DOP-C02 Configuration Management and IaC Practice Test 13 — 15 Questions

Question 1

A company is using AWS Elastic Beanstalk to deploy a web application. The development team wants to ensure that environment variables are set consistently across all environments (development, staging, production) without manual intervention. Which AWS service or feature should be used to manage these environment variables?

Accepted Answer

AWS Systems Manager Parameter Store. Option B is correct because AWS Systems Manager Parameter Store can store configuration data securely and Elastic Beanstalk can retrieve it during environment creation or update. Option A is incorrect because CloudFormation is for infrastructure provisioning, not runtime configuration management. Option C is incorrect because Elastic Beanstalk environment properties are environment-specific and not shared across environments. Option D is incorrect because CodeDeploy is for deployment automation, not configuration management.

Answer

AWS CloudFormation templates with parameters

Answer

Elastic Beanstalk environment properties

Answer

AWS CodeDeploy environment variables

Question 2

An organization uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon S3 bucket with a bucket policy that restricts access to a specific IAM role. During a recent security audit, it was discovered that the bucket policy was modified manually via the AWS Management Console, and the change was not reflected in the CloudFormation template. The security team wants to detect and remediate such drift automatically. Which combination of steps should be taken to achieve this?

Accepted Answer

Enable drift detection on the CloudFormation stack and use Amazon EventBridge to trigger an AWS Lambda function that restores the original bucket policy when drift is detected.. Option D is correct because it directly addresses the requirement to both detect and automatically remediate drift in a CloudFormation-managed S3 bucket policy. CloudFormation drift detection identifies manual changes to the bucket policy, and Amazon EventBridge can trigger an AWS Lambda function that uses the CloudFormation UpdateStack API to restore the original policy from the template, ensuring the infrastructure remains in sync with the IaC definition.

Answer

Use AWS CloudTrail to monitor PutBucketPolicy events and send alerts to the security team via Amazon SNS.

Answer

Create an AWS Config rule to check if the bucket policy matches the desired policy, and use an AWS Lambda function to automatically correct any noncompliant buckets.

Answer

Configure S3 event notifications to invoke an AWS Lambda function whenever the bucket policy is modified.

Question 3

A DevOps team is using AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The team wants to add a manual approval step before the deploy stage to ensure that only authorized personnel can approve production deployments. Which action should be taken to implement this requirement?

Accepted Answer

Add a manual approval action to the pipeline between the build and deploy stages, and configure the SNS topic to notify the approvers.. Option D is correct because AWS CodePipeline natively supports a manual approval action that can be inserted as a stage between build and deploy. This action pauses the pipeline and sends a notification via an SNS topic to the configured approvers. The pipeline only resumes when an authorized user clicks the 'Approve' button in the CodePipeline console or API, ensuring that only authorized personnel can approve production deployments.

Answer

Add an AWS Lambda function as a transition action between the build and deploy stages that sends an email to the approver and waits for a response.

Answer

Create a CodeDeploy deployment group with a manual approval step in the deployment configuration.

Answer

Configure an Amazon SNS topic to send an approval request email to the approver, and use a Lambda function to resume the pipeline upon approval.

Question 4

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The operations team needs to run a script on all instances that are missing a specific security patch. Which Systems Manager capability should be used to accomplish this?

Accepted Answer

State Manager. State Manager is the correct capability because it is designed to maintain consistent configuration of EC2 instances by defining and enforcing a desired state. In this scenario, the operations team needs to ensure that all instances missing a specific security patch are brought into compliance, which is a classic desired-state management task. State Manager uses associations to define the desired state (e.g., a script to apply the patch) and automatically enforces it on a schedule or on-demand, making it ideal for ensuring all instances eventually reach the patched state.

Answer

Automation

Answer

Run Command

Answer

Patch Manager

Question 5

A company uses AWS CloudFormation to manage its infrastructure. The CloudFormation template includes a custom resource backed by an AWS Lambda function that validates a condition and returns a value. During a stack update, the custom resource fails, and the stack rolls back. The DevOps engineer needs to debug the issue. Which steps should be taken to troubleshoot the custom resource failure?

Accepted Answer

View the Amazon CloudWatch Logs log group for the Lambda function to see the function's output and error messages.. Option A is correct because AWS Lambda functions invoked by CloudFormation custom resources automatically send their logs to Amazon CloudWatch Logs. By examining the log group named `/aws/lambda/<function-name>`, the DevOps engineer can view the function's `stdout`, `stderr`, and any `print()` or `console.log()` statements, which will contain the exact error messages or return values that caused the custom resource to fail. This is the most direct and reliable method to debug the failure without modifying the stack or waiting for a new update.

Answer

Update the Lambda function code to include additional logging and then re-execute the stack update.

Answer

Check the Amazon S3 bucket where the Lambda function code is stored for any access denied errors.

Answer

Review the CloudFormation stack events in the AWS Management Console for detailed error messages from the Lambda function.

Question 6

An organization uses AWS Elastic Beanstalk to deploy a Node.js application. The application requires access to an Amazon RDS database. The database credentials are stored in AWS Secrets Manager. How should the Elastic Beanstalk environment be configured to securely retrieve the database credentials at runtime?

Accepted Answer

Use a configuration file (.ebextensions) to define an option setting that retrieves the secret from Secrets Manager and sets it as an environment variable.. Option C is correct because it uses an .ebextensions configuration file to define a command or script that retrieves the secret from AWS Secrets Manager at deployment time and sets it as an environment variable. This approach ensures the secret is fetched securely via the AWS SDK or CLI, using the instance profile for permissions, and avoids hardcoding credentials in environment properties or application code. It aligns with AWS best practices for dynamic secret retrieval in Elastic Beanstalk.

Answer

In the Elastic Beanstalk environment properties, set the database password to the ARN of the secret in Secrets Manager.

Answer

Configure the Elastic Beanstalk environment to use the Amazon RDS integration feature, and select the option to retrieve credentials from Secrets Manager in the environment's software configuration.

Answer

Modify the EC2 instance profile of the Elastic Beanstalk environment to grant read access to the Secrets Manager secret, and use the AWS CLI in the application code to retrieve the secret.

Question 7

A company uses AWS CodeBuild to compile and test code. The build process requires a specific version of a library that is not available in the default build environment. Which approach should be used to include this library in the build process?

Accepted Answer

Create a custom Docker image that includes the library and use it as the build environment in CodeBuild.. Option D is correct because creating a custom Docker image that includes the required library ensures the build environment is consistent, reproducible, and avoids repeated download/compile overhead. AWS CodeBuild supports custom Docker images via the `image` field in the buildspec file or the console, allowing you to specify a repository in Amazon ECR or Docker Hub. This approach aligns with infrastructure-as-code best practices by baking dependencies into the environment rather than managing them at build time.

Answer

Modify the buildspec file to include the library as a build artifact.

Answer

Store the compiled library in an Amazon S3 bucket and download it during the build process using the buildspec file.

Answer

Add an install command in the buildspec file to download and compile the library during each build.

Question 8

Which TWO approaches can be used to manage configuration files (e.g., application.properties) across multiple AWS accounts and regions using AWS Systems Manager? (Select TWO.)

Accepted Answer

Use AWS AppConfig to create, manage, and deploy application configurations across accounts and regions.. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configurations across accounts and regions. It supports staged rollouts, validation, and monitoring, making it suitable for managing configuration files like application.properties in multi-account, multi-region environments.

Answer

Use AWS OpsWorks for Chef Automate to store configuration data in Chef data bags.

Answer

Store configuration files in AWS Secrets Manager and retrieve them using the Secrets Manager API.

Answer

Use AWS Systems Manager Run Command to push configuration files to EC2 instances on demand.

Question 9

Which THREE actions should be taken to ensure that an AWS CloudFormation stack update does not cause downtime for a production application that runs on an Auto Scaling group behind an Application Load Balancer? (Select THREE.)

Accepted Answer

Configure an 'UpdateWaitCondition' in the CloudFormation template to pause the stack update until a healthy signal is received from the new instances.. Option A is correct because an 'UpdateWaitCondition' in a CloudFormation template can pause the stack update until a healthy signal is received from the new instances. This ensures that the update proceeds only after the new instances have passed health checks, preventing premature traffic routing and potential downtime.

Answer

Add a custom resource that triggers an AWS Lambda function to take a snapshot of the database before the update.

Answer

Ensure that the Auto Scaling group spans at least three Availability Zones to distribute instances.

Question 10

Which TWO approaches can be used to automate the creation of an AWS CloudFormation stack that includes IAM resources? (Select TWO.)

Accepted Answer

Use an AWS Lambda function to call the CreateStack API with the capabilities parameter set to 'CAPABILITY_IAM'.. Option D is correct because when a CloudFormation stack includes IAM resources, you must explicitly acknowledge that the stack may create IAM entities. An AWS Lambda function calling the CreateStack API with the `capabilities` parameter set to `CAPABILITY_IAM` satisfies this requirement. Option E is correct because the AWS CLI `create-stack` command with the `--capabilities CAPABILITY_IAM` parameter also provides the required acknowledgment, allowing the stack to be created successfully.

Answer

Store the CloudFormation template in an Amazon S3 bucket and use the 'aws cloudformation deploy' command.

Answer

Set the 'CAPABILITY_NAMED_IAM' capability when calling the CreateStack API.

Answer

Attach the AWS managed policy 'IAMFullAccess' to the IAM user or role executing the stack creation.

Question 11

An IAM policy is attached to a user who needs to create a CloudFormation stack that provisions an EC2 instance and an S3 bucket. The user receives an 'Access Denied' error when running the 'aws cloudformation create-stack' command. Which additional permission is required?

Accepted Answer

ec2:RunInstances and s3:CreateBucket. Option B is correct because to create a stack that provisions EC2 and S3 resources, the user must have permissions for those resource types (ec2:RunInstances, s3:CreateBucket) in addition to cloudformation:CreateStack. Option A is incorrect because the user already has cloudformation:CreateStack. Option C is incorrect because the user already has s3:GetObject. Option D is incorrect because iam:PassRole is needed only if a role is passed, which is not mentioned.

Answer

s3:PutObject

Answer

cloudformation:DescribeStacks

Answer

iam:PassRole

Question 12

A DevOps engineer attempted to create a CloudFormation stack and it failed. The engineer runs the 'describe-stack-events' command and sees the output above. What is the most likely cause of the failure?

Accepted Answer

The EC2 key pair 'myKeyPair' does not exist in the region where the stack is being created.. The 'describe-stack-events' output shows a 'CREATE_FAILED' event for the EC2 instance resource with the status reason indicating that the key pair 'myKeyPair' was not found. CloudFormation validates the existence of the specified EC2 key pair in the target region at creation time; if the key pair does not exist, the stack creation fails immediately. This is a common validation error when the key pair name is misspelled, belongs to a different region, or has not been created beforehand.

Answer

The AMI ID specified in the template is not available in the region.

Answer

The CloudFormation template has a syntax error in the EC2 instance definition.

Answer

The security group specified for the EC2 instance does not exist.

Question 13

A CloudFormation template snippet is shown. An engineer attempts to create a stack with this template and receives an error: 'Bucket my-unique-bucket-name already exists'. What is the most likely cause?

Accepted Answer

The S3 bucket name 'my-unique-bucket-name' is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts and regions. The error 'Bucket my-unique-bucket-name already exists' indicates that the name is already taken by another AWS account, not that the bucket already exists in the current account. CloudFormation cannot create the bucket because the name is not available in the global S3 namespace.

Answer

The bucket policy has a syntax error that prevents the bucket from being created.

Answer

The versioning configuration is incompatible with the bucket policy.

Answer

The bucket policy references the bucket name incorrectly, causing a circular dependency.

Question 14

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Option A is correct because .ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 15

A DevOps engineer uses AWS CloudFormation to manage infrastructure. The stack creation fails with the error: 'Circular dependency between resources'. The template includes an EC2 instance, an Elastic IP, and an internet gateway. The instance is associated with the Elastic IP, and the Elastic IP uses the internet gateway for the VPC. Which resource relationship is MOST likely causing the circular dependency?

Accepted Answer

The EC2 instance depends on the Elastic IP, and the Elastic IP depends on the EC2 instance.. Option C is correct because the circular dependency arises when the EC2 instance depends on the Elastic IP (via an Association resource) and the Elastic IP depends on the EC2 instance (via the InstanceId property). CloudFormation cannot resolve the creation order when two resources each require the other to exist first. This is a classic circular dependency in CloudFormation templates when using an AWS::EC2::EIP with an InstanceId that references the EC2 instance, while the instance itself has a DependsOn or a reference to the Elastic IP.

Answer

The security group depends on the EC2 instance, and the EC2 instance depends on the security group.

Answer

The Elastic IP depends on the internet gateway, and the internet gateway depends on the Elastic IP.

Answer

The internet gateway depends on the VPC, and the VPC depends on the internet gateway.