DOP-C02 Configuration Management and IaC Practice Test 18 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage its infrastructure. The stack creation recently failed because an IAM role resource was created before the AWS Lambda function that depends on it. The template has no DependsOn clauses. What is the most likely reason for this failure and how can it be fixed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a DependsOn clause to the Lambda function resource referencing the IAM role. The most likely reason for the failure is that CloudFormation, by default, parallelizes the creation of resources that do not have explicit dependencies. Since the IAM role and Lambda function have no DependsOn clause, CloudFormation may attempt to create the Lambda function before the IAM role is fully created and its permissions are propagated. Adding a DependsOn clause to the Lambda function resource referencing the IAM role ensures that CloudFormation creates the IAM role first, resolving the dependency and preventing the failure.

Answer

Use AWS Systems Manager Automation to create the resources sequentially

Answer

Use a ChangeSet to roll back the stack and modify the template

Answer

Split the template into two separate stacks and use nested stacks

Question 2

A DevOps engineer is designing a configuration management strategy for a fleet of EC2 instances running Amazon Linux 2. The instances must be bootstrapped with custom software and continuously managed to ensure desired state compliance. Which combination of services should the engineer use?

Accepted Answer

AWS Systems Manager State Manager for desired state configuration and AWS Systems Manager Run Command for initial bootstrapping. AWS Systems Manager State Manager provides a policy-driven mechanism to define and maintain desired state configuration for EC2 instances, while AWS Systems Manager Run Command enables ad-hoc or initial bootstrapping by executing scripts or commands (e.g., installing custom software) without requiring SSH. Together, they cover both the initial setup and ongoing compliance enforcement for Amazon Linux 2 instances, aligning with the requirement for continuous management.

Answer

AWS CloudFormation for bootstrapping and Amazon CloudWatch Events to enforce desired state

Answer

AWS OpsWorks for Chef Automate for configuration management and AWS CodeDeploy for deployments

Answer

AWS Config for configuration management and Amazon CloudWatch Events for remediation

Question 3

A DevOps engineer is troubleshooting a CloudFormation stack that failed to update. The error message indicates a circular dependency among resources. The template includes an Auto Scaling group, a launch template, and an IAM instance profile. The launch template references the IAM instance profile, and the Auto Scaling group references the launch template. The IAM instance profile's role references the Auto Scaling group name in its trust policy. How can the engineer resolve the circular dependency?

Accepted Answer

Pass the Auto Scaling group name as a parameter to the IAM role's trust policy, and create the Auto Scaling group with a condition that depends on the role. Resolves the circular dependency by decoupling the Auto Scaling group name from the IAM role's trust policy at template creation time. By passing the group name as a parameter and using a condition to create the Auto Scaling group only after the role exists, CloudFormation can determine the correct creation order without a circular reference. This approach allows the trust policy to reference a value that is not yet known at template parsing, breaking the dependency cycle.

Answer

Use DependsOn clauses to explicitly order the resource creation

Answer

Place the launch template and Auto Scaling group in a nested stack

Answer

Hardcode the Auto Scaling group name in the IAM role's trust policy

Question 4

A DevOps engineer is writing an AWS CloudFormation template that creates an Amazon S3 bucket with versioning enabled. The engineer wants to ensure that the bucket cannot be deleted accidentally. What should the engineer add to the template?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource. Setting the DeletionPolicy attribute to Retain on the S3 bucket resource ensures that when the CloudFormation stack is deleted, the bucket is preserved and not removed. This is the correct AWS CloudFormation mechanism to prevent accidental deletion of a resource, as it overrides the default behavior of deleting all resources when a stack is deleted.

Answer

Enable termination protection on the S3 bucket

Answer

Add a DependsOn clause to the bucket referencing the stack itself

Answer

A bucket policy that denies s3:DeleteBucket

Question 5

A company uses AWS CloudFormation StackSets to deploy a VPC across multiple AWS accounts in AWS Organizations. The StackSet is created with self-managed permissions. The deployment fails in some accounts with the error: 'Insufficient IAM permissions to create resources'. What is the most likely cause of this failure?

Accepted Answer

The execution IAM role is not created in the target accounts. With self-managed permissions in AWS CloudFormation StackSets, the administrator account does not automatically create the necessary IAM roles in target accounts. The execution IAM role must be manually created in each target account to grant StackSets the permissions required to create resources. The error 'Insufficient IAM permissions to create resources' directly indicates that this execution role is missing or lacks the required policies.

Answer

The StackSet does not support deploying to more than one account

Answer

The administrator account does not have a service-linked role for StackSets

Answer

The target accounts have reached their resource service quotas

Question 6

A DevOps engineer is designing an infrastructure as code solution for a microservices application that runs on Amazon ECS with Fargate. The application requires a shared Application Load Balancer (ALB) and multiple ECS services. Which CloudFormation resources are required to expose each service behind the ALB? (Choose THREE.)

Accepted Answer

AWS::ElasticLoadBalancingV2::Listener. AWS::ElasticLoadBalancingV2::Listener is correct because it defines the protocol and port (e.g., HTTP:80) on which the ALB accepts traffic. Without a listener, the ALB cannot receive incoming requests. This resource is essential for routing traffic to target groups that are associated with ECS services.

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Answer

AWS::AutoScaling::AutoScalingGroup

Question 7

A company uses AWS OpsWorks for configuration management. The DevOps team wants to deploy a new application version to a stack of EC2 instances. What should the team use to perform the deployment?

Accepted Answer

Custom Chef recipes in OpsWorks. AWS OpsWorks is a configuration management service that uses Chef. When you need to deploy a new application version to a stack of EC2 instances managed by OpsWorks, the native and recommended approach is to use custom Chef recipes. These recipes can be executed as a lifecycle event (e.g., Deploy) to update application code, restart services, or perform any deployment tasks directly on the instances, leveraging the existing OpsWorks agent and Chef infrastructure.

Answer

AWS Elastic Beanstalk

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 8

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the new instances fail the health check and are terminated. The deployment fails. The team wants to automatically roll back to the previous working version. What should they do?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails.. AWS CodeDeploy provides a built-in rollback configuration that can be triggered automatically when a deployment fails. By enabling automatic rollback in the deployment group settings, CodeDeploy will redeploy the last successful revision when the current deployment fails health checks, without requiring manual intervention or additional infrastructure.

Answer

Set up an Auto Scaling lifecycle hook to terminate instances and trigger a rollback.

Answer

Manually redeploy the last successful deployment revision after investigating the failure.

Answer

Configure the deployment group to automatically redeploy the same revision on failure.

Question 9

A DevOps engineer is troubleshooting an AWS OpsWorks for Chef Automate deployment. The Chef server is configured with a custom run list that includes a recipe to install and configure an application. The test environment works correctly, but in the production environment, the application fails to start. The Chef client logs show that the recipe executed successfully, but the application process is not running. What is the most likely cause of this issue?

Accepted Answer

The IAM instance profile attached to the production EC2 instance does not have the necessary permissions to start the application service.. The IAM instance profile determines the AWS API permissions available to the EC2 instance. If the profile lacks permissions to call the service startup API (e.g., `ec2:StartInstances` or `autoscaling:CompleteLifecycleAction`), or to access required resources like an EFS mount target or Secrets Manager secret, the Chef recipe's service resource may execute without error but the underlying systemd or init daemon cannot actually start the application process. The Chef client logs only show recipe execution success, not the outcome of the service start, so the application fails silently.

Answer

The OpsWorks stack is configured to use 'auto-healing' which automatically terminates and replaces instances that fail to start the application.

Answer

The Chef server in production is running a different version of Chef than the test environment, causing the recipe to behave differently.

Answer

The Chef recipe does not include a 'service' resource to start the application; it only installs the package.

Question 10

A DevOps team is using AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The team wants to add a manual approval step before the deploy stage to ensure that only authorized personnel can approve production deployments. Which action should be taken to implement this requirement?

Accepted Answer

Add a manual approval action to the pipeline between the build and deploy stages, and configure the SNS topic to notify the approvers.. AWS CodePipeline natively supports a manual approval action that can be inserted as a stage between build and deploy. This action pauses the pipeline and sends a notification via an SNS topic to the configured approvers. The pipeline only resumes when an authorized user clicks the 'Approve' button in the CodePipeline console or API, ensuring that only authorized personnel can approve production deployments.

Answer

Add an AWS Lambda function as a transition action between the build and deploy stages that sends an email to the approver and waits for a response.

Answer

Create a CodeDeploy deployment group with a manual approval step in the deployment configuration.

Answer

Configure an Amazon SNS topic to send an approval request email to the approver, and use a Lambda function to resume the pipeline upon approval.

Question 11

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 12

A DevOps team wants to enforce that all EC2 instances launched in an AWS account have a specific tag 'Environment' with value 'Production' or 'Development'. The team uses AWS CloudFormation to provision resources. Which approach should the team use to enforce tagging compliance at launch?

Accepted Answer

Use an AWS Config rule with an auto-remediation action that applies the required tag to non-compliant resources.. AWS Config rules can evaluate EC2 instances for the presence of the 'Environment' tag with allowed values and, when combined with an auto-remediation action (e.g., using AWS Systems Manager Automation), can automatically apply the missing tag to non-compliant resources. This enforces tagging compliance at launch and throughout the resource lifecycle, even if the instance was launched without the tag. The auto-remediation action can be triggered as soon as the Config rule detects non-compliance, ensuring the tag is applied shortly after launch.

Answer

Configure a CloudFormation stack policy that denies stack updates if the tag is missing.

Answer

Add an IAM policy that denies ec2:RunInstances unless the request includes the required tag.

Answer

Create an AWS Service Catalog portfolio with a tag option constraint that requires the tag.

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires environment-specific configuration values (database URL, API keys) that must be stored securely and rotated automatically. The team uses AWS Secrets Manager. Which configuration management strategy should the team implement to securely inject secrets into the Elastic Beanstalk environment?

Accepted Answer

Use an Elastic Beanstalk platform hook script that retrieves secrets from Secrets Manager and sets them as environment variables.. Elastic Beanstalk platform hooks allow custom scripts to run during deployment, enabling retrieval of secrets from AWS Secrets Manager and setting them as environment variables before the application starts. This approach keeps secrets out of the environment configuration and supports automatic rotation by having the script fetch the latest secret value on each deployment.

Answer

Store the secrets in the Elastic Beanstalk environment configuration as plain text under 'aws:elasticbeanstalk:application:environment'.

Answer

Configure Secrets Manager to automatically push secrets to Elastic Beanstalk environment properties.

Answer

Use AWS CloudFormation dynamic references to inject secrets into the Elastic Beanstalk environment.

Question 14

A DevOps engineer is responsible for managing infrastructure as code for multiple microservices. The team uses AWS CloudFormation and wants to reuse common resource definitions across multiple stacks. Which approach should the engineer use to promote reusability and reduce code duplication?

Accepted Answer

Develop CloudFormation modules that encapsulate common resource configurations and publish them in a registry.. AWS CloudFormation modules allow you to encapsulate common resource configurations into reusable, versioned components that can be published in the CloudFormation registry. This promotes reusability and reduces code duplication across multiple stacks without the overhead of managing nested stack templates or manual copying.

Answer

Create nested stacks that include the common resources and pass parameters as needed.

Answer

Store the common resource definitions in an AWS CodeCommit repository and copy them into each template.

Answer

Use cross-stack references by exporting outputs from a central stack and importing them in other stacks.

Question 15

A company uses AWS CodeDeploy for application deployments to EC2 instances. The team recently noticed that deployments are failing because some instances do not have the CodeDeploy agent installed. Which configuration management approach should the team implement to ensure the CodeDeploy agent is installed and running on all instances before deployment?

Accepted Answer

Create a custom AMI with the CodeDeploy agent pre-installed, or use a user data script to install the agent at launch.. It ensures the CodeDeploy agent is present on every EC2 instance from the moment it is launched, either by baking the agent into a custom AMI or by installing it via a user data script. This approach aligns with immutable infrastructure and configuration management best practices, preventing deployment failures caused by missing agents. AWS CodeDeploy requires the agent to be installed and running on target instances before any deployment can proceed.

Answer

Use an AWS Config rule to detect instances without the agent and trigger a Lambda function to install it.

Answer

Use the CodeDeploy deployment configuration to skip instances that do not have the agent.

Answer

Configure the CodeDeploy deployment group to automatically install the agent on new instances.