DOP-C02 Configuration Management and IaC Practice Test 18 — 15 Questions

Question 1

A company uses AWS CodeBuild to compile and test code. The buildspec.yml file includes commands that require access to a private S3 bucket. The DevOps engineer wants to securely provide AWS credentials to the build project. What is the recommended approach?

Accepted Answer

Use a service role for CodeBuild with appropriate permissions. Option C is correct because the recommended approach is to use a CodeBuild service role that grants access to the S3 bucket. Option A is wrong because access keys should not be hardcoded. Option B is wrong because instance profiles are for EC2, not CodeBuild. Option D is wrong because environment variables are not secure.

Answer

Store the AWS access key ID and secret access key in the buildspec.yml file

Answer

Use an EC2 instance profile attached to the build environment

Answer

Pass the credentials as environment variables in the build project configuration

Question 2

A company uses AWS CloudFormation to manage infrastructure. They have a nested stack that creates an ECS cluster. The parent stack fails with the error: 'The following resource(s) failed to create: [ECSCluster]'. Which TWO are possible causes? (Choose TWO.)

Accepted Answer

The parent stack's IAM role does not have permission to create the nested stack's resources. Options A and B are correct. A: The parent stack might not have permission to create the nested stack's resources because of insufficient IAM permissions. B: The nested stack template might contain syntax errors. Option C is wrong because nested stacks can be in a different region if using cross-region references. Option D is wrong because the nested stack's name does not need to be unique globally. Option E is wrong because outputs from nested stacks can be used by the parent.

Answer

The parent stack is referencing an output from the nested stack that does not exist

Answer

The nested stack is in a different AWS region from the parent stack

Answer

The nested stack's name is not unique among all stacks in the account

Question 3

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the latest security patches are applied to all instances. Which THREE steps should they include in their Ansible playbook? (Choose THREE.)

Accepted Answer

Use the 'command' module to run 'yum update -y'. Options A, B, and D are correct. A: Using the 'yum' module to update packages. B: Using the 'command' module to run 'yum update -y'. D: Using the 'package' module to update all packages. Option C is wrong because the 'service' module is for managing services, not patching. Option E is wrong because 'copy' is for files, not package updates.

Answer

Use the 'service' module to restart services after patching

Answer

Use the 'copy' module to download patch files

Question 4

A company uses AWS Config to evaluate resource compliance. They have a custom AWS Config rule that checks whether EC2 instances have a specific tag. The rule is triggered by configuration changes. The DevOps engineer notices that the rule evaluation results show 'NON_COMPLIANT' for some instances that actually have the tag. Which TWO could be causes? (Choose TWO.)

Accepted Answer

The Lambda function that evaluates the rule has a logic error. Options A and D are correct. A: The custom lambda function might have a bug. D: The AWS Config rule might not be using the correct resource type. Option B is wrong because AWS Config does not use CloudTrail for triggering. Option C is wrong because the rule's maximum execution frequency is not relevant for change-triggered rules. Option E is wrong because the IAM role for AWS Config might not have permission to invoke the Lambda function, but that would cause a different error.

Answer

The rule's maximum execution frequency is set to 24 hours

Answer

The rule is not being triggered by CloudTrail events

Answer

The AWS Config service role does not have permission to invoke the Lambda function

Question 5

A company uses AWS CloudFormation to deploy its infrastructure. They have a production stack that includes an RDS PostgreSQL instance with a read replica. The stack update to modify the DB instance class fails with the error: 'The parameter group cannot be changed during a read replica update.' The DevOps engineer needs to update the DB instance class while minimizing downtime and without losing the read replica. The current configuration: the RDS instance is using a custom parameter group. The read replica is using the same parameter group. The update changes the DBInstanceClass property from db.r5.large to db.r5.xlarge. What should the engineer do to successfully update the stack?

Accepted Answer

Remove the read replica from the stack, update the master instance, then add the read replica back. Option B is correct because the error indicates that the parameter group cannot be changed during a read replica update. To update the instance class, the engineer should first remove the read replica from the stack (or delete it), update the master instance, and then recreate the read replica. Option A is wrong because creating a new parameter group does not resolve the conflict. Option C is wrong because modifying the replica first would also fail. Option D is wrong because the update cannot be done in-place due to the read replica.

Answer

Update the read replica first to the new instance class, then update the master instance

Answer

Use the AWS Management Console to modify the DB instance class directly, bypassing CloudFormation

Answer

Create a new parameter group for the master instance and associate it before the update

Question 6

A company uses AWS OpsWorks for Chef Automate. They have a stack that includes a PHP application layer. The application requires a custom PHP configuration file. The DevOps engineer creates a custom Chef cookbook with a recipe that deploys the configuration file. The recipe is assigned to the layer's Setup lifecycle event. The engineer notices that the configuration file is not being created on new instances when they are added to the layer. The cookbook is stored in a private S3 bucket. The engineer has verified that the cookbook is correctly associated with the stack. What should the engineer do to fix the issue?

Accepted Answer

Ensure that the instance profile has permissions to read from the S3 bucket where the cookbook is stored. Option C is correct because OpsWorks requires that the cookbook be installed on the instance before the lifecycle event runs. The cookbook is in a private S3 bucket, so the instance needs permission to access it. The engineer should ensure that the stack's custom cookbooks source is configured with the correct S3 bucket and that the instance profile has permissions to read from the bucket. Option A is wrong because the recipe is assigned to the correct lifecycle event. Option B is wrong because the cookbook version is not the issue. Option D is wrong because the recipe is in the cookbook.

Answer

Assign the recipe to the Configure lifecycle event instead of Setup

Answer

Verify that the recipe is included in the cookbook's default.rb file

Answer

Update the cookbook version to the latest

Question 7

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that stack updates do not accidentally delete critical resources like a database. Which CloudFormation stack policy should they apply to protect the database resource?

Accepted Answer

Create a stack policy that denies delete actions on the logical resource ID of the database.. Option A is correct because a CloudFormation stack policy allows you to define resource-level permissions that prevent specific resources (identified by their logical resource ID) from being updated or deleted during a stack update. By creating a policy that denies delete actions on the database's logical resource ID, the DevOps team ensures that even if the template or parameters change, the database resource cannot be accidentally removed.

Answer

Apply an IAM policy that denies cloudformation:DeleteStack on the database.

Answer

Use an S3 bucket policy to deny deletion of the database snapshot.

Answer

Enable termination protection on the CloudFormation stack.

Question 8

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an AWS::EC2::Instance with a UserData script. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]. The requested configuration is currently not supported. Please check the documentation for supported configurations.' The engineer suspects the instance type is not supported in the selected Availability Zone. Which action should the engineer take to resolve this issue and ensure successful stack creation?

Accepted Answer

Add an Availability Zone parameter and map it to an AZ that supports the instance type, or use the AWS::EC2::Instance AvailabilityZone property to specify an AZ that supports the instance type.. Option C is correct because specifying AllowedPattern in the template for the instance type parameter is not relevant; the solution is to use the AWS::EC2::Instance property AvailabilityZone to explicitly set an AZ that supports the instance type, or use a parameter to select an AZ. Option A is wrong because OpsWorks is not needed. Option B is wrong because it only changes the region, not the availability zone within the region. Option D is wrong because changing the instance type to a previous generation might not be desired and does not address the AZ constraint.

Answer

Use AWS OpsWorks to deploy the instance instead of CloudFormation.

Answer

Change the instance type to a previous generation that is supported in all AZs.

Answer

Modify the template to specify a different region that supports the instance type.

Question 9

A company uses AWS Elastic Beanstalk to deploy a Java web application. The DevOps team wants to ensure that configuration changes are tracked and can be rolled back if needed. Which Elastic Beanstalk feature should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and restore them if needed.. Option B is correct because Elastic Beanstalk saved configurations allow you to capture and restore environment settings. Option A is wrong because CloudFormation change sets are for CloudFormation stacks, not Elastic Beanstalk. Option C is wrong because Jenkins is a CI/CD tool, not a configuration management feature. Option D is wrong because CodeCommit is a source control service.

Answer

Use AWS CodeCommit to store configuration files and version them.

Answer

Use AWS CodePipeline with a manual approval stage to track changes.

Answer

Use AWS CloudFormation change sets to review changes before deployment.

Question 10

Refer to the exhibit. A DevOps engineer is troubleshooting an issue where an IAM user is unable to stop an EC2 instance with the tag 'Environment: Development'. The attached IAM policy is shown. Which statement explains the failure?

Accepted Answer

The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.. Option D is correct. The Deny statement denies ec2:TerminateInstances for instances where the tag Environment is NOT Production. However, the user is trying to stop an instance, not terminate it. The StopInstances action is allowed by the first statement. But wait, the user is unable to stop; that suggests there is an additional deny or the policy is not the issue. Actually, the policy allows StopInstances. The problem might be that the user is trying to stop an instance that is part of an Auto Scaling group and the stop action is not allowed by the ASG. But based on the policy alone, the user should be able to stop. However, the question says 'unable to stop'. Actually, the Deny statement only applies to TerminateInstances. So the correct answer is D: The policy does not restrict stop actions, so the issue is elsewhere. But the question asks 'Which statement explains the failure?' The options are about the policy. Let's review: Option A says the Deny statement prevents stop, which is false. Option B says the Allow statement only gives describe, but it gives start and stop. Option C says the condition on the Deny statement incorrectly uses StringNotEquals. Option D says the policy does not prevent stopping instances with Development tag. Actually, the user can stop Development instances because the Deny only applies to terminate. So the failure must be due to something else. However, the question expects D as correct because the policy is not the cause. But that doesn't 'explain the failure'. Hmm. I think the intended answer is D: The policy does not prevent stopping instances with the Development tag, so the failure is not due to this policy. But that doesn't explain why they can't stop. Maybe the exhibit is about a different issue. Let me re-read: 'unable to stop an EC2 instance with the tag Environment: Development'. The policy allows StopInstances on all resources. So why can't they stop? Possibly because there is another policy denying it. But the question is to explain based on the exhibit. The best answer is D because the policy shown does not deny stop. So the failure must be due to another reason. I'll go with D.

Answer

The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.

Answer

The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.

Answer

The Allow statement only grants ec2:DescribeInstances, not start/stop.

Question 11

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the deployment fails because the target instances are not passing the health checks. The DevOps engineer notices that the CodeDeploy agent logs show 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which step should the engineer take to diagnose the issue?

Accepted Answer

Review the CodeDeploy deployment logs on a failed instance to identify script errors.. Option B is correct because reviewing the deployment logs on a failed instance provides details on why the application installation failed. Option A is wrong because CloudTrail logs API calls, not deployment scripts. Option C is wrong because scaling policies do not cause deployment failures. Option D is wrong because CloudWatch alarms may not capture script-level errors.

Answer

Increase the size of the Auto Scaling group to ensure more instances are available.

Answer

Create a CloudWatch alarm to monitor the deployment health.

Answer

Check AWS CloudTrail logs for the CodeDeploy API calls to see if permissions are missing.

Question 12

A company uses AWS OpsWorks for configuration management. The DevOps team wants to run a custom recipe on all instances in a layer during stack updates. Which OpsWorks lifecycle event should they hook the recipe into?

Accepted Answer

Setup. Option C is correct because the Setup event runs after an instance finishes booting, which is appropriate for applying configurations during stack updates. Option A is wrong because Configure runs when instances come online or go offline. Option B is wrong because Deploy runs when you run a deploy command. Option D is wrong because Shutdown runs when the instance is terminated.

Answer

Deploy

Answer

Shutdown

Answer

Configure

Question 13

A company is using AWS Systems Manager to manage configuration drift on EC2 instances. They want to automatically apply a baseline configuration to instances that have drifted from the desired state. Which Systems Manager capability should they use?

Accepted Answer

AWS Systems Manager State Manager. Option A is correct because State Manager uses associations to automatically apply configurations and remediate drift. Option B is wrong because Patch Manager only handles patches. Option C is wrong because Run Command is for manual execution. Option D is wrong because Parameter Store stores configuration data but does not apply it.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager Parameter Store

Answer

AWS Systems Manager Run Command

Question 14

A DevOps engineer wants to ensure that all EC2 instances launched in an AWS account automatically have a specific set of tags applied for cost allocation. Which AWS service should they use to enforce this?

Accepted Answer

AWS Config. Option D is correct because AWS Config rules can be used to check for required tags and trigger remediation. Option A is wrong because CloudFormation is for infrastructure as code, not automatic enforcement. Option B is wrong because Service Catalog allows users to provision products but does not enforce tags on all instances. Option C is wrong because EC2 Auto Scaling does not enforce tagging across all instances.

Answer

AWS Service Catalog

Answer

Amazon EC2 Auto Scaling

Answer

AWS CloudFormation

Question 15

A company is using AWS CloudFormation to deploy a multi-tier application. The DevOps team wants to ensure that the database password is not exposed in the template or the console. Which two methods should they use to securely manage the password? (Choose TWO.)

Accepted Answer

Use a CloudFormation parameter with the NoEcho property set to true.. Option A and D are correct. Using AWS Secrets Manager dynamically references the secret value without exposing it. Using a NoEcho parameter prevents the password from being displayed in the console. Option B is wrong because hardcoding is insecure. Option C is wrong because Systems Manager Parameter Store does not have a NoEcho property. Option E is wrong because user data is not secure.

Answer

Hardcode the password in the template and use a condition to only apply it in production.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it with {{resolve:ssm:...}}

Answer

Pass the password as user data to the EC2 instance and encrypt the user data.