Deployment, Provisioning, and Automation — AWS Certified CloudOps Engineer SOA-C03 practice questions

A serverless deployment must ship code and infrastructure atomically with rollback on failed invocations detected via CloudWatch alarms.

1. Use AWS SAM with CodeDeploy traffic shifting and alarm-based auto-rollback on failure
2. Deploy Lambda with a Lambda alias and manually flip versions during release windows
3. Package the code in an S3 bucket and update the function through a shell script daily
4. Rely on CloudFormation update-stack to swap the code and roll back on any exception

Answer: A — Use AWS SAM with CodeDeploy traffic shifting and alarm-based auto-rollback on failure

A) Correct - SAM + CodeDeploy shifts Lambda traffic gradually and rolls back on alarm. B) Manual flip loses automation. C) Not atomic. D) Lacks alarm-driven rollback.

A team wants blue-green deployments for an EC2 fleet with automatic traffic shift and automatic rollback on CloudWatch alarm breach.

1. Deploy a fresh ASG and manually swap the ALB target group during the release window
2. Use CodeDeploy blue-green with ALB traffic shifting and alarm-based auto-rollback
3. Rely on an ASG instance-refresh with rolling replacement and manual verification steps
4. Configure Elastic Beanstalk immutable deployments and inspect health via the console

Answer: B — Use CodeDeploy blue-green with ALB traffic shifting and alarm-based auto-rollback

A) Manual swap loses automation. B) Correct - CodeDeploy blue-green natively supports ALB shifts + alarm rollback. C) Rolling is not blue-green. D) Beanstalk immutable is close but the question specifies alarm-driven rollback.

An organization must provision an identical VPC + subnet layout across 25 member accounts in 3 Regions from one central template, with per-account drift detection. Which SOA-C03 Domain 3 combination is the BEST fit?

1. CloudFormation StackSets with a service-managed permission model targeting the Organization's OUs
2. A shell script looping the AWS CLI against each account's assumed role, run manually each quarter
3. AWS Resource Access Manager sharing a single VPC from the management account to all members
4. Terraform Cloud with a single workspace applying to all 75 account/Region combinations serially

Answer: A — CloudFormation StackSets with a service-managed permission model targeting the Organization's OUs

A) Correct — StackSets with the service-managed permission model is the AWS-native way to deploy + maintain identical stacks across an Organization's accounts/Regions, with built-in drift detection. B) Manual scripting isn't repeatable, auditable, or drift-aware in the way the requirement demands. C) RAM shares a single resource across accounts — it doesn't provision an independent identical VPC per account. D) Terraform Cloud is a valid third-party option AWS explicitly acknowledges for IaC, but a single serial workspace across 75 targets isn't the efficient or idiomatic pattern versus StackSets' native parallel multi-account rollout.

A CloudFormation change set failed to preview an update, and the team wants to see which resources will replace vs update in-place.

1. Deploy to a scratch account first and rely on trial-and-error to observe the behavior best
2. Run stack update with rollback disabled and let CFN print the actual replacements taken
3. Diff the local template against the console template using an external Python script now
4. Inspect the change set details showing Modify/Replace flags per resource before executing

Answer: D — Inspect the change set details showing Modify/Replace flags per resource before executing

A) Wasteful. B) Direction reversal - risky. C) Reinvents change sets. D) Correct - change set details enumerate Replace/Modify per resource before execution.

A CodeDeploy deployment must route production traffic gradually to a new version over ten minutes to catch regressions early.

1. Choose a linear traffic-shift deployment configuration for the target compute type here
2. Rely on the all-at-once deployment configuration and roll back if alarms flip states now
3. Deploy the new version to only 10 percent of hosts and hold indefinitely for review later
4. Reduce the ALB weighted target group to zero and increase it every minute manually daily

Answer: A — Choose a linear traffic-shift deployment configuration for the target compute type here

A) Correct - linear (e.g., CodeDeployDefault.LinearEvery1Minute) shifts traffic gradually. B) Direction reversal - no gradual shift. C) Manual and unbounded. D) Reinvents CodeDeploy weighting.

An ASG must roll out a new AMI to instances one at a time, verifying health before proceeding to the next replacement.

1. Terminate instances manually via console and let the ASG recover them to the new AMI now
2. Configure ASG instance refresh with a min-healthy-percentage that forces one-at-a-time
3. Attach a lifecycle hook that pauses each instance forever until a manual continue is sent
4. Reduce the ASG desired capacity to one temporarily and update the launch template inline

Answer: B — Configure ASG instance refresh with a min-healthy-percentage that forces one-at-a-time

A) Manual and error-prone. B) Correct - instance refresh with high min-healthy is the built-in rolling replace. C) Manual continue defeats automation. D) Loses availability.

An operations team must run a security script on 200 EC2 hosts simultaneously with output centralized for audit and no direct SSH connectivity.

1. Use Systems Manager Run Command to execute the script and capture output centrally
2. Attach a shared EFS volume, drop the script on it, and use cron to trigger it locally
3. Distribute the script through user data on the next instance-refresh rolling deploy
4. Deploy a Lambda that iterates instance IDs and invokes ssh via a tunneling helper layer

Answer: A — Use Systems Manager Run Command to execute the script and capture output centrally

A) Correct — Run Command executes shell commands across many managed instances with output to S3/CloudWatch. B) Cron is unmanaged and not auditable. C) User data runs only at first boot. D) Reinvents Run Command and reintroduces SSH.

A CloudFormation stack update fails partway through with a subnet CIDR conflict, leaving the stack in UPDATE_ROLLBACK_FAILED. What is the MOST direct first remediation step per SOA-C03 Domain 3 guidance?

1. Delete the entire stack immediately and recreate it from scratch to guarantee a clean state
2. Manually edit resources in the console to match the template, then continue the rollback
3. Identify and skip the specific resource causing the rollback failure via continue-update-rollback, after confirming its actual state
4. Ignore the failed state — CloudFormation will retry automatically on the next scheduled drift check

Answer: C — Identify and skip the specific resource causing the rollback failure via continue-update-rollback, after confirming its actual state

A) Destroys resources unnecessarily and risks data loss for a state that's usually recoverable. B) Manual console edits without reconciling the stack's tracked state often make the drift worse and don't resolve the ROLLBACK_FAILED status. C) Correct — continue-update-rollback with resources-to-skip (after verifying the resource's real state) is the documented path out of UPDATE_ROLLBACK_FAILED. D) CloudFormation does not auto-retry a failed rollback; drift detection is a separate, unrelated feature.

A CloudFormation stack managed by the platform team has been changed by operators through the console, and leadership wants a report of the mismatches.

1. Compare current-live templates to the last change-set summary in the stack
2. Run CloudFormation drift detection on the stack to list altered resources
3. Enable AWS Config change history to alert on every out-of-band modification
4. Turn on CloudTrail Insights to surface unusual write API activity by users

Answer: B — Run CloudFormation drift detection on the stack to list altered resources

A) Change sets show proposed changes, not actual live drift. B) Correct — Drift Detection compares stack state to template and reports resource-level drift. C) Config tracks changes but does not tie them to stack templates. D) Insights flags anomalies, not stack conformance.

A CloudFormation deployment fails half-way, and the team wants automatic restoration of the previous resource state without manual cleanup steps.

1. Leave rollback-on-failure enabled so the stack returns to its prior good state
2. Turn on CloudFormation drift detection so the stack automatically self-heals on error
3. Add a Lambda-backed custom resource that watches events and deletes failed items
4. Use --disable-rollback so the stack halts at failure and awaits manual intervention

Answer: A — Leave rollback-on-failure enabled so the stack returns to its prior good state

A) Correct — rollback-on-failure is the default and restores the last stable state. B) Drift detection reports drift, does not heal. C) Reinvents built-in rollback. D) Direction reversal — disables the desired behavior.

SSM Run Command?

Execute commands on instances (one or many) without SSH.

SSM Parameter Store?

Store config and secrets. Hierarchical, versioned. SecureString for KMS-encrypted.

EventBridge scheduled rules?

Cron expressions trigger Lambda/SQS/etc. Replaces CloudWatch Events.

SSM Automation?

Run runbooks (predefined or custom). Patch, AMI build, etc.