DOP-C02 Configuration Management and IaC Practice Test 14 — 15 Questions

Question 1

A DevOps team uses AWS OpsWorks for configuration management. They want to run a custom recipe on all instances in a layer during the setup lifecycle event. What should they do?

Accepted Answer

Assign the custom recipe to the Setup lifecycle event in the layer's Recipes settings.. In AWS OpsWorks, lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) are predefined hooks that run Chef recipes on instances. To run a custom recipe during the Setup event on all instances in a layer, you must assign that recipe to the Setup lifecycle event in the layer's Recipes settings. This ensures the recipe executes automatically when an instance enters the online state after bootstrapping.

Answer

Add the recipe commands to the instance's user data.

Answer

Store the recipe in an S3 bucket and reference it in the stack configuration.

Answer

Define a custom lifecycle event in the stack settings.

Question 2

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails because the new instances cannot connect to the database. The previous deployment succeeded. The DevOps engineer checks the CodeDeploy deployment configuration and finds that the deployment uses the 'CodeDeployDefault.AllAtOnce' configuration. What is the MOST likely cause of the failure?

Accepted Answer

The deployment replaced all instances at once, causing a temporary loss of connectivity if the new application version has incompatible changes.. The 'CodeDeployDefault.AllAtOnce' deployment configuration causes CodeDeploy to attempt to deploy the new application revision to all instances in the Auto Scaling group simultaneously. If the new application version contains incompatible changes—such as a database schema mismatch, altered connection strings, or missing environment variables—all instances will fail at the same time, resulting in a complete loss of connectivity to the database. This contrasts with a rolling or canary deployment, which would limit the blast radius by updating only a subset of instances at a time.

Answer

The load balancer health check is misconfigured, causing new instances to be deregistered.

Answer

The deployment group is not configured to handle traffic routing, causing a routing loop.

Answer

The security group for the Auto Scaling group was updated during deployment, blocking database access.

Question 3

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They need to ensure that the stack can be updated to modify a resource's property that requires replacement. Which CloudFormation stack policy should they use?

Accepted Answer

No stack policy, or a policy that allows updates to all resources.. Option A is correct because CloudFormation stack policies are designed to prevent accidental updates to critical resources, not to block updates that require replacement. By default, if no stack policy is applied, all resources can be updated, including those that require replacement. A policy that allows updates to all resources (or no policy) is necessary to permit a stack update that modifies a property requiring resource replacement, as the replacement process involves creating a new resource and deleting the old one, which is a valid update action.

Answer

A stack policy with an AllowAll statement.

Answer

A stack policy with a DenyAll statement.

Answer

A stack policy that explicitly denies updates to the resource.

Question 4

A company is using AWS Elastic Beanstalk with a custom platform. They need to install a third-party agent on all instances. The agent requires a configuration file that contains sensitive credentials. How should the DevOps engineer provide the configuration file to the agent?

Accepted Answer

Use .ebextensions configuration files to download the configuration from a secure S3 bucket using an IAM instance role.. Option C is correct because .ebextensions configuration files allow you to run custom commands and scripts during instance provisioning, and by combining this with an IAM instance role that grants read access to a secure S3 bucket, you can securely download the sensitive configuration file without embedding credentials in the source code or user data. This approach follows AWS best practices for handling secrets by avoiding hard-coded credentials and leveraging IAM roles for temporary, scoped access.

Answer

Use instance user data to write the configuration file during instance launch.

Answer

Embed the configuration file in the application source code and deploy it with the application.

Answer

Use AWS Systems Manager Run Command to distribute the configuration file after instances are launched.

Question 5

A DevOps engineer is creating a CloudFormation template to deploy a VPC with public and private subnets. The template uses the 'AWS::EC2::VPC' resource and two 'AWS::EC2::Subnet' resources. The engineer wants to ensure that the subnets are created in different Availability Zones. What is the best approach?

Accepted Answer

Use Fn::GetAZs function with Fn::Select to pick different AZs from the region's AZ list.. Option A is correct because Fn::GetAZs returns a list of all Availability Zones in the region, and Fn::Select allows you to pick specific indices from that list, ensuring each subnet is assigned a different AZ. This approach is dynamic and region-agnostic, so the template works across regions without hardcoding AZ names. It also avoids the risk of using the same AZ for both subnets, which would violate the requirement for high availability.

Answer

Use the CidrBlock property to define different AZs.

Answer

Use Fn::GetAZs function with a count of 2 to automatically assign different AZs.

Answer

Hardcode the Availability Zone names in the template.

Question 6

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team needs to deploy a stack that includes a Lambda function and an S3 bucket. The Lambda function's code is stored in the S3 bucket. How can the team ensure that the Lambda function is created after the S3 bucket and the code is uploaded?

Accepted Answer

Use the DependsOn attribute on the Lambda function to depend on the S3 bucket.. Option D is correct because the DependsOn attribute explicitly instructs CloudFormation to create the S3 bucket before the Lambda function. Even though CloudFormation automatically determines resource dependencies for certain intrinsic functions, it does not infer dependencies based on code uploads. Using DependsOn ensures the bucket exists and the code is uploaded before the Lambda function is created, preventing a deployment failure when the Lambda references code that is not yet available.

Answer

Upload the code to the S3 bucket before creating the stack.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the bucket name.

Answer

Define the S3 bucket resource before the Lambda function resource in the template.

Question 7

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to enforce a policy that prevents creating S3 buckets with public read access. They plan to use AWS CloudFormation StackSets to deploy a stack across all accounts. What is the BEST way to enforce this policy?

Accepted Answer

Create a service control policy (SCP) in the root organizational unit that denies the s3:PutBucketPublicAccessBlock action.. Option C is correct because a service control policy (SCP) applied at the root organizational unit in AWS Organizations can centrally deny the s3:PutBucketPublicAccessBlock action across all accounts, effectively preventing any user or role from disabling the bucket-level public access block settings. This approach works even if an IAM principal has full administrative permissions, as SCPs act as a guardrail that cannot be overridden by account-level policies. It enforces the policy at the organization level without requiring per-account configuration or modifying individual IAM users.

Answer

Use AWS CloudFormation Guard to validate templates before deployment and reject those with public access.

Answer

Create an IAM policy that denies s3:PutBucketAcl and attach it to all IAM users.

Answer

Create an S3 bucket policy in each account that denies public read access.

Question 8

Which TWO actions should a DevOps engineer take to implement a GitFlow branching strategy for infrastructure as code using AWS CodeCommit and CodePipeline? (Choose two.)

Accepted Answer

Use CodeBuild to run unit tests on feature branches before merging.. Options B and D are correct. Using separate pipelines for each branch allows different deployment behaviors. Option A is wrong because CodePipeline does not natively support pull request triggers; CodeBuild can be used for validation. Option C is wrong because merging from develop to master should trigger a pipeline for release. Option E is wrong because using the same pipeline for all branches reduces flexibility.

Answer

Disable automatic triggers on the master branch to prevent accidental deployments.

Answer

Use a single pipeline that handles all branches.

Answer

Configure CodePipeline to trigger on pull request creation.

Question 9

Which THREE actions are best practices for managing secrets in AWS CloudFormation templates? (Choose three.)

Accepted Answer

Use AWS CloudFormation parameters with the NoEcho property set to true.. Option A is correct because setting the NoEcho property to true on a CloudFormation parameter prevents the parameter value from being returned in API calls or displayed in the console, which is a basic mechanism for masking secrets. However, this alone does not encrypt the value at rest or in transit, and the value is still passed as plaintext in the template, so it is considered a best practice only when combined with other secure methods like dynamic references.

Answer

Encrypt the CloudFormation template file with AWS KMS.

Answer

Store secrets as plaintext in the template parameters.

Question 10

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

Accepted Answer

AWS Config. AWS Config continuously monitors and records AWS resource configurations and can detect changes against desired baselines, enabling drift detection through rules and compliance checks. AWS CloudFormation Drift Detection directly compares the current state of a stack's resources with the expected template-defined state to identify configuration drift. Both tools provide native mechanisms to detect when resources deviate from their intended configuration.

Answer

AWS Systems Manager Inventory

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 11

A DevOps team wants to enforce that all EC2 instances launched in an AWS account have a specific tag 'Environment' with value 'Production' or 'Development'. The team uses AWS CloudFormation to provision resources. Which approach should the team use to enforce tagging compliance at launch?

Accepted Answer

Use an AWS Config rule with an auto-remediation action that applies the required tag to non-compliant resources.. Option D is correct because AWS Config rules can evaluate EC2 instances for the presence of the 'Environment' tag with allowed values and, when combined with an auto-remediation action (e.g., using AWS Systems Manager Automation), can automatically apply the missing tag to non-compliant resources. This enforces tagging compliance at launch and throughout the resource lifecycle, even if the instance was launched without the tag. The auto-remediation action can be triggered as soon as the Config rule detects non-compliance, ensuring the tag is applied shortly after launch.

Answer

Configure a CloudFormation stack policy that denies stack updates if the tag is missing.

Answer

Add an IAM policy that denies ec2:RunInstances unless the request includes the required tag.

Answer

Create an AWS Service Catalog portfolio with a tag option constraint that requires the tag.

Question 12

An organization uses AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that all instances have the latest security patches applied automatically. Which action should the team take?

Accepted Answer

Configure a custom Chef recipe in OpsWorks to run 'yum update' on a schedule.. Option D is correct because OpsWorks can run Chef recipes on a schedule using custom recipes. Option A is incorrect because OpsWorks does not directly integrate with Systems Manager Patch Manager; that is a separate service. Option B is incorrect because AWS Config rules are for compliance evaluation, not patching. Option C is incorrect because updating the AMI does not affect running instances.

Answer

Create an AWS Config rule to check for missing patches and trigger an auto-remediation.

Answer

Update the AMI used by the OpsWorks layer to include the latest patches.

Answer

Enable AWS Systems Manager Patch Manager to patch all instances managed by OpsWorks.

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires environment-specific configuration values (database URL, API keys) that must be stored securely and rotated automatically. The team uses AWS Secrets Manager. Which configuration management strategy should the team implement to securely inject secrets into the Elastic Beanstalk environment?

Accepted Answer

Use an Elastic Beanstalk platform hook script that retrieves secrets from Secrets Manager and sets them as environment variables.. Option C is correct because Elastic Beanstalk platform hooks allow custom scripts to run during deployment, enabling retrieval of secrets from AWS Secrets Manager and setting them as environment variables before the application starts. This approach keeps secrets out of the environment configuration and supports automatic rotation by having the script fetch the latest secret value on each deployment.

Answer

Store the secrets in the Elastic Beanstalk environment configuration as plain text under 'aws:elasticbeanstalk:application:environment'.

Answer

Configure Secrets Manager to automatically push secrets to Elastic Beanstalk environment properties.

Answer

Use AWS CloudFormation dynamic references to inject secrets into the Elastic Beanstalk environment.

Question 14

A DevOps engineer is responsible for managing infrastructure as code for multiple microservices. The team uses AWS CloudFormation and wants to reuse common resource definitions across multiple stacks. Which approach should the engineer use to promote reusability and reduce code duplication?

Accepted Answer

Develop CloudFormation modules that encapsulate common resource configurations and publish them in a registry.. Option D is correct because AWS CloudFormation modules allow you to encapsulate common resource configurations into reusable, versioned components that can be published in the CloudFormation registry. This promotes reusability and reduces code duplication across multiple stacks without the overhead of managing nested stack templates or manual copying.

Answer

Create nested stacks that include the common resources and pass parameters as needed.

Answer

Store the common resource definitions in an AWS CodeCommit repository and copy them into each template.

Answer

Use cross-stack references by exporting outputs from a central stack and importing them in other stacks.

Question 15

A company uses AWS CodeDeploy for application deployments to EC2 instances. The team recently noticed that deployments are failing because some instances do not have the CodeDeploy agent installed. Which configuration management approach should the team implement to ensure the CodeDeploy agent is installed and running on all instances before deployment?

Accepted Answer

Create a custom AMI with the CodeDeploy agent pre-installed, or use a user data script to install the agent at launch.. Option C is correct because it ensures the CodeDeploy agent is present on every EC2 instance from the moment it is launched, either by baking the agent into a custom AMI or by installing it via a user data script. This approach aligns with immutable infrastructure and configuration management best practices, preventing deployment failures caused by missing agents. AWS CodeDeploy requires the agent to be installed and running on target instances before any deployment can proceed.

Answer

Use an AWS Config rule to detect instances without the agent and trigger a Lambda function to install it.

Answer

Use the CodeDeploy deployment configuration to skip instances that do not have the agent.

Answer

Configure the CodeDeploy deployment group to automatically install the agent on new instances.