DOP-C02 Configuration Management and IaC Practice Test 2 — 15 Questions

Question 1

A large enterprise uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set that contains a custom resource backed by a Lambda function. The update changes the Lambda function code. What is the CORRECT approach to ensure the Lambda function is updated without manual intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the stack set with a new template version that references the updated Lambda code, and let CloudFormation handle the update.. When you update a CloudFormation stack set with a new template version that references updated Lambda code, CloudFormation automatically detects the change to the custom resource and triggers an update to the Lambda function across all target accounts and regions. This approach leverages CloudFormation's built-in drift detection and resource update lifecycle, ensuring the Lambda function code is replaced without any manual intervention. The custom resource's backing Lambda function is updated as part of the stack set update operation because CloudFormation treats the Lambda function as a managed resource within the stack.

Answer

Use a Lambda function alias and point the custom resource to the alias.

Answer

Create a new stack set for the updated Lambda and delete the old one.

Answer

Manually update the Lambda function in each account, then update the stack set.

Question 2

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the Ansible control node can connect to managed nodes securely without storing SSH keys in plaintext. Which AWS service should they integrate with Ansible to securely manage SSH keys?

Accepted Answer

AWS Secrets Manager to store the SSH private keys and retrieve them dynamically.. AWS Secrets Manager can store SSH private keys securely and Ansible can retrieve them via API. Option A is wrong because AWS KMS is for encryption keys, not for storing secrets directly. Option C is wrong because IAM roles are for permissions, not storing keys. Option D is wrong because Systems Manager Parameter Store can store secrets but is less feature-rich for secret rotation.

Answer

AWS KMS to encrypt the SSH keys at rest.

Answer

AWS IAM roles to grant Ansible access to the instances.

Answer

AWS Systems Manager Parameter Store to store the keys.

Question 3

A company uses AWS CodeCommit and CodePipeline. The pipeline triggers on commits to the main branch. The DevOps engineer wants to add a stage that runs unit tests in a build environment. After the tests pass, the pipeline should deploy to a staging environment. If the tests fail, the pipeline should stop and notify the team. Which AWS service should be used to implement this workflow?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it can be integrated directly into a CodePipeline as a build action that runs unit tests in a managed build environment. When tests fail, CodeBuild can be configured to exit with a non-zero status, which causes CodePipeline to stop the execution and optionally trigger notifications via Amazon SNS or CloudWatch Events. This matches the requirement for a build stage that runs tests and conditionally proceeds or halts the pipeline.

Answer

AWS CodeStar

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 4

A financial services company uses Chef for configuration management. They need to enforce security compliance across thousands of EC2 instances. The compliance requirements include specific file permissions, firewall rules, and user account settings. They want to automatically remediate non-compliant instances. Which approach is MOST effective?

Accepted Answer

Use Chef recipes to define desired state and enforce compliance on each client run.. Chef is already in use for configuration management, and its core strength is enforcing desired state through recipes. By running Chef client on each EC2 instance (via cron or Systems Manager), non-compliant instances are automatically remediated on each convergence cycle without needing separate detection or notification tools. This approach directly addresses the requirement for automated remediation using the existing toolchain.

Answer

Use AWS Config rules to detect non-compliance and send notifications.

Answer

Use AWS CloudWatch Events to trigger a Lambda function that runs remediation scripts.

Answer

Use AWS Systems Manager Patch Manager to apply patches.

Question 5

A company uses AWS Elastic Beanstalk for a web application. The DevOps engineer needs to ensure that environment configuration changes (e.g., instance type, environment variables) are version-controlled and can be rolled back quickly. Which approach should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations stored in source control.. Elastic Beanstalk saved configurations allow you to export environment settings (e.g., instance type, environment variables) as a YAML or JSON file that can be stored in a version control system like Git. This enables you to recreate environments with identical settings and roll back to a previous configuration by deploying an older saved configuration file, providing a version-controlled, auditable, and reversible change management process.

Answer

Manually update the environment configuration through the Elastic Beanstalk console.

Answer

Use the AWS CLI to apply configuration changes from a script.

Answer

Use AWS CloudFormation to manage the Elastic Beanstalk environment.

Question 6

A company uses AWS CloudFormation to deploy infrastructure. They want to implement a change management process that requires approval before any stack update is executed. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use AWS CodePipeline with a manual approval stage before the CloudFormation deployment action.. AWS CodePipeline can include a manual approval action that pauses the pipeline until an authorized user approves the change, after which the CloudFormation deployment action executes the stack update. This enforces a formal approval gate before any infrastructure change is applied.

Answer

Use CloudFormation StackSets with approval tokens.

Answer

Use CloudFormation Change Sets and require a separate user to execute them.

Answer

Use AWS Service Catalog to manage CloudFormation templates and require approval for product launches.

Question 7

A DevOps team manages hundreds of EC2 instances using AWS Systems Manager State Manager. They need to ensure that a specific configuration (e.g., a custom firewall rule) is applied to all instances and remains enforced. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Ensure the instances have an IAM role that allows Systems Manager to perform actions.. AWS Systems Manager requires instances to have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) for the SSM Agent to communicate with the Systems Manager service. Without this role, State Manager cannot apply or enforce any configuration, including custom firewall rules.

Answer

Use AWS Config rules to detect non-compliance.

Answer

Use Run Command to execute the configuration once.

Question 8

A company uses AWS CodeBuild to run tests as part of their CI/CD pipeline. They want to store build artifacts in an S3 bucket and ensure that only the latest successful build artifacts are retained. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure CodeBuild to output artifacts to a specific S3 bucket.. CodeBuild can be configured to output artifacts directly to a specified S3 bucket. Option B is correct because an S3 lifecycle policy can be used to automatically delete old artifacts, ensuring only the latest successful build is retained. Option D is incorrect because enabling versioning would keep all versions, contrary to the requirement of retaining only the latest. Option C is incorrect because CodeCommit is for source code, not build artifacts. Option E is incorrect because CloudWatch Logs store logs, not artifacts.

Answer

Store artifacts in an AWS CodeCommit repository.

Answer

Enable versioning on the S3 bucket to keep all versions.

Answer

Use CloudWatch Logs to store build logs.

Question 9

A company uses AWS CloudFormation to manage its infrastructure. The security team requires that all S3 buckets have versioning enabled. A DevOps engineer needs to enforce this policy across all accounts in an AWS Organization. Which solution is MOST operationally efficient?

Accepted Answer

Create an SCP in AWS Organizations that denies s3:PutBucketVersioning with a condition that versioning is not enabled.. An SCP (Service Control Policy) in AWS Organizations can centrally deny the s3:PutBucketVersioning API action unless versioning is already enabled, effectively preventing any S3 bucket from being created or updated without versioning across all accounts in the organization. This is the most operationally efficient solution as it requires no per-account configuration, no custom resources, and no remediation logic—it enforces the policy at the AWS Organizations level before any API call succeeds.

Answer

Add a CloudFormation custom resource to each template that enables versioning and attaches a Lambda function to re-enable it if disabled.

Answer

Create a Service Catalog portfolio with a product that enforces versioning and require all users to launch stacks from it.

Answer

Use AWS Config with a managed rule 's3-bucket-versioning-enabled' and an automatic remediation action that enables versioning.

Question 10

A company uses AWS OpsWorks for configuration management with Chef. They are migrating to AWS Systems Manager to reduce complexity. The operations team needs to run custom scripts on a fleet of EC2 instances on a schedule, with the ability to target instances based on tags. Which Systems Manager capability should the engineer use?

Accepted Answer

State Manager. State Manager is the correct choice because it is designed to define and maintain consistent configuration of EC2 instances and other AWS resources, including running custom scripts on a schedule. It supports targeting instances by tags and uses associations to enforce desired states at specified intervals, making it ideal for scheduled script execution across a tagged fleet.

Answer

Patch Manager

Answer

Automation

Answer

Run Command

Question 11

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to ensure that infrastructure changes are reviewed and approved before deployment. The code is stored in AWS CodeCommit, and the pipeline uses AWS CodePipeline and AWS CloudFormation. What is the BEST way to implement an approval process for infrastructure changes?

Accepted Answer

Add a manual approval step in CodePipeline between the build and deploy stages.. AWS CodePipeline supports a manual approval action that can be added between stages (e.g., between build and deploy) to require human approval before proceeding. This allows the team to review infrastructure changes before deployment. Option A is incorrect because CodeCommit approval rules apply to pull requests for code changes, not to pipeline executions or infrastructure deployments. Option B is incorrect because IAM policies requiring MFA control who can update stacks, but do not create an approval gate; they enforce authentication, not approval workflows. Option C is incorrect because while you could use a custom CodeBuild action to send an SNS message and wait, this is not the best approach; CodePipeline natively provides manual approval steps, which are simpler and more appropriate.

Answer

Use CodeCommit approval rules to require a pull request before any change is merged.

Answer

Configure IAM policies to require MFA before any CloudFormation stack update.

Answer

Use CodeBuild to run a script that sends an approval request via Amazon SNS and waits for a response.

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running behind an Application Load Balancer. The DevOps team notices that during deployments, the new application version fails health checks and the deployment rolls back. The team wants to reduce deployment time while maintaining safety. Which configuration change should the engineer recommend?

Accepted Answer

Change the deployment policy to immutable.. The immutable deployment policy in AWS Elastic Beanstalk creates a new Auto Scaling group with fresh instances running the new application version, performs health checks, and only then swaps the environment's target group to route traffic to the new fleet. This avoids the rolling update's problem of health check failures on existing instances (which trigger a rollback) and ensures the entire new environment is validated before any traffic is shifted. While immutable deployments can take longer than a successful rolling update because they provision a full new fleet, they reduce overall deployment time in this scenario by preventing repeated failed deployments and rollbacks, and they maintain safety by not exposing partially updated instances.

Answer

Increase the number of EC2 instances in the environment.

Answer

Use the all-at-once deployment policy.

Answer

Increase the rolling update batch size to 100%.

Question 13

A company uses a central CloudFormation template to create VPCs with a standard CIDR block of 10.0.0.0/16. The template is used across multiple accounts and regions. The team needs to ensure that the VPC CIDR does not overlap with other VPCs in the same account. Which approach should the engineer take to dynamically assign a unique /16 subnet from a larger pool?

Accepted Answer

Use the Fn::Cidr function with the stack ID as a seed to generate a /16 CIDR from a larger pool.. The Fn::Cidr intrinsic function generates a list of CIDR blocks from an ipBlock, a count, and cidrBits. It has no seed or stack-based input. Using the stack ID as a seed is not supported. To allocate unique /16 prefixes, a mapping (e.g., Fn::FindInMap based on account ID) or a custom resource is required. None of the provided options offer a valid solution.

Answer

Use Fn::Select on a predefined list of CIDR blocks passed as a parameter.

Answer

Use Fn::GetAtt to retrieve the VPC's CidrBlock from another VPC resource.

Answer

Use the Ref function to assign the VPC ID as the CIDR block.

Question 14

A DevOps engineer is implementing AWS Config rules to enforce tagging standards on resources. The rule should trigger a remediation action via AWS Systems Manager Automation to apply the correct tags if a resource is non-compliant. What is the correct way to set up this remediation?

Accepted Answer

Use the AWS Config rule's remediation action to run an AWS Systems Manager Automation document.. AWS Config rules can directly associate a remediation action using an AWS Systems Manager Automation document. When a resource is evaluated as non-compliant, Config can automatically invoke the specified SSM Automation document to apply the correct tags, without requiring intermediate services. This is the native, supported mechanism for auto-remediation of non-compliant resources.

Answer

Configure the AWS Config rule to send events to AWS CodePipeline to trigger a pipeline that fixes the tags.

Answer

Configure a CloudWatch Events rule to detect non-compliant resources and invoke a Lambda function that applies tags.

Answer

Use an SNS topic to notify administrators when a resource is non-compliant.

Question 15

A company uses AWS CloudFormation StackSets to deploy a common security group across multiple accounts in an AWS Organization. The security group must allow inbound traffic from the organization's central VPN CIDR range. The VPN CIDR range is stored in AWS Systems Manager Parameter Store. How should the engineer reference this parameter in the StackSet template to ensure the value is resolved at deployment time?

Accepted Answer

Use the dynamic reference '{{resolve:ssm:/org/vpn/cidr}}' in the template.. CloudFormation dynamic references ({{resolve:ssm:/org/vpn/cidr}}) allow you to retrieve the current value of an SSM Parameter Store parameter at stack deployment time, without needing to pass it as a parameter or create a separate resource. This ensures the security group rule always uses the latest VPN CIDR value stored in Parameter Store, even if the CIDR changes between deployments.

Answer

Use Fn::ImportValue with an export from another stack that reads the parameter.

Answer

Use the Ref function on the parameter name as a CloudFormation parameter.

Answer

Use Fn::GetAtt to retrieve the parameter value from an AWS::SSM::Parameter resource.