DOP-C02 Configuration Management and IaC Practice Test 10 — 15 Questions

Question 1

A team uses CloudFormation to deploy a multi-container Docker environment on Amazon ECS. They need to pass environment variables to the containers from Parameter Store. How should they reference these values in the CloudFormation template?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using the 'resolve:ssm' dynamic reference. CloudFormation supports dynamic references using the 'resolve:ssm' prefix to retrieve values from AWS Systems Manager Parameter Store at stack creation or update time. This allows environment variables in an ECS task definition to be populated directly from Parameter Store without hardcoding secrets or using custom Lambda-backed custom resources.

Answer

Using the 'Ref' function with the parameter name

Answer

Using the 'Fn::ParamStore' intrinsic function

Answer

Using 'Fn::GetAtt' on the Parameter Store resource

Question 2

A DevOps engineer is troubleshooting a CloudFormation stack that is in UPDATE_ROLLBACK_FAILED state. The stack attempted to update an Auto Scaling group but failed due to insufficient capacity in the Availability Zone. What is the recommended next step?

Accepted Answer

Use the ContinueUpdateRollback operation to skip the resources that failed. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended next step is to use the ContinueUpdateRollback operation with the 'ResourcesToSkip' parameter to skip the resources that failed during rollback. This allows CloudFormation to complete the rollback of the remaining resources and move the stack to a stable state, after which you can investigate and fix the underlying issue (e.g., insufficient capacity in the AZ) before attempting the update again. Option C directly aligns with AWS documentation for handling this specific stack state.

Answer

Execute a new stack update with the same template

Answer

Manually increase the Auto Scaling group capacity in the affected AZ

Answer

Delete the Auto Scaling group and recreate it

Question 3

A company is designing a CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy. They need to ensure that the pipeline can deploy to multiple environments (dev, test, prod) with manual approval gates. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create separate stages in the pipeline for dev, test, and prod. AWS CodePipeline allows you to define separate stages for each environment (dev, test, prod) within a single pipeline. This enables sequential or parallel deployments with clear separation of concerns, and each stage can have its own actions, such as deployment to a specific CodeDeploy application or environment. Option D is correct because you can add a manual approval action as a stage gate before each environment deployment, ensuring that a human reviewer must explicitly approve the promotion before the pipeline proceeds to the next environment.

Answer

Configure a single pipeline with multiple branches in the source stage

Answer

Use CodeDeploy deployment groups to represent each environment

Answer

Use CodeBuild batch builds to manage environment promotion

Question 4

A DevOps team is using AWS Elastic Beanstalk to deploy a web application. They need to customize the software configuration on the EC2 instances that are part of the Elastic Beanstalk environment. Which THREE methods can they use? (Choose THREE.)

Accepted Answer

Use saved configurations to create reusable environment templates. Saved configurations in Elastic Beanstalk allow you to capture the environment's settings, including custom software configurations, and reuse them as templates for future environments. This enables consistent deployment without manual reconfiguration, directly addressing the need to customize software on EC2 instances.

Answer

Create a custom AMI with the desired configuration

Answer

Use OpsWorks to manage the instances

Question 5

A company uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to ensure that updates to the stack set are rolled out in a controlled manner, with the ability to roll back if errors occur. Which THREE strategies should they implement? (Choose THREE.)

Accepted Answer

Set a failure tolerance to allow a certain number of stack operation failures before the overall operation fails. Option B is correct because StackSets support a failure tolerance parameter that defines how many stack instance operations may fail before the entire stack set operation is considered failed and rolled back, enabling controlled error handling. Option D is correct because region concurrency (MaximumConcurrentPercentage or a specific number of regions) lets you limit how many regions are updated in parallel, reducing blast radius and allowing controlled rollout across regions. Option E is correct because maximum concurrent accounts controls how many accounts within each region are updated simultaneously, which is the primary mechanism for throttling and controlling the pace of stack set updates. Option A is not correct because CloudFormation StackSets do not provide a native canary deployment feature; controlled rollout is achieved through concurrency and failure tolerance settings rather than a built-in canary mode. Option C is not correct because manually pausing stack instances is not a supported StackSets control mechanism; rollback and failure handling are governed by failure tolerance and concurrency parameters, not manual pausing.

Answer

Use a canary deployment strategy by updating only a subset of accounts first

Answer

Pause stack instances manually if errors are detected

Question 6

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. They want to ensure that all instances have a specific software package installed. Which approach should they take?

Accepted Answer

Create a State Manager association with a custom document that installs the package.. AWS Systems Manager State Manager is designed to maintain a consistent configuration state on managed instances. By creating an association with a custom document that installs the required software package, State Manager will apply and re-apply the configuration on a schedule or on instance registration, ensuring the package remains installed.

Answer

Use OpsCenter to create an OpsItem for each instance.

Answer

Use Run Command to execute the installation on all instances.

Answer

Create a Patch Baseline that includes the package.

Question 7

A company is using AWS CodePipeline for CI/CD with CloudFormation as the deployment action. The pipeline fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What is the most likely cause and solution?

Accepted Answer

The CloudFormation API rate limit is being hit; request a limit increase from AWS Support.. The 'Rate exceeded' error is a standard AWS API throttling error, indicating that CloudFormation API requests are being made faster than the account-level or region-level rate limit allows. CodePipeline can trigger multiple concurrent stack operations, especially during parallel stage executions or frequent commits, which can exceed the default CloudFormation API rate limit (e.g., 0.5 requests per second per account per region for CreateStack/UpdateStack). Requesting a limit increase from AWS Support is the correct solution to accommodate higher throughput.

Answer

The stack has a stack policy that prevents updates; modify the stack policy.

Answer

The IAM role used by CloudFormation does not have sufficient permissions; update the role policy.

Answer

The pipeline is exceeding the CodePipeline execution frequency limit; reduce the number of pipeline executions.

Question 8

A developer is writing an AWS CloudFormation template to create an Amazon S3 bucket. The bucket name must be unique across all AWS accounts. Which property should the developer use to ensure the name is unique?

Accepted Answer

Omit the BucketName property so CloudFormation generates a unique name.. Omit the BucketName property so CloudFormation generates a unique name. Amazon S3 bucket names must be globally unique across all AWS accounts. If you specify a custom BucketName, you must ensure its uniqueness yourself, which is error-prone. By omitting BucketName, CloudFormation automatically generates a unique name that includes a random suffix, guaranteeing global uniqueness. Option A (DeletionPolicy) controls what happens when the stack is deleted, not naming. Option B (setting BucketName to a unique value via parameter) still requires manual uniqueness and is not a property that ensures uniqueness automatically. Option C (UpdateReplacePolicy) controls replacement behavior on updates, not naming. Therefore, omitting BucketName is the simplest way to ensure a unique name.

Answer

Use the DeletionPolicy attribute to retain the bucket.

Answer

Set the BucketName property to a unique value using a parameter.

Answer

Use the UpdateReplacePolicy attribute to control replacement.

Question 9

A company uses AWS Elastic Beanstalk to deploy a web application. They want to ensure that configuration changes (e.g., environment variables, instance type) are version-controlled and can be rolled back. Which strategy should they use?

Accepted Answer

Store configuration in a configuration file (e.g., .ebextensions) included with the application source code.. Storing configuration in .ebextensions files (YAML/JSON) within the application source bundle allows version control of environment settings (e.g., environment variables, instance type) alongside the code. When the application is deployed or updated, Elastic Beanstalk applies these configuration files automatically, enabling consistent rollback by redeploying a previous source bundle version. This approach integrates configuration management with the application lifecycle, ensuring that changes are tracked and reversible.

Answer

Use AWS CloudFormation to manage the Beanstalk environment outside of Beanstalk.

Answer

Use Elastic Beanstalk saved configurations to store environment settings.

Answer

Manually change environment configuration using the Elastic Beanstalk console when needed.

Question 10

A DevOps engineer is troubleshooting an AWS CloudFormation stack that failed to create. The error message indicates that a resource 'AWS::Lambda::Function' timed out while being created. The Lambda function code is packaged as a ZIP file in Amazon S3. What is the most likely cause?

Accepted Answer

The Lambda deployment package is very large, causing the S3 download to exceed the resource creation timeout.. AWS CloudFormation has a default timeout for creating resources, and if the Lambda deployment package is very large, downloading it from S3 can exceed that timeout. Option A is incorrect because the Lambda function's timeout setting (e.g., 3 seconds) applies to function execution, not to the creation process; the creation timeout is controlled by CloudFormation. Option B is incorrect because if the execution role lacks permissions to download the ZIP file, it would result in an access denied error, not a timeout. Option D is incorrect because the CloudFormation service role permissions affect stack operations broadly, but they do not directly cause a resource-specific timeout; the timeout here is due to package size.

Answer

The Lambda function has a very short timeout (e.g., 3 seconds) configured in the function properties.

Answer

The Lambda function's execution role does not have permission to download the ZIP file from S3.

Answer

The CloudFormation service role does not have permissions to create Lambda functions.

Question 11

A team is using AWS CodeDeploy to deploy an application to EC2 instances. They want to ensure that if a deployment fails, the instances are automatically rolled back to the previous version. What should they configure?

Accepted Answer

Enable automatic rollback in the deployment group settings.. CodeDeploy supports automatic rollback configuration. When enabled, if a deployment fails, CodeDeploy automatically redeploys the last successful revision. Option A is wrong because a hook is a lifecycle event, not a rollback mechanism. Option B is wrong because a deployment group contains instances but does not have a rollback setting. Option C is wrong because a deployment configuration specifies traffic routing and failure thresholds, not automatic rollback.

Answer

Add a BeforeBlockTraffic hook to the AppSpec file to run a rollback script.

Answer

Set the deployment configuration to 'CodeDeployDefault.OneAtATime' for a gradual deployment.

Answer

Configure the deployment group to use the same Auto Scaling group for rollback.

Question 12

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts. They notice that a stack instance in one account is in a 'FAILED' status because of a permissions issue. After fixing the permissions, what is the most efficient way to retry the stack instance operation?

Accepted Answer

Use the 'Update stack instances' operation for the failed target account.. StackSets allow you to update stack instances individually; you can retry the specific failed instance without affecting others. Option A is wrong because updating the entire stack set would affect all accounts, which is inefficient. Option C is wrong because deleting and recreating the stack instance is disruptive. Option D is wrong because manual stack creation outside StackSets defeats the purpose.

Answer

Manually create the stack in the failed account using the same template.

Answer

Update the entire stack set to retry all stack instances.

Answer

Delete the stack instance from the stack set and add it again.

Question 13

Which TWO are benefits of using AWS CloudFormation for infrastructure as code? (Select TWO.)

Accepted Answer

Enables declarative infrastructure definition.. AWS CloudFormation uses a declarative approach to infrastructure as code, where you define the desired end state of your resources in a template (JSON or YAML), and CloudFormation handles the provisioning and configuration to achieve that state. This contrasts with imperative scripting, where you must specify every step. Declarative definitions reduce complexity and improve reliability by letting the service manage the orchestration.

Answer

Manages both AWS and on-premises resources.

Answer

Provides a graphical interface for designing infrastructure.

Answer

Automatically optimizes resource costs.

Question 14

Which THREE are valid AWS Systems Manager capabilities for configuration management? (Select THREE.)

Accepted Answer

Run Command. Run Command enables you to manage configuration by remotely executing commands on instances. Patch Manager automates the process of patching managed instances. State Manager helps you define and maintain the desired state of your instances. OpsCenter (B) is an operational data hub for viewing and resolving operational issues, not primarily for configuration management. Parameter Store (C) provides secure storage for configuration data and secrets, but it is a supporting service rather than a configuration management capability itself.

Answer

OpsCenter

Answer

Parameter Store

Question 15

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. AWS Organizations can centrally manage accounts, and StackSets can be enabled with trusted access to deploy stacks across accounts. Option D is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts. Option B is incorrect because CloudFormation cannot automatically create new AWS accounts. Option C is incorrect because nested stacks operate within a single stack and cannot deploy resources across different accounts from a single template. Option E is incorrect because cross-stack references only work within the same account and region.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.