DOP-C02 Configuration Management and IaC Practice Test 17 — 15 Questions

Question 1

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a script on all instances that have a specific tag 'Environment:Development'. Which Systems Manager capability should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run Command. Run Command is the correct capability because it allows you to remotely and securely execute scripts or commands on targeted EC2 instances using AWS Systems Manager. You can target instances by specifying tags, such as 'Environment:Development', and Run Command will execute the script on all matching instances without requiring SSH or RDP access.

Answer

Inventory

Answer

Patch Manager

Answer

State Manager

Question 2

A company uses Chef for configuration management of their EC2 instances. They want to use AWS OpsWorks for Chef Automate to manage the Chef server. What is the primary benefit of using OpsWorks for Chef Automate compared to running a self-managed Chef server?

Accepted Answer

It reduces operational overhead by managing the Chef server's infrastructure.. The primary benefit of AWS OpsWorks for Chef Automate is that it reduces operational overhead by managing the Chef server's infrastructure, including patching, backups, scaling, and high availability. This allows teams to focus on authoring cookbooks and managing node configurations rather than maintaining the Chef server itself.

Answer

It provides a graphical user interface to author cookbooks.

Answer

It creates cookbooks based on the instance configuration.

Answer

It automatically applies cookbooks to all instances in the account.

Question 3

A company uses AWS CloudFormation StackSets to deploy a common security baseline across multiple AWS accounts. They have a new account that needs to be added to the StackSet. The StackSet is configured with self-service permissions and uses a service-managed IAM role. What must be done to include the new account?

Accepted Answer

Add the new account to the AWS Organization.. When a StackSet uses service-managed permissions, it relies on AWS Organizations to manage accounts. To include a new account, you must add it to the AWS Organization; the StackSet will automatically deploy stack instances to that account based on the specified organizational units (OUs) or accounts. This is because service-managed permissions use a service-linked role created and managed by CloudFormation, not a manually created IAM role in the target account.

Answer

Create an IAM role in the new account that trusts the StackSet.

Answer

Create a new StackSet that includes the new account.

Answer

Manually create a stack instance for the new account in the StackSet.

Question 4

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack creation. The stack creates an EC2 instance with a user data script that runs a configuration management tool. The instance launches successfully, but the user data script fails. How can the engineer retrieve the user data execution logs to debug the issue?

Accepted Answer

Access the instance via EC2 Instance Connect and check /var/log/cloud-init-output.log.. The user data script output is logged by cloud-init to /var/log/cloud-init-output.log on the EC2 instance. By using EC2 Instance Connect to access the instance, the engineer can directly read this log file to see the full execution output, including any error messages from the configuration management tool.

Answer

Use AWS CloudTrail to view the user data execution events.

Answer

Use AWS Systems Manager Run Command to retrieve the logs remotely.

Answer

Check the CloudWatch Logs group for the instance.

Question 5

A company uses AWS Elastic Beanstalk with a custom platform. They need to update the platform version to include a new security patch. Which approach should be used to create a new custom platform version?

Accepted Answer

Create a new platform version using the aws elasticbeanstalk create-platform-version command with an updated platform definition file.. AWS Elastic Beanstalk custom platforms are defined using a platform definition file (a YAML or JSON file that specifies the AMI, Chef recipes, and other configuration). To create a new platform version with an updated security patch, you must update this platform definition file (e.g., to reference a new base AMI with the patch) and then run the `aws elasticbeanstalk create-platform-version` CLI command. This command packages the definition file and uploads it to Elastic Beanstalk, which then builds and registers the new platform version. The other options either bypass the custom platform framework or are not supported operations.

Answer

Use the Elastic Beanstalk CLI to rebuild the platform with the new AMI.

Answer

Launch a new EC2 instance, apply the patch, and create an AMI, then update the platform version.

Answer

Modify the existing platform version's AMI ID using the Elastic Beanstalk console.

Question 6

A CloudFormation template includes the following resource:

MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: My security group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890
      InstanceType: t2.micro
      SecurityGroupIds: !Ref MySecurityGroup

The stack creation fails with the error shown. What is the cause?

Accepted Answer

The SecurityGroupIds property must be a list, but !Ref returns a single value.. The error occurs because the `SecurityGroupIds` property expects a list of security group IDs, but the `!Ref` intrinsic function returns a single security group ID (a string), not a list. In CloudFormation, `!Ref` for a security group returns its ID as a scalar value, so wrapping it in a list (e.g., `[!Ref MySecurityGroup]`) is required to satisfy the `List<String>` type constraint.

Answer

The SecurityGroupIds property must be a list of security group names, not IDs.

Answer

The security group ingress rule is invalid because it allows all traffic.

Answer

The ImageId is missing, so the security group validation fails first.

Question 7

A company uses AWS CloudFormation to deploy a web application across multiple AWS accounts using StackSets. The DevOps team notices that stack instance updates are failing in some accounts with the error: 'Insufficient IAM permissions to perform the action'. The team has already verified that the StackSet IAM role has the necessary permissions. What is the most likely cause of this issue?

Accepted Answer

The target accounts do not have the necessary trust policy to allow the StackSet IAM role to assume the execution role.. StackSets require a trust relationship between the StackSet IAM role (in the management account) and an execution role in each target account. Even if the StackSet IAM role has full permissions, the target accounts must have a trust policy that allows the StackSet IAM role to assume the execution role. Without this trust policy, the assumption fails, resulting in the 'Insufficient IAM permissions' error.

Answer

The target accounts have reached the limit of 200 stacks per region.

Answer

AWS Organizations has a service control policy (SCP) that denies the required action, but the StackSet IAM role has full admin permissions.

Answer

The StackSet name contains invalid characters that are not allowed in some accounts.

Question 8

A DevOps team is designing a configuration management solution for a microservices architecture running on Amazon ECS. The team wants to ensure that container configurations are automatically updated when a new version of a parameter is stored in AWS Systems Manager Parameter Store. Which approach best meets this requirement with minimal operational overhead?

Accepted Answer

Use AWS AppConfig to create a configuration profile that references the parameter. Configure a Lambda function as a validator and deploy strategy. When the parameter changes, AppConfig triggers a deployment that updates the ECS service.. AWS AppConfig is purpose-built for managing application configuration and supports automatic deployment of configuration changes to ECS services when a parameter in Systems Manager Parameter Store is updated. By creating a configuration profile that references the parameter, AppConfig can trigger a deployment that updates the ECS service without requiring custom code or manual intervention, minimizing operational overhead.

Answer

Use an AWS CloudFormation custom resource that updates the ECS service when the parameter changes.

Answer

Use a CI/CD pipeline that monitors the parameter store and triggers a new build and deploy of the container image with the updated parameter.

Answer

Use Amazon EventBridge to detect changes to the parameter and invoke a Lambda function that updates the ECS task definition and forces a new deployment.

Question 9

A company uses AWS OpsWorks for configuration management of its EC2 instances. The DevOps team wants to apply a new security patch to all instances in a specific layer. What is the most efficient way to accomplish this?

Accepted Answer

Update the layer's custom Chef recipe to include the patch and trigger a lifecycle event to execute the recipe on all instances.. OpsWorks uses Chef to manage configuration, and updating the layer's custom Chef recipe to include the security patch allows you to trigger a lifecycle event (e.g., 'Setup' or 'Configure') that runs the recipe on all instances in that layer simultaneously. This approach is efficient, automated, and leverages OpsWorks' built-in configuration management without manual intervention or stack migration.

Answer

Create a new OpsWorks stack with the patch and migrate instances to it.

Answer

SSH into each instance and run the patch command manually.

Answer

Use AWS Systems Manager Run Command to run a patch command on each instance individually.

Question 10

A DevOps team uses AWS Elastic Beanstalk to deploy a web application. They want to implement a blue/green deployment strategy to minimize downtime. Which configuration change should they make?

Accepted Answer

Create a new environment and perform a CNAME swap.. Blue/green deployment in AWS Elastic Beanstalk is achieved by creating a separate environment (the 'green' environment) with the new application version, then swapping the CNAME of the existing 'blue' environment to point to the green environment. This CNAME swap is instantaneous and does not require DNS propagation, minimizing downtime. Option A correctly describes this process.

Answer

Set the deployment policy to 'All at once'.

Answer

Set the deployment policy to 'Rolling' with a batch size of 50%.

Answer

Set the deployment policy to 'Immutable'.

Question 11

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon RDS DB instance. The DevOps team wants to update the DB instance class without downtime. What should they do?

Accepted Answer

Modify the DB instance class using an RDS blue/green deployment, then update the CloudFormation stack to match the new class.. RDS blue/green deployments allow you to make changes (such as modifying the DB instance class) with minimal downtime by creating a staging environment that mirrors the production environment. After the change is applied and verified, the blue/green deployment switches traffic to the new environment, ensuring zero or near-zero downtime. Subsequently, updating the CloudFormation stack to match the new class keeps the infrastructure code in sync with the actual deployed resources.

Answer

Use a CloudFormation stack update with a 'ReplaceOnDelete' deletion policy on the DB instance.

Answer

Create a new DB instance with the new class, update the application to point to the new endpoint, and delete the old instance.

Answer

Update the DBInstanceClass property in the CloudFormation template and set 'ApplyImmediately: true'.

Question 12

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a script on all instances that have a specific tag 'Environment:Development'. Which Systems Manager capability should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patch Manager. Patch Manager is the correct Systems Manager capability because it is specifically designed to automate the process of patching managed instances with security updates and other types of patches. It can scan for missing patches and enforce compliance by applying patches on a schedule or on demand, directly addressing the requirement to ensure all EC2 instances have a specific security patch installed.

Answer

Automation

Answer

Parameter Store

Answer

State Manager

Question 13

A DevOps team is troubleshooting a CloudFormation stack creation failure. The error message states: 'CREATE_FAILED: Resource handler returned message: "You have attempted to create more resources than the current AWS account limit"'. Which step should the team take to resolve this issue?

Accepted Answer

Check the current service limits for the resource type and request a limit increase from AWS Support.. The error message explicitly indicates that the CloudFormation stack creation failed because the AWS account has reached a service limit for a specific resource type. Option D is correct because the team must first identify which resource type exceeded its limit (e.g., EC2 instances, VPCs, or IAM roles) by checking the AWS Service Quotas console or using the Trusted Advisor dashboard, then request a limit increase from AWS Support. Simply retrying the stack creation or modifying IAM permissions will not resolve a hard service quota violation.

Answer

Delete the failed stack and recreate it with the same template.

Answer

Review the IAM permissions for the CloudFormation service role.

Answer

Modify the CloudFormation template to use a different resource type.

Question 14

A company uses AWS CodeDeploy for application deployments. They want to ensure that if a deployment fails, the system automatically rolls back to the previous version. Which configuration should they set?

Accepted Answer

Configure the deployment group to enable automatic rollback when a deployment fails.. AWS CodeDeploy provides a built-in automatic rollback feature that can be configured at the deployment group level. When enabled, CodeDeploy automatically reverts the deployment to the last known successful version if the deployment fails or reaches a specified alarm threshold, without requiring custom scripting or external orchestration.

Answer

Define a 'Failure' lifecycle event hook that calls a Lambda function to revert the deployment.

Answer

Set the 'auto-rollback' property in the CodeDeploy deployment group to 'true'.

Answer

Use a CloudFormation stack with a rollback configuration.

Question 15

Which TWO options are valid approaches for managing configuration drift in an AWS environment? (Choose two.)

Accepted Answer

Use AWS Config rules to evaluate resource configurations against desired policies.. AWS Config rules continuously evaluate your resource configurations against desired policies defined in managed or custom rules. When a resource configuration changes and violates a rule, AWS Config can trigger remediation actions or notify you, directly addressing configuration drift by detecting non-compliant resources in near real-time.

Answer

Use AWS CodePipeline to automatically redeploy infrastructure when changes are detected.

Answer

Use AWS Systems Manager Patch Manager to keep instances patched.

Answer

Use AWS CloudTrail to monitor API calls that modify resources.