Task 3.1: Provision and Maintain Cloud Resources. SOA-C03 Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A company uses EC2 Image Builder to create a golden AMI. The pipeline builds the AMI, tests it, and distributes it to multiple Regions. Recently, a new security compliance requirement mandates that all AMIs must be patched within 24 hours of a new patch release. The team is concerned that the current pipeline, which runs weekly, does not meet this requirement. The team also wants to ensure that the AMI is rebuilt immediately if a critical patch is released. What should the team do?

   • AUse AWS Systems Manager State Manager to patch the instances immediately and rely on the weekly Image Builder pipeline for the AMI.
   • BChange the Image Builder pipeline schedule to run every hour.
   • CManually run the Image Builder pipeline when a critical patch is released.
   • DCreate an Amazon EventBridge rule that triggers the Image Builder pipeline when a Systems Manager Patch Manager baseline update is published.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A CloudOps engineer needs to automate the creation and maintenance of an Amazon Machine Image (AMI) that includes a custom application and its dependencies. Which AWS service is designed specifically for this purpose?

   • AAWS CodeDeploy
   • BAWS Systems Manager Patch Manager
   • CEC2 Image Builder
   • DAWS Elastic Beanstalk
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A CloudFormation stack update is failing. The error message states: 'Resource handler returned message: "The submitted information didn't contain a valid security group ID" (Service: AmazonEC2; Status Code: 400; Error Code: InvalidGroupId.Malformed).' The template has a parameter for the security group ID. What is the most likely cause of this error?

   • AThe parameter value for the security group ID is incorrect or references a security group in a different VPC.
   • BThe IAM user performing the stack update does not have permission to use the security group.
   • CThe CloudFormation template is missing the 'AWS::EC2::SecurityGroup' resource definition.
   • DThe security group is not attached to the EC2 instance in the template.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A CloudFormation stack creation fails because the IAM role specified in the template does not have permission to create an S3 bucket. What is the most direct way to remediate this issue?

   • AChange the bucket name in the template
   • BDelete the stack and recreate it
   • CUse a different AWS Region
   • DUpdate the IAM policy to grant the required s3:CreateBucket permission
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's security team requires that all EC2 instances in the production environment run a hardened operating system with the latest security patches. The operations team currently maintains a single AMI that is manually updated each month. After a recent incident, management mandates that the AMI be rebuilt automatically on a schedule, and that the source configuration be version-controlled. The team wants to minimize manual effort and ensure the AMI is available in all production Regions. Which solution should the team use?

   • ACreate a new AMI from a running instance, then use an AWS Lambda function on a schedule to copy that AMI to other Regions.
   • BUse AWS Systems Manager Patch Manager to patch all running instances in place, and rely on the default AMI for new instances.
   • CLaunch an EC2 instance, apply the patches manually, create an AMI, and copy it to all production Regions using the AWS Management Console.
   • DCreate an EC2 Image Builder pipeline with a recipe, a schedule, and a cross-Region distribution configuration. Store the recipe components in a Git repository.
   Reveal Solution Discussion Select an answer first