condition to each Auto Scaling instance so CloudFormation waits for a success signal before completing the update.

Answer

Enable stack termination protection and create an EventBridge rule that deletes the stack when the 5xx alarm fires.

Answer

Use a stack policy to deny updates to the Auto Scaling group unless the CloudWatch alarm is in the OK state.

Question 12

A CloudOps engineer manages an Auto Scaling group of 12 EC2 instances defined in a CloudFormation template. When a new launch configuration with an updated AMI is deployed, the team requires that no more than 3 instances be replaced at a time, that each batch wait for a success signal from the application before continuing, and that the deployment roll back automatically if any batch fails. Which CloudFormation configuration meets these requirements?

Accepted Answer

Add an UpdatePolicy with AutoScalingRollingUpdate specifying MaxBatchSize of 3, MinSuccessfulInstancesPercent, and WaitOnResourceSignals with a PauseTime, and have instances send cfn-signal on successful startup.

Answer

Add a CreationPolicy with ResourceSignal to the Auto Scaling group so that each new instance signals completion during the update.

Answer

Add an UpdatePolicy with AutoScalingReplacingUpdate set to WillReplace true so the entire group is replaced behind a new group only after all instances are healthy.

Answer

Configure a DeletionPolicy of Snapshot on the Auto Scaling group and use a stack policy to limit the number of instances updated per change set.

Question 13

A CloudOps engineer is writing a CloudFormation template to provision an Amazon RDS MySQL instance. Company policy prohibits storing database credentials in plaintext anywhere in the template or in source control, and the master password must be generated automatically and stored securely. Which approach meets these requirements with the least operational effort?

Accepted Answer

Create an AWS::SecretsManager::Secret resource with a GenerateSecretString property, then reference it in the RDS instance's MasterUserPassword using a Secrets Manager dynamic reference (resolve:secretsmanager).

Answer

Pass the master password as a NoEcho CloudFormation parameter at stack creation time and store the value in an encrypted S3 object for later retrieval.

Answer

Store the password as a SecureString parameter in Parameter Store beforehand and hardcode the plaintext ARN and value as a template Mapping.

Answer

Use a Lambda-backed custom resource to generate a random password and return it as a stack output for administrators to copy into the RDS console.

Question 14

A CloudOps engineer manages a production environment using a single CloudFormation stack that includes an Aurora database and several stateless application resources. During routine stack updates to modify the application tier, the team is worried that an accidental change to the template could cause a replacement of the database resource and destroy production data. They still need to allow updates to all other resources in the stack. What is the MOST appropriate way to prevent updates to the database resource while permitting normal updates elsewhere?

Accepted Answer

Apply a stack policy that denies Update actions on the database resource's logical ID while allowing updates to all other resources.

Answer

Set a DeletionPolicy of Retain on the database resource so it cannot be modified during stack updates.

Answer

Enable termination protection on the CloudFormation stack to block any changes to the database.

Answer

Move the database into a separate stack and enable drift detection to alert on unwanted changes.

Question 15

A company manages its AWS accounts through AWS Organizations. The CloudOps team uses a CloudFormation StackSet with service-managed permissions to deploy a baseline security configuration (IAM roles, Config rules, and a logging bucket) to all accounts in a specific organizational unit (OU). New accounts are frequently created and added to this OU. The team wants the baseline StackSet to be deployed automatically to any new account added to the OU, without manual intervention. Which action meets this requirement?

Accepted Answer

Enable automatic deployment on the StackSet so that stack instances are created automatically when accounts are added to the target OU.

Answer

Create an EventBridge rule that triggers a Lambda function to run create-stack-instances whenever a new account joins the OU.

Answer

Switch the StackSet to self-managed permissions and share the template through AWS RAM with the new accounts.

Answer

Enable drift detection on the StackSet so that missing stack instances in new accounts are automatically remediated.

Question 16

A CloudOps engineer manages a security baseline (AWS Config rules, IAM roles, and CloudTrail configuration) deployed to 40 member accounts using a CloudFormation StackSet with service-managed permissions across an AWS Organization. Compliance auditors report that some member accounts have had resources manually modified outside of CloudFormation. The engineer needs to identify which stack instances no longer match the StackSet template's expected configuration, with the least operational effort. What should the engineer do?

Accepted Answer

Run drift detection on the StackSet, which evaluates each stack instance and reports instances with a DRIFTED status.

Answer

Log in to each member account and run drift detection on the individual CloudFormation stack, then manually compile the results.

Answer

Enable AWS Config aggregation in the management account and create a custom Config rule to compare resources against the template.

Answer

Re-deploy the StackSet to all accounts with an updated template to overwrite any manual changes and restore the baseline.

Question 17

A CloudOps engineer must deploy a standardized IAM role and a logging configuration to 40 AWS accounts spread across three Regions. The accounts are all members of an AWS Organizations organization. The engineer wants a repeatable, centrally managed way to deploy and update these resources across all accounts and Regions with the least ongoing administrative effort. Which approach should the engineer use?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions and deploy to the organization's organizational units, enabling automatic deployment to accounts as they join.

Answer

Create a single CloudFormation stack in the management account and use nested stacks that reference each member account's resources.

Answer

Write an AWS Systems Manager Automation runbook that assumes a role in each account and creates the resources sequentially.

Answer

Manually launch the same CloudFormation template in each account and Region, then enable drift detection on every stack.

Question 18

A CloudOps engineer maintains a Systems Manager Automation runbook that resizes production EC2 instances during scheduled changes. Company policy requires that a senior operator manually approve the resize before it executes, and the approval request must pause the automation until a response is received. The team wants to implement this control within the existing runbook without building custom Lambda functions. Which approach meets these requirements?

Accepted Answer

Add an aws:approve action step to the Automation runbook that pauses execution and notifies the approvers via an SNS topic until they approve or reject.

Answer

Configure the runbook to use an aws:pause step and require operators to manually resume the execution from the console.

Answer

Wrap the runbook in an EventBridge rule that triggers only after an approval email is received in Amazon SES.

Answer

Use a Systems Manager Change Calendar to block execution until an operator opens the calendar window.

Question 19

A company runs about 200 non-production EC2 instances used only during business hours (08:00-18:00, Monday to Friday). The CloudOps team wants an automated, low-maintenance solution to stop these instances outside business hours and start them each morning to reduce costs, without deploying or managing any additional compute resources. Which approach best meets these requirements?

Accepted Answer

Create two EventBridge Scheduler schedules that invoke the AWS-StartEC2Instance and AWS-StopEC2Instance Systems Manager Automation runbooks targeting instances by tag.

Answer

Deploy a dedicated t3.micro EC2 instance running a cron job with the AWS CLI to start and stop the tagged fleet on a schedule.

Answer

Configure an Auto Scaling group with scheduled scaling actions to scale the fleet to zero at night and back up in the morning.

Answer

Enable Systems Manager Patch Manager maintenance windows to power the instances off overnight and on again during the day.

Question 20

A CloudOps engineer manages a centralized 'shared services' AWS account that builds a hardened, monthly golden AMI using an SSM Automation runbook. The organization has 40 workload accounts that must be able to launch EC2 instances from the newest golden AMI. The AMI is currently only available in the shared services account, and each workload team must manually copy the AMI ID. The engineer needs an automated, repeatable way to make the latest AMI ID discoverable across all workload accounts without granting broad AMI-sharing permissions each cycle. Which approach best meets these requirements?

Accepted Answer

After building the AMI, have the Automation runbook share the AMI with the AWS Organization and write the AMI ID to an SSM Parameter Store parameter that is shared across the organization via AWS Resource Access Manager (RAM).

Answer

Have the Automation runbook share the AMI with each account ID and write the AMI ID to a Parameter Store SecureString parameter in the shared services account, then have workload accounts read it directly.

Answer

Configure a CloudFormation StackSet that copies the AMI into all 40 accounts on a schedule and stores the AMI ID as a stack output in each account.

Answer

Enable AMI sharing to all accounts and require workload teams to use an EventBridge rule to detect the new AMI and manually update their launch templates.

More SOA-C03 practice