DOP-C02 Configuration Management and IaC Practice Test 12 — 15 Questions

Question 1

A company uses AWS CodeBuild to compile and test code. The build process requires a specific version of a library that is not available in the default build environment. Which approach should be used to include this library in the build process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom Docker image that includes the library and use it as the build environment in CodeBuild.. Creating a custom Docker image that includes the required library ensures the build environment is consistent, reproducible, and avoids repeated download/compile overhead. AWS CodeBuild supports custom Docker images via the `image` field in the buildspec file or the console, allowing you to specify a repository in Amazon ECR or Docker Hub. This approach aligns with infrastructure-as-code best practices by baking dependencies into the environment rather than managing them at build time.

Answer

Modify the buildspec file to include the library as a build artifact.

Answer

Store the compiled library in an Amazon S3 bucket and download it during the build process using the buildspec file.

Answer

Add an install command in the buildspec file to download and compile the library during each build.

Question 2

Which TWO approaches can be used to manage configuration files (e.g., application.properties) across multiple AWS accounts and regions using AWS Systems Manager? (Select TWO.)

Accepted Answer

Use AWS AppConfig to create, manage, and deploy application configurations across accounts and regions.. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configurations across accounts and regions. It supports staged rollouts, validation, and monitoring, making it suitable for managing configuration files like application.properties in multi-account, multi-region environments.

Answer

Use AWS OpsWorks for Chef Automate to store configuration data in Chef data bags.

Answer

Store configuration files in AWS Secrets Manager and retrieve them using the Secrets Manager API.

Answer

Use AWS Systems Manager Run Command to push configuration files to EC2 instances on demand.

Question 3

Which THREE actions should be taken to ensure that an AWS CloudFormation stack update does not cause downtime for a production application that runs on an Auto Scaling group behind an Application Load Balancer? (Select THREE.)

Accepted Answer

Configure an 'UpdateWaitCondition' in the CloudFormation template to pause the stack update until a healthy signal is received from the new instances.. An 'UpdateWaitCondition' in a CloudFormation template can pause the stack update until a healthy signal is received from the new instances. This ensures that the update proceeds only after the new instances have passed health checks, preventing premature traffic routing and potential downtime.

Answer

Add a custom resource that triggers an AWS Lambda function to take a snapshot of the database before the update.

Answer

Ensure that the Auto Scaling group spans at least three Availability Zones to distribute instances.

Question 4

Which TWO approaches can be used to automate the creation of an AWS CloudFormation stack that includes IAM resources? (Select TWO.)

Accepted Answer

Use an AWS Lambda function to call the CreateStack API with the capabilities parameter set to 'CAPABILITY_IAM'.. When a CloudFormation stack includes IAM resources, you must explicitly acknowledge that the stack may create IAM entities. An AWS Lambda function calling the CreateStack API with the `capabilities` parameter set to `CAPABILITY_IAM` satisfies this requirement. Option E is correct because the AWS CLI `create-stack` command with the `--capabilities CAPABILITY_IAM` parameter also provides the required acknowledgment, allowing the stack to be created successfully.

Answer

Store the CloudFormation template in an Amazon S3 bucket and use the 'aws cloudformation deploy' command.

Answer

Set the 'CAPABILITY_NAMED_IAM' capability when calling the CreateStack API.

Answer

Attach the AWS managed policy 'IAMFullAccess' to the IAM user or role executing the stack creation.

Question 5

An IAM policy is attached to a user who needs to create a CloudFormation stack that provisions an EC2 instance and an S3 bucket. The user receives an 'Access Denied' error when running the 'aws cloudformation create-stack' command. Which additional permission is required?

Accepted Answer

ec2:RunInstances and s3:CreateBucket. To successfully create a CloudFormation stack that provisions an EC2 instance and an S3 bucket, the IAM user must have permissions for the actions that CloudFormation will perform on their behalf. Specifically, ec2:RunInstances and s3:CreateBucket are required in addition to cloudformation:CreateStack. The 'Access Denied' error occurs because the user lacks these resource-level permissions. Notably, the DeletionPolicy attribute (e.g., Retain) only controls behavior when resources are deleted, not during stack creation or updates; it does not affect the permissions required for provisioning.

Answer

s3:PutObject

Answer

cloudformation:DescribeStacks

Answer

iam:PassRole

Question 6

A DevOps engineer attempted to create a CloudFormation stack and it failed. The engineer runs the 'describe-stack-events' command and sees the output above. What is the most likely cause of the failure?

Accepted Answer

The EC2 key pair 'myKeyPair' does not exist in the region where the stack is being created.. The 'describe-stack-events' output shows a 'CREATE_FAILED' event for the EC2 instance resource with the status reason indicating that the key pair 'myKeyPair' was not found. CloudFormation validates the existence of the specified EC2 key pair in the target region at creation time; if the key pair does not exist, the stack creation fails immediately. This is a common validation error when the key pair name is misspelled, belongs to a different region, or has not been created beforehand.

Answer

The AMI ID specified in the template is not available in the region.

Answer

The CloudFormation template has a syntax error in the EC2 instance definition.

Answer

The security group specified for the EC2 instance does not exist.

Question 7

A CloudFormation template snippet is shown. An engineer attempts to create a stack with this template and receives an error: 'Bucket my-unique-bucket-name already exists'. What is the most likely cause?

Accepted Answer

The S3 bucket name 'my-unique-bucket-name' is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts and regions. The error 'Bucket my-unique-bucket-name already exists' indicates that the name is already taken by another AWS account, not that the bucket already exists in the current account. CloudFormation cannot create the bucket because the name is not available in the global S3 namespace.

Answer

The bucket policy has a syntax error that prevents the bucket from being created.

Answer

The versioning configuration is incompatible with the bucket policy.

Answer

The bucket policy references the bucket name incorrectly, causing a circular dependency.

Question 8

A DevOps engineer uses AWS CloudFormation to manage infrastructure. The stack creation fails with the error: 'Circular dependency between resources'. The template includes an EC2 instance, an Elastic IP, and an internet gateway. The instance is associated with the Elastic IP, and the Elastic IP uses the internet gateway for the VPC. Which resource relationship is MOST likely causing the circular dependency?

Accepted Answer

The EC2 instance depends on the Elastic IP, and the Elastic IP depends on the EC2 instance.. The circular dependency arises when the EC2 instance depends on the Elastic IP (via an Association resource) and the Elastic IP depends on the EC2 instance (via the InstanceId property). CloudFormation cannot resolve the creation order when two resources each require the other to exist first. This is a classic circular dependency in CloudFormation templates when using an AWS::EC2::EIP with an InstanceId that references the EC2 instance, while the instance itself has a DependsOn or a reference to the Elastic IP.

Answer

The security group depends on the EC2 instance, and the EC2 instance depends on the security group.

Answer

The Elastic IP depends on the internet gateway, and the internet gateway depends on the Elastic IP.

Answer

The internet gateway depends on the VPC, and the VPC depends on the internet gateway.

Question 9

A DevOps team uses AWS OpsWorks for configuration management. They want to run a custom recipe on all instances in a layer during the setup lifecycle event. What should they do?

Accepted Answer

Assign the custom recipe to the Setup lifecycle event in the layer's Recipes settings.. In AWS OpsWorks, lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) are predefined hooks that run Chef recipes on instances. To run a custom recipe during the Setup event on all instances in a layer, you must assign that recipe to the Setup lifecycle event in the layer's Recipes settings. This ensures the recipe executes automatically when an instance enters the online state after bootstrapping.

Answer

Add the recipe commands to the instance's user data.

Answer

Store the recipe in an S3 bucket and reference it in the stack configuration.

Answer

Define a custom lifecycle event in the stack settings.

Question 10

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails because the new instances cannot connect to the database. The previous deployment succeeded. The DevOps engineer checks the CodeDeploy deployment configuration and finds that the deployment uses the 'CodeDeployDefault.AllAtOnce' configuration. What is the MOST likely cause of the failure?

Accepted Answer

The deployment replaced all instances at once, causing a temporary loss of connectivity if the new application version has incompatible changes.. The 'CodeDeployDefault.AllAtOnce' deployment configuration causes CodeDeploy to attempt to deploy the new application revision to all instances in the Auto Scaling group simultaneously. If the new application version contains incompatible changes—such as a database schema mismatch, altered connection strings, or missing environment variables—all instances will fail at the same time, resulting in a complete loss of connectivity to the database. This contrasts with a rolling or canary deployment, which would limit the blast radius by updating only a subset of instances at a time.

Answer

The load balancer health check is misconfigured, causing new instances to be deregistered.

Answer

The deployment group is not configured to handle traffic routing, causing a routing loop.

Answer

The security group for the Auto Scaling group was updated during deployment, blocking database access.

Question 11

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They need to ensure that the stack can be updated to modify a resource's property that requires replacement. Which CloudFormation stack policy should they use?

Accepted Answer

No stack policy, or a policy that allows updates to all resources.. CloudFormation stack policies are designed to prevent accidental updates to critical resources, not to block updates that require replacement. By default, if no stack policy is applied, all resources can be updated, including those that require replacement. A policy that allows updates to all resources (or no policy) is necessary to permit a stack update that modifies a property requiring resource replacement, as the replacement process involves creating a new resource and deleting the old one, which is a valid update action.

Answer

A stack policy with an AllowAll statement.

Answer

A stack policy with a DenyAll statement.

Answer

A stack policy that explicitly denies updates to the resource.

Question 12

A company is using AWS Elastic Beanstalk with a custom platform. They need to install a third-party agent on all instances. The agent requires a configuration file that contains sensitive credentials. How should the DevOps engineer provide the configuration file to the agent?

Accepted Answer

Use .ebextensions configuration files to download the configuration from a secure S3 bucket using an IAM instance role.. Ebextensions configuration files allow you to run custom commands and scripts during instance provisioning, and by combining this with an IAM instance role that grants read access to a secure S3 bucket, you can securely download the sensitive configuration file without embedding credentials in the source code or user data. This approach follows AWS best practices for handling secrets by avoiding hard-coded credentials and leveraging IAM roles for temporary, scoped access.

Answer

Use instance user data to write the configuration file during instance launch.

Answer

Embed the configuration file in the application source code and deploy it with the application.

Answer

Use AWS Systems Manager Run Command to distribute the configuration file after instances are launched.

Question 13

A DevOps engineer is creating a CloudFormation template to deploy a VPC with public and private subnets. The template uses the 'AWS::EC2::VPC' resource and two 'AWS::EC2::Subnet' resources. The engineer wants to ensure that the subnets are created in different Availability Zones. What is the best approach?

Accepted Answer

Use Fn::GetAZs function with Fn::Select to pick different AZs from the region's AZ list.. Fn::GetAZs returns a list of all Availability Zones in the region, and Fn::Select allows you to pick specific indices from that list, ensuring each subnet is assigned a different AZ. This approach is dynamic and region-agnostic, so the template works across regions without hardcoding AZ names. It also avoids the risk of using the same AZ for both subnets, which would violate the requirement for high availability.

Answer

Use the CidrBlock property to define different AZs.

Answer

Use Fn::GetAZs function with a count of 2 to automatically assign different AZs.

Answer

Hardcode the Availability Zone names in the template.

Question 14

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team needs to deploy a stack that includes a Lambda function and an S3 bucket. The Lambda function's code is stored in the S3 bucket. How can the team ensure that the Lambda function is created after the S3 bucket and the code is uploaded?

Accepted Answer

Use the DependsOn attribute on the Lambda function to depend on the S3 bucket.. The DependsOn attribute explicitly instructs CloudFormation to create the S3 bucket before the Lambda function. Even though CloudFormation automatically determines resource dependencies for certain intrinsic functions, it does not infer dependencies based on code uploads. Using DependsOn ensures the bucket exists and the code is uploaded before the Lambda function is created, preventing a deployment failure when the Lambda references code that is not yet available.

Answer

Upload the code to the S3 bucket before creating the stack.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the bucket name.

Answer

Define the S3 bucket resource before the Lambda function resource in the template.

Question 15

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to enforce a policy that prevents creating S3 buckets with public read access. They plan to use AWS CloudFormation StackSets to deploy a stack across all accounts. What is the BEST way to enforce this policy?

Accepted Answer

Create a service control policy (SCP) in the root organizational unit that denies the s3:PutBucketPublicAccessBlock action.. A service control policy (SCP) applied at the root organizational unit in AWS Organizations can centrally deny the s3:PutBucketPublicAccessBlock action across all accounts, effectively preventing any user or role from disabling the bucket-level public access block settings. This approach works even if an IAM principal has full administrative permissions, as SCPs act as a guardrail that cannot be overridden by account-level policies. It enforces the policy at the organization level without requiring per-account configuration or modifying individual IAM users.

Answer

Use AWS CloudFormation Guard to validate templates before deployment and reject those with public access.

Answer

Create an IAM policy that denies s3:PutBucketAcl and attach it to all IAM users.

Answer

Create an S3 bucket policy in each account that denies public read access.