DOP-C02 Configuration Management and IaC Practice Test 16 — 15 Questions

Question 1

A DevOps engineer is responsible for managing infrastructure as code for multiple microservices. The team uses AWS CloudFormation and wants to reuse common resource definitions across multiple stacks. Which approach should the engineer use to promote reusability and reduce code duplication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Develop CloudFormation modules that encapsulate common resource configurations and publish them in a registry.. AWS CloudFormation modules allow you to encapsulate common resource configurations into reusable, versioned components that can be published in the CloudFormation registry. This promotes reusability and reduces code duplication across multiple stacks without the overhead of managing nested stack templates or manual copying.

Answer

Create nested stacks that include the common resources and pass parameters as needed.

Answer

Store the common resource definitions in an AWS CodeCommit repository and copy them into each template.

Answer

Use cross-stack references by exporting outputs from a central stack and importing them in other stacks.

Question 2

A company uses AWS CodeDeploy for application deployments to EC2 instances. The team recently noticed that deployments are failing because some instances do not have the CodeDeploy agent installed. Which configuration management approach should the team implement to ensure the CodeDeploy agent is installed and running on all instances before deployment?

Accepted Answer

Create a custom AMI with the CodeDeploy agent pre-installed, or use a user data script to install the agent at launch.. It ensures the CodeDeploy agent is present on every EC2 instance from the moment it is launched, either by baking the agent into a custom AMI or by installing it via a user data script. This approach aligns with immutable infrastructure and configuration management best practices, preventing deployment failures caused by missing agents. AWS CodeDeploy requires the agent to be installed and running on target instances before any deployment can proceed.

Answer

Use an AWS Config rule to detect instances without the agent and trigger a Lambda function to install it.

Answer

Use the CodeDeploy deployment configuration to skip instances that do not have the agent.

Answer

Configure the CodeDeploy deployment group to automatically install the agent on new instances.

Question 3

A team manages a large fleet of EC2 instances using AWS Systems Manager. They want to enforce a consistent configuration across all instances, including installed software packages, firewall rules, and user accounts. The team also needs to audit configuration changes and remediate drift automatically. Which AWS service should the team use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it is designed to enforce a consistent configuration across EC2 instances by defining and applying desired state configurations (DSCs). It can manage software packages, firewall rules, and user accounts, and it automatically remediates drift by re-applying the desired state on a schedule. This directly meets the requirement for configuration enforcement, auditing, and automated drift remediation.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS Systems Manager Run Command

Answer

AWS Config

Question 4

A company uses AWS CloudFormation to manage infrastructure. The team wants to ensure that all stack updates are reviewed and approved before execution. Which mechanism should the team implement?

Accepted Answer

Use AWS CloudFormation change sets to review the proposed changes before executing the update.. AWS CloudFormation change sets allow you to preview how proposed changes to a stack will be applied before you execute them. This includes a summary of additions, modifications, and deletions of resources, enabling you to review and approve the changes in a controlled manner. By generating a change set, the team can ensure that no update is executed without prior review and approval, meeting the requirement for a gated deployment process.

Answer

Create a stack policy that denies all updates unless approved.

Answer

Use AWS CloudFormation drift detection to identify changes before updating.

Answer

Enable termination protection on the stack to prevent accidental updates.

Question 5

A company uses AWS CloudFormation to deploy a multi-tier application. The network team manages the VPC and subnets using a separate CloudFormation stack. The application team needs to reference the VPC ID and subnet IDs from the network stack. Which approach should the application team use to obtain these values?

Accepted Answer

Export the VPC ID and subnet IDs from the network stack using the 'Export' field and import them in the application stack using Fn::ImportValue.. CloudFormation's Export and Fn::ImportValue mechanism allows cross-stack references without hardcoding or duplicating values. The network stack exports the VPC ID and subnet IDs using the Export field, and the application stack imports them via Fn::ImportValue, ensuring that changes in the network stack propagate automatically to dependent stacks.

Answer

Hardcode the VPC and subnet IDs in the application template.

Answer

Create the network stack as a nested stack inside the application stack.

Answer

Store the VPC and subnet IDs in AWS Systems Manager Parameter Store and retrieve them using dynamic references.

Question 6

A company uses AWS CodeBuild to build and test their application. They want to integrate Infrastructure as Code (IaC) scanning into their build pipeline to detect security misconfigurations in CloudFormation templates before deployment. Which TWO tools or services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to enforce compliance and security best practices on CloudFormation templates. It can be integrated into a CodeBuild pipeline to scan templates for misconfigurations before deployment, making it a correct choice for IaC security scanning.

Answer

AWS Security Hub

Answer

AWS Config

Answer

HashiCorp Terraform

Question 7

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

Accepted Answer

Run Command. Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.

Answer

OpsCenter

Answer

Parameter Store

Question 8

A company uses AWS CloudFormation to deploy infrastructure. They want to enforce mandatory tags on all resources created by CloudFormation. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use CloudFormation stack tags that propagate to all resources in the stack.. CloudFormation stack tags propagate to all resources that support tagging within the stack. When you specify tags at the stack level, CloudFormation automatically applies them to each resource it creates, ensuring mandatory tags are enforced without additional configuration.

Answer

Create an AWS Config rule to automatically tag resources after creation.

Answer

Add an IAM policy that denies cloudformation:CreateStack unless the template includes the required tags.

Answer

Enable AWS CloudTrail to log all API calls and monitor for untagged resources.

Question 9

A DevOps engineer is designing a CI/CD pipeline for an application that runs on Amazon ECS. The pipeline should automatically build a Docker image from source code, push it to Amazon ECR, and deploy it to the ECS service. The engineer wants to use AWS CodePipeline with Amazon ECR as a source. Which action provider should be used for the deploy stage?

Accepted Answer

Amazon ECS. Amazon ECS is the correct action provider for the deploy stage when using AWS CodePipeline because it directly integrates with ECS to update an existing ECS service with a new task definition. When Amazon ECR is configured as a source, CodePipeline detects image pushes, and the ECS deploy action automatically triggers a rolling update of the ECS service using the new image, without requiring additional deployment tools.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 10

An organization uses AWS OpsWorks for configuration management. They have a stack with multiple layers, including a PHP application layer and a MySQL database layer. The operations team needs to deploy a custom configuration file to all PHP application instances. How should this be accomplished using OpsWorks?

Accepted Answer

Create a custom cookbook with a recipe that deploys the configuration file, and assign it to the Deploy lifecycle event of the PHP layer.. OpsWorks uses Chef cookbooks to manage configuration. By creating a custom cookbook with a recipe that deploys the configuration file and assigning it to the Deploy lifecycle event of the PHP layer, the recipe runs on all PHP application instances during deployment, ensuring the file is placed correctly. This approach leverages OpsWorks' built-in lifecycle events and Chef's idempotent execution model.

Answer

Use the OpsWorks agent to directly copy the file to each instance via SSH.

Answer

Add the configuration file as a stack-level custom cookbook and assign it to all layers.

Answer

Use a custom JSON attribute in the stack settings to define the file content, and then use a built-in recipe to apply it.

Question 11

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance and an EC2 instance that connects to it. The DB instance has a deletion policy of 'Retain'. The stack fails to delete because the DB instance is retained and still exists. Which TWO actions would allow the stack to be deleted successfully? (Select TWO.)

Accepted Answer

Manually delete the DB instance using the RDS console.. Manually deleting the retained DB instance removes the resource that is blocking the stack deletion. CloudFormation cannot delete a stack that contains a resource with a 'Retain' deletion policy until that resource is manually removed, as the stack expects the resource to no longer exist for the deletion to complete.

Answer

Use the AWS CLI to force delete the stack with the --force option.

Answer

Disable termination protection on the EC2 instance.

Answer

Modify the DB instance to allow deletion by setting DeletionProtection to false.

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The company wants to configure automatic scaling based on CPU utilization. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Set the minimum and maximum number of instances for the auto scaling group.. Elastic Beanstalk uses Auto Scaling groups to manage the EC2 instances for the application. Setting the minimum and maximum number of instances defines the boundaries within which the Auto Scaling group can scale, ensuring the application can handle high traffic during business hours and scale down during low traffic at night.

Answer

Create a CloudWatch alarm that triggers a scaling policy.

Answer

Configure the load balancer health check interval.

Question 13

A DevOps engineer needs to create an IAM policy that allows a user to start and stop EC2 instances, but only for instances that have a specific tag 'Environment=Production'. The current policy allows all actions on all instances. Which modification must be made to enforce the tag-based restriction?

Accepted Answer

Add a Condition block: "Condition": {"StringEquals": {"ec2:ResourceTag/Environment": "Production"}}. The `ec2:ResourceTag` condition key allows you to restrict actions based on the tags already attached to the EC2 instance. By using `StringEquals` with `ec2:ResourceTag/Environment` set to `Production`, the policy will only permit the `ec2:StartInstances` and `ec2:StopInstances` actions on instances that currently have that tag. This is the standard AWS mechanism for tag-based resource-level authorization in IAM policies.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:PrincipalTag/Environment": "Production"}}

Answer

Change the Action to "ec2:Describe*" and add a NotAction element.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:RequestTag/Environment": "Production"}}

Question 14

A CloudFormation stack update failed with the error shown. What is the most likely cause?

Accepted Answer

The AMI ID specified in the template is incorrect or has been deregistered.. The error message indicates that CloudFormation cannot find the specified AMI. This typically occurs when the AMI ID is incorrect, has been deregistered, or is not available in the region where the stack is being deployed. CloudFormation validates the AMI ID during stack creation or update, and if the AMI does not exist or is inaccessible, the operation fails with a 'Resource creation cancelled' error.

Answer

The instance type t2.micro is not available in the region.

Answer

The IAM role used by CloudFormation lacks ec2:RunInstances permissions.

Answer

The stack name does not match the existing stack.

Question 15

An organization wants to ensure that all objects stored in the S3 bucket are encrypted at rest using server-side encryption with S3 managed keys (SSE-S3). The bucket policy above is intended to enforce this. However, a user reported that they can still upload unencrypted objects. What is the MOST likely reason?

Accepted Answer

The condition is applied to the GetObject action, not the PutObject action.. The bucket policy condition `s3:x-amz-server-side-encryption` is applied to the `s3:GetObject` action instead of `s3:PutObject`. This means the policy only checks encryption headers when reading objects, not when uploading them. To enforce encryption at upload time, the condition must be attached to the `s3:PutObject` action, which is the operation that accepts the `x-amz-server-side-encryption` header.

Answer

The bucket policy is not attached to the bucket because of a circular dependency.

Answer

The bucket policy does not apply to objects uploaded by the root user.

Answer

The condition should use 's3:x-amz-server-side-encryption-aws-kms-key-id' instead.