DOP-C02 Configuration Management and IaC Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. A DevOps engineer is troubleshooting an issue where an IAM user is unable to stop an EC2 instance with the tag 'Environment: Development'. The attached IAM policy is shown. Which statement explains the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Allow statement only grants ec2:DescribeInstances, not start/stop.. The IAM policy in the exhibit only grants ec2:DescribeInstances and explicitly denies ec2:RunInstances with a condition. It does not include an Allow for ec2:StopInstances. By default, IAM denies any action that is not explicitly allowed. Therefore, the user lacks permission to stop instances, including the Development-tagged instance. Option C correctly identifies this as the reason for the failure. Option D is incorrect because the policy itself denies stop implicitly due to the missing Allow; it is not necessary to invoke another policy or SCP.

Answer

The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.

Answer

The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.

Answer

The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.

Question 2

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the deployment fails because the target instances are not passing the health checks. The DevOps engineer notices that the CodeDeploy agent logs show 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which step should the engineer take to diagnose the issue?

Accepted Answer

Review the CodeDeploy deployment logs on a failed instance to identify script errors.. The error message indicates that individual instances failed deployment, and the CodeDeploy agent logs on a failed instance contain detailed script output (e.g., AppSpec hooks like BeforeInstall, AfterInstall, ApplicationStart) that reveal the root cause, such as a missing dependency or incorrect file path. Reviewing these logs directly identifies script errors, which is the most targeted diagnostic step before considering infrastructure changes.

Answer

Increase the size of the Auto Scaling group to ensure more instances are available.

Answer

Create a CloudWatch alarm to monitor the deployment health.

Answer

Check AWS CloudTrail logs for the CodeDeploy API calls to see if permissions are missing.

Question 3

A company uses AWS OpsWorks for configuration management. The DevOps team wants to run a custom recipe on all instances in a layer during stack updates. Which OpsWorks lifecycle event should they hook the recipe into?

Accepted Answer

Setup. The Setup lifecycle event runs on every instance in a layer when it first boots or during a stack update, making it the correct hook for running a custom recipe that must execute on all instances during updates. This event occurs after the instance is fully configured and before it enters service, ensuring the recipe runs consistently across the layer.

Answer

Deploy

Answer

Shutdown

Answer

Configure

Question 4

A company is using AWS Systems Manager to manage configuration drift on EC2 instances. They want to automatically apply a baseline configuration to instances that have drifted from the desired state. Which Systems Manager capability should they use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct capability because it is specifically designed to define and maintain consistent configuration states for EC2 instances and other AWS resources. It uses associations to automatically apply a baseline configuration and remediate drift on a schedule or when triggered, ensuring instances remain in the desired state without manual intervention.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager Parameter Store

Answer

AWS Systems Manager Run Command

Question 5

A DevOps engineer wants to ensure that all EC2 instances launched in an AWS account automatically have a specific set of tags applied for cost allocation. Which AWS service should they use to enforce this?

Accepted Answer

AWS Config. AWS Config is correct because it can enforce tagging rules through managed rules like `required-tags` or custom AWS Config rules using AWS Lambda. When an EC2 instance is launched without the required tags, AWS Config can evaluate the resource against the rule and trigger remediation actions (e.g., via AWS Systems Manager Automation) to automatically apply the tags or flag non-compliance. This ensures consistent cost allocation tagging across all instances without manual intervention.

Answer

AWS Service Catalog

Answer

Amazon EC2 Auto Scaling

Answer

AWS CloudFormation

Question 6

A company is using AWS CloudFormation to deploy a multi-tier application. The DevOps team wants to ensure that the database password is not exposed in the template or the console. Which two methods should they use to securely manage the password? (Choose TWO.)

Accepted Answer

Use a CloudFormation parameter with the NoEcho property set to true.. Setting the `NoEcho` property to `true` on a CloudFormation parameter masks the password from console outputs and `DescribeStack` calls, preventing exposure in logs or the AWS Management Console. This is a straightforward way to handle sensitive input without external services, though it does not encrypt the value at rest in the template.

Answer

Hardcode the password in the template and use a condition to only apply it in production.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it with {{resolve:ssm:...}}

Answer

Pass the password as user data to the EC2 instance and encrypt the user data.

Question 7

A DevOps team is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. They want to incorporate infrastructure as code (IaC) using AWS CloudFormation. Which three practices should they follow to ensure reliable and repeatable deployments? (Choose THREE.)

Accepted Answer

Use the same CloudFormation template across all environments, with parameterization for environment-specific values.. Using a single CloudFormation template across all environments with parameterization ensures consistency and reduces drift. Environment-specific values (e.g., instance sizes, subnet IDs) are passed as parameters, so the same template logic applies to dev, test, and prod, making deployments repeatable and auditable.

Answer

Create a single monolithic template for all microservices to simplify management.

Answer

Skip change sets during stack updates to speed up the pipeline.

Question 8

A company uses AWS Elastic Beanstalk to manage its web application. The DevOps team wants to customize the Amazon EC2 instances launched by Elastic Beanstalk. Which two methods can they use to achieve this? (Choose TWO.)

Accepted Answer

Use .ebextensions configuration files in the application source bundle to install packages and run commands.. `.ebextensions` configuration files allow you to customize the EC2 instances launched by Elastic Beanstalk by installing packages, running commands, and configuring services during instance provisioning. These YAML or JSON files are placed in the `.ebextensions` folder of your application source bundle and are executed by the Elastic Beanstalk platform as part of the instance initialization process, providing a native and supported customization mechanism.

Answer

Use AWS OpsWorks to manage the instances instead of Elastic Beanstalk.

Answer

Add user data to the Auto Scaling group launch configuration that Elastic Beanstalk creates.

Answer

Modify the CloudFormation template generated by Elastic Beanstalk directly.

Question 9

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team has a template that creates an Amazon RDS DB instance and an EC2 instance that runs a web application. The EC2 instance needs to connect to the RDS instance using the database endpoint and password. The team currently passes the endpoint and password as CloudFormation parameters, which are then stored in the EC2 instance's user data. However, security audit has flagged this as a security risk because the password is visible in the user data. The team wants to securely pass the database credentials to the EC2 instance without exposing them in the template or user data. The EC2 instance has an IAM role that allows it to read from AWS Secrets Manager. Which solution should the team implement?

Accepted Answer

Store the password in AWS Secrets Manager, use a dynamic reference to pass it to the EC2 instance's IAM role, and have the application retrieve it from Secrets Manager at runtime.. By storing the password in AWS Secrets Manager and using a dynamic reference in CloudFormation, the password is never exposed in the template or user data. The EC2 instance retrieves the password from Secrets Manager at runtime using its IAM role. Option A is not the best because although Parameter Store can store SecureStrings, Secrets Manager is more secure and supports automatic rotation, and the instance already has permissions to read Secrets Manager. Option B is risky because encrypting user data still exposes the password in the user data itself and adds key management complexity. Option D is wrong because Fn::GetAtt cannot retrieve the RDS master password, and even if it could, the password would still be passed via user data, which is insecure.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString and have the EC2 instance retrieve it using the AWS CLI.

Answer

Encrypt the user data using AWS KMS and decrypt it on the EC2 instance at boot time.

Answer

Use CloudFormation's Fn::GetAtt to retrieve the password from the RDS instance and pass it to the EC2 instance via user data.

Question 10

A company is using AWS OpsWorks for configuration management of their application stack. The stack includes a PHP application layer and a MySQL database layer. The DevOps team wants to automate the deployment of a new PHP version across all instances in the PHP layer. The team has created a custom Chef recipe that updates PHP. They want to run this recipe on all instances in the PHP layer in a rolling update fashion to avoid downtime. Which OpsWorks feature should they use?

Accepted Answer

Use the OpsWorks 'Run Command' feature to execute the recipe on the PHP layer with rolling update settings.. AWS OpsWorks Stacks provides a 'Run Command' feature that lets you execute a specific Chef recipe on a chosen layer, and it supports rolling updates so instances are updated in batches rather than all at once. This is the designed mechanism for on-demand execution of a recipe across a layer without redeploying the entire stack. Rolling updates minimize downtime by updating instances in configurable batch sizes while keeping the rest of the layer serving traffic.

Answer

Create a custom Chef cookbook and enable automatic updates in OpsWorks.

Answer

Add the recipe to the Setup lifecycle event for the PHP layer.

Answer

Modify the PHP layer's lifecycle configuration to include the recipe in the Configure event.

Question 11

A DevOps engineer is creating an AWS Elastic Beanstalk environment and needs to ensure that configuration changes are tracked and can be reverted. Which THREE steps should the engineer take to achieve this? (Choose THREE.)

Accepted Answer

Enable configuration drift detection using AWS Config.. AWS Config can be used to track configuration changes to Elastic Beanstalk resources (e.g., the underlying EC2 instances, security groups, and load balancers) by recording configuration items and detecting drift from the desired state. This allows the DevOps engineer to audit changes and revert to a compliant configuration if needed.

Answer

Use Elastic Beanstalk lifecycle policies to automatically retain old configurations.

Answer

Store configuration templates in the Elastic Beanstalk console, which automatically keeps version history.

Question 12

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails because the new version of the application crashes the instances. The DevOps engineer needs the Auto Scaling group to automatically replace the unhealthy instances with the previous working version. Which deployment configuration should the engineer use?

Accepted Answer

Blue/Green deployment with a load balancer to switch traffic only after health checks pass.. A blue/green deployment with a load balancer health check ensures that the new (green) instances are validated before any traffic is routed to them. If the new version crashes, the health checks fail, the load balancer keeps traffic on the old (blue) instances, and the Auto Scaling group can automatically terminate the unhealthy green instances and replace them with the previous working version by reverting to the original launch configuration or template.

Answer

In-place deployment with a deployment group that has a failure threshold of 0.

Answer

Canary deployment that shifts 10% of traffic to the new version, then 100% after 10 minutes.

Answer

Linear deployment that shifts 10% of traffic every 10 minutes.

Question 13

A DevOps team uses AWS OpsWorks for configuration management. They have a stack with a custom cookbook that installs and configures an application. After updating the cookbook on GitHub, they need to apply the changes to existing instances without creating new ones. What should the team do?

Accepted Answer

Use the 'Execute Recipes' feature to run the updated custom recipe on the instances.. AWS OpsWorks provides the 'Execute Recipes' feature, which allows you to run a specific recipe from a cookbook on existing instances without requiring a stack update or instance replacement. This is the direct method to apply changes from an updated custom cookbook to running instances, as it triggers Chef to execute the specified recipe immediately on the selected instances.

Answer

Clone the stack and assign the updated cookbook to the new stack.

Answer

Update the layer's custom cookbook settings and then reboot the instances.

Answer

Update the stack's custom cookbook source and click 'Update Dependencies' on the stack.

Question 14

A company uses AWS CloudFormation to manage infrastructure. They have a template that creates an Amazon RDS DB instance. The template includes a 'DeletionPolicy' attribute set to 'Retain' on the DB instance resource. The DevOps team deletes the stack. Later, they notice that the DB instance still exists and is incurring costs. What is the MOST cost-effective way to remove the DB instance?

Accepted Answer

Manually delete the DB instance using the AWS Management Console or AWS CLI.. The DB instance was created with a DeletionPolicy of 'Retain', which explicitly instructs CloudFormation to preserve the resource when the stack is deleted. Once the stack is deleted, CloudFormation no longer manages the DB instance, so the only way to remove it and stop costs is to manually delete it via the AWS Management Console or AWS CLI. This is the most cost-effective approach as it directly addresses the orphaned resource without unnecessary overhead.

Answer

Create a new CloudFormation stack that includes the same DB instance but with a DeletionPolicy of 'Delete', then delete that stack.

Answer

Use the 'aws cloudformation delete-change-set' command to remove the resource.

Answer

Update the stack: change the DeletionPolicy to 'Delete' and then delete the stack again.

Question 15

A DevOps engineer is using AWS CloudFormation to provision a VPC that includes public and private subnets, an Internet Gateway, and NAT Gateways. The engineer wants to ensure that the private subnets have outbound internet access through the NAT Gateways. After deploying the stack, the engineer notices that instances in the private subnets cannot reach the internet. The engineer verifies that the route tables for the private subnets have a route to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The route in the private subnet's route table points to the NAT Gateway in the same Availability Zone, but the NAT Gateway is in a public subnet that lacks a route to the Internet Gateway.. A NAT Gateway must reside in a public subnet that has a route to an Internet Gateway. If the public subnet's route table lacks a route to the Internet Gateway, the NAT Gateway cannot route traffic to the internet. The engineer should verify that the public subnet's route table has a route to the Internet Gateway and that the NAT Gateway is correctly placed.

Answer

The NAT Gateway is not associated with an Elastic IP address.

Answer

The private subnets are missing an association with a network ACL that allows outbound traffic to the NAT Gateway.

Answer

The instances in the private subnets do not have a public IP address, so they cannot communicate with the NAT Gateway.