DOP-C02 Configuration Management and IaC Practice Test 11 — 15 Questions

Question 1

A DevOps team is using AWS CloudFormation to manage infrastructure. They want to reuse the same template across multiple environments (dev, test, prod) with minor parameter variations. Which CloudFormation feature should they use to pass environment-specific values without modifying the template?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Parameters. CloudFormation Parameters let you pass environment-specific values (like instance sizes, CIDR ranges, or environment names) into a template at stack creation or update time without modifying the template itself. This is exactly the use case described: one template, multiple environments, different values supplied at deploy time via the console, CLI, or a parameters file.

Answer

Conditions

Answer

Outputs

Answer

Mappings

Question 2

An organization uses AWS Elastic Beanstalk to deploy a web application. They need to ensure that configuration changes (e.g., environment variables, instance types) are version-controlled and can be rolled back. Which approach meets these requirements?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and store the configuration files in a version control system.. Elastic Beanstalk saved configurations allow you to capture the complete environment settings (including environment variables, instance types, and other configuration options) as a YAML or JSON file. By storing these configuration files in a version control system (e.g., Git), you achieve version-controlled configuration that can be applied to recreate or roll back an environment to a known state using the `eb config` command or the AWS Management Console.

Answer

Use AWS Systems Manager Parameter Store to store configuration values.

Answer

Create a custom script that uses the Elastic Beanstalk API to apply configuration and store the script in a Git repository.

Answer

Manually record all configuration changes in a spreadsheet.

Question 3

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture on AWS. They want to use AWS CodeDeploy to deploy applications to an Auto Scaling group. The pipeline must ensure that only a small percentage of instances are updated at a time, and if health checks fail, the deployment is automatically rolled back. Which deployment configuration should be used?

Accepted Answer

In-place deployment with 'CodeDeployDefault.OneAtATime' configuration and automatic rollback enabled.. `CodeDeployDefault.OneAtATime` deploys to one instance at a time, which is the smallest possible batch and satisfies the 'small percentage of instances' requirement. Enabling automatic rollback ensures that if health checks fail, CodeDeploy reverts to the last known good revision, meeting the rollback requirement.

Answer

Blue/green deployment with a fixed number of instances.

Answer

In-place deployment with 'CodeDeployDefault.AllAtOnce' configuration.

Answer

In-place deployment with 'CodeDeployDefault.HalfAtATime' configuration.

Question 4

A company uses AWS OpsWorks for configuration management. They need to automate the installation of a custom package on all instances in a layer. Which OpsWorks feature should they use?

Accepted Answer

Custom Chef recipes associated with lifecycle events. Custom Chef recipes associated with lifecycle events in AWS OpsWorks allow running Chef recipes automatically on instance lifecycle events such as Setup, Configure, Deploy, Undeploy, and Shutdown. This is the correct feature for automating package installation on all instances in a layer. Option A is incorrect because AWS CodeDeploy AppSpec file is used for CodeDeploy deployments, not OpsWorks. Option B is incorrect because AWS CloudFormation custom resources are used to extend CloudFormation templates, not for OpsWorks automation. Option D is incorrect because AWS Systems Manager Run Command is a separate service for managing instances, not OpsWorks.

Answer

AWS CodeDeploy AppSpec file

Answer

AWS CloudFormation custom resources

Answer

AWS Systems Manager Run Command

Question 5

A DevOps engineer needs to manage configuration files for multiple applications across several EC2 instances. The configuration values are sensitive (e.g., database passwords) and must be encrypted at rest and in transit. Which AWS service should be used to store and retrieve these configuration values?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store with the SecureString parameter type uses AWS KMS to encrypt values at rest and enforces TLS for values in transit, making it purpose-built for storing sensitive configuration such as database passwords. It integrates natively with EC2 instance profiles and IAM, so applications can retrieve secrets without embedding credentials in code or AMIs. This is the canonical DOP-C02 answer for encrypted configuration management.

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Question 6

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template needs to reference the secret value dynamically during stack creation. How should the template retrieve the secret?

Accepted Answer

Use a dynamic reference with '{{resolve:secretsmanager:secret-id:secret-string}}' in the template.. CloudFormation dynamic references using the 'resolve:secretsmanager' syntax allow the template to retrieve secret values from AWS Secrets Manager at stack creation time. Option B correctly uses this dynamic reference to pull the password securely. Option A (mapping) cannot retrieve secrets dynamically; it only stores static values. Option C (hardcoding) is insecure and not dynamic. Option D (parameter with default ARN) does not retrieve the secret value; it only passes the ARN string, not the actual secret.

Answer

Use a CloudFormation mapping to store the secret ARN.

Answer

Hardcode the password in the template as a literal string.

Answer

Use a CloudFormation parameter with a default value referencing the secret ARN.

Question 7

A company is using AWS Elastic Beanstalk for a production environment. They have observed that during deployments, the environment's health status intermittently becomes 'Severe' even though the application is functioning correctly. The deployment uses rolling updates with a batch size of 50%. Which TWO configuration changes would improve deployment stability without completely redesigning the deployment process? (Select TWO.)

Accepted Answer

Increase the health check interval to allow more time for the application to stabilize.. Increasing the health check interval gives the application more time to stabilize after an update, reducing false 'Severe' health statuses. Option E is correct because decreasing the batch size to 25% reduces the number of instances updated at once, limiting the blast radius of any issues. Option A (switching to immutable updates) changes the deployment strategy, which may not be desired. Option C (increasing batch size to 75%) increases the number of instances updated simultaneously, worsening stability. Option D (decreasing deployment cooldown time) would shorten the wait between batches, not allowing enough time for the application to stabilize, potentially increasing instability.

Answer

Switch from rolling to immutable updates.

Answer

Increase the batch size to 75%.

Answer

Decrease the deployment cooldown time.

Question 8

A DevOps team is using AWS CodeBuild to run unit tests and package a Java application. They want to cache the Maven local repository (~/.m2) between builds to improve build times. Which TWO steps are necessary to enable caching in CodeBuild? (Select TWO.)

Accepted Answer

Add a 'cache' section in the buildspec file specifying the paths to cache.. To enable caching for the Maven local repository in AWS CodeBuild, two steps are required: (1) Add a `cache` section in the buildspec file specifying the paths to cache (e.g., ~/.m2) — this is option D. (2) Create an S3 bucket to store the cache and configure the CodeBuild project to use that bucket for caching — this is option E. Option A (setting MAVEN_OPTS) is not necessary because the default Maven repository path is already ~/.m2. Option B (uploading as a build artifact) is for saving output artifacts, not for caching. Option C ('Local cache' mode) is a different feature used for Docker layer caching, not for Maven dependencies. Therefore, options D and E are correct.

Answer

Set the MAVEN_OPTS environment variable to use a custom repository path.

Answer

Configure the buildspec to upload the Maven repository as a build artifact.

Answer

Enable 'Local cache' mode in the CodeBuild project.

Question 9

A DevOps engineer creates the IAM policy above for an instance role. The role is attached to an EC2 instance that runs an application. The application starts and stops EC2 instances and reads a database password from Systems Manager Parameter Store. However, the application fails to retrieve the parameter. What is the most likely cause?

Accepted Answer

The parameter is a SecureString and the policy does not grant 'kms:Decrypt' permission for the KMS key.. The policy allows 'ssm:GetParameter' and 'ssm:GetParameters' on the specific parameter ARN. However, to retrieve a parameter, the action 'ssm:GetParameter' is sufficient, but the resource ARN must be correct. The given ARN includes the parameter name '/MyApp/DBPassword'. If the application is using a different path or the parameter is encrypted, the policy might be insufficient. But the most common issue is that the parameter is a SecureString and the policy also needs 'kms:Decrypt' access to the KMS key. Option C is correct because the policy does not include KMS permissions. Option A and B are less likely. Option D is incorrect because the actions are allowed.

Answer

The policy does not allow 'ssm:GetParameterHistory'.

Answer

The policy does not allow 'ec2:DescribeParameters'.

Answer

The policy does not allow 'ssm:GetParameter' on the specific resource.

Question 10

A DevOps team manages a multi-account AWS environment using AWS Organizations. They need to enforce a mandatory tag (e.g., 'CostCenter') on all resources created across accounts. Which combination of services should be used to automatically remediate non-compliant resources?

Accepted Answer

AWS Config rules with automatic remediation using AWS Systems Manager Automation or Lambda.. AWS Config rules continuously evaluate resource configurations against desired tag policies. When a resource is non-compliant, Config can trigger automatic remediation using AWS Systems Manager Automation documents or Lambda functions to add the required tag or stop/delete the resource. This combination provides detection and automated enforcement across all accounts in AWS Organizations.

Answer

AWS Service Control Policies (SCPs) to deny creation of resources without the tag.

Answer

AWS CloudTrail to detect non-compliant resource creation and send notifications.

Answer

AWS Resource Groups & Tag Editor to manually add tags to non-compliant resources.

Question 11

A company uses AWS OpsWorks for configuration management. The operations team needs to apply a configuration change to all instances in a layer without downtime. Which approach should they use?

Accepted Answer

Use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'.. The correct approach is to use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'. This allows applying configuration changes to all instances in the layer without downtime, as OpsWorks executes the recipe on each instance without requiring instance recreation. Option B is incorrect because Auto Scaling lifecycle hooks are used to execute actions during instance launch or termination, not for runtime configuration updates. Option C is incorrect because cloning a layer creates a new layer and does not apply changes to existing instances; switching traffic would involve additional steps and potential downtime. Option D is incorrect because manually SSHing into each instance is error-prone, not scalable, and violates best practices for configuration management.

Answer

Use an Auto Scaling lifecycle hook to apply the change during instance launch.

Answer

Clone the layer and update the clone with the new configuration, then switch traffic.

Answer

SSH into each instance and manually apply the change.

Question 12

A DevOps engineer uses AWS Secrets Manager to rotate database credentials. The rotation fails because the Lambda function used for rotation does not have network access to the database. The database is in a private VPC. How should the engineer fix this?

Accepted Answer

Configure the Lambda function to be VPC-enabled and place it in the same subnet as the database.. The Lambda rotation function must reach the private database, so it needs to run inside the VPC with network access to the database's subnet and security group. Configuring the Lambda function to be VPC-enabled and placing it in the same subnet (or a subnet with routing to the database) allows it to resolve and connect to the private RDS/DB endpoint, fixing the rotation failure.

Answer

Assign a public IP address to the database and update the security group to allow access from the Lambda function.

Answer

Set up a VPC Peering connection between the Lambda service and the VPC.

Answer

Add a NAT Gateway to the VPC to allow Lambda to reach the database.

Question 13

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

Accepted Answer

The webhook in GitHub is not properly configured or has been removed.. The most likely cause is that the webhook in GitHub is not properly configured or has been removed. CodePipeline relies on a webhook to automatically detect changes in the GitHub repository. If the webhook is missing or misconfigured, the pipeline will not trigger on pushes. Option A is incorrect because the pipeline uses the master branch as specified. Option B is incorrect because AWS regions are independent of GitHub; the webhook is not region-specific. Option D is incorrect because pipeline permissions are not required for the webhook to function; the webhook itself is the key mechanism for triggering.

Answer

The pipeline uses a different branch name.

Answer

The GitHub repository is not in the same AWS region as the pipeline.

Answer

The pipeline does not have permission to access the GitHub repository.

Question 14

An organization uses AWS System Manager Patch Manager to patch EC2 instances. The patches are not being applied to some instances. The instances are running Amazon Linux 2 and have the SSM Agent installed. What is the MOST likely reason for the failure?

Accepted Answer

The instances are missing the required IAM role for Systems Manager.. Instances must have an IAM role that grants Systems Manager permissions to manage patches. Without this role, the SSM Agent cannot communicate with the Systems Manager service, preventing patch application. Option A is incorrect because instances can use VPC endpoints (e.g., AWS PrivateLink) to reach Systems Manager without internet access. Option B is incorrect: although an out-of-date SSM Agent can cause issues, the agent auto-updates by default, and the most common cause for patch failures is missing IAM permissions, not an outdated agent. Option D is incorrect because Amazon Linux 2 is a fully supported operating system for Patch Manager.

Answer

The instances do not have internet access to reach the Systems Manager endpoint.

Answer

The SSM Agent is out of date and needs to be updated.

Answer

The instances are not running a supported operating system.

Question 15

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance in us-east-1. What will happen?

Accepted Answer

The action is allowed because StopInstances is explicitly allowed and not denied.. The policy explicitly allows ec2:StopInstances for all resources, and there is no explicit deny for StopInstances. The Deny only applies to TerminateInstances. Option A is incorrect because StopInstances is allowed. Option B is incorrect because the Deny is not ambiguous. Option C is incorrect because there is no condition key about instance state.

Answer

The action is denied because the policy does not explicitly allow stopping an instance that is running.

Answer

The action is denied because the Deny statement is ambiguous and could apply to StopInstances.

Answer

The action is allowed only if the instance is in a stopped state.