DOP-C02 Configuration Management and IaC Practice Test 13 — 15 Questions

Question 1

A DevOps engineer is designing a configuration management strategy for a fleet of EC2 instances running Amazon Linux 2. The instances must be bootstrapped with custom software and continuously managed to ensure desired state compliance. Which combination of services should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Systems Manager State Manager for desired state configuration and AWS Systems Manager Run Command for initial bootstrapping. AWS Systems Manager State Manager provides a policy-driven mechanism to define and maintain desired state configuration for EC2 instances, while AWS Systems Manager Run Command enables ad-hoc or initial bootstrapping by executing scripts or commands (e.g., installing custom software) without requiring SSH. Together, they cover both the initial setup and ongoing compliance enforcement for Amazon Linux 2 instances, aligning with the requirement for continuous management.

Answer

AWS CloudFormation for bootstrapping and Amazon CloudWatch Events to enforce desired state

Answer

AWS OpsWorks for Chef Automate for configuration management and AWS CodeDeploy for deployments

Answer

AWS Config for configuration management and Amazon CloudWatch Events for remediation

Question 2

A company uses AWS CodeCommit to store its infrastructure as code templates. The DevOps team wants to automatically validate CloudFormation templates before merging changes to the main branch. Which service should be used to implement this validation?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it can be configured as a pre-merge check in a pull request workflow. By integrating CodeBuild with CodeCommit, the DevOps team can automatically run a build project that validates CloudFormation templates (e.g., using `aws cloudformation validate-template` or `cfn-lint`) before the merge is allowed. This provides a serverless, automated validation step without requiring a full pipeline or deployment.

Answer

AWS CodeDeploy

Answer

AWS CodePipeline

Answer

AWS CodeStar

Question 3

A company uses AWS CloudFormation StackSets to deploy a VPC across multiple AWS accounts in AWS Organizations. The StackSet is created with self-managed permissions. The deployment fails in some accounts with the error: 'Insufficient IAM permissions to create resources'. What is the most likely cause of this failure?

Accepted Answer

The execution IAM role is not created in the target accounts. With self-managed permissions in AWS CloudFormation StackSets, the administrator account does not automatically create the necessary IAM roles in target accounts. The execution IAM role must be manually created in each target account to grant StackSets the permissions required to create resources. The error 'Insufficient IAM permissions to create resources' directly indicates that this execution role is missing or lacks the required policies.

Answer

The StackSet does not support deploying to more than one account

Answer

The administrator account does not have a service-linked role for StackSets

Answer

The target accounts have reached their resource service quotas

Question 4

A DevOps engineer is managing the lifecycle of a CloudFormation stack. The engineer needs to update a stack that contains an Auto Scaling group. The update requires a replacement of the Auto Scaling group. What will happen to the existing instances during the update?

Accepted Answer

The existing instances will be terminated after the new Auto Scaling group is created. When a CloudFormation stack update requires replacement of an Auto Scaling group (e.g., due to a change in the `LaunchConfigurationName` or `LaunchTemplate` property), CloudFormation creates the new Auto Scaling group first, then terminates the old instances after the new group is fully operational. This ensures minimal downtime because the new group begins serving traffic before the old one is torn down.

Answer

The stack update will fail because Auto Scaling groups cannot be replaced

Answer

The existing instances will remain running and be associated with the new Auto Scaling group

Answer

The instances will be updated in-place by terminating and recreating each instance one by one

Question 5

A DevOps engineer is writing an AWS CloudFormation template to create a VPC with public and private subnets. The engineer wants to ensure that the private subnets can access the internet through a NAT gateway. Which resources must be included in the template? (Choose TWO.)

Accepted Answer

AWS::EC2::RouteTable. A is correct because an AWS::EC2::RouteTable resource is required to define the routing rules for the private subnets. Specifically, you must create a route table for the private subnets and add a default route (0.0.0.0/0) that points to the NAT gateway, enabling outbound internet traffic from instances in the private subnets while blocking inbound traffic from the internet.

Answer

AWS::EC2::VPNGateway

Answer

AWS::EC2::InternetGateway

Answer

AWS::EC2::VPCEndpoint

Question 6

A company uses AWS CodeCommit as a source repository and AWS CodeBuild for building artifacts. The DevOps team wants to ensure that all commits to the main branch trigger a build. Which steps should be taken? (Choose THREE.)

Accepted Answer

Configure the CodeBuild project to use the CodeCommit repository as the source and specify the main branch. Configuring the CodeBuild project to use the CodeCommit repository as the source and specifying the main branch ensures that CodeBuild knows which repository and branch to monitor for changes. This is the foundational step that links the source code to the build project, enabling automated builds when commits are pushed to the main branch.

Answer

Configure a webhook in the CodeCommit repository to notify CodeBuild

Answer

Use AWS CodeDeploy to trigger the build on commits

Question 7

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team notices that stack updates sometimes fail because of resource conflicts. The team wants to prevent concurrent updates to the same stack. What should they do?

Accepted Answer

No action needed; CloudFormation already prevents concurrent stack updates. AWS CloudFormation inherently prevents concurrent updates to the same stack. When an update operation is initiated, CloudFormation places a lock on the stack, rejecting any subsequent update requests until the current operation completes. This behavior is built into the service and requires no additional configuration, making option C correct.

Answer

Use an AWS Organizations service control policy to restrict updates

Answer

Create an IAM policy that denies cloudformation:UpdateStack if a stack update is in progress

Answer

Enable CloudTrail to log all stack update attempts and manually review

Question 8

A DevOps engineer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment'. The engineer checks the logs and finds that the application installation script exits with a non-zero exit code. What should the engineer do to troubleshoot?

Accepted Answer

SSH into one of the failed instances and run the install script manually to identify the error. The deployment failure is caused by the application installation script exiting with a non-zero exit code, which indicates a specific error in the script or its environment. SSHing into a failed instance and running the install script manually allows the engineer to see the exact error output, debug the script logic, and identify missing dependencies or configuration issues directly on the target host.

Answer

Configure CloudWatch Logs to capture the script output

Answer

Increase the deployment's MinHealthyHosts percentage

Answer

Re-upload the application revision to S3

Question 9

A company is using AWS Elastic Beanstalk with a custom platform. The platform is based on Amazon Linux 2 and includes a pre-installed application. The DevOps team needs to inject environment-specific configuration files into the EC2 instances during deployment. Which approach should be used?

Accepted Answer

Use .ebextensions configuration files in the application source bundle. Ebextensions configuration files are the native mechanism in Elastic Beanstalk to inject environment-specific configuration into EC2 instances during deployment. These YAML or JSON files, placed in the .ebextensions directory of the application source bundle, are processed by the Elastic Beanstalk platform engine to execute commands, create files, or modify configuration before the application starts, ensuring the custom platform receives the necessary environment-specific settings.

Answer

Use AWS CloudFormation to update the environment with new configuration

Answer

Use EC2 user-data scripts to download configuration from S3

Answer

Store configuration in AWS Systems Manager Parameter Store and retrieve it in the application

Question 10

A DevOps engineer is creating a CloudFormation template that includes an AWS Lambda function. The function code is stored in an S3 bucket. The engineer wants to ensure that the Lambda function is updated whenever the code in S3 changes. What should the engineer do?

Accepted Answer

Reference the S3 object version in the Lambda function's Code property to force an update when the version changes. Referencing the S3 object version in the Lambda function's Code property (e.g., `S3ObjectVersion`) creates a dependency on that specific version. When the S3 object is updated, its version changes, which triggers CloudFormation to detect a change in the template and update the Lambda function during the next stack update. This ensures the function code is refreshed without manual intervention.

Answer

Use AWS CodeDeploy to deploy the Lambda function

Answer

Add a DependsOn clause to the Lambda function resource

Answer

Use AWS CodePipeline to automatically update the stack when the S3 object changes

Question 11

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

Accepted Answer

CloudFormation Change Sets. CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.

Answer

CloudFormation StackSets

Answer

CloudFormation Stack Policies

Answer

CloudFormation Drift Detection

Question 12

A DevOps team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They need to ensure that sensitive configuration parameters such as database passwords are not stored in plaintext in the source code repository. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Systems Manager Parameter Store with secure strings, and reference them in the pipeline using parameter-store action.. AWS Systems Manager Parameter Store with secure strings provides a native, fully managed service for storing sensitive configuration data like database passwords. By using the parameter-store action in CodePipeline, the pipeline can retrieve the secure parameter at runtime without exposing it in the source code or requiring manual encryption/decryption logic, minimizing operational overhead.

Answer

Store the parameters in a separate encrypted Git repository and use Git submodules.

Answer

Use AWS KMS to encrypt the parameters and include the encrypted blob in the source code.

Answer

Store the parameters in an S3 bucket with server-side encryption, and have the pipeline download them.

Question 13

An organization manages multiple AWS accounts using AWS Organizations. They want to use AWS CloudFormation StackSets to deploy a standard VPC configuration across all accounts. However, some accounts require specific CIDR blocks that differ from the default. What is the most efficient way to handle this variation?

Accepted Answer

Use a single StackSet with parameters and pass account-specific parameter files via AWS CloudFormation parameter overrides in the StackSet instance.. AWS CloudFormation StackSets support parameter overrides at the stack instance level, allowing you to deploy a single StackSet template across multiple accounts while specifying account-specific CIDR blocks without duplicating infrastructure. This approach minimizes management overhead by using one template and one StackSet, with parameter overrides applied per target account or organizational unit (OU) via the StackSet instance configuration.

Answer

Create separate StackSets for each CIDR range and assign accounts accordingly.

Answer

Create a nested stack for each account that overrides the default parameters.

Answer

Maintain separate templates per account with hardcoded CIDR blocks.

Question 14

A company uses AWS Elastic Beanstalk to deploy a web application. The operations team wants to ensure that the environment's configuration (e.g., instance type, scaling limits) is version-controlled and reproducible. Which practice should they adopt?

Accepted Answer

Use the Elastic Beanstalk saved configuration feature to download a configuration file and store it in version control.. Elastic Beanstalk's saved configuration feature allows you to download the environment's configuration as a YAML or JSON file, which can be stored in version control and used to recreate identical environments. This directly addresses the need for version-controlled, reproducible environment configuration without requiring additional infrastructure-as-code tools.

Answer

Manually recreate the environment from the Elastic Beanstalk console when needed.

Answer

Use AWS CloudFormation to define the environment and store the template in a Git repository.

Answer

Document the configuration in a wiki and apply it manually through the AWS Management Console.

Question 15

A DevOps engineer is using AWS OpsWorks for configuration management. They need to ensure that custom recipes are applied to all instances in a layer in a specific order. What should the engineer do?

Accepted Answer

Assign the recipes to the appropriate lifecycle events in the layer configuration.. AWS OpsWorks uses lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) to control when custom recipes run on instances within a layer. By assigning recipes to the appropriate lifecycle events in the layer configuration, the engineer ensures they execute in the defined order for that event across all instances in the layer, which is the native mechanism for ordering in OpsWorks.

Answer

Use AWS CloudFormation Init with cfn-init to order the scripts.

Answer

Include all recipes in a single wrapper recipe and use include_recipe with the desired order.

Answer

Add the recipes to the instance's user data script.