DOP-C02 Configuration Management and IaC Practice Test 17 — 15 Questions

Question 1

A company is using AWS CloudFormation to manage its infrastructure. The DevOps team wants to implement a strategy that allows for rollback in case a stack update fails. Which TWO approaches should the team consider? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use nested stacks to isolate changes; if a nested stack fails, the parent stack automatically rolls back.. AWS CloudFormation provides native rollback capabilities. Enabling 'Rollback on failure' ensures CloudFormation automatically reverts the stack to its last known good state if an update fails. Additionally, using nested stacks is a valid strategy: if a nested stack's update fails, the parent stack update fails and CloudFormation rolls back the entire stack, including reverting the nested stack to its previous state. Change sets are not a rollback mechanism; they merely preview changes. Executing a change set does not prevent partial updates or leave the stack unchanged—the stack follows the configured rollback behavior (enabled by default).

Answer

Disable the 'Rollback on failure' option and manually revert changes using the AWS Management Console.

Answer

Create and execute a change set. If the update fails, the stack remains unchanged.

Answer

Use AWS Backup to create manual snapshots of all resources before the update.

Question 2

A DevOps engineer is creating an AWS Elastic Beanstalk environment and needs to ensure that configuration changes are tracked and can be reverted. Which THREE steps should the engineer take to achieve this? (Choose THREE.)

Accepted Answer

Enable configuration drift detection using AWS Config.. AWS Config can be used to track configuration changes to Elastic Beanstalk resources (e.g., the underlying EC2 instances, security groups, and load balancers) by recording configuration items and detecting drift from the desired state. This allows the DevOps engineer to audit changes and revert to a compliant configuration if needed.

Answer

Use Elastic Beanstalk lifecycle policies to automatically retain old configurations.

Answer

Store configuration templates in the Elastic Beanstalk console, which automatically keeps version history.

Question 3

A DevOps team uses AWS OpsWorks for configuration management. They have a stack with a custom cookbook that installs and configures an application. After updating the cookbook on GitHub, they need to apply the changes to existing instances without creating new ones. What should the team do?

Accepted Answer

Use the 'Execute Recipes' feature to run the updated custom recipe on the instances.. AWS OpsWorks provides the 'Execute Recipes' feature, which allows you to run a specific recipe from a cookbook on existing instances without requiring a stack update or instance replacement. This is the direct method to apply changes from an updated custom cookbook to running instances, as it triggers Chef to execute the specified recipe immediately on the selected instances.

Answer

Clone the stack and assign the updated cookbook to the new stack.

Answer

Update the layer's custom cookbook settings and then reboot the instances.

Answer

Update the stack's custom cookbook source and click 'Update Dependencies' on the stack.

Question 4

A company uses AWS CloudFormation to manage infrastructure. They have a template that creates an Amazon RDS DB instance. The template includes a 'DeletionPolicy' attribute set to 'Retain' on the DB instance resource. The DevOps team deletes the stack. Later, they notice that the DB instance still exists and is incurring costs. What is the MOST cost-effective way to remove the DB instance?

Accepted Answer

Manually delete the DB instance using the AWS Management Console or AWS CLI.. The DB instance was created with a DeletionPolicy of 'Retain', which explicitly instructs CloudFormation to preserve the resource when the stack is deleted. Once the stack is deleted, CloudFormation no longer manages the DB instance, so the only way to remove it and stop costs is to manually delete it via the AWS Management Console or AWS CLI. This is the most cost-effective approach as it directly addresses the orphaned resource without unnecessary overhead.

Answer

Create a new CloudFormation stack that includes the same DB instance but with a DeletionPolicy of 'Delete', then delete that stack.

Answer

Use the 'aws cloudformation delete-change-set' command to remove the resource.

Answer

Update the stack: change the DeletionPolicy to 'Delete' and then delete the stack again.

Question 5

A DevOps team uses AWS CodePipeline to automate deployments. The pipeline has a Deploy stage that uses AWS CloudFormation to create or update a stack. Recently, a stack update failed because the template referenced an AMI that was deprecated. The team wants to automatically roll back the stack to the last known good state if a deployment fails. What should they do?

Accepted Answer

Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.. The CloudFormation deployment action in CodePipeline supports a 'Rollback on failure' option when 'ActionMode' is set to 'CREATE_UPDATE'. When enabled, if the stack update fails, CloudFormation automatically rolls back the stack to the last known good state (the previously deployed stack). This directly addresses the team's requirement to revert to a stable state after a failed deployment due to a deprecated AMI.

Answer

Use the CodePipeline console to enable 'Automatic rollback' for the Deploy stage.

Answer

Set the stack's 'DisableRollback' parameter to 'true' in the template.

Answer

Add a stack policy to the CloudFormation stack that denies updates to the AMI parameter.

Question 6

A developer wants to use AWS CloudFormation to create an Amazon RDS DB instance. The template includes a DB instance resource. Which property is required for the DB instance to be created successfully?

Accepted Answer

DBInstanceClass and Engine. In AWS CloudFormation, when creating an Amazon RDS DB instance using the AWS::RDS::DBInstance resource, the only truly required properties are DBInstanceClass (the compute and memory capacity) and Engine (the database engine, e.g., MySQL, PostgreSQL). These two properties are mandatory in the CloudFormation resource specification; without them, the template will fail validation. All other properties, such as AllocatedStorage, DBInstanceIdentifier, MasterUsername, and MasterUserPassword, have default behaviors or can be omitted under certain conditions (e.g., AllocatedStorage defaults to 20 GB for some engines, and MasterUsername/MasterUserPassword are not required if you use a snapshot or a source DB instance).

Answer

AllocatedStorage

Answer

DBInstanceIdentifier

Answer

MasterUsername and MasterUserPassword

Question 7

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

Accepted Answer

Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.. The UpdatePolicy attribute with AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup resources, not for AWS::RDS::DBInstance. Therefore, option D is incorrect. Options A and C are also invalid (CreationPolicy is for signal-based creation, and AutoScalingRollingUpdate is for rolling updates on Auto Scaling groups). Option B, Stack Policy, can protect resources from being updated but does not control how a replacement occurs to minimize downtime or prevent data loss. Thus, none of the provided options are correct for ensuring minimal downtime and data safety during an RDS instance class change that requires replacement.

Answer

Set the CreationPolicy attribute on the database resource.

Answer

Configure a Stack Policy to protect the database resource.

Answer

Set the UpdatePolicy to AutoScalingRollingUpdate.

Question 8

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

Accepted Answer

CreationPolicy attribute. The CreationPolicy attribute can be added to a resource to ensure that CloudFormation waits for a specified number of success signals before considering the resource created. When a stack update causes a resource replacement, CloudFormation creates the new resource, waits for the creation signals (if a CreationPolicy is defined), and only then deletes the old resource. This ensures the new resource is fully operational and tested before replacement. The other options are incorrect: UpdatePolicy with AutoScalingRollingUpdate is for updating instances in an Auto Scaling group without full replacement; DeletionPolicy Retain keeps the old resource but does not manage creation; DependsOn controls creation order but does not wait for testing signals.

Answer

UpdatePolicy attribute with AutoScalingRollingUpdate

Answer

DeletionPolicy attribute set to Retain

Answer

DependsOn attribute to specify creation order

Question 9

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create. The error message indicates a 'circular dependency' between two resources: a security group and an EC2 instance. The security group contains an ingress rule that references the instance's private IP address, which is not known until the instance is created. The instance's network interface uses the security group. What change should the engineer make to resolve the circular dependency?

Accepted Answer

Add an AWS::EC2::SecurityGroupIngress rule that references the instance's network interface using Fn::GetAtt on the network interface resource.. It resolves the circular dependency by creating an explicit dependency on the network interface resource rather than the EC2 instance. The `AWS::EC2::SecurityGroupIngress` rule can use `Fn::GetAtt` on the `AWS::EC2::NetworkInterface` resource to retrieve the private IP address of the instance's primary network interface, which is known after the network interface is created but before the instance is fully launched. This breaks the cycle because the security group ingress rule depends on the network interface, and the network interface depends on the security group (via association), but the instance itself is not directly referenced in the ingress rule, allowing CloudFormation to resolve the dependencies in the correct order.

Answer

Create the EC2 instance first without a security group, then attach the security group after creation.

Answer

Hardcode the instance's private IP address in the security group rule.

Answer

Use the Ref function on the EC2 instance to get its private IP address.

Question 10

A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?

Accepted Answer

The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.. The CloudFormation template does not include a `SecurityGroup` or `SecurityGroupIds` property in the EC2 instance's `AWS::EC2::Instance` resource. Without this explicit reference, the instance launches with the default VPC security group, not the custom security group defined in the template. The security group resource is created successfully, but it is not attached to the instance.

Answer

The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.

Answer

The security group is created after the instance, so the instance cannot reference it.

Answer

The DependsOn clause should be removed because it causes a circular dependency.

Question 11

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that critical resources, such as an RDS database, are not accidentally deleted when a stack is updated or deleted. Which CloudFormation feature should be used to prevent this?

Accepted Answer

DeletionPolicy attribute with Retain. The DeletionPolicy attribute with the Retain value is the correct choice because it explicitly instructs CloudFormation to preserve the physical resource (e.g., an RDS database) when its corresponding logical resource is deleted from the stack template during an update or when the entire stack is deleted. This prevents accidental deletion of critical stateful resources by ensuring the resource remains in the AWS account even after the stack operation completes.

Answer

Stack policy

Answer

Termination protection

Answer

DependsOn attribute

Question 12

A developer wants to provision AWS resources using AWS Cloud Development Kit (CDK) and ensure that the infrastructure can be version-controlled and reviewed. Which practice should they follow?

Accepted Answer

Write the CDK app in TypeScript, store it in a Git repository, and use CDK pipelines for deployment.. It follows the recommended practice of treating CDK application code as infrastructure source code, storing it in a version control system (Git), and using CDK Pipelines (a high-level construct that automatically synthesizes and deploys CloudFormation templates) to ensure repeatable, reviewed deployments. This approach enables infrastructure-as-code best practices: version history, peer review via pull requests, and automated deployment pipelines.

Answer

Write the CDK app and deploy directly without synthesis to avoid extra steps.

Answer

Write the CDK app to generate Terraform configurations and store them in Git.

Answer

Write raw CloudFormation templates instead of CDK to simplify version control.

Question 13

A company uses AWS Systems Manager to manage hybrid servers. They want to automate the patching of Windows servers using Patch Manager. However, some servers are not showing up in the compliance reporting. What should the DevOps engineer check first?

Accepted Answer

Ensure the SSM Agent is installed and running on the servers. The SSM Agent is the core component that enables a server to communicate with AWS Systems Manager. Without the agent installed and running, the server cannot register with the service, receive patch commands, or report its compliance status. Therefore, this is the most fundamental prerequisite to check first when servers are missing from compliance reporting.

Answer

Verify that the servers have the correct patch baseline tags

Answer

Check that the Patch Baseline is configured to include the missing servers

Answer

Confirm that the servers have an IAM service role for Systems Manager

Question 14

A company uses AWS CodeBuild to build and test code. They need to securely store sensitive parameters, such as database passwords, and inject them into the build process. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it provides secure, hierarchical storage for configuration data and secrets, such as database passwords, and integrates natively with AWS CodeBuild via the `parameter-store` environment variable type. This allows you to reference parameters without hardcoding sensitive values, and you can optionally use secure string parameters encrypted with KMS for additional protection.

Answer

Storing them in the CodeBuild project environment variables

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Question 15

A company uses AWS CloudFormation StackSets to deploy a common network infrastructure across multiple AWS accounts. They need to ensure that all StackSet operations are audited and any failed stack instances are automatically retried. Which THREE configurations should be implemented? (Select THREE.)

Accepted Answer

Configure Amazon SNS notifications for StackSet events.. To audit StackSet operations, enable AWS CloudTrail to log StackSet API calls (option E). To automatically retry failed stack instances, set the 'Retry on failure' option in StackSet operation preferences (option D). To receive notifications about StackSet events, configure Amazon SNS notifications (option B). Automatic rollback (A) is not a retry mechanism, and AWS Config rules (C) monitor compliance but do not provide audit logging or retry functionality.

Answer

Enable automatic rollback on failure.

Answer

Use AWS Config rules to monitor StackSet compliance.