5 Questions to Test Your Deployment, Provisioning, and Automation Knowledge (SOA-C03)
Practice Deployment, Provisioning, and Automation for the AWS CloudOps Engineer – Associate (SOA-C03) exam with the 5 questions below. It carries about 22% of the exam score. Every option is explained, so a wrong pick still teaches something.
AWS CloudOps Engineer – Associate (SOA-C03) · Deployment, Provisioning, and Automation · 5 questions with answers and explanations
🧭 How Deployment, Provisioning, and Automation is tested
Deployment and automation questions describe an operational job: a stack that hangs during creation, settings that must stay applied on a fleet, a large file copy followed by nightly syncs, a stack update that failed to roll back, or a risky production update. The choice is the AWS tool built for that job at that moment. Several options are related tools that act once, act later or work at a different layer.
Watch for these while you work
• If a CloudFormation resource waits a long time and then fails, think about a signal the template expects from the instance, not about launch errors, which tend to fail quickly.
• Separate one-time actions from continuous enforcement. Configuration that must correct itself over time needs a Systems Manager feature built for ongoing state.
• Before a risky stack update, preview it. Tools that preview changes, find manual drift or protect resources from updates serve three different purposes.
Question 1 of 5
A CloudFormation stack creation hangs waiting for an EC2 instance, then fails after an hour. The template uses a CreationPolicy. What is the likely cause?
Show answer
✅ Answer: D
Difficulty: advanced · Topic: AWS CloudFormation
How CreationPolicy waits for an instance
Normally CloudFormation marks an EC2 instance complete as soon as EC2 reports it running, even if the software on it failed to install. A CreationPolicy with ResourceSignal makes CloudFormation wait for explicit success signals instead:
• Count: how many success signals are needed (for example 1).
• Timeout: how long to wait, in ISO 8601 format, such as PT1H for one hour.
The instance's user data runs its setup and then calls the helper script, for example /opt/aws/bin/cfn-signal -e $? --stack ... --resource WebServer --region .... If the signal never arrives before the timeout, the resource fails and the stack rolls back.
Common reasons for a missing signal: cfn-signal not installed or not called, the script failing earlier, or no network path from the instance to the CloudFormation endpoint (private subnet without NAT or VPC endpoint).
Why each option works or fails
• ✗ A. Instance type unavailable: EC2 rejects the launch within seconds with a capacity or unsupported-type error, so the stack would fail quickly, not after an hour.
• ✗ B. Stack policy denial: stack policies protect resources during stack updates only; they have no effect on resources created with the stack.
• ✗ C. Missing export in outputs: an import of a nonexistent export is caught right away when the template is processed; it does not cause a long wait on an instance.
• ✓ D. No success signal from cfn-signal (correct): a one-hour wait followed by failure matches a PT1H timeout expiring with zero signals received.
Question 2 of 5
A CloudOps engineer must ensure that a specific antivirus agent configuration and a required set of registry settings remain applied on a fleet of managed EC2 instances on an ongoing basis, automatically correcting any instance that drifts from the desired state. Which Systems Manager capability is designed for this?
Show answer
✅ Answer: A
Difficulty: applied · Topic: Systems Manager
State Manager keeps a desired state
Systems Manager State Manager uses associations. An association binds a document (for example a Command document that configures an agent, or AWS-ApplyAnsiblePlaybooks) to a set of targets, often by tag, and a schedule.
• It applies the configuration when an instance first matches the target, then again on the schedule (for example every 30 minutes).
• If someone changes a setting, the next run puts it back, and association compliance shows which instances failed.
Example
Associate a document that installs and configures the antivirus agent and sets the required registry keys with all instances tagged Env=Prod, with a rate(30 minutes) schedule. New instances with that tag are configured automatically.
Why each option works or fails
• ✓ A. State Manager (correct): associations reapply the desired configuration on a schedule and to new instances, correcting drift continuously.
• ✗ B. Distributor: it packages and publishes software such as agents for installation, but it does not by itself keep settings enforced over time.
• ✗ C. Session Manager: it provides browser or CLI shell access to instances without SSH; it does not manage configuration.
• ✗ D. One-time Automation: a single execution changes things once and does nothing when an instance drifts later.
Question 3 of 5
200 TB on an on-premises NFS server must be copied to S3 over a 10 Gbps link, followed by nightly incremental syncs with integrity checks, preserving metadata. Which service fits BEST?
Show answer
✅ Answer: D
Difficulty: advanced · Topic: AWS DataSync, Amazon S3
Online transfer with AWS DataSync
AWS DataSync is a managed online transfer service. You deploy a DataSync agent (a VM) near the source, point it at the NFS or SMB share, and create a task to an S3 bucket.
• It moves data in parallel across the network and can use a VPC endpoint or Direct Connect.
• It verifies integrity with checksums during and after transfer.
• It copies only changed files on later runs, and tasks can be scheduled (for example, nightly).
• It preserves file metadata such as timestamps and POSIX permissions (stored as S3 object metadata).
Rough math: 10 Gbps is about 1.25 GB/s, or roughly 100 TB per day at full rate. 200 TB therefore fits in a few days of online transfer, so no shipping of devices is needed.
Why each option works or fails
• ✗ A. Direct Connect alone, mounting S3 as NFS: Direct Connect is only a network link; S3 is an object store and cannot be mounted as an NFS share by itself, and nothing would perform the copy, scheduling or verification.
• ✗ B. Transfer Acceleration with aws s3 sync: it speeds transfers over long distances on the internet, but there is no built-in scheduling, managed integrity verification or preservation of NFS file metadata.
• ✗ C. Snowball Edge every night: shipping physical devices takes days per round trip, so nightly incremental syncs are impossible, and a 10 Gbps link already makes the bulk transfer practical online.
• ✓ D. DataSync with an on-premises agent (correct): it handles the large initial copy efficiently, then runs scheduled incremental syncs with built-in integrity verification and metadata preservation.
Question 4 of 5
A stack is stuck in UPDATE_ROLLBACK_FAILED because a resource was deleted manually. The team needs the stack usable again without deleting it. Which action fits?
Show answer
✅ Answer: B
Difficulty: advanced · Topic: AWS CloudFormation
What UPDATE_ROLLBACK_FAILED means
When an update fails, CloudFormation rolls resources back to their previous state. If a resource cannot be rolled back, the stack stops in UPDATE_ROLLBACK_FAILED. A common cause is out-of-band change: someone deleted a resource manually, so CloudFormation cannot restore or update it.
In this state the stack cannot be updated, and CloudFormation does not retry by itself.
Continuing the rollback
• ContinueUpdateRollback (console: "Continue update rollback") tries the rollback again.
• If a resource still cannot roll back, pass its logical ID in ResourcesToSkip. CloudFormation marks it UPDATE_COMPLETE without rolling it back and finishes the rest.
Example: aws cloudformation continue-update-rollback --stack-name app --resources-to-skip OrdersQueue
The stack reaches UPDATE_ROLLBACK_COMPLETE and can be updated again. Skipped resources may no longer match the template, so fix or recreate them in a later update.
Why each option works or fails
• ✗ A. Edit stack state in the console: the console shows resource status but offers no way to edit CloudFormation's internal record of the stack; changes go through updates, rollbacks or resource import.
• ✓ B. ContinueUpdateRollback with skipped resources (correct): it resumes the stuck rollback and, by skipping the manually deleted resource, lets the stack reach UPDATE_ROLLBACK_COMPLETE without deleting the stack.
• ✗ C. Recreate every resource: deleting and rebuilding everything is destructive, can lose data and causes downtime, and it is unnecessary when only one resource blocks the rollback.
• ✗ D. Wait for an automatic retry: CloudFormation does not retry a failed rollback by itself; the stack stays in UPDATE_ROLLBACK_FAILED until someone continues the rollback or deletes the stack.
Question 5 of 5
Before applying an update to a production CloudFormation stack, a developer wants to preview exactly which resources will be modified, replaced, or deleted. Which CloudFormation feature should they use?
Show answer
✅ Answer: B
Difficulty: applied · Topic: CloudFormation
What a change set is
A change set is a preview of a stack update. You submit the new template or parameters, and CloudFormation compares them with the current stack without changing anything yet.
For each resource it lists:
• the action: Add, Modify or Remove
• for modifications, whether replacement is True, False or Conditional
Replacement matters: replacing a DynamoDB table or an RDS instance creates a new resource and deletes the old one, which can mean data loss.
Workflow
aws cloudformation create-change-set, review it with describe-change-set or in the console, then execute-change-set if it looks right, or delete it if not. sam deploy shows a change set before it deploys.
Why each option works or fails
• ✗ A. Stack policy: it protects chosen resources from being updated or replaced during stack updates; it blocks changes but does not preview them.
• ✓ B. Change set (correct): it is the CloudFormation feature that previews exactly which resources will be added, modified, replaced or removed before the update runs.
• ✗ C. Drift detection: it compares live resources with the stack's recorded state to find manual changes; it does not evaluate a new template.
• ✗ D. Nested stack: it is a way to split templates into reusable child stacks, not a tool for previewing an update.
🎯 What to remember
• A stack that hangs on a resource with CreationPolicy and fails at the timeout means the instance never sent cfn-signal; real launch errors fail fast.
• Ongoing, self-correcting configuration means State Manager associations, not one-time Automation or package distribution.
• For large NFS/SMB-to-S3 copies plus scheduled incremental syncs with verification over a good network link, use DataSync; Snowball is for one-time moves when bandwidth is insufficient.
• A stack stuck in UPDATE_ROLLBACK_FAILED is recovered with ContinueUpdateRollback, skipping resources that can no longer roll back, rather than waiting or rebuilding.
• Change sets preview the impact of an update; drift detection finds manual changes; stack policies block updates to protected resources.
📊 About this set
Exam: SOA-C03 · 65 questions · 130 minutes · passing score 720
This set: 3 advanced, 2 applied · 2 scenario, 2 troubleshooting, 1 concept check
Topics: AWS CloudFormation, Systems Manager, AWS DataSync, Amazon S3, CloudFormation
🔗 More from this exam
• SOA-C03 Practice Set: Security and Compliance
• AWS CloudOps Engineer – Associate (SOA-C03): 5 Practice Questions on Security and Compliance
• Can You Answer These 5 SOA-C03 Questions on Monitoring, Logging, and Remediation?
• All SOA-C03 practice sets
• Every exam on this blog
📚 More SOA-C03 practice
More SOA-C03 questions: https://hyunhp.github.io/cert-bank/#exam=SOA-C03
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=SOA-C03
These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.
Original practice questions written for this blog, not exam dumps.
Comments
Post a Comment