DOP-C02 Configuration Management and IaC Practice Test 13 — 15 Questions

Question 1

Which TWO actions should a DevOps engineer take to implement a GitFlow branching strategy for infrastructure as code using AWS CodeCommit and CodePipeline? (Choose two.)

Accepted Answer

Use CodeBuild to run unit tests on feature branches before merging.. Options B and D are correct. Option B: CodeBuild can run unit tests on feature branches before merging, ensuring code quality. Option D: Separate pipelines for develop and master branches allow different deployment behaviors (e.g., non-prod vs. prod). Option A is wrong because disabling automatic triggers on the master branch would prevent automated deployments when changes are merged, which is contrary to GitFlow where master deployments are desired. Option C is wrong because a single pipeline for all branches reduces flexibility and can cause unintended deployments. Option E is wrong because CodePipeline does not natively support pull request triggers; use CodeBuild or other services for that.

Answer

Disable automatic triggers on the master branch to prevent accidental deployments.

Answer

Use a single pipeline that handles all branches.

Answer

Configure CodePipeline to trigger on pull request creation.

Question 2

Which THREE actions are best practices for managing secrets in AWS CloudFormation templates? (Choose three.)

Accepted Answer

Use AWS CloudFormation parameters with the NoEcho property set to true.. Setting the NoEcho property to true on a CloudFormation parameter prevents the parameter value from being returned in API calls or displayed in the console, which is a basic mechanism for masking secrets. However, this alone does not encrypt the value at rest or in transit, and the value is still passed as plaintext in the template, so it is considered a best practice only when combined with other secure methods like dynamic references.

Answer

Encrypt the CloudFormation template file with AWS KMS.

Answer

Store secrets as plaintext in the template parameters.

Question 3

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

Accepted Answer

AWS Config. AWS Config continuously monitors and records AWS resource configurations and can detect changes against desired baselines, enabling drift detection through rules and compliance checks. AWS CloudFormation Drift Detection directly compares the current state of a stack's resources with the expected template-defined state to identify configuration drift. Both tools provide native mechanisms to detect when resources deviate from their intended configuration.

Answer

AWS Systems Manager Inventory

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 4

An organization uses AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that all instances have the latest security patches applied automatically. Which action should the team take?

Accepted Answer

Configure a custom Chef recipe in OpsWorks to run 'yum update' on a schedule.. The correct action is to configure a custom Chef recipe in OpsWorks to run 'yum update' on a schedule. OpsWorks uses Chef for configuration management, so a custom recipe can be added to a layer's lifecycle events (e.g., Setup or Configure) or scheduled via a cron job within a recipe to ensure all instances apply the latest security patches automatically. Option B is incorrect because AWS Config rules evaluate compliance but do not perform patching; they require a custom remediation action, which is less direct than OpsWorks' built-in Chef integration. Option C is incorrect because updating the AMI only affects new instances launched from that AMI; running instances are not updated. Option D is incorrect because while AWS Systems Manager Patch Manager can patch instances, OpsWorks does not natively integrate with it; managing patches through OpsWorks' Chef recipes is the more appropriate and direct method for OpsWorks-managed instances.

Answer

Create an AWS Config rule to check for missing patches and trigger an auto-remediation.

Answer

Update the AMI used by the OpsWorks layer to include the latest patches.

Answer

Enable AWS Systems Manager Patch Manager to patch all instances managed by OpsWorks.

Question 5

A company uses AWS CloudFormation to manage infrastructure. The team wants to ensure that all stack updates are reviewed and approved before execution. Which mechanism should the team implement?

Accepted Answer

Use AWS CloudFormation change sets to review the proposed changes before executing the update.. AWS CloudFormation change sets allow you to preview how proposed changes to a stack will be applied before you execute them. This includes a summary of additions, modifications, and deletions of resources, enabling you to review and approve the changes in a controlled manner. By generating a change set, the team can ensure that no update is executed without prior review and approval, meeting the requirement for a gated deployment process.

Answer

Create a stack policy that denies all updates unless approved.

Answer

Use AWS CloudFormation drift detection to identify changes before updating.

Answer

Enable termination protection on the stack to prevent accidental updates.

Question 6

A DevOps engineer needs to deploy a configuration management solution that can manage both Windows and Linux servers across on-premises and AWS environments. The solution must support a Git-based workflow for version control of configurations. Which AWS service should the engineer choose?

Accepted Answer

AWS OpsWorks for Chef Automate. AWS OpsWorks for Chef Automate is the correct choice because it provides a fully managed Chef Automate server that supports configuration management for both Windows and Linux servers across on-premises and AWS environments. Chef uses a Git-based workflow for version control of cookbooks, enabling DevOps teams to store, version, and manage configurations as code in a Git repository.

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 7

A company uses AWS CodeBuild to build and test their application. They want to integrate Infrastructure as Code (IaC) scanning into their build pipeline to detect security misconfigurations in CloudFormation templates before deployment. Which TWO tools or services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to enforce compliance and security best practices on CloudFormation templates. It can be integrated into a CodeBuild pipeline to scan templates for misconfigurations before deployment, making it a correct choice for IaC security scanning.

Answer

AWS Security Hub

Answer

AWS Config

Answer

HashiCorp Terraform

Question 8

A company uses AWS CloudFormation to deploy infrastructure. They want to enforce mandatory tags on all resources created by CloudFormation. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use CloudFormation stack tags that propagate to all resources in the stack.. CloudFormation stack tags propagate to all resources that support tagging within the stack. When you specify tags at the stack level, CloudFormation automatically applies them to each resource it creates, ensuring mandatory tags are enforced without additional configuration.

Answer

Create an AWS Config rule to automatically tag resources after creation.

Answer

Add an IAM policy that denies cloudformation:CreateStack unless the template includes the required tags.

Answer

Enable AWS CloudTrail to log all API calls and monitor for untagged resources.

Question 9

A company uses AWS CloudFormation to deploy a microservices architecture. The Operations team needs to update a stack that contains a Lambda function and an API Gateway REST API. They want to ensure that the Lambda function code is updated without downtime. Which update policy should be used for the Lambda function in the CloudFormation template?

Accepted Answer

Use an UpdateReplacePolicy of 'Snapshot'. UpdateReplacePolicy of 'Snapshot'. This policy is used to take a snapshot of the old Lambda function's code and configuration before it is replaced during a stack update. While this does not directly prevent downtime, it provides a means for quick rollback if needed, and it is the only valid policy among the options that supports an update scenario without resorting to invalid values. Options B and D are not valid values for UpdateReplacePolicy; valid values are Snapshot, Retain, and Delete. Option C (Retain) would keep the old resource, which can cause naming conflicts for Lambda functions because the new function cannot use the same name.

Answer

Use an UpdateReplacePolicy of 'Replace'

Answer

Use an UpdateReplacePolicy of 'Retain'

Answer

Use an UpdateReplacePolicy of 'Rollback'

Question 10

A DevOps engineer is designing a CI/CD pipeline for an application that runs on Amazon ECS. The pipeline should automatically build a Docker image from source code, push it to Amazon ECR, and deploy it to the ECS service. The engineer wants to use AWS CodePipeline with Amazon ECR as a source. Which action provider should be used for the deploy stage?

Accepted Answer

Amazon ECS. Amazon ECS is the correct action provider for the deploy stage when using AWS CodePipeline because it directly integrates with ECS to update an existing ECS service with a new task definition. When Amazon ECR is configured as a source, CodePipeline detects image pushes, and the ECS deploy action automatically triggers a rolling update of the ECS service using the new image, without requiring additional deployment tools.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 11

An organization uses AWS OpsWorks for configuration management. They have a stack with multiple layers, including a PHP application layer and a MySQL database layer. The operations team needs to deploy a custom configuration file to all PHP application instances. How should this be accomplished using OpsWorks?

Accepted Answer

Create a custom cookbook with a recipe that deploys the configuration file, and assign it to the Deploy lifecycle event of the PHP layer.. OpsWorks uses Chef cookbooks to manage configuration. By creating a custom cookbook with a recipe that deploys the configuration file and assigning it to the Deploy lifecycle event of the PHP layer, the recipe runs on all PHP application instances during deployment, ensuring the file is placed correctly. This approach leverages OpsWorks' built-in lifecycle events and Chef's idempotent execution model.

Answer

Use the OpsWorks agent to directly copy the file to each instance via SSH.

Answer

Add the configuration file as a stack-level custom cookbook and assign it to all layers.

Answer

Use a custom JSON attribute in the stack settings to define the file content, and then use a built-in recipe to apply it.

Question 12

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance and an EC2 instance that connects to it. The DB instance has a deletion policy of 'Retain'. The stack fails to delete because the DB instance is retained and still exists. Which TWO actions would allow the stack to be deleted successfully? (Select TWO.)

Accepted Answer

Manually delete the DB instance using the RDS console.. Manually deleting the retained DB instance removes the resource that is blocking the stack deletion. CloudFormation cannot delete a stack that contains a resource with a 'Retain' deletion policy until that resource is manually removed, as the stack expects the resource to no longer exist for the deletion to complete.

Answer

Use the AWS CLI to force delete the stack with the --force option.

Answer

Disable termination protection on the EC2 instance.

Answer

Modify the DB instance to allow deletion by setting DeletionProtection to false.

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The company wants to configure automatic scaling based on CPU utilization. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Set the minimum and maximum number of instances for the auto scaling group.. Elastic Beanstalk uses Auto Scaling groups to manage the EC2 instances for the application. Setting the minimum and maximum number of instances defines the boundaries within which the Auto Scaling group can scale, ensuring the application can handle high traffic during business hours and scale down during low traffic at night.

Answer

Create a CloudWatch alarm that triggers a scaling policy.

Answer

Configure the load balancer health check interval.

Question 14

A company uses AWS CodeCommit to store source code. The development team wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which TWO resources must be configured to accomplish this? (Select TWO.)

Accepted Answer

An Amazon CloudWatch Events rule that listens for CodeCommit pull request events.. AWS CodeBuild supports webhooks only for GitHub and GitHub Enterprise repositories, not for AWS CodeCommit. For CodeCommit, the recommended and native event-driven approach is to use Amazon CloudWatch Events (EventBridge) to capture pull request state changes and target a CodeBuild project directly. Therefore, the resources required are a CloudWatch Events rule (C) and a CodeBuild project (not necessarily with a webhook). Since the only CodeBuild project option (E) incorrectly specifies a webhook, it should not be selected.

Answer

An AWS Lambda function to process the pull request event.

Answer

An AWS CodePipeline pipeline with a source stage for CodeCommit.

Answer

An Amazon Simple Notification Service (SNS) topic to send notifications.

Answer

An AWS CodeBuild project with a webhook configured.

Question 15

A DevOps engineer needs to create an IAM policy that allows a user to start and stop EC2 instances, but only for instances that have a specific tag 'Environment=Production'. The current policy allows all actions on all instances. Which modification must be made to enforce the tag-based restriction?

Accepted Answer

Add a Condition block: "Condition": {"StringEquals": {"ec2:ResourceTag/Environment": "Production"}}. The `ec2:ResourceTag` condition key allows you to restrict actions based on the tags already attached to the EC2 instance. By using `StringEquals` with `ec2:ResourceTag/Environment` set to `Production`, the policy will only permit the `ec2:StartInstances` and `ec2:StopInstances` actions on instances that currently have that tag. This is the standard AWS mechanism for tag-based resource-level authorization in IAM policies.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:PrincipalTag/Environment": "Production"}}

Answer

Change the Action to "ec2:Describe*" and add a NotAction element.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:RequestTag/Environment": "Production"}}