DOP-C02 Configuration Management and IaC Practice Test 15 — 15 Questions

Question 1

A team manages a large fleet of EC2 instances using AWS Systems Manager. They want to enforce a consistent configuration across all instances, including installed software packages, firewall rules, and user accounts. The team also needs to audit configuration changes and remediate drift automatically. Which AWS service should the team use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it is designed to enforce a consistent configuration across EC2 instances by defining and applying desired state configurations (DSCs). It can manage software packages, firewall rules, and user accounts, and it automatically remediates drift by re-applying the desired state on a schedule. This directly meets the requirement for configuration enforcement, auditing, and automated drift remediation.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS Systems Manager Run Command

Answer

AWS Config

Question 2

A company uses AWS CloudFormation to manage infrastructure. The team wants to ensure that all stack updates are reviewed and approved before execution. Which mechanism should the team implement?

Accepted Answer

Use AWS CloudFormation change sets to review the proposed changes before executing the update.. AWS CloudFormation change sets allow you to preview how proposed changes to a stack will be applied before you execute them. This includes a summary of additions, modifications, and deletions of resources, enabling you to review and approve the changes in a controlled manner. By generating a change set, the team can ensure that no update is executed without prior review and approval, meeting the requirement for a gated deployment process.

Answer

Create a stack policy that denies all updates unless approved.

Answer

Use AWS CloudFormation drift detection to identify changes before updating.

Answer

Enable termination protection on the stack to prevent accidental updates.

Question 3

A DevOps engineer needs to deploy a configuration management solution that can manage both Windows and Linux servers across on-premises and AWS environments. The solution must support a Git-based workflow for version control of configurations. Which AWS service should the engineer choose?

Accepted Answer

AWS OpsWorks for Chef Automate. AWS OpsWorks for Chef Automate is the correct choice because it provides a fully managed Chef Automate server that supports configuration management for both Windows and Linux servers across on-premises and AWS environments. Chef uses a Git-based workflow for version control of cookbooks, enabling DevOps teams to store, version, and manage configurations as code in a Git repository.

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 4

A company uses AWS CloudFormation to deploy a multi-tier application. The network team manages the VPC and subnets using a separate CloudFormation stack. The application team needs to reference the VPC ID and subnet IDs from the network stack. Which approach should the application team use to obtain these values?

Accepted Answer

Export the VPC ID and subnet IDs from the network stack using the 'Export' field and import them in the application stack using Fn::ImportValue.. Option B is correct because CloudFormation's Export and Fn::ImportValue mechanism allows cross-stack references without hardcoding or duplicating values. The network stack exports the VPC ID and subnet IDs using the Export field, and the application stack imports them via Fn::ImportValue, ensuring that changes in the network stack propagate automatically to dependent stacks.

Answer

Hardcode the VPC and subnet IDs in the application template.

Answer

Create the network stack as a nested stack inside the application stack.

Answer

Store the VPC and subnet IDs in AWS Systems Manager Parameter Store and retrieve them using dynamic references.

Question 5

A company uses AWS CodeBuild to build and test their application. They want to integrate Infrastructure as Code (IaC) scanning into their build pipeline to detect security misconfigurations in CloudFormation templates before deployment. Which TWO tools or services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to enforce compliance and security best practices on CloudFormation templates. It can be integrated into a CodeBuild pipeline to scan templates for misconfigurations before deployment, making it a correct choice for IaC security scanning.

Answer

AWS Security Hub

Answer

AWS Config

Answer

HashiCorp Terraform

Question 6

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

Accepted Answer

Run Command. Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.

Answer

OpsCenter

Answer

Parameter Store

Question 7

A company uses AWS CloudFormation to deploy infrastructure. They want to enforce mandatory tags on all resources created by CloudFormation. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use CloudFormation stack tags that propagate to all resources in the stack.. Option A is correct because CloudFormation stack tags propagate to all resources that support tagging within the stack. When you specify tags at the stack level, CloudFormation automatically applies them to each resource it creates, ensuring mandatory tags are enforced without additional configuration.

Answer

Create an AWS Config rule to automatically tag resources after creation.

Answer

Add an IAM policy that denies cloudformation:CreateStack unless the template includes the required tags.

Answer

Enable AWS CloudTrail to log all API calls and monitor for untagged resources.

Question 8

A company uses AWS CloudFormation to deploy a microservices architecture. The Operations team needs to update a stack that contains a Lambda function and an API Gateway REST API. They want to ensure that the Lambda function code is updated without downtime. Which update policy should be used for the Lambda function in the CloudFormation template?

Accepted Answer

Use an UpdateReplacePolicy of 'Replace'. The correct answer is B because the `UpdateReplacePolicy` attribute in CloudFormation is used to specify the behavior when a resource must be replaced during a stack update. Setting it to `Replace` ensures that the Lambda function is recreated with the new code, and because CloudFormation creates the new function before deleting the old one (for Lambda), there is no downtime. This policy directly addresses the requirement for a zero-downtime code update.

Answer

Use an UpdateReplacePolicy of 'Snapshot'

Answer

Use an UpdateReplacePolicy of 'Retain'

Answer

Use an UpdateReplacePolicy of 'Rollback'

Question 9

A DevOps engineer is designing a CI/CD pipeline for an application that runs on Amazon ECS. The pipeline should automatically build a Docker image from source code, push it to Amazon ECR, and deploy it to the ECS service. The engineer wants to use AWS CodePipeline with Amazon ECR as a source. Which action provider should be used for the deploy stage?

Accepted Answer

Amazon ECS. Amazon ECS is the correct action provider for the deploy stage when using AWS CodePipeline because it directly integrates with ECS to update an existing ECS service with a new task definition. When Amazon ECR is configured as a source, CodePipeline detects image pushes, and the ECS deploy action automatically triggers a rolling update of the ECS service using the new image, without requiring additional deployment tools.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 10

An organization uses AWS OpsWorks for configuration management. They have a stack with multiple layers, including a PHP application layer and a MySQL database layer. The operations team needs to deploy a custom configuration file to all PHP application instances. How should this be accomplished using OpsWorks?

Accepted Answer

Create a custom cookbook with a recipe that deploys the configuration file, and assign it to the Deploy lifecycle event of the PHP layer.. Option C is correct because OpsWorks uses Chef cookbooks to manage configuration. By creating a custom cookbook with a recipe that deploys the configuration file and assigning it to the Deploy lifecycle event of the PHP layer, the recipe runs on all PHP application instances during deployment, ensuring the file is placed correctly. This approach leverages OpsWorks' built-in lifecycle events and Chef's idempotent execution model.

Answer

Use the OpsWorks agent to directly copy the file to each instance via SSH.

Answer

Add the configuration file as a stack-level custom cookbook and assign it to all layers.

Answer

Use a custom JSON attribute in the stack settings to define the file content, and then use a built-in recipe to apply it.

Question 11

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance and an EC2 instance that connects to it. The DB instance has a deletion policy of 'Retain'. The stack fails to delete because the DB instance is retained and still exists. Which TWO actions would allow the stack to be deleted successfully? (Select TWO.)

Accepted Answer

Manually delete the DB instance using the RDS console.. Option B is correct because manually deleting the retained DB instance removes the resource that is blocking the stack deletion. CloudFormation cannot delete a stack that contains a resource with a 'Retain' deletion policy until that resource is manually removed, as the stack expects the resource to no longer exist for the deletion to complete.

Answer

Use the AWS CLI to force delete the stack with the --force option.

Answer

Disable termination protection on the EC2 instance.

Answer

Modify the DB instance to allow deletion by setting DeletionProtection to false.

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The company wants to configure automatic scaling based on CPU utilization. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Set the minimum and maximum number of instances for the auto scaling group.. Option B is correct because Elastic Beanstalk uses Auto Scaling groups to manage the EC2 instances for the application. Setting the minimum and maximum number of instances defines the boundaries within which the Auto Scaling group can scale, ensuring the application can handle high traffic during business hours and scale down during low traffic at night.

Answer

Create a CloudWatch alarm that triggers a scaling policy.

Answer

Configure the load balancer health check interval.

Question 13

A company uses AWS CodeCommit to store source code. The development team wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which TWO resources must be configured to accomplish this? (Select TWO.)

Accepted Answer

An Amazon CloudWatch Events rule that listens for CodeCommit pull request events.. Option C is correct because Amazon CloudWatch Events (now Amazon EventBridge) can capture CodeCommit pull request state changes (e.g., created, updated) and route them to targets like AWS CodeBuild. This allows you to automatically trigger a build when a pull request event occurs, without needing a separate polling mechanism.

Answer

An AWS Lambda function to process the pull request event.

Answer

An AWS CodePipeline pipeline with a source stage for CodeCommit.

Answer

An Amazon Simple Notification Service (SNS) topic to send notifications.

Question 14

A DevOps engineer needs to create an IAM policy that allows a user to start and stop EC2 instances, but only for instances that have a specific tag 'Environment=Production'. The current policy allows all actions on all instances. Which modification must be made to enforce the tag-based restriction?

Accepted Answer

Add a Condition block: "Condition": {"StringEquals": {"ec2:ResourceTag/Environment": "Production"}}. Option C is correct because the `ec2:ResourceTag` condition key allows you to restrict actions based on the tags already attached to the EC2 instance. By using `StringEquals` with `ec2:ResourceTag/Environment` set to `Production`, the policy will only permit the `ec2:StartInstances` and `ec2:StopInstances` actions on instances that currently have that tag. This is the standard AWS mechanism for tag-based resource-level authorization in IAM policies.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:PrincipalTag/Environment": "Production"}}

Answer

Change the Action to "ec2:Describe*" and add a NotAction element.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:RequestTag/Environment": "Production"}}

Question 15

A CloudFormation stack update failed with the error shown. What is the most likely cause?

Accepted Answer

The AMI ID specified in the template is incorrect or has been deregistered.. Option B is correct. The error message indicates that the AMI ID specified in the resource properties is invalid. This typically happens when the AMI ID does not exist in the region or has been deregistered. The stack update is trying to update the EC2 instance with a new AMI, but the AMI ID is incorrect. Option A is incorrect because the error is about the AMI ID, not the instance type. Option C is incorrect because the error is not about permissions. Option D is incorrect because the error is not about the stack name.

Answer

The instance type t2.micro is not available in the region.

Answer

The IAM role used by CloudFormation lacks ec2:RunInstances permissions.

Answer

The stack name does not match the existing stack.