DOP-C02 Configuration Management and IaC Practice Test 15 — 15 Questions

Question 1

An IAM policy is attached to a user who needs to create a CloudFormation stack that provisions an EC2 instance and an S3 bucket. The user receives an 'Access Denied' error when running the 'aws cloudformation create-stack' command. Which additional permission is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ec2:RunInstances and s3:CreateBucket. To successfully create a CloudFormation stack that provisions an EC2 instance and an S3 bucket, the IAM user must have permissions for the actions that CloudFormation will perform on their behalf. Specifically, ec2:RunInstances and s3:CreateBucket are required in addition to cloudformation:CreateStack. The 'Access Denied' error occurs because the user lacks these resource-level permissions. Notably, the DeletionPolicy attribute (e.g., Retain) only controls behavior when resources are deleted, not during stack creation or updates; it does not affect the permissions required for provisioning.

Answer

s3:PutObject

Answer

cloudformation:DescribeStacks

Answer

iam:PassRole

Question 2

A DevOps engineer attempted to create a CloudFormation stack and it failed. The engineer runs the 'describe-stack-events' command and sees the output above. What is the most likely cause of the failure?

Accepted Answer

The EC2 key pair 'myKeyPair' does not exist in the region where the stack is being created.. The 'describe-stack-events' output shows a 'CREATE_FAILED' event for the EC2 instance resource with the status reason indicating that the key pair 'myKeyPair' was not found. CloudFormation validates the existence of the specified EC2 key pair in the target region at creation time; if the key pair does not exist, the stack creation fails immediately. This is a common validation error when the key pair name is misspelled, belongs to a different region, or has not been created beforehand.

Answer

The AMI ID specified in the template is not available in the region.

Answer

The CloudFormation template has a syntax error in the EC2 instance definition.

Answer

The security group specified for the EC2 instance does not exist.

Question 3

A CloudFormation template snippet is shown. An engineer attempts to create a stack with this template and receives an error: 'Bucket my-unique-bucket-name already exists'. What is the most likely cause?

Accepted Answer

The S3 bucket name 'my-unique-bucket-name' is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts and regions. The error 'Bucket my-unique-bucket-name already exists' indicates that the name is already taken by another AWS account, not that the bucket already exists in the current account. CloudFormation cannot create the bucket because the name is not available in the global S3 namespace.

Answer

The bucket policy has a syntax error that prevents the bucket from being created.

Answer

The versioning configuration is incompatible with the bucket policy.

Answer

The bucket policy references the bucket name incorrectly, causing a circular dependency.

Question 4

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 5

A DevOps engineer uses AWS CloudFormation to manage infrastructure. The stack creation fails with the error: 'Circular dependency between resources'. The template includes an EC2 instance, an Elastic IP, and an internet gateway. The instance is associated with the Elastic IP, and the Elastic IP uses the internet gateway for the VPC. Which resource relationship is MOST likely causing the circular dependency?

Accepted Answer

The EC2 instance depends on the Elastic IP, and the Elastic IP depends on the EC2 instance.. The circular dependency arises when the EC2 instance depends on the Elastic IP (via an Association resource) and the Elastic IP depends on the EC2 instance (via the InstanceId property). CloudFormation cannot resolve the creation order when two resources each require the other to exist first. This is a classic circular dependency in CloudFormation templates when using an AWS::EC2::EIP with an InstanceId that references the EC2 instance, while the instance itself has a DependsOn or a reference to the Elastic IP.

Answer

The security group depends on the EC2 instance, and the EC2 instance depends on the security group.

Answer

The Elastic IP depends on the internet gateway, and the internet gateway depends on the Elastic IP.

Answer

The internet gateway depends on the VPC, and the VPC depends on the internet gateway.

Question 6

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails because the new instances cannot connect to the database. The previous deployment succeeded. The DevOps engineer checks the CodeDeploy deployment configuration and finds that the deployment uses the 'CodeDeployDefault.AllAtOnce' configuration. What is the MOST likely cause of the failure?

Accepted Answer

The deployment replaced all instances at once, causing a temporary loss of connectivity if the new application version has incompatible changes.. The 'CodeDeployDefault.AllAtOnce' deployment configuration causes CodeDeploy to attempt to deploy the new application revision to all instances in the Auto Scaling group simultaneously. If the new application version contains incompatible changes—such as a database schema mismatch, altered connection strings, or missing environment variables—all instances will fail at the same time, resulting in a complete loss of connectivity to the database. This contrasts with a rolling or canary deployment, which would limit the blast radius by updating only a subset of instances at a time.

Answer

The load balancer health check is misconfigured, causing new instances to be deregistered.

Answer

The deployment group is not configured to handle traffic routing, causing a routing loop.

Answer

The security group for the Auto Scaling group was updated during deployment, blocking database access.

Question 7

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They need to ensure that the stack can be updated to modify a resource's property that requires replacement. Which CloudFormation stack policy should they use?

Accepted Answer

No stack policy, or a policy that allows updates to all resources.. CloudFormation stack policies are designed to prevent accidental updates to critical resources, not to block updates that require replacement. By default, if no stack policy is applied, all resources can be updated, including those that require replacement. A policy that allows updates to all resources (or no policy) is necessary to permit a stack update that modifies a property requiring resource replacement, as the replacement process involves creating a new resource and deleting the old one, which is a valid update action.

Answer

A stack policy with an AllowAll statement.

Answer

A stack policy with a DenyAll statement.

Answer

A stack policy that explicitly denies updates to the resource.

Question 8

A company is using AWS Elastic Beanstalk with a custom platform. They need to install a third-party agent on all instances. The agent requires a configuration file that contains sensitive credentials. How should the DevOps engineer provide the configuration file to the agent?

Accepted Answer

Use .ebextensions configuration files to download the configuration from a secure S3 bucket using an IAM instance role.. Ebextensions configuration files allow you to run custom commands and scripts during instance provisioning, and by combining this with an IAM instance role that grants read access to a secure S3 bucket, you can securely download the sensitive configuration file without embedding credentials in the source code or user data. This approach follows AWS best practices for handling secrets by avoiding hard-coded credentials and leveraging IAM roles for temporary, scoped access.

Answer

Use instance user data to write the configuration file during instance launch.

Answer

Embed the configuration file in the application source code and deploy it with the application.

Answer

Use AWS Systems Manager Run Command to distribute the configuration file after instances are launched.

Question 9

A DevOps engineer is creating a CloudFormation template to deploy a VPC with public and private subnets. The template uses the 'AWS::EC2::VPC' resource and two 'AWS::EC2::Subnet' resources. The engineer wants to ensure that the subnets are created in different Availability Zones. What is the best approach?

Accepted Answer

Use Fn::GetAZs function with Fn::Select to pick different AZs from the region's AZ list.. Fn::GetAZs returns a list of all Availability Zones in the region, and Fn::Select allows you to pick specific indices from that list, ensuring each subnet is assigned a different AZ. This approach is dynamic and region-agnostic, so the template works across regions without hardcoding AZ names. It also avoids the risk of using the same AZ for both subnets, which would violate the requirement for high availability.

Answer

Use the CidrBlock property to define different AZs.

Answer

Use Fn::GetAZs function with a count of 2 to automatically assign different AZs.

Answer

Hardcode the Availability Zone names in the template.

Question 10

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team needs to deploy a stack that includes a Lambda function and an S3 bucket. The Lambda function's code is stored in the S3 bucket. How can the team ensure that the Lambda function is created after the S3 bucket and the code is uploaded?

Accepted Answer

Use the DependsOn attribute on the Lambda function to depend on the S3 bucket.. The DependsOn attribute explicitly instructs CloudFormation to create the S3 bucket before the Lambda function. Even though CloudFormation automatically determines resource dependencies for certain intrinsic functions, it does not infer dependencies based on code uploads. Using DependsOn ensures the bucket exists and the code is uploaded before the Lambda function is created, preventing a deployment failure when the Lambda references code that is not yet available.

Answer

Upload the code to the S3 bucket before creating the stack.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the bucket name.

Answer

Define the S3 bucket resource before the Lambda function resource in the template.

Question 11

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to enforce a policy that prevents creating S3 buckets with public read access. They plan to use AWS CloudFormation StackSets to deploy a stack across all accounts. What is the BEST way to enforce this policy?

Accepted Answer

Create a service control policy (SCP) in the root organizational unit that denies the s3:PutBucketPublicAccessBlock action.. A service control policy (SCP) applied at the root organizational unit in AWS Organizations can centrally deny the s3:PutBucketPublicAccessBlock action across all accounts, effectively preventing any user or role from disabling the bucket-level public access block settings. This approach works even if an IAM principal has full administrative permissions, as SCPs act as a guardrail that cannot be overridden by account-level policies. It enforces the policy at the organization level without requiring per-account configuration or modifying individual IAM users.

Answer

Use AWS CloudFormation Guard to validate templates before deployment and reject those with public access.

Answer

Create an IAM policy that denies s3:PutBucketAcl and attach it to all IAM users.

Answer

Create an S3 bucket policy in each account that denies public read access.

Question 12

Which TWO actions should a DevOps engineer take to implement a GitFlow branching strategy for infrastructure as code using AWS CodeCommit and CodePipeline? (Choose two.)

Accepted Answer

Use CodeBuild to run unit tests on feature branches before merging.. Options B and D are correct. Option B: CodeBuild can run unit tests on feature branches before merging, ensuring code quality. Option D: Separate pipelines for develop and master branches allow different deployment behaviors (e.g., non-prod vs. prod). Option A is wrong because disabling automatic triggers on the master branch would prevent automated deployments when changes are merged, which is contrary to GitFlow where master deployments are desired. Option C is wrong because a single pipeline for all branches reduces flexibility and can cause unintended deployments. Option E is wrong because CodePipeline does not natively support pull request triggers; use CodeBuild or other services for that.

Answer

Disable automatic triggers on the master branch to prevent accidental deployments.

Answer

Use a single pipeline that handles all branches.

Answer

Configure CodePipeline to trigger on pull request creation.

Question 13

Which THREE actions are best practices for managing secrets in AWS CloudFormation templates? (Choose three.)

Accepted Answer

Use AWS CloudFormation parameters with the NoEcho property set to true.. Setting the NoEcho property to true on a CloudFormation parameter prevents the parameter value from being returned in API calls or displayed in the console, which is a basic mechanism for masking secrets. However, this alone does not encrypt the value at rest or in transit, and the value is still passed as plaintext in the template, so it is considered a best practice only when combined with other secure methods like dynamic references.

Answer

Encrypt the CloudFormation template file with AWS KMS.

Answer

Store secrets as plaintext in the template parameters.

Question 14

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

Accepted Answer

AWS Config. AWS Config continuously monitors and records AWS resource configurations and can detect changes against desired baselines, enabling drift detection through rules and compliance checks. AWS CloudFormation Drift Detection directly compares the current state of a stack's resources with the expected template-defined state to identify configuration drift. Both tools provide native mechanisms to detect when resources deviate from their intended configuration.

Answer

AWS Systems Manager Inventory

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires environment-specific configuration values (database URL, API keys) that must be stored securely and rotated automatically. The team uses AWS Secrets Manager. Which configuration management strategy should the team implement to securely inject secrets into the Elastic Beanstalk environment?

Accepted Answer

Use an Elastic Beanstalk platform hook script that retrieves secrets from Secrets Manager and sets them as environment variables.. Elastic Beanstalk platform hooks allow custom scripts to run during deployment, enabling retrieval of secrets from AWS Secrets Manager and setting them as environment variables before the application starts. This approach keeps secrets out of the environment configuration and supports automatic rotation by having the script fetch the latest secret value on each deployment.

Answer

Store the secrets in the Elastic Beanstalk environment configuration as plain text under 'aws:elasticbeanstalk:application:environment'.

Answer

Configure Secrets Manager to automatically push secrets to Elastic Beanstalk environment properties.

Answer

Use AWS CloudFormation dynamic references to inject secrets into the Elastic Beanstalk environment.