DOP-C02 Configuration Management and IaC Practice Test 11 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The operations team wants to ensure that the environment's configuration (e.g., instance type, scaling limits) is version-controlled and reproducible. Which practice should they adopt?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Elastic Beanstalk saved configuration feature to download a configuration file and store it in version control.. Elastic Beanstalk's saved configuration feature allows you to download the environment's configuration as a YAML or JSON file, which can be stored in version control and used to recreate identical environments. This directly addresses the need for version-controlled, reproducible environment configuration without requiring additional infrastructure-as-code tools.

Answer

Manually recreate the environment from the Elastic Beanstalk console when needed.

Answer

Use AWS CloudFormation to define the environment and store the template in a Git repository.

Answer

Document the configuration in a wiki and apply it manually through the AWS Management Console.

Question 2

A DevOps engineer is using AWS OpsWorks for configuration management. They need to ensure that custom recipes are applied to all instances in a layer in a specific order. What should the engineer do?

Accepted Answer

Assign the recipes to the appropriate lifecycle events in the layer configuration.. AWS OpsWorks uses lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) to control when custom recipes run on instances within a layer. By assigning recipes to the appropriate lifecycle events in the layer configuration, the engineer ensures they execute in the defined order for that event across all instances in the layer, which is the native mechanism for ordering in OpsWorks.

Answer

Use AWS CloudFormation Init with cfn-init to order the scripts.

Answer

Include all recipes in a single wrapper recipe and use include_recipe with the desired order.

Answer

Add the recipes to the instance's user data script.

Question 3

A company uses AWS CloudFormation to manage infrastructure. They have a production stack that creates an Auto Scaling group. They want to update the launch configuration to use a new Amazon Machine Image (AMI) ID without causing downtime. Which update policy should they set on the Auto Scaling group?

Accepted Answer

AutoScalingRollingUpdate. The AutoScalingRollingUpdate policy allows CloudFormation to update the Auto Scaling group's launch configuration by gradually replacing instances in batches, ensuring that a minimum number of instances remain in service throughout the update. This prevents downtime by terminating old instances and launching new ones with the updated AMI in a controlled, rolling fashion.

Answer

AutoScalingScheduledAction

Answer

AutoScalingReplacingUpdate

Answer

AutoScalingBatchUpdate

Question 4

A DevOps engineer needs to manage configuration files across a fleet of Amazon EC2 instances running Amazon Linux. The configuration files must be updated whenever they change in an S3 bucket. Which AWS service is most suitable for this task?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the most suitable service because it provides a configuration management solution that can automatically apply and maintain the desired state of EC2 instances. It can be configured to run associations on a schedule or in response to events, such as changes to an S3 bucket, using an AWS Lambda trigger or EventBridge rule to invoke the association. This ensures that configuration files are updated whenever they change in the S3 bucket, without requiring manual intervention or a full configuration management platform.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS CloudFormation

Answer

AWS Config

Question 5

A company uses AWS CloudFormation with a template that creates an Amazon RDS DB instance. The password for the master user is stored in AWS Secrets Manager. The CloudFormation stack creation fails with the error: 'Value of property MasterUserPassword must be of type String'. How should the DevOps engineer resolve this issue?

Accepted Answer

Use the dynamic reference '{{resolve:secretsmanager:MySecret:SecretString:password}}' in the CloudFormation template.. CloudFormation supports dynamic references, which allow you to retrieve secret values from AWS Secrets Manager at stack creation time using the syntax `{{resolve:secretsmanager:secret-id:secret-string:json-key}}`. This resolves the password as a plaintext string directly in the template, satisfying the `MasterUserPassword` property's requirement for a String type. Other intrinsic functions like `Ref` or `Fn::GetAtt` return ARNs or metadata, not the secret value itself, and cannot be used directly for this purpose.

Answer

Use the Fn::ImportValue intrinsic function to import the secret value.

Answer

Use the Ref intrinsic function to reference the secret.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the secret value from Secrets Manager.

Question 6

A team uses AWS CodePipeline to orchestrate deployments. They want to integrate a manual approval step before deploying to production. Which action should they take?

Accepted Answer

Add a manual approval action to the pipeline before the production deployment stage.. AWS CodePipeline natively supports a manual approval action that can be added as a stage before the production deployment. This action pauses the pipeline and sends a notification (via Amazon SNS) to specified approvers, who can then approve or reject the deployment through the AWS Management Console, CLI, or API. No custom code or external services are required.

Answer

Use an AWS Lambda function to send an approval request email and wait for HTTP response.

Answer

Add an Amazon CloudWatch Events rule to pause the pipeline before the production stage.

Answer

Add an Amazon SNS topic to the pipeline and require subscription confirmation.

Question 7

A company is using AWS CloudFormation to manage its infrastructure. The DevOps team wants to implement drift detection to identify resources that have been modified outside of CloudFormation. Which TWO of the following are correct statements about CloudFormation drift detection?

Accepted Answer

Drift detection can detect changes to resources such as security groups.. Drift detection can detect changes to resources such as security groups because CloudFormation supports drift detection for a wide range of AWS resources, including EC2 security groups. When drift detection is performed, CloudFormation compares the current configuration of each supported resource in the stack with the expected configuration defined in the stack template. If a security group rule is added or removed outside of CloudFormation (e.g., via the AWS Console or CLI), drift detection will report that resource as drifted.

Answer

Drift detection is automatically performed every time the stack is updated.

Answer

Drift detection can be performed on nested stacks independently.

Answer

Drift detection automatically reverts any changes to the original template.

Question 8

A DevOps team is using AWS CodeDeploy to deploy a web application. The deployment group consists of an Auto Scaling group with a minimum of 2 instances. They want to ensure high availability during the deployment. Which THREE of the following deployment configurations support zero-downtime deployments?

Accepted Answer

Deployment type: Rolling, with a batch size of 1 and a wait time between batches.. A rolling deployment with a batch size of 1 and a wait time between batches updates one instance at a time, keeping the remaining instances in service. This ensures that the Auto Scaling group never drops below its minimum capacity, maintaining full availability throughout the deployment process.

Answer

Deployment type: Canary, with 10% traffic shift initially.

Answer

Deployment type: In-place, with a batch size of 50%.

Question 9

A company is adopting Infrastructure as Code (IaC) using AWS CloudFormation. They want to ensure that stack updates are safe and minimize the risk of resource replacement. Which TWO of the following strategies should they use?

Accepted Answer

Always create a change set before executing a stack update.. Creating a change set before executing a stack update allows you to review the proposed changes, including whether any resources will be replaced or interrupted. This provides a safety net by letting you validate the impact of the update before committing, reducing the risk of unintended resource replacement.

Answer

Perform updates directly from the AWS Management Console to see immediate results.

Answer

Delete the stack and create a new one with the updated template.

Answer

Use the --disable-rollback flag to avoid unnecessary rollbacks.

Question 10

A company uses AWS CloudFormation to deploy a three-tier web application. The deployment includes an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The operations team reports that updates to the database security group rules are not being applied correctly during stack updates. The CloudFormation template uses AWS::RDS::DBInstance and AWS::EC2::SecurityGroup resources. What is the most likely cause of this issue?

Accepted Answer

The DBInstance resource has a DeletionPolicy attribute set to 'Retain', causing CloudFormation to skip updates to dependent resources.. When a DBInstance resource has a DeletionPolicy set to 'Retain', CloudFormation treats the resource as a 'non-updatable' resource during stack updates. This means CloudFormation will not modify the DBInstance or its dependent resources, such as the security group rules, even if the template changes. The 'Retain' policy prevents CloudFormation from replacing or updating the resource, causing updates to associated security group rules to be silently skipped.

Answer

The CloudFormation stack has a stack policy that denies updates to the security group resources.

Answer

The security group rules are defined inline within the AWS::EC2::SecurityGroup resource, and CloudFormation does not update inline rules after initial creation.

Answer

The RDS database is in a VPC that requires a VPC endpoint for CloudFormation to update security groups.

Question 11

A company is using AWS Elastic Beanstalk to deploy a web application. The development team wants to ensure that environment variables are set consistently across all environments (development, staging, production) without manual intervention. Which AWS service or feature should be used to manage these environment variables?

Accepted Answer

Elastic Beanstalk environment properties. Elastic Beanstalk environment properties can be defined in configuration files (e.g., .ebextensions) that are deployed with the application, ensuring consistent environment variables across all environments without manual intervention. Option C is incorrect because AWS Systems Manager Parameter Store, while capable of storing configuration, requires additional setup in the application code to retrieve parameters at runtime, making it less direct for Elastic Beanstalk environments. Option A is incorrect because CloudFormation templates with parameters are for infrastructure provisioning, not runtime environment variables. Option D is incorrect because AWS CodeDeploy is for deployment automation, not managing environment variables.

Answer

AWS CloudFormation templates with parameters

Answer

AWS Systems Manager Parameter Store

Answer

AWS CodeDeploy environment variables

Question 12

An organization uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon S3 bucket with a bucket policy that restricts access to a specific IAM role. During a recent security audit, it was discovered that the bucket policy was modified manually via the AWS Management Console, and the change was not reflected in the CloudFormation template. The security team wants to detect and remediate such drift automatically. Which combination of steps should be taken to achieve this?

Accepted Answer

Enable drift detection on the CloudFormation stack and use Amazon EventBridge to trigger an AWS Lambda function that restores the original bucket policy when drift is detected.. It directly addresses the requirement to both detect and automatically remediate drift in a CloudFormation-managed S3 bucket policy. CloudFormation drift detection identifies manual changes to the bucket policy, and Amazon EventBridge can trigger an AWS Lambda function that uses the CloudFormation UpdateStack API to restore the original policy from the template, ensuring the infrastructure remains in sync with the IaC definition.

Answer

Use AWS CloudTrail to monitor PutBucketPolicy events and send alerts to the security team via Amazon SNS.

Answer

Create an AWS Config rule to check if the bucket policy matches the desired policy, and use an AWS Lambda function to automatically correct any noncompliant buckets.

Answer

Configure S3 event notifications to invoke an AWS Lambda function whenever the bucket policy is modified.

Question 13

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The operations team needs to run a script on all instances that are missing a specific security patch. Which Systems Manager capability should be used to accomplish this?

Accepted Answer

Run Command. Run Command is the Systems Manager capability designed for executing commands or scripts on one or more EC2 instances immediately. This fits the scenario of running a script on all instances missing a specific security patch. State Manager is intended for defining and maintaining a desired state over time via associations, which is not implied by the question. While State Manager can run a script, Run Command is the more direct and appropriate choice for a one-time script execution.

Answer

Automation

Answer

State Manager

Answer

Patch Manager

Question 14

A company uses AWS CloudFormation to manage its infrastructure. The CloudFormation template includes a custom resource backed by an AWS Lambda function that validates a condition and returns a value. During a stack update, the custom resource fails, and the stack rolls back. The DevOps engineer needs to debug the issue. Which steps should be taken to troubleshoot the custom resource failure?

Accepted Answer

View the Amazon CloudWatch Logs log group for the Lambda function to see the function's output and error messages.. AWS Lambda functions invoked by CloudFormation custom resources automatically send their logs to Amazon CloudWatch Logs. By examining the log group named `/aws/lambda/<function-name>`, the DevOps engineer can view the function's `stdout`, `stderr`, and any `print()` or `console.log()` statements, which will contain the exact error messages or return values that caused the custom resource to fail. This is the most direct and reliable method to debug the failure without modifying the stack or waiting for a new update.

Answer

Update the Lambda function code to include additional logging and then re-execute the stack update.

Answer

Check the Amazon S3 bucket where the Lambda function code is stored for any access denied errors.

Answer

Review the CloudFormation stack events in the AWS Management Console for detailed error messages from the Lambda function.

Question 15

An organization uses AWS Elastic Beanstalk to deploy a Node.js application. The application requires access to an Amazon RDS database. The database credentials are stored in AWS Secrets Manager. How should the Elastic Beanstalk environment be configured to securely retrieve the database credentials at runtime?

Accepted Answer

Modify the EC2 instance profile of the Elastic Beanstalk environment to grant read access to the Secrets Manager secret, and use the AWS CLI in the application code to retrieve the secret.. The correct approach is to grant the EC2 instance profile permissions to read the Secrets Manager secret, and then have the application retrieve the secret at runtime using the AWS CLI or SDK. This avoids hardcoding credentials and supports dynamic retrieval, including secret rotation. Option C is flawed because .ebextensions option settings are static and cannot fetch secrets; scripts can fetch secrets but they run at deployment time, not at runtime, and cannot update environment variables dynamically for rotated secrets.

Answer

In the Elastic Beanstalk environment properties, set the database password to the ARN of the secret in Secrets Manager.

Answer

Configure the Elastic Beanstalk environment to use the Amazon RDS integration feature, and select the option to retrieve credentials from Secrets Manager in the environment's software configuration.

Answer

Use a configuration file (.ebextensions) to define an option setting that retrieves the secret from Secrets Manager and sets it as an environment variable.