DOP-C02 Configuration Management and IaC Practice Test 2 — 15 Questions

Question 1

A DevOps engineer updated an EC2 instance's InstanceType in a CloudFormation stack and received the stack events shown in the exhibit. What is the most likely cause of the failure?

Accepted Answer

The engineer specified an invalid instance type (e.g., t2.large) that is not allowed by CloudFormation.. CloudFormation itself does not restrict AWS::EC2::Instance's InstanceType property to a fixed set of values -- it is a plain String in the resource provider schema and accepts any syntactically valid EC2 instance type. The 'Value of property InstanceType must be one of: t2.micro, t2.small, t2.medium' error instead comes from a governance control the template's author added: an InstanceType input Parameter defined with AllowedValues: [t2.micro, t2.small, t2.medium]. When the engineer updated the stack with a value like t2.large that falls outside that parameter's AllowedValues list, CloudFormation rejects the update during parameter validation, before ever calling the EC2 API, producing exactly this UPDATE_FAILED reason. The fix is to either supply an InstanceType value that is in the template's AllowedValues list, or update the Parameter definition itself to include the desired instance type.

Answer

The engineer did not have permission to modify the instance type.

Answer

The AMI ID specified does not support the new instance type.

Answer

The VPC configuration does not support the new instance type.

Question 2

A team creates the CloudFormation template shown in the exhibit. What is a potential security concern with this configuration?

Accepted Answer

The bucket policy allows public read access to all objects.. The bucket policy in the exhibit explicitly grants `s3:GetObject` to `Principal: "*"`, which allows any unauthenticated user to read all objects in the bucket. This is a critical security concern because it exposes the bucket's contents to the public internet, potentially leading to data leakage or unauthorized access. Even if the bucket itself is private, a permissive policy overrides that default restriction.

Answer

The bucket name is not unique.

Answer

The bucket does not have server-side encryption enabled.

Answer

The bucket is not versioned.

Question 3

A company uses AWS OpsWorks for configuration management. They want to ensure that a custom recipe runs on all instances in a layer every 30 minutes. What should they do?

Accepted Answer

Set a custom chef recipe with a cron schedule. AWS OpsWorks Stacks reached end-of-life on May 26, 2024 and is no longer available in any AWS account. This question should be retired or rewritten around a currently supported configuration-management/scheduling approach, such as AWS Systems Manager State Manager associations (which support rate-based schedules, e.g., every 30 minutes) or a cron entry deployed via Systems Manager Run Command / Distributor, since AWS explicitly recommends migrating OpsWorks Stacks workloads to Systems Manager.

Answer

Add the recipe to the 'Setup' lifecycle event

Answer

Add the recipe to the 'Deploy' lifecycle event

Answer

Add the recipe to the 'Configure' lifecycle event

Question 4

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to update a stack that includes an EC2 instance with a security group. The update requires changing a security group rule. Which method should the team use to perform this update with minimal disruption?

Accepted Answer

Update the stack directly by submitting the updated template to CloudFormation.. Updating the stack directly by submitting the updated template to CloudFormation is the correct method. CloudFormation will compute the changes and apply them, updating the security group rule with minimal disruption. This is the standard way to update a stack.

Answer

Manually modify the security group in the EC2 console and then import the resource into CloudFormation.

Answer

Delete the stack and create a new stack with the updated template.

Answer

Use a change set to review the changes and then execute it.

Question 5

A company uses AWS OpsWorks for configuration management. They want to automate the installation of a custom agent on new EC2 instances. Which OpsWorks feature should they use?

Accepted Answer

Use a custom Chef recipe in the layer's configuration to run the installation.. AWS OpsWorks (both Stacks and the managed Chef Automate offering) executes configuration management through Chef recipes organized into cookbooks and attached to layers via lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown). To install a custom agent on every new instance, the correct mechanism is a custom Chef recipe bound to the layer's Setup lifecycle event, which runs automatically when an instance boots. Built-in layer configuration only covers AWS-provided defaults and cannot encode arbitrary installation logic.

Answer

Define the agent installation in the layer's built-in configuration.

Answer

Use custom JSON to pass the installation commands.

Answer

Create a cookbook repository and upload the agent installation script.

Question 6

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a custom script on all instances every time the instance is started. The script is stored in an S3 bucket. Which approach ensures the script runs automatically on every instance start with minimal administrative overhead?

Accepted Answer

Create a State Manager association with the AWS-RunDocument document, targeting the instances, and set the schedule to 'On Instance Start'.. AWS Systems Manager State Manager associations support a schedule type of 'On Instance Start' (also called 'Instance Start' or 'When the instance starts'), which triggers the associated document whenever the instance boots. By using the AWS-RunDocument document (or a custom document that references the S3-stored script), the association can download and execute the script from S3 on every start. This approach requires no custom AMI maintenance, no user data scripting, and no additional Lambda or Config infrastructure, providing minimal administrative overhead while ensuring the script runs automatically on each start.

Answer

Place the script in /etc/rc.local on a custom AMI.

Answer

Use AWS Config rules to invoke a Lambda function that runs the script.

Answer

Create an EC2 launch template that includes the script in user data.

Question 7

A team uses AWS CloudFormation to manage a VPC with multiple subnets. They want to ensure that when a stack is updated, the update does not accidentally replace the VPC or any subnet. Which CloudFormation property should they set on the resources?

Accepted Answer

UpdateReplacePolicy. The 'DeletionPolicy' attribute with 'Retain' keeps the resource if the stack is deleted, but does not prevent replacement during update. To prevent replacement, use 'UpdateReplacePolicy' with 'Retain', or design the template to avoid replacement. However, the most direct way is to use 'UpdateReplacePolicy'. Option C is correct because it specifically handles update replacement.

Answer

CreationPolicy

Answer

DependsOn

Answer

DeletionPolicy

Question 8

A company uses AWS CodePipeline to orchestrate a multi-stage CI/CD pipeline. The build stage uses AWS CodeBuild and the deploy stage uses AWS CodeDeploy. The pipeline includes a manual approval step between build and deploy. The team wants to automatically trigger the pipeline when changes are pushed to a Git repository hosted in AWS CodeCommit. Which pipeline configuration is required for automatic triggers?

Accepted Answer

Configure the source stage to use CodeCommit as the source provider and enable 'Amazon CloudWatch Events' (EventBridge) to detect changes.. For CodePipeline to trigger automatically on CodeCommit pushes, the source stage must specify CodeCommit as the source provider, and change detection must be enabled — historically via CloudWatch Events (now EventBridge), which is the event-driven mechanism that starts the pipeline on repository changes. This replaces the older polling model and gives near-real-time triggers. The configuration is done in the source action of the pipeline, not via external services.

Answer

Configure the source stage to use periodic polling of the CodeCommit repository.

Answer

Set up an SNS topic to notify the pipeline when code changes occur.

Answer

Add a Lambda function that calls StartPipelineExecution in response to CodeCommit events.

Question 9

A company uses AWS CloudFormation StackSets to deploy a common network infrastructure across multiple AWS accounts. They need to ensure that all StackSet operations are audited and any failed stack instances are automatically retried. Which THREE configurations should be implemented? (Select THREE.)

Accepted Answer

Configure Amazon SNS notifications for StackSet events.. Option B is correct because configuring Amazon SNS notifications for StackSet events lets the company receive alerts on StackSet operations and failures, which supports auditing and operational visibility. Option D is correct because setting the 'Retry on failure' option in StackSet operation preferences automatically retries failed stack instances, directly satisfying the retry requirement. Option E is correct because enabling AWS CloudTrail logs StackSet API calls (such as CreateStackSet, UpdateStackSet, and CreateStackInstances), providing the required audit trail of all StackSet operations. Option A is not appropriate because automatic rollback on failure reverts changes rather than retrying failed stack instances, and it does not provide auditing. Option C is not appropriate because AWS Config rules evaluate resource compliance and do not audit StackSet API operations or automatically retry failed stack instances.

Answer

Enable automatic rollback on failure.

Answer

Use AWS Config rules to monitor StackSet compliance.

Question 10

A CloudFormation stack creation failed. The engineer runs the describe-stack-events command and sees the output above. What is the root cause of the failure?

Accepted Answer

The EC2 instance failed to create because the AMI ID is invalid or does not exist in the region.. The describe-stack-events output shows a CREATE_FAILED event for the EC2 instance with a status reason indicating the AMI ID is invalid. Specifically, the error mentions 'Expected: 'ami-0abcdef1234567890'' which confirms the AMI ID provided does not exist or is incorrect in the region. Therefore, option D is correct. Option A is incorrect because the stack is rolling back due to the EC2 failure, not because a network resource failed. Option B is incorrect because the error is not about permissions; it's about an invalid AMI ID. Option C is incorrect because the failure is due to the AMI, not the instance type.

Answer

The stack is rolling back because a network resource failed to create.

Answer

The stack lacks permissions to launch EC2 instances.

Answer

The EC2 instance failed because the instance type 't2.micro' is not supported.

Question 11

A CloudFormation template includes the above snippet. The stack creation fails with the error 'Unable to validate the following destination configurations'. What is the most likely cause?

Accepted Answer

The account has a public access block that denies public bucket policies.. The error 'Unable to validate the following destination configurations' occurs when S3 cannot validate the destination configuration for events, often due to public access block settings. If the account-level or bucket-level public access block is enabled to deny public bucket policies, then any attempt to set a bucket policy that grants public access will fail with this error. In this scenario, the CloudFormation template likely includes a bucket policy that grants public access, but the account has a public access block that denies such policies. Therefore, option D is correct. Option A is incorrect because the error is not a syntax error; it's a validation error. Option B is incorrect because the bucket name uniqueness is not the issue. Option C is incorrect because S3 bucket policies are supported in all regions.

Answer

The template has a syntax error in the PolicyDocument section.

Answer

The bucket name is not globally unique.

Answer

S3 Bucket Policy is not supported for this bucket region.

Question 12

A DevOps engineer uses AWS CodeBuild to build a Java application. The build fails with an error indicating that the build environment does not have the required Java version. What is the MOST efficient way to ensure the correct Java version is installed for all future builds?

Accepted Answer

Specify a managed image in the buildspec that includes the required Java version.. Add a runtime-versions block to the buildspec (e.g., under phases > install > runtime-versions, specifying java: corretto17) to select the exact JDK version within the CodeBuild managed image already configured on the project. This lets you select the required Java version without any manual installation or custom image maintenance, since managed images are pre-bundled with multiple JDK versions.

Answer

Use AWS Lambda to install Java on the build instance before the build starts.

Answer

Add a command in the buildspec to install the required Java version using apt-get.

Answer

Create a custom Docker image with the required Java version and reference it in the build project.

Question 13

A company uses AWS CloudFormation to manage infrastructure. After updating a stack, a resource fails to update because it requires a physical replacement. The stack update is set to 'Rollback on failure'. The engineer wants to test the effect of the change without affecting the production environment. Which approach should the engineer use?

Accepted Answer

Create a change set to review the proposed changes before executing the update.. A change set in CloudFormation lets the engineer preview exactly what CloudFormation will do — including which resources will be replaced — without actually executing the update against the production stack. Because the resource requires replacement, the change set will show 'Modify' or 'Replace' actions, allowing the engineer to assess impact before committing. This is the AWS-recommended way to test the effect of a template change safely.

Answer

Disable rollback on failure and update the stack, then manually revert if issues occur.

Answer

Create a new stack using the same template but with a different stack name.

Answer

Use a different AWS region and replicate the stack there for testing.

Question 14

An engineer uses AWS Elastic Beanstalk to deploy a web application. The application needs to read from an S3 bucket. The engineer has configured an instance profile with the necessary S3 permissions. However, the application returns an access denied error. What is the MOST likely cause?

Accepted Answer

The instance profile has not been assigned to the Elastic Beanstalk environment.. This option is not the MOST likely cause given the scenario as stated: nothing in the stem indicates the bucket policy explicitly denies access. However, it is worth noting that IAM evaluation is not simply additive — an explicit Deny in a bucket policy overrides an Allow granted via the instance profile's IAM policy, so a restrictive bucket policy could independently cause this exact error. Absent evidence of such a policy, the more likely explanation remains that the instance profile was never attached to the Elastic Beanstalk environment (option A).

Answer

The S3 bucket policy denies access to the application.

Answer

The security group assigned to the environment does not allow outbound traffic to S3.

Answer

The S3 bucket is in a different region and the application is not configured to use the correct region.

Question 15

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set with a new template version. The update fails in some accounts due to a resource conflict. What is the BEST way to resolve the conflict and complete the update?

Accepted Answer

Use the 'Skip accounts' option to temporarily exclude failing accounts, then fix and retry.. StackSets does not have a literal 'Skip accounts' button. Instead, you use Operation Preferences (FailureToleranceCount or FailureTolerancePercentage) so the update operation continues rolling out to the remaining, non-conflicting accounts instead of halting entirely, and you can target 'update stack instances' explicitly at the deployment targets (accounts/OUs) that already succeeded or are ready, excluding the accounts with the resource conflict. Once you've resolved the underlying conflict in those accounts (e.g., by renaming or importing the conflicting resource), you re-run the stack instance update scoped to just those accounts. This staged, targeted retry approach is best because it avoids the downtime of deleting/recreating the whole stack set (option A), avoids risky manual/undocumented resource deletion (option B), and avoids masking the conflict with a template condition instead of resolving it (option C).

Answer

Delete the stack set and recreate it with the new template.

Answer

Manually delete the conflicting resources in the failing accounts and retry the update.

Answer

Modify the CloudFormation template to ignore the conflicting resources using a condition.