DOP-C02 Configuration Management and IaC Practice Test 17 — 15 Questions

Question 1

A company uses AWS CodeDeploy for application deployments. They want to ensure that if a deployment fails, the system automatically rolls back to the previous version. Which configuration should they set?

Accepted Answer

Configure the deployment group to enable automatic rollback when a deployment fails.. Option D is correct because CodeDeploy has a built-in rollback configuration that can automatically trigger when a deployment fails. Option A is wrong because CloudFormation is for infrastructure. Option B is wrong because 'auto-rollback' is not a valid CodeDeploy property. Option C is wrong because the 'Failure' hook is for custom scripts, not automatic rollback.

Answer

Define a 'Failure' lifecycle event hook that calls a Lambda function to revert the deployment.

Answer

Set the 'auto-rollback' property in the CodeDeploy deployment group to 'true'.

Answer

Use a CloudFormation stack with a rollback configuration.

Question 2

Which TWO options are valid approaches for managing configuration drift in an AWS environment? (Choose two.)

Accepted Answer

Use AWS Config rules to evaluate resource configurations against desired policies.. Option A is correct because AWS Config can detect drift from desired configuration. Option D is correct because CloudFormation drift detection identifies changes to resources. Option B is wrong because Systems Manager Patch Manager is for patching, not drift detection. Option C is wrong because CloudTrail is for API logging. Option E is wrong because CodePipeline is for CI/CD.

Answer

Use AWS CodePipeline to automatically redeploy infrastructure when changes are detected.

Answer

Use AWS Systems Manager Patch Manager to keep instances patched.

Answer

Use AWS CloudTrail to monitor API calls that modify resources.

Question 3

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Accepted Answer

Use a service role with least privilege when creating the stack.. Option A is correct because IAM policies can restrict who can create/modify stacks. Option C is correct because stack policies protect critical resources during updates. Option D is correct because using service roles follows least privilege. Option B is wrong because there is no 'StackSetPolicy' property. Option E is wrong because deletion policies are for individual resources, not the whole stack.

Answer

Set a DeletionPolicy on the stack to retain resources when the stack is deleted.

Answer

Define a StackSetPolicy to control permissions across accounts.

Question 4

Which TWO AWS services can be used to automate the configuration of EC2 instances at launch? (Choose two.)

Accepted Answer

EC2 user data. Option B is correct because EC2 user data can run scripts at launch. Option D is correct because AWS CloudFormation can bootstrap instances with configuration. Option A is wrong because AWS Config is for monitoring. Option C is wrong because Amazon Inspector is for security scanning. Option E is wrong because Amazon CloudWatch is for monitoring.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 5

A DevOps team is troubleshooting a CloudFormation stack creation failure. The stack uses a service role with the trust policy shown in the exhibit. The error message states: 'Insufficient permissions to create the resource'. Which action should the team take to resolve this issue?

Accepted Answer

Attach IAM policies to the service role that grant permissions to create the resources.. Option B is correct because the service role's trust policy allows CloudFormation to assume it, but the role itself needs permissions to create resources. Option A is wrong because the trust policy is correct. Option C is wrong because adding a trust policy is for the stack's role. Option D is wrong because CloudFormation does not need to assume the user role.

Answer

Modify the CloudFormation template to use the user's IAM role instead of a service role.

Answer

Create a new stack policy that allows the required actions.

Answer

Add the user's IAM role to the trust policy.

Question 6

A DevOps engineer runs the command shown in the exhibit. The output shows the stack status as ROLLBACK_COMPLETE. Which statement best describes the current state of the stack?

Accepted Answer

The stack creation failed and has been rolled back. No resources remain.. Option B is correct because ROLLBACK_COMPLETE means the stack creation failed and rolled back, leaving no resources. Option A is wrong because that would be CREATE_COMPLETE. Option C is wrong because UPDATE_ROLLBACK_COMPLETE is for updates. Option D is wrong because ROLLBACK_IN_PROGRESS is the intermediate state.

Answer

The stack was created successfully and is in a steady state.

Answer

The stack update failed and has been rolled back to the previous state.

Answer

The stack is currently in the process of rolling back after a failed creation.

Question 7

A DevOps engineer deploys the CloudFormation snippet shown in the exhibit. After the stack is deleted, the engineer checks for the S3 bucket. Which statement best describes the outcome?

Accepted Answer

The bucket is retained (not deleted) after the stack deletion.. Option C is correct because the DeletionPolicy: Retain ensures the bucket is not deleted when the stack is deleted. Option A is wrong because the bucket is retained. Option B is wrong because the bucket exists. Option D is wrong because the stack deletion succeeds, but the bucket remains.

Answer

The bucket is deleted because the stack deletion overrides the DeletionPolicy.

Answer

The stack deletion fails because the bucket has versioning enabled.

Answer

The bucket is deleted along with the stack because the DeletionPolicy is not supported for S3 buckets.

Question 8

A company uses AWS CloudFormation to manage its infrastructure. The Operations team needs to update a stack that contains an EC2 instance. They want to change the instance type from t2.micro to t2.small without recreating the instance. Which CloudFormation stack update policy should they use?

Accepted Answer

Use an UpdatePolicy with AutoScalingRollingUpdate. Option D is correct because the 'UpdatePolicy: AutoScalingRollingUpdate' attribute can be used to update instance types without interruption when associated with an Auto Scaling group or EC2 instances with a creation policy. Option A is wrong because Replacement policy dictates whether to replace or update a resource. Option B is wrong because CreationPolicy is used to wait for signals before considering the resource created. Option C is wrong because DeletionPolicy only defines what happens when a resource is deleted.

Answer

Use a ChangeSet with Replacement set to False

Answer

Use a CreationPolicy with a Timeout

Answer

Use a DeletionPolicy with Retain

Question 9

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that fails during the 'BeforeInstall' lifecycle event. The deployment group uses an in-place deployment to an Auto Scaling group. The engineer reviews the logs on the instance and sees that the 'BeforeInstall' script exits with code 1. The script is a shell script that compiles application code. What is the most likely cause of the failure?

Accepted Answer

The script exited with a non-zero exit code. Option B is correct because CodeDeploy expects scripts to exit with 0 for success; any non-zero exit code is treated as a failure and the deployment stops. Option A is wrong because missing dependencies would typically cause compilation errors, but the script still exits with non-zero. Option C is wrong because CodeDeploy does not require scripts to be owned by root; any user with execute permission can run them. Option D is wrong because the script should be in the appspec.yml's 'files' section.

Answer

The script is not included in the 'files' section of the appspec.yml

Answer

The script requires dependencies that are not installed on the instance

Answer

The script is not owned by the root user

Question 10

A company uses AWS Systems Manager to manage its EC2 instances at scale. The DevOps team wants to ensure that all instances are patched with the latest security updates. Which Systems Manager capability should they use to automate patching?

Accepted Answer

Patch Manager. Option C is correct because Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates. Option A is wrong because State Manager is used to define and maintain consistent configuration, not specifically patching. Option B is wrong because Automation is used for common maintenance and deployment tasks but not specifically for patching. Option D is wrong because Run Command is used to execute scripts or commands remotely, not for automated patching.

Answer

Run Command

Answer

Automation

Answer

State Manager

Question 11

A company uses AWS OpsWorks for configuration management. They have a stack with a layer that includes several EC2 instances. The DevOps engineer needs to deploy a custom configuration file to all instances in the layer. What is the recommended approach?

Accepted Answer

Create a custom Chef recipe and assign it to the layer's lifecycle events. Option A is correct because OpsWorks allows custom recipes to be associated with lifecycle events, which can deploy configuration files. Option B is wrong because custom JSON is for overriding stack settings, not for deploying files. Option C is wrong because user data only runs at launch. Option D is wrong because Run Command is for ad-hoc commands, not for ongoing configuration management.

Answer

Use custom JSON in the stack settings to specify the file content

Answer

Use AWS Systems Manager Run Command to copy the file

Answer

Add the file to the instance's user data script

Question 12

A company uses Terraform to manage AWS infrastructure. They have a state file stored in an S3 bucket with DynamoDB locking. After a failed 'terraform apply', the state file is locked. The DevOps engineer tries to run 'terraform plan' but gets an error: 'Error acquiring the state lock'. What should the engineer do to resolve this issue?

Accepted Answer

Run 'terraform force-unlock' with the lock ID. Option D is correct because the lock is stored in DynamoDB and can be forcefully removed using 'terraform force-unlock' after verifying no other process is using it. Option A is wrong because deleting the S3 bucket would lose the state. Option B is wrong because modifying the DynamoDB table directly is not recommended. Option C is wrong because waiting indefinitely is not a solution.

Answer

Manually delete the lock item from the DynamoDB table

Answer

Wait for the lock to expire automatically

Answer

Delete the state file from S3 and re-run terraform init

Question 13

A company wants to use AWS Elastic Beanstalk to deploy a web application. They need to ensure that the application can be updated with zero downtime. Which deployment policy should they use?

Accepted Answer

Rolling. The Rolling deployment policy in AWS Elastic Beanstalk updates instances in batches, replacing a subset of the current environment's instances with new ones while keeping the rest serving traffic. This ensures that the application remains available throughout the update process, achieving zero downtime as long as the health check passes for each batch before proceeding.

Answer

Immutable

Answer

All at once

Answer

Traffic splitting

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group, and an RDS database. The DevOps engineer needs to update the stack to change the DB instance type. The engineer wants to minimize downtime. Which strategy should they use?

Accepted Answer

Create a new DB instance with the new type, update the application stack to point to the new DB, then remove the old DB. Option D is correct because using a 'Replacement' update policy for the DB instance will create a new DB instance and then delete the old one. However, to minimize downtime, the engineer can create a new DB instance first (by updating the logical ID) and then update the application to point to the new one before removing the old one. Option A is wrong because updating in place causes downtime. Option B is wrong because creating a new stack and migrating traffic is possible but not the best practice for a single stack. Option C is wrong because Multi-AZ is for high availability, not for updates.

Answer

Create a new CloudFormation stack with the new DB instance type and update DNS to point to the new DB

Answer

Modify the DB instance to use Multi-AZ deployment before the update

Answer

Update the stack directly by changing the DBInstanceType property

Question 15

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The DevOps engineer notices that the pipeline fails intermittently during the deploy stage with the error: 'The deployment failed because the deployment group does not exist'. What is the most likely cause?

Accepted Answer

The deployment group was deleted or renamed after the pipeline was configured. Option B is correct because the deployment group is configured in CodeDeploy, and if the pipeline's deploy stage references a deployment group that does not exist, it will fail. Option A is wrong because IAM roles would cause a different error. Option C is wrong because insufficient capacity would cause a deployment error, not a missing group. Option D is wrong because the application name would also cause a different error.

Answer

The Auto Scaling group associated with the deployment group has insufficient capacity

Answer

The CodePipeline service role does not have permission to call CodeDeploy

Answer

The CodeDeploy application name in the pipeline is misspelled