DOP-C02 Configuration Management and IaC Practice Test 11 — 15 Questions

Question 1

A company uses AWS CodeCommit to store its infrastructure as code templates. The DevOps team wants to automatically validate CloudFormation templates before merging changes to the main branch. Which service should be used to implement this validation?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it can be configured as a pre-merge check in a pull request workflow. By integrating CodeBuild with CodeCommit, the DevOps team can automatically run a build project that validates CloudFormation templates (e.g., using `aws cloudformation validate-template` or `cfn-lint`) before the merge is allowed. This provides a serverless, automated validation step without requiring a full pipeline or deployment.

Answer

AWS CodeDeploy

Answer

AWS CodePipeline

Answer

AWS CodeStar

Question 2

A DevOps engineer is troubleshooting a CloudFormation stack that failed to update. The error message indicates a circular dependency among resources. The template includes an Auto Scaling group, a launch template, and an IAM instance profile. The launch template references the IAM instance profile, and the Auto Scaling group references the launch template. The IAM instance profile's role references the Auto Scaling group name in its trust policy. How can the engineer resolve the circular dependency?

Accepted Answer

Pass the Auto Scaling group name as a parameter to the IAM role's trust policy, and create the Auto Scaling group with a condition that depends on the role. Option B resolves the circular dependency by decoupling the Auto Scaling group name from the IAM role's trust policy at template creation time. By passing the group name as a parameter and using a condition to create the Auto Scaling group only after the role exists, CloudFormation can determine the correct creation order without a circular reference. This approach allows the trust policy to reference a value that is not yet known at template parsing, breaking the dependency cycle.

Answer

Use DependsOn clauses to explicitly order the resource creation

Answer

Place the launch template and Auto Scaling group in a nested stack

Answer

Hardcode the Auto Scaling group name in the IAM role's trust policy

Question 3

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) for its EC2 instances. The DevOps team updates the AMI monthly. What is the most efficient way to update the Elastic Beanstalk environment to use the new AMI?

Accepted Answer

Update the CloudFormation template that manages the environment to reference the new AMI ID, and perform a stack update. Option D is correct because Elastic Beanstalk environments are built on AWS CloudFormation stacks. Updating the CloudFormation template that manages the environment to reference the new AMI ID and performing a stack update triggers a rolling or immutable update that replaces EC2 instances with the new AMI while preserving the environment configuration, DNS name, and other resources. This is the most efficient and supported method for updating the AMI in an existing environment without creating a new one.

Answer

Use the Elastic Beanstalk console to modify the launch configuration's AMI ID

Answer

Create a new Elastic Beanstalk environment with the new AMI and swap the environment URL

Answer

Use the AWS CLI command aws elasticbeanstalk update-environment with the new AMI ID

Question 4

A DevOps engineer is writing an AWS CloudFormation template that creates an Amazon S3 bucket with versioning enabled. The engineer wants to ensure that the bucket cannot be deleted accidentally. What should the engineer add to the template?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource. Setting the DeletionPolicy attribute to Retain on the S3 bucket resource ensures that when the CloudFormation stack is deleted, the bucket is preserved and not removed. This is the correct AWS CloudFormation mechanism to prevent accidental deletion of a resource, as it overrides the default behavior of deleting all resources when a stack is deleted.

Answer

Enable termination protection on the S3 bucket

Answer

Add a DependsOn clause to the bucket referencing the stack itself

Answer

A bucket policy that denies s3:DeleteBucket

Question 5

A company uses AWS CodePipeline to deploy a serverless application with AWS Lambda and Amazon API Gateway. The pipeline includes a beta and a production stage. The DevOps team wants to automatically promote the application from beta to production after successful testing. Which action should be taken in the pipeline?

Accepted Answer

Add a manual approval step between the beta and production stages. Option C is correct because CodePipeline requires an explicit manual approval action to gate promotions between stages. Without a manual approval step, the pipeline would automatically transition from beta to production upon successful testing, which bypasses the necessary human validation for production deployments. Adding a manual approval step ensures that a designated approver reviews the beta stage results before promoting to production, aligning with safe deployment practices.

Answer

Configure a CloudWatch Events rule to automatically trigger the production deployment after beta completion

Answer

Use AWS CodeDeploy to create a deployment group that promotes the application

Answer

Configure an AWS Config rule to automatically approve the promotion

Question 6

A company uses AWS CloudFormation StackSets to deploy a VPC across multiple AWS accounts in AWS Organizations. The StackSet is created with self-managed permissions. The deployment fails in some accounts with the error: 'Insufficient IAM permissions to create resources'. What is the most likely cause of this failure?

Accepted Answer

The execution IAM role is not created in the target accounts. With self-managed permissions in AWS CloudFormation StackSets, the administrator account does not automatically create the necessary IAM roles in target accounts. The execution IAM role must be manually created in each target account to grant StackSets the permissions required to create resources. The error 'Insufficient IAM permissions to create resources' directly indicates that this execution role is missing or lacks the required policies.

Answer

The StackSet does not support deploying to more than one account

Answer

The administrator account does not have a service-linked role for StackSets

Answer

The target accounts have reached their resource service quotas

Question 7

A DevOps engineer is managing the lifecycle of a CloudFormation stack. The engineer needs to update a stack that contains an Auto Scaling group. The update requires a replacement of the Auto Scaling group. What will happen to the existing instances during the update?

Accepted Answer

The existing instances will be terminated after the new Auto Scaling group is created. When a CloudFormation stack update requires replacement of an Auto Scaling group (e.g., due to a change in the `LaunchConfigurationName` or `LaunchTemplate` property), CloudFormation creates the new Auto Scaling group first, then terminates the old instances after the new group is fully operational. This ensures minimal downtime because the new group begins serving traffic before the old one is torn down.

Answer

The stack update will fail because Auto Scaling groups cannot be replaced

Answer

The existing instances will remain running and be associated with the new Auto Scaling group

Answer

The instances will be updated in-place by terminating and recreating each instance one by one

Question 8

A DevOps engineer is writing an AWS CloudFormation template to create a VPC with public and private subnets. The engineer wants to ensure that the private subnets can access the internet through a NAT gateway. Which resources must be included in the template? (Choose TWO.)

Accepted Answer

AWS::EC2::RouteTable. A is correct because an AWS::EC2::RouteTable resource is required to define the routing rules for the private subnets. Specifically, you must create a route table for the private subnets and add a default route (0.0.0.0/0) that points to the NAT gateway, enabling outbound internet traffic from instances in the private subnets while blocking inbound traffic from the internet.

Answer

AWS::EC2::VPNGateway

Answer

AWS::EC2::InternetGateway

Answer

AWS::EC2::VPCEndpoint

Question 9

A company uses AWS CodeCommit as a source repository and AWS CodeBuild for building artifacts. The DevOps team wants to ensure that all commits to the main branch trigger a build. Which steps should be taken? (Choose THREE.)

Accepted Answer

Configure the CodeBuild project to use the CodeCommit repository as the source and specify the main branch. Option A is correct because configuring the CodeBuild project to use the CodeCommit repository as the source and specifying the main branch ensures that CodeBuild knows which repository and branch to monitor for changes. This is the foundational step that links the source code to the build project, enabling automated builds when commits are pushed to the main branch.

Answer

Configure a webhook in the CodeCommit repository to notify CodeBuild

Answer

Use AWS CodeDeploy to trigger the build on commits

Question 10

A DevOps engineer is designing an infrastructure as code solution for a microservices application that runs on Amazon ECS with Fargate. The application requires a shared Application Load Balancer (ALB) and multiple ECS services. Which CloudFormation resources are required to expose each service behind the ALB? (Choose THREE.)

Accepted Answer

AWS::ElasticLoadBalancingV2::Listener. AWS::ElasticLoadBalancingV2::Listener is correct because it defines the protocol and port (e.g., HTTP:80) on which the ALB accepts traffic. Without a listener, the ALB cannot receive incoming requests. This resource is essential for routing traffic to target groups that are associated with ECS services.

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Answer

AWS::AutoScaling::AutoScalingGroup

Question 11

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team notices that stack updates sometimes fail because of resource conflicts. The team wants to prevent concurrent updates to the same stack. What should they do?

Accepted Answer

No action needed; CloudFormation already prevents concurrent stack updates. AWS CloudFormation inherently prevents concurrent updates to the same stack. When an update operation is initiated, CloudFormation places a lock on the stack, rejecting any subsequent update requests until the current operation completes. This behavior is built into the service and requires no additional configuration, making option C correct.

Answer

Use an AWS Organizations service control policy to restrict updates

Answer

Create an IAM policy that denies cloudformation:UpdateStack if a stack update is in progress

Answer

Enable CloudTrail to log all stack update attempts and manually review

Question 12

A DevOps engineer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment'. The engineer checks the logs and finds that the application installation script exits with a non-zero exit code. What should the engineer do to troubleshoot?

Accepted Answer

SSH into one of the failed instances and run the install script manually to identify the error. Option D is correct because the deployment failure is caused by the application installation script exiting with a non-zero exit code, which indicates a specific error in the script or its environment. SSHing into a failed instance and running the install script manually allows the engineer to see the exact error output, debug the script logic, and identify missing dependencies or configuration issues directly on the target host.

Answer

Configure CloudWatch Logs to capture the script output

Answer

Increase the deployment's MinHealthyHosts percentage

Answer

Re-upload the application revision to S3

Question 13

A company is using AWS Elastic Beanstalk with a custom platform. The platform is based on Amazon Linux 2 and includes a pre-installed application. The DevOps team needs to inject environment-specific configuration files into the EC2 instances during deployment. Which approach should be used?

Accepted Answer

Use .ebextensions configuration files in the application source bundle. Option B is correct because .ebextensions configuration files are the native mechanism in Elastic Beanstalk to inject environment-specific configuration into EC2 instances during deployment. These YAML or JSON files, placed in the .ebextensions directory of the application source bundle, are processed by the Elastic Beanstalk platform engine to execute commands, create files, or modify configuration before the application starts, ensuring the custom platform receives the necessary environment-specific settings.

Answer

Use AWS CloudFormation to update the environment with new configuration

Answer

Use EC2 user-data scripts to download configuration from S3

Answer

Store configuration in AWS Systems Manager Parameter Store and retrieve it in the application

Question 14

A DevOps engineer is creating a CloudFormation template that includes an AWS Lambda function. The function code is stored in an S3 bucket. The engineer wants to ensure that the Lambda function is updated whenever the code in S3 changes. What should the engineer do?

Accepted Answer

Reference the S3 object version in the Lambda function's Code property to force an update when the version changes. Option B is correct because referencing the S3 object version in the Lambda function's Code property (e.g., `S3ObjectVersion`) creates a dependency on that specific version. When the S3 object is updated, its version changes, which triggers CloudFormation to detect a change in the template and update the Lambda function during the next stack update. This ensures the function code is refreshed without manual intervention.

Answer

Use AWS CodeDeploy to deploy the Lambda function

Answer

Add a DependsOn clause to the Lambda function resource

Answer

Use AWS CodePipeline to automatically update the stack when the S3 object changes

Question 15

A company uses AWS OpsWorks for configuration management. The DevOps team wants to deploy a new application version to a stack of EC2 instances. What should the team use to perform the deployment?

Accepted Answer

Custom Chef recipes in OpsWorks. AWS OpsWorks is a configuration management service that uses Chef. When you need to deploy a new application version to a stack of EC2 instances managed by OpsWorks, the native and recommended approach is to use custom Chef recipes. These recipes can be executed as a lifecycle event (e.g., Deploy) to update application code, restart services, or perform any deployment tasks directly on the instances, leveraging the existing OpsWorks agent and Chef infrastructure.

Answer

AWS Elastic Beanstalk

Answer

AWS CloudFormation

Answer

AWS CodeDeploy