DOP-C02 Configuration Management and IaC — 100 Questions

Question 1

A company uses AWS CloudFormation to deploy a multi-tier web application. The template includes a nested stack for the database layer. When updating the stack, the database stack fails with a 'CREATE_FAILED' status, but the parent stack continues updating other resources. What is the most likely cause and best practice to prevent this?

Accepted Answer

The parent stack's update policy is set to 'CONTINUE' by default. To prevent this, set 'OnFailure' to 'ROLLBACK' in the stack update options.. Option A is correct because, by default, when a CloudFormation stack update encounters a failure in a nested stack, the parent stack's update policy is set to 'CONTINUE', meaning it will proceed with updating other resources despite the failure. To prevent this, you should set the 'OnFailure' parameter to 'ROLLBACK' in the stack update options, which instructs CloudFormation to roll back the entire parent stack if any resource (including nested stacks) fails to update, ensuring consistency across the deployment.

Answer

The parent stack was created without the '--capabilities' parameter, so it cannot roll back.

Answer

The nested stack failure automatically triggers a rollback of the parent stack, but the rollback also failed.

Answer

The parent stack is configured with 'OnFailure' set to 'DO_NOTHING'. Change it to 'DELETE'.

Question 2

A DevOps engineer manages infrastructure using Terraform. The team needs to store secrets such as database passwords in a secure manner and reference them in Terraform configurations. They have configured AWS Secrets Manager. What is the recommended approach to reference secrets in Terraform without exposing them in state files?

Accepted Answer

Use the 'data.aws_secretsmanager_secret_version' data source and mark the attribute as 'sensitive = true' in the output.. Option D is correct because using the `data.aws_secretsmanager_secret_version` data source retrieves the secret value at plan time without storing it in the Terraform state file. Marking the attribute as `sensitive = true` in the output prevents the value from being displayed in the CLI output, but the key protection is that the secret value itself is never written to the state file when using this data source — Terraform only stores the data source's ID and metadata, not the actual secret payload.

Answer

Store the secret ARN in a Terraform variable and use 'var.secret_arn' in the resource.

Answer

Store the secret in AWS Systems Manager Parameter Store and reference it using 'data.aws_ssm_parameter'.

Answer

Pass the secret as an environment variable to Terraform and reference it with 'var.secret_value'.

Question 3

A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?

Accepted Answer

Upload the recipe to a custom cookbook repository and assign it to the 'Configure' lifecycle event in the stack settings.. In AWS OpsWorks, lifecycle events (such as Configure) are tied to layers, not individual instances. To run a custom recipe on all instances during the Configure event, you must upload the recipe to a custom cookbook repository (e.g., S3 or Git) and then assign that recipe to the Configure lifecycle event in the stack's layer settings. This ensures OpsWorks Chef runs the recipe on every instance in that layer whenever the Configure event fires (e.g., after scaling or instance state changes).

Answer

Modify the stack's CloudFormation template to include the recipe.

Answer

Add the recipe commands to the instance's user data script.

Answer

Use AWS CodeDeploy to trigger the recipe during the Configure event.

Question 4

A DevOps team uses AWS CodePipeline to automate deployments. The pipeline has a Deploy stage that uses AWS CloudFormation to create or update a stack. Recently, a stack update failed because the template referenced an AMI that was deprecated. The team wants to automatically roll back the stack to the last known good state if a deployment fails. What should they do?

Accepted Answer

Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.. Option A is correct because the CloudFormation deployment action in CodePipeline supports a 'Rollback on failure' option when 'ActionMode' is set to 'CREATE_UPDATE'. When enabled, if the stack update fails, CloudFormation automatically rolls back the stack to the last known good state (the previously deployed stack). This directly addresses the team's requirement to revert to a stable state after a failed deployment due to a deprecated AMI.

Answer

Use the CodePipeline console to enable 'Automatic rollback' for the Deploy stage.

Answer

Set the stack's 'DisableRollback' parameter to 'true' in the template.

Answer

Add a stack policy to the CloudFormation stack that denies updates to the AMI parameter.

Question 5

An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?

Accepted Answer

Immutable update.. Immutable updates in AWS Elastic Beanstalk launch a completely new environment with the new application version. If the new environment fails health checks, Elastic Beanstalk automatically terminates it, leaving the original environment untouched. This ensures zero downtime and a safe rollback, which matches the requirement to keep the old environment intact if health checks fail.

Answer

Traffic splitting.

Answer

All at once.

Answer

Rolling update based on health.

Question 6

A developer wants to use AWS CloudFormation to create an Amazon RDS DB instance. The template includes a DB instance resource. Which property is required for the DB instance to be created successfully?

Accepted Answer

DBInstanceClass and Engine. In AWS CloudFormation, when creating an Amazon RDS DB instance using the AWS::RDS::DBInstance resource, the only truly required properties are DBInstanceClass (the compute and memory capacity) and Engine (the database engine, e.g., MySQL, PostgreSQL). These two properties are mandatory in the CloudFormation resource specification; without them, the template will fail validation. All other properties, such as AllocatedStorage, DBInstanceIdentifier, MasterUsername, and MasterUserPassword, have default behaviors or can be omitted under certain conditions (e.g., AllocatedStorage defaults to 20 GB for some engines, and MasterUsername/MasterUserPassword are not required if you use a snapshot or a source DB instance).

Answer

AllocatedStorage

Answer

DBInstanceIdentifier

Answer

MasterUsername and MasterUserPassword

Question 7

A DevOps team is designing a CI/CD pipeline using AWS CodeBuild and CodePipeline. They want to use infrastructure as code to define the build environment. Which TWO options are valid approaches to define the build environment in CodeBuild?

Accepted Answer

Define the build environment using a buildspec.yml file that includes runtime versions and environment variables.. Option B is correct because the buildspec.yml file is the primary mechanism in AWS CodeBuild to define the build environment, including runtime versions (e.g., runtime: nodejs:18) and environment variables. This file is placed at the root of the source code and instructs CodeBuild on how to execute the build phases, making it a valid infrastructure-as-code approach for environment configuration.

Answer

Configure CodeDeploy to set up the build environment before the build starts.

Answer

Use an Elastic Beanstalk environment to run the build.

Answer

Use an AWS CloudFormation template to specify the build environment configuration.

Question 8

A company manages its infrastructure using AWS CloudFormation. They have a production stack that includes an Amazon RDS Multi-AZ DB instance. The stack was created using the 'aws cloudformation create-stack' command with default settings. The DB instance uses a custom DB parameter group. A DevOps engineer needs to modify a parameter in the DB parameter group and update the stack. The engineer updates the template to change the parameter value and runs 'aws cloudformation update-stack'. The update fails with a 'ROLLBACK_IN_PROGRESS' status. The engineer checks the CloudFormation console and sees that the DB instance was successfully modified, but the stack is rolling back. The rollback fails because the DB instance cannot be reverted to the original parameter value. The stack is now in 'UPDATE_ROLLBACK_FAILED' state. What should the engineer do to resolve this situation and apply the desired parameter change?

Accepted Answer

Use the 'aws cloudformation continue-update-rollback' command with the '--resources-to-skip' parameter to skip the DB instance, allowing the stack to reach 'UPDATE_ROLLBACK_COMPLETE'. Then apply a change set with the desired parameter change.. Option B is correct because when a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the `continue-update-rollback` command with `--resources-to-skip` allows you to skip the resource that cannot be rolled back (the RDS DB instance with the custom parameter group). This moves the stack to UPDATE_ROLLBACK_COMPLETE, after which you can apply a change set with the desired parameter change. This approach avoids manual intervention or stack deletion while preserving the modified DB instance.

Answer

Run 'aws cloudformation update-stack' again with the original template to revert the changes.

Answer

Revert the parameter value manually in the RDS console and then resume the rollback.

Answer

Delete the stack and recreate it with the updated template.

Question 9

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

Accepted Answer

Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.. Option D is correct because the `AutoScalingReplacingUpdate` update policy with `WillReplace` set to `true` tells CloudFormation to create a new replacement resource (e.g., a new RDS DB instance) before deleting the old one, which minimizes downtime by allowing traffic to be switched to the new resource after it is fully provisioned. This policy is specifically designed for resources that must be replaced during an update, such as changing an RDS DB instance class that requires a new underlying host, and it ensures data is preserved by using the existing database snapshot or by relying on the replacement process to maintain data integrity.

Answer

Set the CreationPolicy attribute on the database resource.

Answer

Configure a Stack Policy to protect the database resource.

Answer

Set the UpdatePolicy to AutoScalingRollingUpdate.

Question 10

A DevOps engineer is designing an AWS CloudFormation template to deploy a three-tier web application. The application must be highly available across multiple Availability Zones. The engineer needs to ensure that the database layer uses a Multi-AZ deployment. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Accepted Answer

Select a database engine that supports Multi-AZ deployments.. Option C is correct because not all AWS RDS database engines support Multi-AZ deployments; for example, Amazon Aurora uses a different high-availability mechanism (cluster volume) and does not use the standard Multi-AZ feature. The engineer must verify that the chosen engine (e.g., MySQL, PostgreSQL, Oracle, SQL Server) explicitly supports Multi-AZ to enable synchronous standby replication across Availability Zones. Option E is correct because setting the 'MultiAZ' property to 'true' on the 'AWS::RDS::DBInstance' resource directly instructs CloudFormation to provision a primary DB instance in one AZ and a standby in another AZ, with automatic failover.

Answer

Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets from at least two Availability Zones.

Answer

Deploy the database with multiple read replicas in different Availability Zones.

Answer

Configure the database to use a DB subnet group with subnets in a single Availability Zone.

Question 11

A DevOps engineer receives the error shown in the exhibit when attempting to update an existing CloudFormation stack that deploys a VPC with subnets. The stack was created successfully earlier using the same template. What is the most likely cause of this error?

Accepted Answer

The IAM role used for the stack update lacks the 'ec2:DescribeSubnets' permission.. When updating a CloudFormation stack that deploys a VPC with subnets, the update operation must be able to read the current state of the subnet resources to determine if changes are needed. The IAM role used for the stack update must have the 'ec2:DescribeSubnets' permission to query the existing subnet configuration. Without this permission, CloudFormation cannot verify the subnet's current properties, leading to the error shown in the exhibit.

Answer

The subnet ID in the template is already used by another stack in the same account.

Answer

The subnet specified in the template does not exist in the selected AWS region.

Answer

The CloudFormation template has a syntax error in the subnet definition.

Question 12

Drag and drop the steps to set up an AWS CodePipeline with a source stage from CodeCommit and a deploy stage to Elastic Beanstalk.

Question 13

Drag and drop the steps to set up an AWS Lambda function triggered by an S3 event.

Question 14

Match each AWS service to its primary function in a DevOps pipeline.

Question 15

Match each AWS Config rule to its purpose.

Question 16

A company uses AWS CodePipeline with a multi-branch strategy. The pipeline deploys a Lambda function using CloudFormation. The DevOps engineer notices that when a new branch is created, the pipeline executes but the CloudFormation stack fails because the stack name already exists. What is the MOST efficient way to resolve this issue?

Accepted Answer

Modify the pipeline to use a dynamic stack name parameter, such as the branch name.. Option B is correct because using a dynamic stack name based on the branch name or a unique identifier ensures each pipeline execution creates a separate stack, avoiding name conflicts. Option A is wrong because deleting the stack before creation may cause downtime. Option C is wrong because CloudFormation does not support stack name overrides; a new name must be used. Option D is wrong because hardcoding a different stack name per branch is not scalable.

Answer

Hardcode a different stack name for each branch in the pipeline.

Answer

Delete the existing stack before each deployment.

Answer

Use the CloudFormation 'Override' parameter to reuse the same stack.

Question 17

An organization uses AWS OpsWorks for configuration management. They want to migrate to AWS Systems Manager to reduce costs and improve flexibility. Their current stack includes custom Chef recipes that manage package installations and service configurations. What is the MOST effective migration strategy?

Accepted Answer

Translate Chef recipes into Systems Manager State Manager associations and use Run Command for ad-hoc tasks.. Option C is correct because Systems Manager State Manager can manage configurations using association documents that are equivalent to Chef recipes, and Run Command can execute ad-hoc commands. Option A is wrong because it does not address existing recipes. Option B is wrong because CodeDeploy is for application deployments, not configuration management. Option D is wrong because it adds complexity and cost.

Answer

Use AWS CloudFormation to recreate the entire infrastructure and manage configurations.

Answer

Use AWS CodeDeploy to replace OpsWorks and manage configurations.

Answer

Keep OpsWorks but integrate it with Systems Manager for hybrid management.

Question 18

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

Accepted Answer

CreationPolicy attribute with CreateBeforeDestroy. Option D is correct because CloudFormation 'CreateBeforeDestroy' ensures that a new resource is created before the old one is deleted, reducing downtime. Option A is wrong because 'UpdatePolicy' is for auto-scaling groups. Option B is wrong because 'DeletionPolicy' controls what happens when a resource is deleted. Option C is wrong because 'DependsOn' only defines resource creation order.

Answer

UpdatePolicy attribute with AutoScalingRollingUpdate

Answer

DeletionPolicy attribute set to Retain

Answer

DependsOn attribute to specify creation order

Question 19

A company uses Terraform with an S3 backend to manage infrastructure. The DevOps engineer notices that after a colleague runs 'terraform apply' locally, the state file in S3 becomes corrupted and subsequent runs fail. What is the BEST way to prevent this issue?

Accepted Answer

Use DynamoDB for state locking and enable consistency checks.. Option B is correct because enabling DynamoDB state locking prevents concurrent modifications that can corrupt the state file. Option A is wrong because versioning only allows recovery, not prevention. Option C is wrong because encryption does not prevent corruption. Option D is wrong because it is not a best practice for state management.

Answer

Store the state file locally and commit it to version control.

Answer

Use S3 server-side encryption to protect the state file.

Answer

Enable S3 versioning on the state bucket to recover previous versions.

Question 20

A large enterprise uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set that contains a custom resource backed by a Lambda function. The update changes the Lambda function code. What is the CORRECT approach to ensure the Lambda function is updated without manual intervention?

Accepted Answer

Update the stack set with a new template version that references the updated Lambda code, and let CloudFormation handle the update.. Option A is correct because updating the stack set with new template and parameters triggers CloudFormation to update the Lambda function automatically. Option B is wrong because manually updating the Lambda function is not scalable. Option C is wrong because CloudFormation does not support Lambda function aliases for custom resources. Option D is wrong because StackSets automatically handle updates across accounts.

Answer

Use a Lambda function alias and point the custom resource to the alias.

Answer

Create a new stack set for the updated Lambda and delete the old one.

Answer

Manually update the Lambda function in each account, then update the stack set.