DOP-C02 Configuration Management and IaC Practice Test 10 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline has a Source stage (GitHub), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The deployment fails intermittently with the error: 'Bucket does not allow ACLs'. The S3 bucket is configured to use the 'bucket-owner-enforced' setting for Object Ownership. The team wants to resolve the failure while maintaining security best practices. What should the team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the CodeDeploy deployment action to use a bucket policy and disable ACLs.. The error occurs because the S3 bucket uses the 'bucket-owner-enforced' Object Ownership setting, which disables ACLs. AWS CodeDeploy's default deployment action attempts to set ACLs on deployed objects, causing the failure. The correct solution is option A: configure the CodeDeploy deployment action to use a bucket policy instead of ACLs. This resolves the error while maintaining security best practices by keeping ACLs disabled. Option B (making the bucket public) is insecure. Option C (adding a CodeBuild step) does not address the root cause. Option D (changing Object Ownership to 'ObjectWriter') re-enables ACLs but is not recommended as it weakens ownership control and does not follow current best practices.

Answer

Make the S3 bucket publicly accessible to allow CodeDeploy to write objects.

Answer

Add a step in CodeBuild to copy the artifacts to the S3 bucket using the AWS CLI.

Answer

Change the Object Ownership setting to 'ObjectWriter' to enable ACLs.

Question 2

A gaming company uses AWS Elastic Beanstalk to deploy a web application. The operations team needs to update environment configuration variables (e.g., database URL) without causing downtime. They want to change the value of an environment property. What is the CORRECT way to apply this change?

Accepted Answer

Update the environment properties in the Elastic Beanstalk console; the platform will perform a rolling update.. Updating environment properties via the Elastic Beanstalk console or CLI triggers a rolling update of the environment instances, applying the new configuration without downtime. Option B (terminate and recreate) causes downtime. Option C (immutable update) is used for deploying new application versions, not for changing environment properties. Option D (AWS Lambda) cannot directly modify Elastic Beanstalk environment configuration in a supported manner.

Answer

Terminate the environment and create a new one with the updated configuration.

Answer

Use an immutable update by deploying a new version with the changes.

Answer

Use AWS Lambda to directly modify the environment configuration without redeploying.

Question 3

A company uses AWS CodeCommit to store its infrastructure as code templates. The DevOps team wants to automatically validate CloudFormation templates before merging changes to the main branch. Which service should be used to implement this validation?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it can be configured as a pre-merge check in a pull request workflow. By integrating CodeBuild with CodeCommit, the DevOps team can automatically run a build project that validates CloudFormation templates (e.g., using `aws cloudformation validate-template` or `cfn-lint`) before the merge is allowed. This provides a serverless, automated validation step without requiring a full pipeline or deployment.

Answer

AWS CodeDeploy

Answer

AWS CodePipeline

Answer

AWS CodeStar

Question 4

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) for its EC2 instances. The DevOps team updates the AMI monthly. What is the most efficient way to update the Elastic Beanstalk environment to use the new AMI?

Accepted Answer

Use the AWS CLI command aws elasticbeanstalk update-environment with the new AMI ID. You can update the AMI in an existing Elastic Beanstalk environment using the AWS CLI command 'aws elasticbeanstalk update-environment' with the appropriate option settings. Specifically, you specify the AMI ID in the 'aws:autoscaling:launchconfiguration' namespace using the 'ImageId' option name. This triggers a rolling update, replacing EC2 instances with the new AMI while preserving the environment configuration, DNS name, and other resources. This is the most efficient method as it avoids creating a new environment or manually modifying CloudFormation stacks, which is not supported.

Answer

Use the Elastic Beanstalk console to modify the launch configuration's AMI ID

Answer

Create a new Elastic Beanstalk environment with the new AMI and swap the environment URL

Answer

Update the CloudFormation template that manages the environment to reference the new AMI ID, and perform a stack update

Question 5

A company uses AWS CodePipeline to deploy a serverless application with AWS Lambda and Amazon API Gateway. The pipeline includes a beta and a production stage. The DevOps team wants to automatically promote the application from beta to production after successful testing. Which action should be taken in the pipeline?

Accepted Answer

Add a manual approval step between the beta and production stages. CodePipeline requires an explicit manual approval action to gate promotions between stages. Without a manual approval step, the pipeline would automatically transition from beta to production upon successful testing, which bypasses the necessary human validation for production deployments. Adding a manual approval step ensures that a designated approver reviews the beta stage results before promoting to production, aligning with safe deployment practices.

Answer

Configure a CloudWatch Events rule to automatically trigger the production deployment after beta completion

Answer

Use AWS CodeDeploy to create a deployment group that promotes the application

Answer

Configure an AWS Config rule to automatically approve the promotion

Question 6

A DevOps engineer is managing the lifecycle of a CloudFormation stack. The engineer needs to update a stack that contains an Auto Scaling group. The update requires a replacement of the Auto Scaling group. What will happen to the existing instances during the update?

Accepted Answer

The existing instances will be terminated after the new Auto Scaling group is created. When a CloudFormation stack update requires replacement of an Auto Scaling group (e.g., due to a change in the `LaunchConfigurationName` or `LaunchTemplate` property), CloudFormation creates the new Auto Scaling group first, then terminates the old instances after the new group is fully operational. This ensures minimal downtime because the new group begins serving traffic before the old one is torn down.

Answer

The stack update will fail because Auto Scaling groups cannot be replaced

Answer

The existing instances will remain running and be associated with the new Auto Scaling group

Answer

The instances will be updated in-place by terminating and recreating each instance one by one

Question 7

A DevOps engineer is writing an AWS CloudFormation template to create a VPC with public and private subnets. The engineer wants to ensure that the private subnets can access the internet through a NAT gateway. Which resources must be included in the template? (Choose TWO.)

Accepted Answer

AWS::EC2::RouteTable. A is correct because an AWS::EC2::RouteTable resource is required to define the routing rules for the private subnets. Specifically, you must create a route table for the private subnets and add a default route (0.0.0.0/0) that points to the NAT gateway, enabling outbound internet traffic from instances in the private subnets while blocking inbound traffic from the internet.

Answer

AWS::EC2::VPNGateway

Answer

AWS::EC2::InternetGateway

Answer

AWS::EC2::VPCEndpoint

Question 8

A company uses AWS CodeCommit as a source repository and AWS CodeBuild for building artifacts. The DevOps team wants to ensure that all commits to the main branch trigger a build. Which steps should be taken? (Choose THREE.)

Accepted Answer

Configure the CodeBuild project to use the CodeCommit repository as the source and specify the main branch. Configuring the CodeBuild project to use the CodeCommit repository as the source and specifying the main branch ensures that CodeBuild knows which repository and branch to monitor for changes. This is the foundational step that links the source code to the build project, enabling automated builds when commits are pushed to the main branch.

Answer

Configure a webhook in the CodeCommit repository to notify CodeBuild

Answer

Use AWS CodeDeploy to trigger the build on commits

Question 9

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team notices that stack updates sometimes fail because of resource conflicts. The team wants to prevent concurrent updates to the same stack. What should they do?

Accepted Answer

No action needed; CloudFormation already prevents concurrent stack updates. AWS CloudFormation inherently prevents concurrent updates to the same stack. When an update operation is initiated, CloudFormation places a lock on the stack, rejecting any subsequent update requests until the current operation completes. This behavior is built into the service and requires no additional configuration, making option C correct.

Answer

Use an AWS Organizations service control policy to restrict updates

Answer

Create an IAM policy that denies cloudformation:UpdateStack if a stack update is in progress

Answer

Enable CloudTrail to log all stack update attempts and manually review

Question 10

A DevOps engineer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment'. The engineer checks the logs and finds that the application installation script exits with a non-zero exit code. What should the engineer do to troubleshoot?

Accepted Answer

SSH into one of the failed instances and run the install script manually to identify the error. The deployment failure is caused by the application installation script exiting with a non-zero exit code, which indicates a specific error in the script or its environment. SSHing into a failed instance and running the install script manually allows the engineer to see the exact error output, debug the script logic, and identify missing dependencies or configuration issues directly on the target host.

Answer

Configure CloudWatch Logs to capture the script output

Answer

Increase the deployment's MinHealthyHosts percentage

Answer

Re-upload the application revision to S3

Question 11

A company is using AWS Elastic Beanstalk with a custom platform. The platform is based on Amazon Linux 2 and includes a pre-installed application. The DevOps team needs to inject environment-specific configuration files into the EC2 instances during deployment. Which approach should be used?

Accepted Answer

Use .ebextensions configuration files in the application source bundle. Ebextensions configuration files are the native mechanism in Elastic Beanstalk to inject environment-specific configuration into EC2 instances during deployment. These YAML or JSON files, placed in the .ebextensions directory of the application source bundle, are processed by the Elastic Beanstalk platform engine to execute commands, create files, or modify configuration before the application starts, ensuring the custom platform receives the necessary environment-specific settings.

Answer

Use AWS CloudFormation to update the environment with new configuration

Answer

Use EC2 user-data scripts to download configuration from S3

Answer

Store configuration in AWS Systems Manager Parameter Store and retrieve it in the application

Question 12

A DevOps engineer is creating a CloudFormation template that includes an AWS Lambda function. The function code is stored in an S3 bucket. The engineer wants to ensure that the Lambda function is updated whenever the code in S3 changes. What should the engineer do?

Accepted Answer

Reference the S3 object version in the Lambda function's Code property to force an update when the version changes. Referencing the S3 object version in the Lambda function's Code property (e.g., `S3ObjectVersion`) creates a dependency on that specific version. When the S3 object is updated, its version changes, which triggers CloudFormation to detect a change in the template and update the Lambda function during the next stack update. This ensures the function code is refreshed without manual intervention.

Answer

Use AWS CodeDeploy to deploy the Lambda function

Answer

Add a DependsOn clause to the Lambda function resource

Answer

Use AWS CodePipeline to automatically update the stack when the S3 object changes

Question 13

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

Accepted Answer

CloudFormation Change Sets. CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.

Answer

CloudFormation StackSets

Answer

CloudFormation Stack Policies

Answer

CloudFormation Drift Detection

Question 14

A DevOps team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They need to ensure that sensitive configuration parameters such as database passwords are not stored in plaintext in the source code repository. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Systems Manager Parameter Store with secure strings, and reference them in the pipeline using parameter-store action.. AWS Systems Manager Parameter Store with secure strings provides a native, fully managed service for storing sensitive configuration data like database passwords. By using the parameter-store action in CodePipeline, the pipeline can retrieve the secure parameter at runtime without exposing it in the source code or requiring manual encryption/decryption logic, minimizing operational overhead.

Answer

Store the parameters in a separate encrypted Git repository and use Git submodules.

Answer

Use AWS KMS to encrypt the parameters and include the encrypted blob in the source code.

Answer

Store the parameters in an S3 bucket with server-side encryption, and have the pipeline download them.

Question 15

An organization manages multiple AWS accounts using AWS Organizations. They want to use AWS CloudFormation StackSets to deploy a standard VPC configuration across all accounts. However, some accounts require specific CIDR blocks that differ from the default. What is the most efficient way to handle this variation?

Accepted Answer

Use a single StackSet with parameters and pass account-specific parameter files via AWS CloudFormation parameter overrides in the StackSet instance.. AWS CloudFormation StackSets support parameter overrides at the stack instance level, allowing you to deploy a single StackSet template across multiple accounts while specifying account-specific CIDR blocks without duplicating infrastructure. This approach minimizes management overhead by using one template and one StackSet, with parameter overrides applied per target account or organizational unit (OU) via the StackSet instance configuration.

Answer

Create separate StackSets for each CIDR range and assign accounts accordingly.

Answer

Create a nested stack for each account that overrides the default parameters.

Answer

Maintain separate templates per account with hardcoded CIDR blocks.