DOP-C02 Configuration Management and IaC Practice Test 14 — 15 Questions

Question 1

A CloudFormation stack update failed with the error shown. What is the most likely cause?

Accepted Answer

The AMI ID specified in the template is incorrect or has been deregistered.. The error message indicates that CloudFormation cannot find the specified AMI. This typically occurs when the AMI ID is incorrect, has been deregistered, or is not available in the region where the stack is being deployed. CloudFormation validates the AMI ID during stack creation or update, and if the AMI does not exist or is inaccessible, the operation fails with a 'Resource creation cancelled' error.

Answer

The instance type t2.micro is not available in the region.

Answer

The IAM role used by CloudFormation lacks ec2:RunInstances permissions.

Answer

The stack name does not match the existing stack.

Question 2

An organization wants to ensure that all objects stored in the S3 bucket are encrypted at rest using server-side encryption with S3 managed keys (SSE-S3). The bucket policy above is intended to enforce this. However, a user reported that they can still upload unencrypted objects. What is the MOST likely reason?

Accepted Answer

The condition is applied to the GetObject action, not the PutObject action.. The bucket policy condition `s3:x-amz-server-side-encryption` is applied to the `s3:GetObject` action instead of `s3:PutObject`. This means the policy only checks encryption headers when reading objects, not when uploading them. To enforce encryption at upload time, the condition must be attached to the `s3:PutObject` action, which is the operation that accepts the `x-amz-server-side-encryption` header.

Answer

The bucket policy is not attached to the bucket because of a circular dependency.

Answer

The bucket policy does not apply to objects uploaded by the root user.

Answer

The condition should use 's3:x-amz-server-side-encryption-aws-kms-key-id' instead.

Question 3

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a script on all instances that have a specific tag 'Environment:Development'. Which Systems Manager capability should be used?

Accepted Answer

Run Command. Run Command is the correct capability because it allows you to remotely and securely execute scripts or commands on targeted EC2 instances using AWS Systems Manager. You can target instances by specifying tags, such as 'Environment:Development', and Run Command will execute the script on all matching instances without requiring SSH or RDP access.

Answer

Inventory

Answer

Patch Manager

Answer

State Manager

Question 4

A company uses Chef for configuration management of their EC2 instances. They want to use AWS OpsWorks for Chef Automate to manage the Chef server. What is the primary benefit of using OpsWorks for Chef Automate compared to running a self-managed Chef server?

Accepted Answer

It reduces operational overhead by managing the Chef server's infrastructure.. The primary benefit of AWS OpsWorks for Chef Automate is that it reduces operational overhead by managing the Chef server's infrastructure, including patching, backups, scaling, and high availability. This allows teams to focus on authoring cookbooks and managing node configurations rather than maintaining the Chef server itself.

Answer

It provides a graphical user interface to author cookbooks.

Answer

It creates cookbooks based on the instance configuration.

Answer

It automatically applies cookbooks to all instances in the account.

Question 5

A company uses AWS CloudFormation StackSets to deploy a common security baseline across multiple AWS accounts. They have a new account that needs to be added to the StackSet. The StackSet is configured with self-service permissions and uses a service-managed IAM role. What must be done to include the new account?

Accepted Answer

Add the new account to the AWS Organization.. When a StackSet uses service-managed permissions, it relies on AWS Organizations to manage accounts. To include a new account, you must add it to the AWS Organization; the StackSet will automatically deploy stack instances to that account based on the specified organizational units (OUs) or accounts. This is because service-managed permissions use a service-linked role created and managed by CloudFormation, not a manually created IAM role in the target account.

Answer

Create an IAM role in the new account that trusts the StackSet.

Answer

Create a new StackSet that includes the new account.

Answer

Manually create a stack instance for the new account in the StackSet.

Question 6

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack creation. The stack creates an EC2 instance with a user data script that runs a configuration management tool. The instance launches successfully, but the user data script fails. How can the engineer retrieve the user data execution logs to debug the issue?

Accepted Answer

Access the instance via EC2 Instance Connect and check /var/log/cloud-init-output.log.. The user data script output is logged by cloud-init to /var/log/cloud-init-output.log on the EC2 instance. By using EC2 Instance Connect to access the instance, the engineer can directly read this log file to see the full execution output, including any error messages from the configuration management tool.

Answer

Use AWS CloudTrail to view the user data execution events.

Answer

Use AWS Systems Manager Run Command to retrieve the logs remotely.

Answer

Check the CloudWatch Logs group for the instance.

Question 7

A company uses AWS Elastic Beanstalk with a custom platform. They need to update the platform version to include a new security patch. Which approach should be used to create a new custom platform version?

Accepted Answer

Create a new platform version using the aws elasticbeanstalk create-platform-version command with an updated platform definition file.. AWS Elastic Beanstalk custom platforms are defined using a platform definition file (a YAML or JSON file that specifies the AMI, Chef recipes, and other configuration). To create a new platform version with an updated security patch, you must update this platform definition file (e.g., to reference a new base AMI with the patch) and then run the `aws elasticbeanstalk create-platform-version` CLI command. This command packages the definition file and uploads it to Elastic Beanstalk, which then builds and registers the new platform version. The other options either bypass the custom platform framework or are not supported operations.

Answer

Use the Elastic Beanstalk CLI to rebuild the platform with the new AMI.

Answer

Launch a new EC2 instance, apply the patch, and create an AMI, then update the platform version.

Answer

Modify the existing platform version's AMI ID using the Elastic Beanstalk console.

Question 8

A CloudFormation template includes the following resource:

MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: My security group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890
      InstanceType: t2.micro
      SecurityGroupIds: !Ref MySecurityGroup

The stack creation fails with the error shown. What is the cause?

Accepted Answer

The SecurityGroupIds property must be a list, but !Ref returns a single value.. The error occurs because the `SecurityGroupIds` property expects a list of security group IDs, but the `!Ref` intrinsic function returns a single security group ID (a string), not a list. In CloudFormation, `!Ref` for a security group returns its ID as a scalar value, so wrapping it in a list (e.g., `[!Ref MySecurityGroup]`) is required to satisfy the `List<String>` type constraint.

Answer

The SecurityGroupIds property must be a list of security group names, not IDs.

Answer

The security group ingress rule is invalid because it allows all traffic.

Answer

The ImageId is missing, so the security group validation fails first.

Question 9

A DevOps team is designing a configuration management solution for a microservices architecture running on Amazon ECS. The team wants to ensure that container configurations are automatically updated when a new version of a parameter is stored in AWS Systems Manager Parameter Store. Which approach best meets this requirement with minimal operational overhead?

Accepted Answer

Use AWS AppConfig to create a configuration profile that references the parameter. Configure a Lambda function as a validator and deploy strategy. When the parameter changes, AppConfig triggers a deployment that updates the ECS service.. AWS AppConfig is purpose-built for managing application configuration and supports automatic deployment of configuration changes to ECS services when a parameter in Systems Manager Parameter Store is updated. By creating a configuration profile that references the parameter, AppConfig can trigger a deployment that updates the ECS service without requiring custom code or manual intervention, minimizing operational overhead.

Answer

Use an AWS CloudFormation custom resource that updates the ECS service when the parameter changes.

Answer

Use a CI/CD pipeline that monitors the parameter store and triggers a new build and deploy of the container image with the updated parameter.

Answer

Use Amazon EventBridge to detect changes to the parameter and invoke a Lambda function that updates the ECS task definition and forces a new deployment.

Question 10

A company uses AWS OpsWorks for configuration management of its EC2 instances. The DevOps team wants to apply a new security patch to all instances in a specific layer. What is the most efficient way to accomplish this?

Accepted Answer

Update the layer's custom Chef recipe to include the patch and trigger a lifecycle event to execute the recipe on all instances.. OpsWorks uses Chef to manage configuration, and updating the layer's custom Chef recipe to include the security patch allows you to trigger a lifecycle event (e.g., 'Setup' or 'Configure') that runs the recipe on all instances in that layer simultaneously. This approach is efficient, automated, and leverages OpsWorks' built-in configuration management without manual intervention or stack migration.

Answer

Create a new OpsWorks stack with the patch and migrate instances to it.

Answer

SSH into each instance and run the patch command manually.

Answer

Use AWS Systems Manager Run Command to run a patch command on each instance individually.

Question 11

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that when a stack update fails, the stack automatically rolls back to its previous state. However, they also want to preserve any resources that were created outside of CloudFormation (drift). What should they do?

Accepted Answer

Use a stack policy that denies updates to resources created outside CloudFormation. Then enable rollback on failure.. A stack policy can be used to deny updates to specific resources, such as those that have drifted. When a stack update fails and rollback is enabled, CloudFormation will attempt to revert changes. By denying updates to drifted resources via a stack policy, those resources are preserved in their current state. This ensures both rollback on failure and preservation of drift.

Answer

Enable termination protection on the stack to prevent deletion during rollback.

Answer

Use a CloudFormation resource policy with a 'Retain' rule for resources that might have drifted. Then enable rollback on failure.

Answer

Enable rollback on failure in the stack options. CloudFormation will automatically roll back, preserving all resources.

Question 12

A DevOps team uses AWS Elastic Beanstalk to deploy a web application. They want to implement a blue/green deployment strategy to minimize downtime. Which configuration change should they make?

Accepted Answer

Create a new environment and perform a CNAME swap.. Blue/green deployment in AWS Elastic Beanstalk is achieved by creating a separate environment (the 'green' environment) with the new application version, then swapping the CNAME of the existing 'blue' environment to point to the green environment. This CNAME swap is instantaneous and does not require DNS propagation, minimizing downtime. Option A correctly describes this process.

Answer

Set the deployment policy to 'All at once'.

Answer

Set the deployment policy to 'Rolling' with a batch size of 50%.

Answer

Set the deployment policy to 'Immutable'.

Question 13

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon RDS DB instance. The DevOps team wants to update the DB instance class without downtime. What should they do?

Accepted Answer

Modify the DB instance class using an RDS blue/green deployment, then update the CloudFormation stack to match the new class.. RDS blue/green deployments allow you to make changes (such as modifying the DB instance class) with minimal downtime by creating a staging environment that mirrors the production environment. After the change is applied and verified, the blue/green deployment switches traffic to the new environment, ensuring zero or near-zero downtime. Subsequently, updating the CloudFormation stack to match the new class keeps the infrastructure code in sync with the actual deployed resources.

Answer

Use a CloudFormation stack update with a 'ReplaceOnDelete' deletion policy on the DB instance.

Answer

Create a new DB instance with the new class, update the application to point to the new endpoint, and delete the old instance.

Answer

Update the DBInstanceClass property in the CloudFormation template and set 'ApplyImmediately: true'.

Question 14

A company uses AWS Systems Manager to manage configuration compliance. They want to ensure that all EC2 instances have a specific security patch installed. Which Systems Manager capability should they use?

Accepted Answer

Patch Manager. Patch Manager is the correct Systems Manager capability because it is specifically designed to automate the process of patching managed instances with security updates and other types of patches. It can scan for missing patches and enforce compliance by applying patches on a schedule or on demand, directly addressing the requirement to ensure all EC2 instances have a specific security patch installed.

Answer

Automation

Answer

Parameter Store

Answer

State Manager

Question 15

A DevOps team is troubleshooting a CloudFormation stack creation failure. The error message states: 'CREATE_FAILED: Resource handler returned message: "You have attempted to create more resources than the current AWS account limit"'. Which step should the team take to resolve this issue?

Accepted Answer

Check the current service limits for the resource type and request a limit increase from AWS Support.. The error message explicitly indicates that the CloudFormation stack creation failed because the AWS account has reached a service limit for a specific resource type. Option D is correct because the team must first identify which resource type exceeded its limit (e.g., EC2 instances, VPCs, or IAM roles) by checking the AWS Service Quotas console or using the Trusted Advisor dashboard, then request a limit increase from AWS Support. Simply retrying the stack creation or modifying IAM permissions will not resolve a hard service quota violation.

Answer

Delete the failed stack and recreate it with the same template.

Answer

Review the IAM permissions for the CloudFormation service role.

Answer

Modify the CloudFormation template to use a different resource type.