DOP-C02 Configuration Management and IaC Practice Test 10 — 15 Questions

Question 1

A company uses AWS CloudFormation StackSets to deploy a VPC with subnets across multiple accounts and regions. Recently, a new account was added to the organization, and the DevOps team wants to deploy the stack set to this new account without affecting existing stacks. The stack set has self-managed permissions. The engineer creates a new stack instance for the account and region, but the operation fails with an 'Access Denied' error when CloudFormation tries to create resources in the new account. The engineer has verified that the stack set's IAM roles exist in the new account. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role in the target account does not grant permissions to the administrator account.. Option A is correct because self-managed permissions require a trust relationship between the administrator and target accounts. Option B is wrong because the roles exist. Option C is wrong because the stack set is already deployed to other accounts, so template is valid. Option D is wrong because service limits would give a different error.

Answer

The stack set template contains a resource that is not supported in the target region.

Answer

The target account has reached a service limit for VPCs.

Answer

The IAM roles in the target account are not named correctly.

Question 2

An organization uses AWS CodeCommit to store CloudFormation templates. They have a requirement that all templates must pass a series of validation checks before being merged to the main branch. The checks include syntax validation, IAM policy linting, and compliance rules. The DevOps team wants to implement this validation using AWS services with minimal operational overhead. They already use AWS CodePipeline for CI/CD. What should the team do?

Accepted Answer

Set up a CodePipeline that is triggered by pull request creation, with a CodeBuild stage to run validation checks, and configure a branch policy to require the pipeline to succeed before merging.. Option D is correct because CodePipeline with CodeBuild can run validation checks on pull requests using a branch policy. Option A is wrong because it requires managing Lambda functions. Option B is wrong because it doesn't integrate with pull request workflow. Option C is wrong because CloudFormation alone cannot enforce pre-merge validation.

Answer

Configure a CloudFormation stack to automatically validate templates and send notifications.

Answer

Create a Lambda function that triggers on CodeCommit events and runs validation.

Answer

Use AWS CloudFormation Guard as a pre-commit hook on local machines.

Question 3

A company manages a fleet of EC2 instances using AWS Systems Manager State Manager. They have a State Manager association that ensures a specific software package is installed on all instances. Recently, they noticed that some instances are reporting the association as 'Success' even though the software is not installed. The association uses a custom document that runs a script to install the package. The engineer checks the association execution history and sees that the script exited with code 0 on those instances. What is the most likely cause?

Accepted Answer

The script does not check the exit code of the installation command and always returns 0.. Option B is correct because the script may exit with code 0 even if installation fails, making State Manager think it succeeded. Option A is wrong because compliance reporting is not the issue. Option C is wrong because the association is running. Option D is wrong because the script ran.

Answer

The association is not targeting those instances.

Answer

The instances are not configured to send compliance data to Systems Manager.

Answer

The instances do not have the SSM Agent installed.

Question 4

A DevOps engineer runs this command to list resources of a CloudFormation stack. The stack status is 'CREATE_COMPLETE'. However, the EC2 instance 'i-0abcd1234efgh5678' was manually terminated by another team. The engineer wants to restore the stack to its intended state without deleting the stack. What should the engineer do?

Accepted Answer

Update the stack with the original template.. Option D is correct because updating the stack with the original template will cause CloudFormation to recreate the terminated instance. Option A is wrong because the stack is not in a failed state. Option B is wrong because creating a new stack would cause duplication. Option C is wrong because the instance is not managed outside the stack.

Answer

Import the terminated instance back into the stack.

Answer

Create a new stack with the same template and delete the old one.

Answer

Perform a stack drift detection and then manually fix the drift.

Question 5

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Amazon ECS. The application uses multiple AWS services including RDS, ElastiCache, and SQS. Which TWO strategies should the team implement to ensure secure and auditable configuration management across environments?

Accepted Answer

Use AWS Secrets Manager to store and rotate database credentials.. Using AWS Secrets Manager for database credentials (B) avoids hardcoding secrets and enables rotation. AWS Config rules (C) ensure resources comply with policies and provide audit trail. Option A (hardcoded) is insecure; D (developer S3 access) violates least privilege; E (manual check) is not scalable.

Answer

Store database credentials in a version-controlled configuration file.

Answer

Manually review configuration changes before deployment.

Answer

Grant developers direct S3 access to upload configuration files.

Question 6

A company manages multiple AWS accounts using AWS Organizations. The DevOps team needs to enforce that all newly created S3 buckets in any account automatically have versioning enabled and are encrypted with SSE-S3. Which THREE steps should the team take to achieve this using Infrastructure as Code and policy-based controls?

Accepted Answer

Create an SCP that denies s3:PutObject if the bucket does not have encryption enabled.. Using a Service Control Policy (SCP) (A) prevents creation of buckets without encryption. AWS Config Rules (B) can remediate non-compliant buckets. CloudFormation StackSets (D) deploy a baseline template to all accounts. Option C (manual) is not scalable; E (CodePipeline only) does not enforce policies.

Answer

Configure AWS CodePipeline to run a script that checks bucket configurations after creation.

Answer

Manually configure each new bucket via the AWS Management Console.

Question 7

A startup uses AWS CloudFormation to manage its infrastructure. The team stores stack templates in an S3 bucket and creates stacks using the AWS CLI. Recently, a developer accidentally deleted a CloudFormation stack, causing a production outage. The team wants to prevent accidental stack deletions while allowing authorized users to delete stacks after approval. What is the MOST effective solution?

Accepted Answer

Apply a Service Control Policy that denies the cloudformation:DeleteStack action.. Using an SCP to deny DeleteStack actions (B) prevents accidental deletion at the account level. Option A (manual) is not automated; C (termination protection) can be disabled; D (IAM policy only) can be bypassed by users with full admin.

Answer

Enable termination protection on the stack.

Answer

Implement a manual review process for all stack deletion requests.

Answer

Use an IAM policy that denies DeleteStack for all users.

Question 8

A company uses AWS OpsWorks for configuration management of a fleet of EC2 instances running a legacy application. The operations team needs to deploy a new version of the application across all instances without causing downtime. The application runs on each instance and requires a rolling update. Which approach should the team use?

Accepted Answer

Use the OpsWorks Deploy command to trigger a rolling update across the stack.. OpsWorks provides rolling updates via the Deploy command (A), which updates instances in batches. Option B (Layers) does not manage updates; C (Auto Scaling) is for scaling, not updates; D (CodeDeploy) is a separate service but OpsWorks is the current tool.

Answer

Use AWS CodeDeploy to perform a blue/green deployment on the existing instances.

Answer

Create a new Auto Scaling group with the updated AMI and terminate old instances.

Answer

Manually update each instance by adding a new layer and reassigning instances.

Question 9

A financial services company uses AWS CloudFormation to deploy a multi-tier application. The security team mandates that all data at rest must be encrypted using KMS CMKs. The CloudFormation template creates an RDS instance with encryption enabled using a KMS key. After deployment, the security team reports that the RDS instance is not using the specified KMS key. The DevOps engineer checks the template and finds the KMS Key ID is correct. What is the MOST likely cause?

Accepted Answer

The RDS instance was created without enabling encryption; encryption cannot be added later.. RDS encryption cannot be enabled after creation (B). The template must set the StorageEncrypted property and the KmsKeyId. If encryption is not enabled at creation, it cannot be added later. Option A (region) is less likely; C (IAM) is irrelevant; D (VPC) is unrelated.

Answer

The KMS key is in a different AWS region.

Answer

The IAM role used by CloudFormation lacks permissions to use the KMS key.

Answer

The RDS instance is inside a VPC that does not have a KMS key policy.

Question 10

A DevOps team manages AWS Lambda functions using the Serverless Application Model (SAM). They need to deploy a new version of a function that requires an increased memory allocation from 128 MB to 256 MB. The team updates the SAM template and runs sam deploy. The deployment succeeds, but the function's memory remains at 128 MB. What is the MOST likely reason?

Accepted Answer

The SAM CLI did not apply the change set because the stack policy does not allow updates to the Lambda function.. The SAM CLI does not automatically update function configuration on an existing stack (C). It uses a change set; if the user does not approve changes or if the stack policy prevents updates, the configuration won't change. Option A (rollback) is not indicated; B (CodeDeploy) is for traffic shifting; D (missing property) would cause an error.

Answer

The deployment triggered a rollback due to a health check failure.

Answer

AWS CodeDeploy is configured to control the update and requires manual approval.

Answer

The sam deploy command requires the --capabilities CAPABILITY_IAM flag to update memory.

Question 11

A large enterprise uses AWS Systems Manager to manage configuration drift on thousands of EC2 instances. The compliance team requires that instances must have a specific security configuration enforced by a Systems Manager State Manager association. The association is configured to run every 30 minutes. However, some instances consistently report a status of 'Failed' in the association compliance dashboard. The instances are running and have the SSM Agent installed. What is the MOST likely cause of the failures?

Accepted Answer

The instances do not have the required IAM instance profile to execute the association document.. State Manager associations require the SSM Agent and appropriate IAM permissions (B). If the instance profile lacks the required permissions, the association will fail. Option A (agent version) would cause a different error; C (timing) is unlikely; D (firewall) would affect communication overall.

Answer

The instances are behind a firewall that blocks communication with the Systems Manager endpoint.

Answer

The association is configured to run at a specific time that conflicts with the instance's maintenance window.

Answer

The SSM Agent version on the instances is outdated and not compatible with the association document.

Question 12

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline has a Source stage (GitHub), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The deployment fails intermittently with the error: 'Bucket does not allow ACLs'. The S3 bucket is configured to use the 'bucket-owner-enforced' setting for Object Ownership. The team wants to resolve the failure while maintaining security best practices. What should the team do?

Accepted Answer

Update the CodeDeploy deployment action to use a bucket policy and disable ACLs.. When Object Ownership is set to bucket-owner-enforced, ACLs are disabled (C). The CodeDeploy action must be configured to use bucket policies instead of ACLs. Option A (remove setting) weakens security; B (public) is insecure; D (CodeBuild) is not the issue.

Answer

Make the S3 bucket publicly accessible to allow CodeDeploy to write objects.

Answer

Add a step in CodeBuild to copy the artifacts to the S3 bucket using the AWS CLI.

Answer

Change the Object Ownership setting to 'ObjectWriter' to enable ACLs.

Question 13

A gaming company uses AWS Elastic Beanstalk to deploy a web application. The operations team needs to update environment configuration variables (e.g., database URL) without causing downtime. They want to change the value of an environment property. What is the CORRECT way to apply this change?

Accepted Answer

Update the environment properties in the Elastic Beanstalk console; the platform will perform a rolling update.. Elastic Beanstalk supports rolling updates for environment configuration changes (B). Updating via the console or CLI triggers a rolling update. Option A (terminate) causes downtime; C (SQS) is not relevant; D (immutable) also causes replacement.

Answer

Terminate the environment and create a new one with the updated configuration.

Answer

Use an immutable update by deploying a new version with the changes.

Answer

Use AWS Lambda to directly modify the environment configuration without redeploying.

Question 14

A company uses AWS CloudFormation to manage its infrastructure. The stack creation recently failed because an IAM role resource was created before the AWS Lambda function that depends on it. The template has no DependsOn clauses. What is the most likely reason for this failure and how can it be fixed?

Accepted Answer

Add a DependsOn clause to the Lambda function resource referencing the IAM role. The most likely reason for the failure is that CloudFormation, by default, parallelizes the creation of resources that do not have explicit dependencies. Since the IAM role and Lambda function have no DependsOn clause, CloudFormation may attempt to create the Lambda function before the IAM role is fully created and its permissions are propagated. Adding a DependsOn clause to the Lambda function resource referencing the IAM role ensures that CloudFormation creates the IAM role first, resolving the dependency and preventing the failure.

Answer

Use AWS Systems Manager Automation to create the resources sequentially

Answer

Use a ChangeSet to roll back the stack and modify the template

Answer

Split the template into two separate stacks and use nested stacks

Question 15

A DevOps engineer is designing a configuration management strategy for a fleet of EC2 instances running Amazon Linux 2. The instances must be bootstrapped with custom software and continuously managed to ensure desired state compliance. Which combination of services should the engineer use?

Accepted Answer

AWS Systems Manager State Manager for desired state configuration and AWS Systems Manager Run Command for initial bootstrapping. Option C is correct because AWS Systems Manager State Manager provides a policy-driven mechanism to define and maintain desired state configuration for EC2 instances, while AWS Systems Manager Run Command enables ad-hoc or initial bootstrapping by executing scripts or commands (e.g., installing custom software) without requiring SSH. Together, they cover both the initial setup and ongoing compliance enforcement for Amazon Linux 2 instances, aligning with the requirement for continuous management.

Answer

AWS CloudFormation for bootstrapping and Amazon CloudWatch Events to enforce desired state

Answer

AWS OpsWorks for Chef Automate for configuration management and AWS CodeDeploy for deployments

Answer

AWS Config for configuration management and Amazon CloudWatch Events for remediation