DOP-C02 Configuration Management and IaC Practice Test 16 — 15 Questions

Question 1

An organization wants to ensure that all objects stored in the S3 bucket are encrypted at rest using server-side encryption with S3 managed keys (SSE-S3). The bucket policy above is intended to enforce this. However, a user reported that they can still upload unencrypted objects. What is the MOST likely reason?

Accepted Answer

The condition is applied to the GetObject action, not the PutObject action.. Option D is correct. The bucket policy condition checks for the header 'x-amz-server-side-encryption' with value 'AES256'. However, this condition is on the GetObject action, not on PutObject. To enforce encryption on uploads, the condition should be on s3:PutObject. Additionally, the condition should require encryption, not just check it. Option A is incorrect because using bucket policy is a valid way to enforce encryption. Option B is incorrect because the condition syntax is correct for SSE-S3. Option C is incorrect because the policy applies to the bucket, but the condition is on the wrong action.

Answer

The bucket policy is not attached to the bucket because of a circular dependency.

Answer

The bucket policy does not apply to objects uploaded by the root user.

Answer

The condition should use 's3:x-amz-server-side-encryption-aws-kms-key-id' instead.

Question 2

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a script on all instances that have a specific tag 'Environment:Development'. Which Systems Manager capability should be used?

Accepted Answer

Run Command. Option C is correct. Run Command allows you to remotely and securely run commands on instances. It can target instances by tags. State Manager is for maintaining consistent state, Patch Manager for patching, and Inventory for collecting metadata. Run Command is the appropriate tool for ad-hoc script execution.

Answer

Inventory

Answer

Patch Manager

Answer

State Manager

Question 3

A company uses Chef for configuration management of their EC2 instances. They want to use AWS OpsWorks for Chef Automate to manage the Chef server. What is the primary benefit of using OpsWorks for Chef Automate compared to running a self-managed Chef server?

Accepted Answer

It reduces operational overhead by managing the Chef server's infrastructure.. Option B is correct. OpsWorks for Chef Automate is a managed service that handles the Chef server maintenance, patching, and high availability. It integrates with AWS services like CloudWatch and IAM. Option A is incorrect because OpsWorks does not provide a GUI for cookbooks; Chef has its own tools. Option C is incorrect because OpsWorks manages the server, not the nodes' cookbooks. Option D is incorrect because OpsWorks does not automatically create cookbooks; they must be developed by the user.

Answer

It provides a graphical user interface to author cookbooks.

Answer

It creates cookbooks based on the instance configuration.

Answer

It automatically applies cookbooks to all instances in the account.

Question 4

A company uses AWS CloudFormation StackSets to deploy a common security baseline across multiple AWS accounts. They have a new account that needs to be added to the StackSet. The StackSet is configured with self-service permissions and uses a service-managed IAM role. What must be done to include the new account?

Accepted Answer

Add the new account to the AWS Organization.. Option D is correct. With service-managed permissions, StackSets use AWS Organizations to automatically manage accounts. You simply need to add the account to the organization, and StackSets can deploy to it. Option A is incorrect because StackSets can deploy to new accounts without manual stack instance creation if using Organizations. Option B is incorrect because creating a new StackSet is unnecessary. Option C is incorrect because the IAM role is managed by StackSets.

Answer

Create an IAM role in the new account that trusts the StackSet.

Answer

Create a new StackSet that includes the new account.

Answer

Manually create a stack instance for the new account in the StackSet.

Question 5

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack creation. The stack creates an EC2 instance with a user data script that runs a configuration management tool. The instance launches successfully, but the user data script fails. How can the engineer retrieve the user data execution logs to debug the issue?

Accepted Answer

Access the instance via EC2 Instance Connect and check /var/log/cloud-init-output.log.. Option A is correct. User data scripts run as root, and the output is typically logged to /var/log/cloud-init-output.log on Linux instances. Option B is incorrect because CloudTrail does not capture user data execution logs. Option C is incorrect because Systems Manager Run Command is not used to retrieve logs from user data. Option D is incorrect because CloudWatch Logs agent must be configured in the user data to send logs; it is not automatically enabled.

Answer

Use AWS CloudTrail to view the user data execution events.

Answer

Use AWS Systems Manager Run Command to retrieve the logs remotely.

Answer

Check the CloudWatch Logs group for the instance.

Question 6

A company uses AWS Elastic Beanstalk with a custom platform. They need to update the platform version to include a new security patch. Which approach should be used to create a new custom platform version?

Accepted Answer

Create a new platform version using the aws elasticbeanstalk create-platform-version command with an updated platform definition file.. Option D is correct. Custom platforms are created by packaging a platform definition file (a .zip) and using the aws elasticbeanstalk create-platform-version command. The platform definition includes the AMI ID and other configuration. Option A is incorrect because you cannot update an existing platform; you must create a new version. Option B is incorrect because you cannot directly modify the AMI in the existing platform. Option C is incorrect because Beanstalk does not automatically rebuild platforms; you need to create a new version.

Answer

Use the Elastic Beanstalk CLI to rebuild the platform with the new AMI.

Answer

Launch a new EC2 instance, apply the patch, and create an AMI, then update the platform version.

Answer

Modify the existing platform version's AMI ID using the Elastic Beanstalk console.

Question 7

A CloudFormation template includes the following resource:

MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: My security group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890
      InstanceType: t2.micro
      SecurityGroupIds: !Ref MySecurityGroup

The stack creation fails with the error shown. What is the cause?

Accepted Answer

The SecurityGroupIds property must be a list, but !Ref returns a single value.. Option C is correct. The SecurityGroupIds property expects a list of security group IDs, but the !Ref MySecurityGroup returns a single string (the security group ID). To pass a list, you must use !Sub or a list literal like [!Ref MySecurityGroup]. Option A is incorrect because the security group definition is correct. Option B is incorrect because security groups can be referenced by ID. Option D is incorrect because the error is about format, not missing property.

Answer

The SecurityGroupIds property must be a list of security group names, not IDs.

Answer

The security group ingress rule is invalid because it allows all traffic.

Answer

The ImageId is missing, so the security group validation fails first.

Question 8

A company uses AWS CloudFormation to deploy a web application across multiple AWS accounts using StackSets. The DevOps team notices that stack instance updates are failing in some accounts with the error: 'Insufficient IAM permissions to perform the action'. The team has already verified that the StackSet IAM role has the necessary permissions. What is the most likely cause of this issue?

Accepted Answer

The target accounts do not have the necessary trust policy to allow the StackSet IAM role to assume the execution role.. Option B is correct because StackSets require that the target accounts have a trust policy allowing the StackSet IAM role to assume a role in those accounts. Option A is wrong because the error is about permissions, not limit. Option C is wrong because the stack set name is not relevant. Option D is wrong because SCPs can block permissions even if the IAM role has them.

Answer

The target accounts have reached the limit of 200 stacks per region.

Answer

AWS Organizations has a service control policy (SCP) that denies the required action, but the StackSet IAM role has full admin permissions.

Answer

The StackSet name contains invalid characters that are not allowed in some accounts.

Question 9

A DevOps team is designing a configuration management solution for a microservices architecture running on Amazon ECS. The team wants to ensure that container configurations are automatically updated when a new version of a parameter is stored in AWS Systems Manager Parameter Store. Which approach best meets this requirement with minimal operational overhead?

Accepted Answer

Use AWS AppConfig to create a configuration profile that references the parameter. Configure a Lambda function as a validator and deploy strategy. When the parameter changes, AppConfig triggers a deployment that updates the ECS service.. Option A is correct because using AWS AppConfig with a Lambda function to trigger an ECS service update is a native, managed solution. Option B is wrong because it does not automatically update running containers. Option C is wrong because it requires manual steps. Option D is wrong because CloudWatch Events cannot directly update ECS services.

Answer

Use an AWS CloudFormation custom resource that updates the ECS service when the parameter changes.

Answer

Use a CI/CD pipeline that monitors the parameter store and triggers a new build and deploy of the container image with the updated parameter.

Answer

Use Amazon EventBridge to detect changes to the parameter and invoke a Lambda function that updates the ECS task definition and forces a new deployment.

Question 10

A company uses AWS OpsWorks for configuration management of its EC2 instances. The DevOps team wants to apply a new security patch to all instances in a specific layer. What is the most efficient way to accomplish this?

Accepted Answer

Update the layer's custom Chef recipe to include the patch and trigger a lifecycle event to execute the recipe on all instances.. Option C is correct because OpsWorks allows running custom Chef recipes as lifecycle events. Option A is wrong because it requires manual login. Option B is wrong because it is not automated across all instances. Option D is wrong because a new stack is unnecessary.

Answer

Create a new OpsWorks stack with the patch and migrate instances to it.

Answer

SSH into each instance and run the patch command manually.

Answer

Use AWS Systems Manager Run Command to run a patch command on each instance individually.

Question 11

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that when a stack update fails, the stack automatically rolls back to its previous state. However, they also want to preserve any resources that were created outside of CloudFormation (drift). What should they do?

Accepted Answer

Use a CloudFormation resource policy with a 'Retain' rule for resources that might have drifted. Then enable rollback on failure.. Option B is correct because CloudFormation resource policies allow you to specify which resources should be retained on deletion. Option A is wrong because it would delete all resources. Option C is wrong because stack policies protect resources during updates, not for rollback. Option D is wrong because termination protection prevents stack deletion, not resource deletion during rollback.

Answer

Enable termination protection on the stack to prevent deletion during rollback.

Answer

Use a stack policy that denies updates to resources created outside CloudFormation. Then enable rollback on failure.

Answer

Enable rollback on failure in the stack options. CloudFormation will automatically roll back, preserving all resources.

Question 12

A DevOps team uses AWS Elastic Beanstalk to deploy a web application. They want to implement a blue/green deployment strategy to minimize downtime. Which configuration change should they make?

Accepted Answer

Create a new environment and perform a CNAME swap.. Option C is correct because blue/green deployments in Elastic Beanstalk use CNAME swap to route traffic to the new environment. Option A is wrong because immutable updates do not swap URLs. Option B is wrong because rolling updates update in-place. Option D is wrong because all-at-once causes downtime.

Answer

Set the deployment policy to 'All at once'.

Answer

Set the deployment policy to 'Rolling' with a batch size of 50%.

Answer

Set the deployment policy to 'Immutable'.

Question 13

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon RDS DB instance. The DevOps team wants to update the DB instance class without downtime. What should they do?

Accepted Answer

Modify the DB instance class using an RDS blue/green deployment, then update the CloudFormation stack to match the new class.. Option D is correct because modifying the DB instance class with 'ApplyImmediately: false' and enabling Multi-AZ allows a blue/green deployment via RDS. Option A is wrong because it causes downtime. Option B is wrong because it creates a new DB, not an update. Option C is wrong because 'ReplaceOnDelete' would recreate the resource.

Answer

Use a CloudFormation stack update with a 'ReplaceOnDelete' deletion policy on the DB instance.

Answer

Create a new DB instance with the new class, update the application to point to the new endpoint, and delete the old instance.

Answer

Update the DBInstanceClass property in the CloudFormation template and set 'ApplyImmediately: true'.

Question 14

A company uses AWS Systems Manager to manage configuration compliance. They want to ensure that all EC2 instances have a specific security patch installed. Which Systems Manager capability should they use?

Accepted Answer

Patch Manager. Option B is correct because Patch Manager is designed to patch instances. Option A is wrong because State Manager is for state management, not patching. Option C is wrong because Automation is for workflows. Option D is wrong because Parameter Store is for configuration data.

Answer

Automation

Answer

Parameter Store

Answer

State Manager

Question 15

A DevOps team is troubleshooting a CloudFormation stack creation failure. The error message states: 'CREATE_FAILED: Resource handler returned message: "You have attempted to create more resources than the current AWS account limit"'. Which step should the team take to resolve this issue?

Accepted Answer

Check the current service limits for the resource type and request a limit increase from AWS Support.. Option C is correct because the error indicates a service limit has been reached, and the team should request a limit increase. Option A is wrong because the error is not about permissions. Option B is wrong because retrying will fail again. Option D is wrong because the error is specific to resource limits, not stack names.

Answer

Delete the failed stack and recreate it with the same template.

Answer

Review the IAM permissions for the CloudFormation service role.

Answer

Modify the CloudFormation template to use a different resource type.

DOP-C02 Configuration Management and IaC Practice Test 16 — 15 Questions

Exhibit

DOP-C02 Configuration Management and IaC Practice Test 16 — 15 Questions

Exhibit