DOP-C02 Configuration Management and IaC Practice Test 18 — 15 Questions

Question 1

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Accepted Answer

Use a service role with least privilege when creating the stack.. Using a service role with least privilege ensures that CloudFormation operates with only the permissions necessary to create, update, and delete resources, rather than inheriting the user's broader permissions. This decouples the user's IAM permissions from the stack's runtime actions, reducing the risk of privilege escalation and unintended resource modifications.

Answer

Set a DeletionPolicy on the stack to retain resources when the stack is deleted.

Answer

Define a StackSetPolicy to control permissions across accounts.

Question 2

Which TWO AWS services can be used to automate the configuration of EC2 instances at launch? (Choose two.)

Accepted Answer

EC2 user data. EC2 user data allows you to specify scripts or cloud-init directives that run automatically during the first boot cycle of an EC2 instance. This enables automated software installation, configuration, and post-launch tasks without manual intervention, making it a core tool for instance configuration at launch.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 3

A DevOps team is troubleshooting a CloudFormation stack creation failure. The stack uses a service role with the trust policy shown in the exhibit. The error message states: 'Insufficient permissions to create the resource'. Which action should the team take to resolve this issue?

Accepted Answer

Attach IAM policies to the service role that grant permissions to create the resources.. The error 'Insufficient permissions to create the resource' indicates that the service role used by CloudFormation lacks the necessary IAM permissions to perform the resource creation actions. The trust policy shown in the exhibit allows CloudFormation to assume the role, but the role itself must have IAM policies attached that grant the required permissions (e.g., ec2:*, s3:*). Option D is correct because attaching the appropriate IAM policies to the service role resolves the permission issue.

Answer

Modify the CloudFormation template to use the user's IAM role instead of a service role.

Answer

Create a new stack policy that allows the required actions.

Answer

Add the user's IAM role to the trust policy.

Question 4

A DevOps engineer runs the command shown in the exhibit. The output shows the stack status as ROLLBACK_COMPLETE. Which statement best describes the current state of the stack?

Accepted Answer

The stack creation failed and has been rolled back. No resources remain.. The ROLLBACK_COMPLETE status in AWS CloudFormation indicates that a stack creation or update operation failed and the stack has been fully rolled back. When a stack creation fails and rolls back, CloudFormation deletes all resources that were created during the failed creation attempt, leaving no resources remaining. This is the correct interpretation for a stack that was being created (not updated) and ended in ROLLBACK_COMPLETE.

Answer

The stack was created successfully and is in a steady state.

Answer

The stack update failed and has been rolled back to the previous state.

Answer

The stack is currently in the process of rolling back after a failed creation.

Question 5

A DevOps engineer deploys the CloudFormation snippet shown in the exhibit. After the stack is deleted, the engineer checks for the S3 bucket. Which statement best describes the outcome?

Accepted Answer

The bucket is retained (not deleted) after the stack deletion.. S3 bucket versioning has no bearing on this stack's deletion mechanics since the bucket uses DeletionPolicy: Retain, so CloudFormation never attempts to delete the physical bucket. More generally, versioning is a bucket-level data-protection feature; it does not, by itself, cause a CloudFormation stack deletion to fail. However, note that CloudFormation does NOT automatically empty a bucket's object versions and delete markers before deleting it -- if DeletionPolicy were Delete (the default) and the bucket were non-empty (including having any object versions), the stack deletion would fail with a 'bucket not empty' error, requiring a custom resource or manual emptying first. Because this stack uses Retain, the deletion action is never attempted, so the bucket -- and any versioned objects in it -- persists after the stack is deleted.

Answer

The bucket is deleted because the stack deletion overrides the DeletionPolicy.

Answer

The stack deletion fails because the bucket has versioning enabled.

Answer

The bucket is deleted along with the stack because the DeletionPolicy is not supported for S3 buckets.

Question 6

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that fails during the 'BeforeInstall' lifecycle event. The deployment group uses an in-place deployment to an Auto Scaling group. The engineer reviews the logs on the instance and sees that the 'BeforeInstall' script exits with code 1. The script is a shell script that compiles application code. What is the most likely cause of the failure?

Accepted Answer

The script exited with a non-zero exit code. In AWS CodeDeploy, lifecycle event scripts must exit with a status code of 0 to indicate success. Any non-zero exit code, including 1, is interpreted as a failure, causing the deployment to abort. Since the 'BeforeInstall' script exits with code 1, the deployment fails regardless of the script's intent or content.

Answer

The script is not included in the 'files' section of the appspec.yml

Answer

The script requires dependencies that are not installed on the instance

Answer

The script is not owned by the root user

Question 7

A company uses AWS Systems Manager to manage its EC2 instances at scale. The DevOps team wants to ensure that all instances are patched with the latest security updates. Which Systems Manager capability should they use to automate patching?

Accepted Answer

Patch Manager. Patch Manager is the correct choice because it is the dedicated AWS Systems Manager capability designed to automate the process of patching managed instances with security updates and other types of updates. It uses patch baselines to define which patches should be installed and can schedule patching on a recurring basis, ensuring compliance across the EC2 fleet.

Answer

Run Command

Answer

Automation

Answer

State Manager

Question 8

A company uses AWS OpsWorks for configuration management. They have a stack with a layer that includes several EC2 instances. The DevOps engineer needs to deploy a custom configuration file to all instances in the layer. What is the recommended approach?

Accepted Answer

Create a custom Chef recipe and assign it to the layer's lifecycle events. AWS OpsWorks is a configuration management service that uses Chef. The recommended approach to deploy custom configuration files to all instances in a layer is to create a custom Chef recipe and assign it to the layer's lifecycle events (e.g., Setup, Configure, Deploy, or Shutdown). This ensures the recipe runs automatically on every instance in the layer at the appropriate stage of the instance lifecycle, providing a consistent and idempotent deployment method.

Answer

Use custom JSON in the stack settings to specify the file content

Answer

Use AWS Systems Manager Run Command to copy the file

Answer

Add the file to the instance's user data script

Question 9

A company uses Terraform to manage AWS infrastructure. They have a state file stored in an S3 bucket with DynamoDB locking. After a failed 'terraform apply', the state file is locked. The DevOps engineer tries to run 'terraform plan' but gets an error: 'Error acquiring the state lock'. What should the engineer do to resolve this issue?

Accepted Answer

Run 'terraform force-unlock' with the lock ID. Terraform uses DynamoDB to implement state locking, and after a failed apply, the lock entry remains in the table. The `terraform force-unlock` command with the specific lock ID (obtained from the error message or via `terraform lock` commands) is the designed mechanism to manually release a stuck lock without corrupting the state file. This approach preserves the existing state and avoids data loss.

Answer

Manually delete the lock item from the DynamoDB table

Answer

Wait for the lock to expire automatically

Answer

Delete the state file from S3 and re-run terraform init

Question 10

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The DevOps engineer notices that the pipeline fails intermittently during the deploy stage with the error: 'The deployment failed because the deployment group does not exist'. What is the most likely cause?

Accepted Answer

The deployment group was deleted or renamed after the pipeline was configured. The intermittent 'deployment group does not exist' error indicates that the deployment group referenced in the CodePipeline deploy stage configuration is missing at the time of execution. This most commonly occurs when the deployment group has been deleted or renamed after the pipeline was initially configured, causing the pipeline to reference a non-existent resource. Since the error is intermittent, it suggests the deployment group may be deleted and recreated or renamed during certain operations, rather than a permanent misconfiguration.

Answer

The Auto Scaling group associated with the deployment group has insufficient capacity

Answer

The CodePipeline service role does not have permission to call CodeDeploy

Answer

The CodeDeploy application name in the pipeline is misspelled

Question 11

A company uses AWS CodeBuild to compile and test code. The buildspec.yml file includes commands that require access to a private S3 bucket. The DevOps engineer wants to securely provide AWS credentials to the build project. What is the recommended approach?

Accepted Answer

Use a service role for CodeBuild with appropriate permissions. The recommended approach is to use a service role for CodeBuild with appropriate permissions. CodeBuild can assume an IAM role that grants the build project access to the private S3 bucket, eliminating the need to manage long-term credentials. This follows AWS best practices for secure credential management by using temporary, automatically rotated credentials via the AWS Security Token Service (STS).

Answer

Store the AWS access key ID and secret access key in the buildspec.yml file

Answer

Use an EC2 instance profile attached to the build environment

Answer

Pass the credentials as environment variables in the build project configuration

Question 12

A company uses AWS OpsWorks for Chef Automate. They have a stack that includes a PHP application layer. The application requires a custom PHP configuration file. The DevOps engineer creates a custom Chef cookbook with a recipe that deploys the configuration file. The recipe is assigned to the layer's Setup lifecycle event. The engineer notices that the configuration file is not being created on new instances when they are added to the layer. The cookbook is stored in a private S3 bucket. The engineer has verified that the cookbook is correctly associated with the stack. What should the engineer do to fix the issue?

Accepted Answer

Ensure that the instance profile has permissions to read from the S3 bucket where the cookbook is stored. The issue is that the custom cookbook is stored in a private S3 bucket. For new instances to access the cookbook during the Setup lifecycle event, the instance must have the necessary IAM permissions to read from that S3 bucket. The instance profile attached to the OpsWorks stack's instances must include a policy that grants s3:GetObject for the cookbook's S3 bucket. Without these permissions, the instance cannot download the cookbook, so the recipe never runs. Therefore, the engineer should ensure that the instance profile has permissions to read from the S3 bucket. Option A is incorrect because the Setup lifecycle event is appropriate for deploying configuration files when the instance is being set up; moving to Configure would run later and might not achieve the same result. Option B is incorrect because the issue is not about the recipe being in default.rb; the cookbook is correctly associated, and the recipe is assigned to the layer lifecycle event directly, not necessarily via default.rb. Option C is incorrect because updating the cookbook version would not address the access permissions issue.

Answer

Assign the recipe to the Configure lifecycle event instead of Setup

Answer

Verify that the recipe is included in the cookbook's default.rb file

Answer

Update the cookbook version to the latest

Question 13

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that stack updates do not accidentally delete critical resources like a database. Which CloudFormation stack policy should they apply to protect the database resource?

Accepted Answer

Create a stack policy that denies delete actions on the logical resource ID of the database.. A CloudFormation stack policy allows you to define resource-level permissions that prevent specific resources (identified by their logical resource ID) from being updated or deleted during a stack update. By creating a policy that denies delete actions on the database's logical resource ID, the DevOps team ensures that even if the template or parameters change, the database resource cannot be accidentally removed.

Answer

Apply an IAM policy that denies cloudformation:DeleteStack on the database.

Answer

Use an S3 bucket policy to deny deletion of the database snapshot.

Answer

Enable termination protection on the CloudFormation stack.

Question 14

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an AWS::EC2::Instance with a UserData script. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]. The requested configuration is currently not supported. Please check the documentation for supported configurations.' The engineer suspects the instance type is not supported in the selected Availability Zone. Which action should the engineer take to resolve this issue and ensure successful stack creation?

Accepted Answer

Add an Availability Zone parameter and map it to an AZ that supports the instance type, or use the AWS::EC2::Instance AvailabilityZone property to specify an AZ that supports the instance type.. The error indicates the instance type is not supported in the default Availability Zone (AZ) selected by CloudFormation. By explicitly specifying an AZ that supports the instance type via the `AvailabilityZone` property or by parameterizing the AZ, the engineer can override the default AZ selection and resolve the incompatibility. This approach directly addresses the root cause without changing the instance type or region.

Answer

Use AWS OpsWorks to deploy the instance instead of CloudFormation.

Answer

Change the instance type to a previous generation that is supported in all AZs.

Answer

Modify the template to specify a different region that supports the instance type.

Question 15

A company uses AWS Elastic Beanstalk to deploy a Java web application. The DevOps team wants to ensure that configuration changes are tracked and can be rolled back if needed. Which Elastic Beanstalk feature should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and restore them if needed.. Elastic Beanstalk saved configurations allow you to capture the environment's configuration settings (e.g., instance type, environment variables, platform version) as a JSON file stored in S3. This enables you to restore or recreate an environment with the exact same settings, providing a straightforward rollback mechanism for configuration changes without relying on external tools or pipelines.

Answer

Use AWS CodeCommit to store configuration files and version them.

Answer

Use AWS CodePipeline with a manual approval stage to track changes.

Answer

Use AWS CloudFormation change sets to review changes before deployment.