DOP-C02 Configuration Management and IaC Practice Test 16 — 15 Questions

Question 1

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the latest security patches are applied to all instances. Which THREE steps should they include in their Ansible playbook? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'command' module to run 'yum update -y'. The 'command' module can run arbitrary shell commands like 'yum update -y' to apply all available package updates. However, it is not idempotent, meaning it will run the update every time the playbook executes, even if no updates are available. For production use, the 'yum' or 'package' module with state=latest is preferred for idempotency.

Answer

Use the 'service' module to restart services after patching

Answer

Use the 'copy' module to download patch files

Question 2

A company uses AWS CloudFormation to deploy its infrastructure. They have a production stack that includes an RDS PostgreSQL instance with a read replica. The stack update to modify the DB instance class fails with the error: 'The parameter group cannot be changed during a read replica update.' The DevOps engineer needs to update the DB instance class while minimizing downtime and without losing the read replica. The current configuration: the RDS instance is using a custom parameter group. The read replica is using the same parameter group. The update changes the DBInstanceClass property from db.r5.large to db.r5.xlarge. What should the engineer do to successfully update the stack?

Accepted Answer

Remove the read replica from the stack, update the master instance, then add the read replica back. The error occurs because CloudFormation attempts to update both the master and the read replica in the same stack update, and the replica's parameter group cannot be changed during the update. However, the actual change is the DB instance class, not the parameter group. The recommended approach is to remove the read replica from the stack, update the master instance class, then add the read replica back. This minimizes downtime and ensures the replica is created with the correct configuration. Option A correctly implements this. Option B is incorrect because the read replica must match the master's instance class, so updating the replica first would fail or cause inconsistency. Option C causes configuration drift and is not a best practice. Option D does not address the instance class change; the error is not about the parameter group.

Answer

Update the read replica first to the new instance class, then update the master instance

Answer

Use the AWS Management Console to modify the DB instance class directly, bypassing CloudFormation

Answer

Create a new parameter group for the master instance and associate it before the update

Question 3

A company uses AWS OpsWorks for Chef Automate. They have a stack that includes a PHP application layer. The application requires a custom PHP configuration file. The DevOps engineer creates a custom Chef cookbook with a recipe that deploys the configuration file. The recipe is assigned to the layer's Setup lifecycle event. The engineer notices that the configuration file is not being created on new instances when they are added to the layer. The cookbook is stored in a private S3 bucket. The engineer has verified that the cookbook is correctly associated with the stack. What should the engineer do to fix the issue?

Accepted Answer

Ensure that the instance profile has permissions to read from the S3 bucket where the cookbook is stored. The issue is that the custom cookbook is stored in a private S3 bucket. For new instances to access the cookbook during the Setup lifecycle event, the instance must have the necessary IAM permissions to read from that S3 bucket. The instance profile attached to the OpsWorks stack's instances must include a policy that grants s3:GetObject for the cookbook's S3 bucket. Without these permissions, the instance cannot download the cookbook, so the recipe never runs. Therefore, the engineer should ensure that the instance profile has permissions to read from the S3 bucket. Option A is incorrect because the Setup lifecycle event is appropriate for deploying configuration files when the instance is being set up; moving to Configure would run later and might not achieve the same result. Option B is incorrect because the issue is not about the recipe being in default.rb; the cookbook is correctly associated, and the recipe is assigned to the layer lifecycle event directly, not necessarily via default.rb. Option C is incorrect because updating the cookbook version would not address the access permissions issue.

Answer

Assign the recipe to the Configure lifecycle event instead of Setup

Answer

Verify that the recipe is included in the cookbook's default.rb file

Answer

Update the cookbook version to the latest

Question 4

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that stack updates do not accidentally delete critical resources like a database. Which CloudFormation stack policy should they apply to protect the database resource?

Accepted Answer

Create a stack policy that denies delete actions on the logical resource ID of the database.. A CloudFormation stack policy allows you to define resource-level permissions that prevent specific resources (identified by their logical resource ID) from being updated or deleted during a stack update. By creating a policy that denies delete actions on the database's logical resource ID, the DevOps team ensures that even if the template or parameters change, the database resource cannot be accidentally removed.

Answer

Apply an IAM policy that denies cloudformation:DeleteStack on the database.

Answer

Use an S3 bucket policy to deny deletion of the database snapshot.

Answer

Enable termination protection on the CloudFormation stack.

Question 5

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an AWS::EC2::Instance with a UserData script. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]. The requested configuration is currently not supported. Please check the documentation for supported configurations.' The engineer suspects the instance type is not supported in the selected Availability Zone. Which action should the engineer take to resolve this issue and ensure successful stack creation?

Accepted Answer

Add an Availability Zone parameter and map it to an AZ that supports the instance type, or use the AWS::EC2::Instance AvailabilityZone property to specify an AZ that supports the instance type.. The error indicates the instance type is not supported in the default Availability Zone (AZ) selected by CloudFormation. By explicitly specifying an AZ that supports the instance type via the `AvailabilityZone` property or by parameterizing the AZ, the engineer can override the default AZ selection and resolve the incompatibility. This approach directly addresses the root cause without changing the instance type or region.

Answer

Use AWS OpsWorks to deploy the instance instead of CloudFormation.

Answer

Change the instance type to a previous generation that is supported in all AZs.

Answer

Modify the template to specify a different region that supports the instance type.

Question 6

A company uses AWS Elastic Beanstalk to deploy a Java web application. The DevOps team wants to ensure that configuration changes are tracked and can be rolled back if needed. Which Elastic Beanstalk feature should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and restore them if needed.. Elastic Beanstalk saved configurations allow you to capture the environment's configuration settings (e.g., instance type, environment variables, platform version) as a JSON file stored in S3. This enables you to restore or recreate an environment with the exact same settings, providing a straightforward rollback mechanism for configuration changes without relying on external tools or pipelines.

Answer

Use AWS CodeCommit to store configuration files and version them.

Answer

Use AWS CodePipeline with a manual approval stage to track changes.

Answer

Use AWS CloudFormation change sets to review changes before deployment.

Question 7

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the deployment fails because the target instances are not passing the health checks. The DevOps engineer notices that the CodeDeploy agent logs show 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which step should the engineer take to diagnose the issue?

Accepted Answer

Review the CodeDeploy deployment logs on a failed instance to identify script errors.. The error message indicates that individual instances failed deployment, and the CodeDeploy agent logs on a failed instance contain detailed script output (e.g., AppSpec hooks like BeforeInstall, AfterInstall, ApplicationStart) that reveal the root cause, such as a missing dependency or incorrect file path. Reviewing these logs directly identifies script errors, which is the most targeted diagnostic step before considering infrastructure changes.

Answer

Increase the size of the Auto Scaling group to ensure more instances are available.

Answer

Create a CloudWatch alarm to monitor the deployment health.

Answer

Check AWS CloudTrail logs for the CodeDeploy API calls to see if permissions are missing.

Question 8

A company uses AWS OpsWorks for configuration management. The DevOps team wants to run a custom recipe on all instances in a layer during stack updates. Which OpsWorks lifecycle event should they hook the recipe into?

Accepted Answer

Setup. The Setup lifecycle event runs on every instance in a layer when it first boots or during a stack update, making it the correct hook for running a custom recipe that must execute on all instances during updates. This event occurs after the instance is fully configured and before it enters service, ensuring the recipe runs consistently across the layer.

Answer

Deploy

Answer

Shutdown

Answer

Configure

Question 9

A company is using AWS Systems Manager to manage configuration drift on EC2 instances. They want to automatically apply a baseline configuration to instances that have drifted from the desired state. Which Systems Manager capability should they use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct capability because it is specifically designed to define and maintain consistent configuration states for EC2 instances and other AWS resources. It uses associations to automatically apply a baseline configuration and remediate drift on a schedule or when triggered, ensuring instances remain in the desired state without manual intervention.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager Parameter Store

Answer

AWS Systems Manager Run Command

Question 10

A company is using AWS CloudFormation to deploy a multi-tier application. The DevOps team wants to ensure that the database password is not exposed in the template or the console. Which two methods should they use to securely manage the password? (Choose TWO.)

Accepted Answer

Use a CloudFormation parameter with the NoEcho property set to true.. Setting the `NoEcho` property to `true` on a CloudFormation parameter masks the password from console outputs and `DescribeStack` calls, preventing exposure in logs or the AWS Management Console. This is a straightforward way to handle sensitive input without external services, though it does not encrypt the value at rest in the template.

Answer

Hardcode the password in the template and use a condition to only apply it in production.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it with {{resolve:ssm:...}}

Answer

Pass the password as user data to the EC2 instance and encrypt the user data.

Question 11

A DevOps team is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. They want to incorporate infrastructure as code (IaC) using AWS CloudFormation. Which three practices should they follow to ensure reliable and repeatable deployments? (Choose THREE.)

Accepted Answer

Use the same CloudFormation template across all environments, with parameterization for environment-specific values.. Using a single CloudFormation template across all environments with parameterization ensures consistency and reduces drift. Environment-specific values (e.g., instance sizes, subnet IDs) are passed as parameters, so the same template logic applies to dev, test, and prod, making deployments repeatable and auditable.

Answer

Create a single monolithic template for all microservices to simplify management.

Answer

Skip change sets during stack updates to speed up the pipeline.

Question 12

A company uses AWS Elastic Beanstalk to manage its web application. The DevOps team wants to customize the Amazon EC2 instances launched by Elastic Beanstalk. Which two methods can they use to achieve this? (Choose TWO.)

Accepted Answer

Use .ebextensions configuration files in the application source bundle to install packages and run commands.. `.ebextensions` configuration files allow you to customize the EC2 instances launched by Elastic Beanstalk by installing packages, running commands, and configuring services during instance provisioning. These YAML or JSON files are placed in the `.ebextensions` folder of your application source bundle and are executed by the Elastic Beanstalk platform as part of the instance initialization process, providing a native and supported customization mechanism.

Answer

Use AWS OpsWorks to manage the instances instead of Elastic Beanstalk.

Answer

Add user data to the Auto Scaling group launch configuration that Elastic Beanstalk creates.

Answer

Modify the CloudFormation template generated by Elastic Beanstalk directly.

Question 13

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team has a template that creates an Amazon RDS DB instance and an EC2 instance that runs a web application. The EC2 instance needs to connect to the RDS instance using the database endpoint and password. The team currently passes the endpoint and password as CloudFormation parameters, which are then stored in the EC2 instance's user data. However, security audit has flagged this as a security risk because the password is visible in the user data. The team wants to securely pass the database credentials to the EC2 instance without exposing them in the template or user data. The EC2 instance has an IAM role that allows it to read from AWS Secrets Manager. Which solution should the team implement?

Accepted Answer

Store the password in AWS Secrets Manager, use a dynamic reference to pass it to the EC2 instance's IAM role, and have the application retrieve it from Secrets Manager at runtime.. By storing the password in AWS Secrets Manager and using a dynamic reference in CloudFormation, the password is never exposed in the template or user data. The EC2 instance retrieves the password from Secrets Manager at runtime using its IAM role. Option A is not the best because although Parameter Store can store SecureStrings, Secrets Manager is more secure and supports automatic rotation, and the instance already has permissions to read Secrets Manager. Option B is risky because encrypting user data still exposes the password in the user data itself and adds key management complexity. Option D is wrong because Fn::GetAtt cannot retrieve the RDS master password, and even if it could, the password would still be passed via user data, which is insecure.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString and have the EC2 instance retrieve it using the AWS CLI.

Answer

Encrypt the user data using AWS KMS and decrypt it on the EC2 instance at boot time.

Answer

Use CloudFormation's Fn::GetAtt to retrieve the password from the RDS instance and pass it to the EC2 instance via user data.

Question 14

A company is using AWS OpsWorks for configuration management of their application stack. The stack includes a PHP application layer and a MySQL database layer. The DevOps team wants to automate the deployment of a new PHP version across all instances in the PHP layer. The team has created a custom Chef recipe that updates PHP. They want to run this recipe on all instances in the PHP layer in a rolling update fashion to avoid downtime. Which OpsWorks feature should they use?

Accepted Answer

Use the OpsWorks 'Run Command' feature to execute the recipe on the PHP layer with rolling update settings.. OpsWorks 'Run Command' allows you to execute a custom Chef recipe on a layer with rolling update settings (e.g., batch size) to update PHP without downtime. Option B is wrong because automatic updates are not an OpsWorks feature. Option C is wrong because the Setup lifecycle event runs only at instance boot, not on-demand. Option D is wrong because the Configure lifecycle event triggers on network changes, not for on-demand deployments.

Answer

Create a custom Chef cookbook and enable automatic updates in OpsWorks.

Answer

Add the recipe to the Setup lifecycle event for the PHP layer.

Answer

Modify the PHP layer's lifecycle configuration to include the recipe in the Configure event.

Question 15

A company uses AWS CodeCommit to store infrastructure as code templates. The DevOps team has set up an AWS CodePipeline that automatically deploys a CloudFormation stack when changes are pushed to the main branch. The pipeline includes a deployment action that uses the CloudFormation create/update stack action. Recently, a developer pushed a change that caused the CloudFormation stack update to fail because the change would have deleted a critical resource. The pipeline did not catch this issue, and the stack update failed midway, leaving the stack in a partially updated state. The team wants to implement a safety mechanism to prevent such issues in the future. Which solution should they implement?

Accepted Answer

Add a CloudFormation change set action in the pipeline with a manual approval step to review the changes before executing the stack update.. Adding a CloudFormation change set action with a manual approval step allows the team to review the exact changes that will be applied to the stack before execution. This prevents unintended modifications like resource deletions. Option B is incorrect because a stack policy can deny deletion of specific resources but does not prevent the update from starting or failing midway; it only blocks the deletion, and the update may still fail. Option C is incorrect because reviewing the code change alone is insufficient; the pipeline needs to see the infrastructure impact through a change set. Option D is incorrect because deploying to a test environment first helps find issues but does not provide a pre-execution review of the production stack changes; the question requires a safety mechanism to catch changes that would delete critical resources before they are applied.

Answer

Create a stack policy that denies deletion of critical resources, and include the policy in the CloudFormation template.

Answer

Add a manual approval step before the deployment action to review the code change.

Answer

Add a 'Test' stage in the pipeline that deploys the stack to a test environment first.