DOP-C02 Configuration Management and IaC Practice Test 12 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

Accepted Answer

CloudFormation Change Sets. CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.

Answer

CloudFormation StackSets

Answer

CloudFormation Stack Policies

Answer

CloudFormation Drift Detection

Question 2

A DevOps team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They need to ensure that sensitive configuration parameters such as database passwords are not stored in plaintext in the source code repository. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Systems Manager Parameter Store with secure strings, and reference them in the pipeline using parameter-store action.. Option D is correct because AWS Systems Manager Parameter Store with secure strings provides a native, fully managed service for storing sensitive configuration data like database passwords. By using the parameter-store action in CodePipeline, the pipeline can retrieve the secure parameter at runtime without exposing it in the source code or requiring manual encryption/decryption logic, minimizing operational overhead.

Answer

Store the parameters in a separate encrypted Git repository and use Git submodules.

Answer

Use AWS KMS to encrypt the parameters and include the encrypted blob in the source code.

Answer

Store the parameters in an S3 bucket with server-side encryption, and have the pipeline download them.

Question 3

An organization manages multiple AWS accounts using AWS Organizations. They want to use AWS CloudFormation StackSets to deploy a standard VPC configuration across all accounts. However, some accounts require specific CIDR blocks that differ from the default. What is the most efficient way to handle this variation?

Accepted Answer

Use a single StackSet with parameters and pass account-specific parameter files via AWS CloudFormation parameter overrides in the StackSet instance.. Option C is correct because AWS CloudFormation StackSets support parameter overrides at the stack instance level, allowing you to deploy a single StackSet template across multiple accounts while specifying account-specific CIDR blocks without duplicating infrastructure. This approach minimizes management overhead by using one template and one StackSet, with parameter overrides applied per target account or organizational unit (OU) via the StackSet instance configuration.

Answer

Create separate StackSets for each CIDR range and assign accounts accordingly.

Answer

Create a nested stack for each account that overrides the default parameters.

Answer

Maintain separate templates per account with hardcoded CIDR blocks.

Question 4

A company uses AWS Elastic Beanstalk to deploy a web application. The operations team wants to ensure that the environment's configuration (e.g., instance type, scaling limits) is version-controlled and reproducible. Which practice should they adopt?

Accepted Answer

Use the Elastic Beanstalk saved configuration feature to download a configuration file and store it in version control.. Option B is correct because Elastic Beanstalk's saved configuration feature allows you to download the environment's configuration as a YAML or JSON file, which can be stored in version control and used to recreate identical environments. This directly addresses the need for version-controlled, reproducible environment configuration without requiring additional infrastructure-as-code tools.

Answer

Manually recreate the environment from the Elastic Beanstalk console when needed.

Answer

Use AWS CloudFormation to define the environment and store the template in a Git repository.

Answer

Document the configuration in a wiki and apply it manually through the AWS Management Console.

Question 5

A DevOps engineer is using AWS OpsWorks for configuration management. They need to ensure that custom recipes are applied to all instances in a layer in a specific order. What should the engineer do?

Accepted Answer

Assign the recipes to the appropriate lifecycle events in the layer configuration.. AWS OpsWorks uses lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) to control when custom recipes run on instances within a layer. By assigning recipes to the appropriate lifecycle events in the layer configuration, the engineer ensures they execute in the defined order for that event across all instances in the layer, which is the native mechanism for ordering in OpsWorks.

Answer

Use AWS CloudFormation Init with cfn-init to order the scripts.

Answer

Include all recipes in a single wrapper recipe and use include_recipe with the desired order.

Answer

Add the recipes to the instance's user data script.

Question 6

A company uses AWS CloudFormation to manage infrastructure. They have a production stack that creates an Auto Scaling group. They want to update the launch configuration to use a new Amazon Machine Image (AMI) ID without causing downtime. Which update policy should they set on the Auto Scaling group?

Accepted Answer

AutoScalingRollingUpdate. Option C is correct because the AutoScalingRollingUpdate policy allows CloudFormation to update the Auto Scaling group's launch configuration by gradually replacing instances in batches, ensuring that a minimum number of instances remain in service throughout the update. This prevents downtime by terminating old instances and launching new ones with the updated AMI in a controlled, rolling fashion.

Answer

AutoScalingScheduledAction

Answer

AutoScalingReplacingUpdate

Answer

AutoScalingBatchUpdate

Question 7

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the new instances fail the health check and are terminated. The deployment fails. The team wants to automatically roll back to the previous working version. What should they do?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails.. Option B is correct because AWS CodeDeploy provides a built-in rollback configuration that can be triggered automatically when a deployment fails. By enabling automatic rollback in the deployment group settings, CodeDeploy will redeploy the last successful revision when the current deployment fails health checks, without requiring manual intervention or additional infrastructure.

Answer

Set up an Auto Scaling lifecycle hook to terminate instances and trigger a rollback.

Answer

Manually redeploy the last successful deployment revision after investigating the failure.

Answer

Configure the deployment group to automatically redeploy the same revision on failure.

Question 8

A DevOps engineer needs to manage configuration files across a fleet of Amazon EC2 instances running Amazon Linux. The configuration files must be updated whenever they change in an S3 bucket. Which AWS service is most suitable for this task?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the most suitable service because it provides a configuration management solution that can automatically apply and maintain the desired state of EC2 instances. It can be configured to run associations on a schedule or in response to events, such as changes to an S3 bucket, using an AWS Lambda trigger or EventBridge rule to invoke the association. This ensures that configuration files are updated whenever they change in the S3 bucket, without requiring manual intervention or a full configuration management platform.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS CloudFormation

Answer

AWS Config

Question 9

A company uses AWS CloudFormation with a template that creates an Amazon RDS DB instance. The password for the master user is stored in AWS Secrets Manager. The CloudFormation stack creation fails with the error: 'Value of property MasterUserPassword must be of type String'. How should the DevOps engineer resolve this issue?

Accepted Answer

Use the dynamic reference '{{resolve:secretsmanager:MySecret:SecretString:password}}' in the CloudFormation template.. Option C is correct because CloudFormation supports dynamic references, which allow you to retrieve secret values from AWS Secrets Manager at stack creation time using the syntax `{{resolve:secretsmanager:secret-id:secret-string:json-key}}`. This resolves the password as a plaintext string directly in the template, satisfying the `MasterUserPassword` property's requirement for a String type. Other intrinsic functions like `Ref` or `Fn::GetAtt` return ARNs or metadata, not the secret value itself, and cannot be used directly for this purpose.

Answer

Use the Fn::ImportValue intrinsic function to import the secret value.

Answer

Use the Ref intrinsic function to reference the secret.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the secret value from Secrets Manager.

Question 10

A team uses AWS CodePipeline to orchestrate deployments. They want to integrate a manual approval step before deploying to production. Which action should they take?

Accepted Answer

Add a manual approval action to the pipeline before the production deployment stage.. Option B is correct because AWS CodePipeline natively supports a manual approval action that can be added as a stage before the production deployment. This action pauses the pipeline and sends a notification (via Amazon SNS) to specified approvers, who can then approve or reject the deployment through the AWS Management Console, CLI, or API. No custom code or external services are required.

Answer

Use an AWS Lambda function to send an approval request email and wait for HTTP response.

Answer

Add an Amazon CloudWatch Events rule to pause the pipeline before the production stage.

Answer

Add an Amazon SNS topic to the pipeline and require subscription confirmation.

Question 11

A company is using AWS CloudFormation to manage its infrastructure. The DevOps team wants to implement drift detection to identify resources that have been modified outside of CloudFormation. Which TWO of the following are correct statements about CloudFormation drift detection?

Accepted Answer

Drift detection can detect changes to resources such as security groups.. Drift detection can detect changes to resources such as security groups because CloudFormation supports drift detection for a wide range of AWS resources, including EC2 security groups. When drift detection is performed, CloudFormation compares the current configuration of each supported resource in the stack with the expected configuration defined in the stack template. If a security group rule is added or removed outside of CloudFormation (e.g., via the AWS Console or CLI), drift detection will report that resource as drifted.

Answer

Drift detection is automatically performed every time the stack is updated.

Answer

Drift detection can be performed on nested stacks independently.

Answer

Drift detection automatically reverts any changes to the original template.

Question 12

A DevOps team is using AWS CodeDeploy to deploy a web application. The deployment group consists of an Auto Scaling group with a minimum of 2 instances. They want to ensure high availability during the deployment. Which THREE of the following deployment configurations support zero-downtime deployments?

Accepted Answer

Deployment type: Rolling, with a batch size of 1 and a wait time between batches.. Option A is correct because a rolling deployment with a batch size of 1 and a wait time between batches updates one instance at a time, keeping the remaining instances in service. This ensures that the Auto Scaling group never drops below its minimum capacity, maintaining full availability throughout the deployment process.

Answer

Deployment type: Canary, with 10% traffic shift initially.

Answer

Deployment type: In-place, with a batch size of 50%.

Question 13

A company is adopting Infrastructure as Code (IaC) using AWS CloudFormation. They want to ensure that stack updates are safe and minimize the risk of resource replacement. Which TWO of the following strategies should they use?

Accepted Answer

Always create a change set before executing a stack update.. Creating a change set before executing a stack update allows you to review the proposed changes, including whether any resources will be replaced or interrupted. This provides a safety net by letting you validate the impact of the update before committing, reducing the risk of unintended resource replacement.

Answer

Perform updates directly from the AWS Management Console to see immediate results.

Answer

Delete the stack and create a new one with the updated template.

Answer

Use the --disable-rollback flag to avoid unnecessary rollbacks.

Question 14

A company uses AWS CloudFormation to deploy a three-tier web application. The deployment includes an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The operations team reports that updates to the database security group rules are not being applied correctly during stack updates. The CloudFormation template uses AWS::RDS::DBInstance and AWS::EC2::SecurityGroup resources. What is the most likely cause of this issue?

Accepted Answer

The DBInstance resource has a DeletionPolicy attribute set to 'Retain', causing CloudFormation to skip updates to dependent resources.. Option A is correct because when a DBInstance resource has a DeletionPolicy set to 'Retain', CloudFormation treats the resource as a 'non-updatable' resource during stack updates. This means CloudFormation will not modify the DBInstance or its dependent resources, such as the security group rules, even if the template changes. The 'Retain' policy prevents CloudFormation from replacing or updating the resource, causing updates to associated security group rules to be silently skipped.

Answer

The CloudFormation stack has a stack policy that denies updates to the security group resources.

Answer

The security group rules are defined inline within the AWS::EC2::SecurityGroup resource, and CloudFormation does not update inline rules after initial creation.

Answer

The RDS database is in a VPC that requires a VPC endpoint for CloudFormation to update security groups.

Question 15

A DevOps engineer is troubleshooting an AWS OpsWorks for Chef Automate deployment. The Chef server is configured with a custom run list that includes a recipe to install and configure an application. The test environment works correctly, but in the production environment, the application fails to start. The Chef client logs show that the recipe executed successfully, but the application process is not running. What is the most likely cause of this issue?

Accepted Answer

The IAM instance profile attached to the production EC2 instance does not have the necessary permissions to start the application service.. Option C is correct because the IAM instance profile determines the AWS API permissions available to the EC2 instance. If the profile lacks permissions to call the service startup API (e.g., `ec2:StartInstances` or `autoscaling:CompleteLifecycleAction`), or to access required resources like an EFS mount target or Secrets Manager secret, the Chef recipe's service resource may execute without error but the underlying systemd or init daemon cannot actually start the application process. The Chef client logs only show recipe execution success, not the outcome of the service start, so the application fails silently.

Answer

The OpsWorks stack is configured to use 'auto-healing' which automatically terminates and replaces instances that fail to start the application.

Answer

The Chef server in production is running a different version of Chef than the test environment, causing the recipe to behave differently.

Answer

The Chef recipe does not include a 'service' resource to start the application; it only installs the package.