DOP-C02 Configuration Management and IaC Practice Test 15 — 15 Questions

Question 1

A company uses AWS CodeDeploy for application deployments. They want to ensure that if a deployment fails, the system automatically rolls back to the previous version. Which configuration should they set?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the deployment group to enable automatic rollback when a deployment fails.. AWS CodeDeploy provides a built-in automatic rollback feature that can be configured at the deployment group level. When enabled, CodeDeploy automatically reverts the deployment to the last known successful version if the deployment fails or reaches a specified alarm threshold, without requiring custom scripting or external orchestration.

Answer

Define a 'Failure' lifecycle event hook that calls a Lambda function to revert the deployment.

Answer

Set the 'auto-rollback' property in the CodeDeploy deployment group to 'true'.

Answer

Use a CloudFormation stack with a rollback configuration.

Question 2

Which TWO options are valid approaches for managing configuration drift in an AWS environment? (Choose two.)

Accepted Answer

Use AWS Config rules to evaluate resource configurations against desired policies.. AWS Config rules continuously evaluate your resource configurations against desired policies defined in managed or custom rules. When a resource configuration changes and violates a rule, AWS Config can trigger remediation actions or notify you, directly addressing configuration drift by detecting non-compliant resources in near real-time.

Answer

Use AWS CodePipeline to automatically redeploy infrastructure when changes are detected.

Answer

Use AWS Systems Manager Patch Manager to keep instances patched.

Answer

Use AWS CloudTrail to monitor API calls that modify resources.

Question 3

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Accepted Answer

Use a service role with least privilege when creating the stack.. Using a service role with least privilege ensures that CloudFormation operates with only the permissions necessary to create, update, and delete resources, rather than inheriting the user's broader permissions. This decouples the user's IAM permissions from the stack's runtime actions, reducing the risk of privilege escalation and unintended resource modifications.

Answer

Set a DeletionPolicy on the stack to retain resources when the stack is deleted.

Answer

Define a StackSetPolicy to control permissions across accounts.

Question 4

Which TWO AWS services can be used to automate the configuration of EC2 instances at launch? (Choose two.)

Accepted Answer

EC2 user data. EC2 user data allows you to specify scripts or cloud-init directives that run automatically during the first boot cycle of an EC2 instance. This enables automated software installation, configuration, and post-launch tasks without manual intervention, making it a core tool for instance configuration at launch.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 5

A DevOps team is troubleshooting a CloudFormation stack creation failure. The stack uses a service role with the trust policy shown in the exhibit. The error message states: 'Insufficient permissions to create the resource'. Which action should the team take to resolve this issue?

Accepted Answer

Attach IAM policies to the service role that grant permissions to create the resources.. The error 'Insufficient permissions to create the resource' indicates that the service role used by CloudFormation lacks the necessary IAM permissions to perform the resource creation actions. The trust policy shown in the exhibit allows CloudFormation to assume the role, but the role itself must have IAM policies attached that grant the required permissions (e.g., ec2:*, s3:*). Option D is correct because attaching the appropriate IAM policies to the service role resolves the permission issue.

Answer

Modify the CloudFormation template to use the user's IAM role instead of a service role.

Answer

Create a new stack policy that allows the required actions.

Answer

Add the user's IAM role to the trust policy.

Question 6

A DevOps engineer runs the command shown in the exhibit. The output shows the stack status as ROLLBACK_COMPLETE. Which statement best describes the current state of the stack?

Accepted Answer

The stack creation failed and has been rolled back. No resources remain.. The ROLLBACK_COMPLETE status in AWS CloudFormation indicates that a stack creation or update operation failed and the stack has been fully rolled back. When a stack creation fails and rolls back, CloudFormation deletes all resources that were created during the failed creation attempt, leaving no resources remaining. This is the correct interpretation for a stack that was being created (not updated) and ended in ROLLBACK_COMPLETE.

Answer

The stack was created successfully and is in a steady state.

Answer

The stack update failed and has been rolled back to the previous state.

Answer

The stack is currently in the process of rolling back after a failed creation.

Question 7

A DevOps engineer deploys the CloudFormation snippet shown in the exhibit. After the stack is deleted, the engineer checks for the S3 bucket. Which statement best describes the outcome?

Accepted Answer

The bucket is retained (not deleted) after the stack deletion.. The DeletionPolicy attribute with a value of 'Retain' explicitly instructs AWS CloudFormation to preserve the S3 bucket when the stack is deleted. Even though stack deletion normally removes all resources, the DeletionPolicy overrides this default behavior, so the bucket remains in the AWS account. The engineer will find the bucket still exists after the stack is deleted.

Answer

The bucket is deleted because the stack deletion overrides the DeletionPolicy.

Answer

The stack deletion fails because the bucket has versioning enabled.

Answer

The bucket is deleted along with the stack because the DeletionPolicy is not supported for S3 buckets.

Question 8

A company uses AWS CloudFormation to manage its infrastructure. The Operations team needs to update a stack that contains an EC2 instance. They want to change the instance type from t2.micro to t2.small without recreating the instance. Which CloudFormation stack update policy should they use?

Accepted Answer

Use a ChangeSet with Replacement set to False. Using a ChangeSet allows previewing changes, and although 'Replacement set to False' is not a real parameter, reviewing a ChangeSet helps identify that changing the instance type for a standalone EC2 instance requires replacement. No update policy can achieve this without recreation, so the best option is to use a ChangeSet to verify the impact. Options B, C, and D are irrelevant—CreationPolicy is for resource creation, DeletionPolicy handles deletion, and AutoScalingRollingUpdate applies only to Auto Scaling groups, not standalone instances.

Answer

Use a CreationPolicy with a Timeout

Answer

Use a DeletionPolicy with Retain

Answer

Use an UpdatePolicy with AutoScalingRollingUpdate

Question 9

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that fails during the 'BeforeInstall' lifecycle event. The deployment group uses an in-place deployment to an Auto Scaling group. The engineer reviews the logs on the instance and sees that the 'BeforeInstall' script exits with code 1. The script is a shell script that compiles application code. What is the most likely cause of the failure?

Accepted Answer

The script exited with a non-zero exit code. In AWS CodeDeploy, lifecycle event scripts must exit with a status code of 0 to indicate success. Any non-zero exit code, including 1, is interpreted as a failure, causing the deployment to abort. Since the 'BeforeInstall' script exits with code 1, the deployment fails regardless of the script's intent or content.

Answer

The script is not included in the 'files' section of the appspec.yml

Answer

The script requires dependencies that are not installed on the instance

Answer

The script is not owned by the root user

Question 10

A company uses AWS Systems Manager to manage its EC2 instances at scale. The DevOps team wants to ensure that all instances are patched with the latest security updates. Which Systems Manager capability should they use to automate patching?

Accepted Answer

Patch Manager. Patch Manager is the correct choice because it is the dedicated AWS Systems Manager capability designed to automate the process of patching managed instances with security updates and other types of updates. It uses patch baselines to define which patches should be installed and can schedule patching on a recurring basis, ensuring compliance across the EC2 fleet.

Answer

Run Command

Answer

Automation

Answer

State Manager

Question 11

A company uses AWS OpsWorks for configuration management. They have a stack with a layer that includes several EC2 instances. The DevOps engineer needs to deploy a custom configuration file to all instances in the layer. What is the recommended approach?

Accepted Answer

Create a custom Chef recipe and assign it to the layer's lifecycle events. AWS OpsWorks is a configuration management service that uses Chef. The recommended approach to deploy custom configuration files to all instances in a layer is to create a custom Chef recipe and assign it to the layer's lifecycle events (e.g., Setup, Configure, Deploy, or Shutdown). This ensures the recipe runs automatically on every instance in the layer at the appropriate stage of the instance lifecycle, providing a consistent and idempotent deployment method.

Answer

Use custom JSON in the stack settings to specify the file content

Answer

Use AWS Systems Manager Run Command to copy the file

Answer

Add the file to the instance's user data script

Question 12

A company uses Terraform to manage AWS infrastructure. They have a state file stored in an S3 bucket with DynamoDB locking. After a failed 'terraform apply', the state file is locked. The DevOps engineer tries to run 'terraform plan' but gets an error: 'Error acquiring the state lock'. What should the engineer do to resolve this issue?

Accepted Answer

Run 'terraform force-unlock' with the lock ID. Terraform uses DynamoDB to implement state locking, and after a failed apply, the lock entry remains in the table. The `terraform force-unlock` command with the specific lock ID (obtained from the error message or via `terraform lock` commands) is the designed mechanism to manually release a stuck lock without corrupting the state file. This approach preserves the existing state and avoids data loss.

Answer

Manually delete the lock item from the DynamoDB table

Answer

Wait for the lock to expire automatically

Answer

Delete the state file from S3 and re-run terraform init

Question 13

A company wants to use AWS Elastic Beanstalk to deploy a web application. They need to ensure that the application can be updated with zero downtime. Which deployment policy should they use?

Accepted Answer

Rolling. The Rolling deployment policy in AWS Elastic Beanstalk updates instances in batches, replacing a subset of the current environment's instances with new ones while keeping the rest serving traffic. This ensures that the application remains available throughout the update process, achieving zero downtime as long as the health check passes for each batch before proceeding.

Answer

Immutable

Answer

All at once

Answer

Traffic splitting

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group, and an RDS database. The DevOps engineer needs to update the stack to change the DB instance type. The engineer wants to minimize downtime. Which strategy should they use?

Accepted Answer

Create a new DB instance with the new type, update the application stack to point to the new DB, then remove the old DB. It minimizes downtime by provisioning a new DB instance with the desired type in parallel, updating the application stack to reference the new DB endpoint (e.g., via a CloudFormation parameter or SSM parameter), and then decommissioning the old instance. This avoids any interruption to the existing database during the transition, as the old DB remains fully operational until the application is switched over.

Answer

Create a new CloudFormation stack with the new DB instance type and update DNS to point to the new DB

Answer

Modify the DB instance to use Multi-AZ deployment before the update

Answer

Update the stack directly by changing the DBInstanceType property

Question 15

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The DevOps engineer notices that the pipeline fails intermittently during the deploy stage with the error: 'The deployment failed because the deployment group does not exist'. What is the most likely cause?

Accepted Answer

The deployment group was deleted or renamed after the pipeline was configured. The intermittent 'deployment group does not exist' error indicates that the deployment group referenced in the CodePipeline deploy stage configuration is missing at the time of execution. This most commonly occurs when the deployment group has been deleted or renamed after the pipeline was initially configured, causing the pipeline to reference a non-existent resource. Since the error is intermittent, it suggests the deployment group may be deleted and recreated or renamed during certain operations, rather than a permanent misconfiguration.

Answer

The Auto Scaling group associated with the deployment group has insufficient capacity

Answer

The CodePipeline service role does not have permission to call CodeDeploy

Answer

The CodeDeploy application name in the pipeline is misspelled