DOP-C02 Configuration Management and IaC Practice Test 2 — 15 Questions

Question 1

A company uses AWS CodePipeline with a multi-branch strategy. The pipeline deploys a Lambda function using CloudFormation. The DevOps engineer notices that when a new branch is created, the pipeline executes but the CloudFormation stack fails because the stack name already exists. What is the MOST efficient way to resolve this issue?

Accepted Answer

Modify the pipeline to use a dynamic stack name parameter, such as the branch name.. Option B is correct because using a dynamic stack name based on the branch name or a unique identifier ensures each pipeline execution creates a separate stack, avoiding name conflicts. Option A is wrong because deleting the stack before creation may cause downtime. Option C is wrong because CloudFormation does not support stack name overrides; a new name must be used. Option D is wrong because hardcoding a different stack name per branch is not scalable.

Answer

Hardcode a different stack name for each branch in the pipeline.

Answer

Delete the existing stack before each deployment.

Answer

Use the CloudFormation 'Override' parameter to reuse the same stack.

Question 2

An organization uses AWS OpsWorks for configuration management. They want to migrate to AWS Systems Manager to reduce costs and improve flexibility. Their current stack includes custom Chef recipes that manage package installations and service configurations. What is the MOST effective migration strategy?

Accepted Answer

Translate Chef recipes into Systems Manager State Manager associations and use Run Command for ad-hoc tasks.. Option C is correct because Systems Manager State Manager can manage configurations using association documents that are equivalent to Chef recipes, and Run Command can execute ad-hoc commands. Option A is wrong because it does not address existing recipes. Option B is wrong because CodeDeploy is for application deployments, not configuration management. Option D is wrong because it adds complexity and cost.

Answer

Use AWS CloudFormation to recreate the entire infrastructure and manage configurations.

Answer

Use AWS CodeDeploy to replace OpsWorks and manage configurations.

Answer

Keep OpsWorks but integrate it with Systems Manager for hybrid management.

Question 3

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

Accepted Answer

CreationPolicy attribute with CreateBeforeDestroy. Option D is correct because CloudFormation 'CreateBeforeDestroy' ensures that a new resource is created before the old one is deleted, reducing downtime. Option A is wrong because 'UpdatePolicy' is for auto-scaling groups. Option B is wrong because 'DeletionPolicy' controls what happens when a resource is deleted. Option C is wrong because 'DependsOn' only defines resource creation order.

Answer

UpdatePolicy attribute with AutoScalingRollingUpdate

Answer

DeletionPolicy attribute set to Retain

Answer

DependsOn attribute to specify creation order

Question 4

A company uses Terraform with an S3 backend to manage infrastructure. The DevOps engineer notices that after a colleague runs 'terraform apply' locally, the state file in S3 becomes corrupted and subsequent runs fail. What is the BEST way to prevent this issue?

Accepted Answer

Use DynamoDB for state locking and enable consistency checks.. Option B is correct because enabling DynamoDB state locking prevents concurrent modifications that can corrupt the state file. Option A is wrong because versioning only allows recovery, not prevention. Option C is wrong because encryption does not prevent corruption. Option D is wrong because it is not a best practice for state management.

Answer

Store the state file locally and commit it to version control.

Answer

Use S3 server-side encryption to protect the state file.

Answer

Enable S3 versioning on the state bucket to recover previous versions.

Question 5

A large enterprise uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set that contains a custom resource backed by a Lambda function. The update changes the Lambda function code. What is the CORRECT approach to ensure the Lambda function is updated without manual intervention?

Accepted Answer

Update the stack set with a new template version that references the updated Lambda code, and let CloudFormation handle the update.. Option A is correct because updating the stack set with new template and parameters triggers CloudFormation to update the Lambda function automatically. Option B is wrong because manually updating the Lambda function is not scalable. Option C is wrong because CloudFormation does not support Lambda function aliases for custom resources. Option D is wrong because StackSets automatically handle updates across accounts.

Answer

Use a Lambda function alias and point the custom resource to the alias.

Answer

Create a new stack set for the updated Lambda and delete the old one.

Answer

Manually update the Lambda function in each account, then update the stack set.

Question 6

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the Ansible control node can connect to managed nodes securely without storing SSH keys in plaintext. Which AWS service should they integrate with Ansible to securely manage SSH keys?

Accepted Answer

AWS Secrets Manager to store the SSH private keys and retrieve them dynamically.. Option B is correct because AWS Secrets Manager can store SSH private keys securely and Ansible can retrieve them via API. Option A is wrong because AWS KMS is for encryption keys, not for storing secrets directly. Option C is wrong because IAM roles are for permissions, not storing keys. Option D is wrong because Systems Manager Parameter Store can store secrets but is less feature-rich for secret rotation.

Answer

AWS KMS to encrypt the SSH keys at rest.

Answer

AWS IAM roles to grant Ansible access to the instances.

Answer

AWS Systems Manager Parameter Store to store the keys.

Question 7

A company uses AWS CodeCommit and CodePipeline. The pipeline triggers on commits to the main branch. The DevOps engineer wants to add a stage that runs unit tests in a build environment. After the tests pass, the pipeline should deploy to a staging environment. If the tests fail, the pipeline should stop and notify the team. Which AWS service should be used to implement this workflow?

Accepted Answer

AWS CodeBuild. Option D is correct because AWS CodeBuild integrates with CodePipeline to run tests and can be configured to fail the pipeline if tests fail. Option A is wrong because CodeDeploy is for deployments, not testing. Option B is wrong because Lambda can run tests but CodeBuild is more appropriate for build and test. Option C is wrong because CodeStar is a project management tool.

Answer

AWS CodeStar

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 8

A financial services company uses Chef for configuration management. They need to enforce security compliance across thousands of EC2 instances. The compliance requirements include specific file permissions, firewall rules, and user account settings. They want to automatically remediate non-compliant instances. Which approach is MOST effective?

Accepted Answer

Use Chef recipes to define desired state and enforce compliance on each client run.. Option A is correct because Chef recipes can define the desired state and automatically enforce compliance on each Chef client run. Option B is wrong because AWS Config rules are for detection only, not remediation. Option C is wrong because Systems Manager Patch Manager is for patching, not compliance. Option D is wrong because CloudWatch Events can trigger remediation but requires custom automation.

Answer

Use AWS Config rules to detect non-compliance and send notifications.

Answer

Use AWS CloudWatch Events to trigger a Lambda function that runs remediation scripts.

Answer

Use AWS Systems Manager Patch Manager to apply patches.

Question 9

A company uses AWS Elastic Beanstalk for a web application. The DevOps engineer needs to ensure that environment configuration changes (e.g., instance type, environment variables) are version-controlled and can be rolled back quickly. Which approach should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations stored in source control.. Option C is correct because Elastic Beanstalk supports saved configurations that can be versioned in source control and applied to environments. Option A is wrong because manual changes in the console are not version-controlled. Option B is wrong because CloudFormation is for infrastructure, not Elastic Beanstalk configuration. Option D is wrong because CLI commands are not version-controlled by default.

Answer

Manually update the environment configuration through the Elastic Beanstalk console.

Answer

Use the AWS CLI to apply configuration changes from a script.

Answer

Use AWS CloudFormation to manage the Elastic Beanstalk environment.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. They want to implement a change management process that requires approval before any stack update is executed. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use AWS CodePipeline with a manual approval stage before the CloudFormation deployment action.. Options A and D are correct. Option A uses a manual approval step in CodePipeline before the CloudFormation deployment action. Option D uses a Lambda function to check for approval before executing the update. Option B is wrong because CloudFormation does not have a built-in approval mechanism. Option C is wrong because Change Sets are for review, not for requiring external approval. Option E is wrong because it does not enforce approval.

Answer

Use CloudFormation StackSets with approval tokens.

Answer

Use CloudFormation Change Sets and require a separate user to execute them.

Answer

Use AWS Service Catalog to manage CloudFormation templates and require approval for product launches.

Question 11

A DevOps team manages hundreds of EC2 instances using AWS Systems Manager State Manager. They need to ensure that a specific configuration (e.g., a custom firewall rule) is applied to all instances and remains enforced. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Ensure the instances have an IAM role that allows Systems Manager to perform actions.. Options A, C, and E are correct. Option A creates a State Manager association for the configuration. Option C sets the association to apply the configuration on a schedule, ensuring enforcement. Option E uses an IAM role to allow Systems Manager to apply the configuration. Option B is wrong because Run Command is ad-hoc, not continuous enforcement. Option D is wrong because Config rules only detect, not enforce.

Answer

Use AWS Config rules to detect non-compliance.

Answer

Use Run Command to execute the configuration once.

Question 12

A company uses AWS CodeBuild to run tests as part of their CI/CD pipeline. They want to store build artifacts in an S3 bucket and ensure that only the latest successful build artifacts are retained. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure CodeBuild to output artifacts to a specific S3 bucket.. Options B and D are correct. Option B configures CodeBuild to store artifacts in S3. Option D sets a lifecycle policy to expire old artifacts. Option A is wrong because it would retain all artifacts. Option C is wrong because CodeCommit is for source code, not artifacts. Option E is wrong because CloudWatch Logs are for logs, not artifacts.

Answer

Store artifacts in an AWS CodeCommit repository.

Answer

Enable versioning on the S3 bucket to keep all versions.

Answer

Use CloudWatch Logs to store build logs.

Question 13

A company uses AWS CloudFormation to manage its infrastructure. The security team requires that all S3 buckets have versioning enabled. A DevOps engineer needs to enforce this policy across all accounts in an AWS Organization. Which solution is MOST operationally efficient?

Accepted Answer

Create an SCP in AWS Organizations that denies s3:PutBucketVersioning with a condition that versioning is not enabled.. Option D is correct because using SCPs at the organizational level allows you to centrally deny actions that disable versioning, which is more efficient than per-account Lambda functions or IAM policies. Option A is wrong because a custom resource in each stack would require modification of every template. Option B is wrong because AWS Config rules require remediations that are not as immediate as SCPs. Option C is wrong because Service Catalog only helps with new stacks, not existing ones.

Answer

Add a CloudFormation custom resource to each template that enables versioning and attaches a Lambda function to re-enable it if disabled.

Answer

Create a Service Catalog portfolio with a product that enforces versioning and require all users to launch stacks from it.

Answer

Use AWS Config with a managed rule 's3-bucket-versioning-enabled' and an automatic remediation action that enables versioning.

Question 14

A company uses AWS OpsWorks for configuration management with Chef. They are migrating to AWS Systems Manager to reduce complexity. The operations team needs to run custom scripts on a fleet of EC2 instances on a schedule, with the ability to target instances based on tags. Which Systems Manager capability should the engineer use?

Accepted Answer

State Manager. Option B is correct because State Manager allows you to define associations that run documents on a schedule with tag-based targeting. Option A is wrong because Run Command is for ad-hoc execution, not scheduled. Option C is wrong because Patch Manager is for patching only. Option D is wrong because Automation is for multi-step workflows, not simple script execution.

Answer

Patch Manager

Answer

Automation

Answer

Run Command

Question 15

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to ensure that infrastructure changes are reviewed and approved before deployment. The code is stored in AWS CodeCommit, and the pipeline uses AWS CodePipeline and AWS CloudFormation. What is the BEST way to implement an approval process for infrastructure changes?

Accepted Answer

Add a manual approval step in CodePipeline between the build and deploy stages.. Option C is correct because CodePipeline supports manual approval actions that can be inserted between stages. Option A is wrong because CodeCommit approval rules only apply to code merges, not pipeline execution. Option B is wrong because IAM policies cannot create approval gates in the pipeline. Option D is wrong because CodeBuild does not have native approval capabilities.

Answer

Use CodeCommit approval rules to require a pull request before any change is merged.

Answer

Configure IAM policies to require MFA before any CloudFormation stack update.

Answer

Use CodeBuild to run a script that sends an approval request via Amazon SNS and waits for a response.