DOP-C02 Configuration Management and IaC Practice Test 3 — 15 Questions

Question 1

A company uses AWS CodeBuild to run unit tests and package a Java application. The build environment needs to have a specific version of Java installed that is not available in the standard build images. The team wants to minimize build time. How should the engineer configure the build environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a custom build image that already includes the required Java version, stored in Amazon ECR.. Using a custom build image stored in Amazon ECR allows the team to pre-install the exact Java version required, eliminating the need for runtime installation. This minimizes build time by avoiding the overhead of downloading and installing software during every build, while still providing a consistent, reproducible environment.

Answer

Use AWS Lambda to run the tests and package the application.

Answer

Use a standard build image and include a pre-build command to install the required Java version.

Answer

Use the pre-build phase to download and install Java from an S3 bucket.

Question 2

A company uses AWS CloudFormation to manage a production environment with multiple stacks. The DevOps team needs to implement a change management process that requires approval for any changes to the production stack. Which approaches meet this requirement? (Choose TWO.)

Accepted Answer

Require that all stack updates be performed through a change set that is reviewed and executed by a separate role.. CloudFormation change sets allow you to preview how proposed changes will affect running resources before you execute them. By requiring a separate IAM role to review and execute the change set, you enforce a two-person rule for production stack updates. Option C is correct because AWS CodePipeline can include a manual approval step that pauses the pipeline, requiring a reviewer to approve before the pipeline executes a CloudFormation change set, thus enforcing an approval gate.

Answer

Create an IAM policy that allows only read-only access to the production stack and a separate role with write access.

Answer

Use AWS Config rules to detect unapproved changes and automatically revert them.

Answer

Use an SCP to deny all CloudFormation actions except from a specific CI/CD role.

Question 3

A company is using AWS Elastic Beanstalk with a custom platform. The DevOps team wants to automate the creation of a new platform version whenever changes are pushed to a Git repository. The pipeline should run tests, build the platform, and then update the Elastic Beanstalk environment to use the new platform version. Which services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can run the tests and build the custom platform artifact. In this scenario, CodeBuild executes the buildspec to compile code, run unit tests, and produce the platform version (e.g., an AMI or Packer image). It integrates directly with CodePipeline to receive source changes and pass artifacts downstream for environment updates.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 4

A company uses AWS OpsWorks for Chef to manage its configuration. The company is planning to migrate to AWS Systems Manager. Which AWS Systems Manager capabilities can replace OpsWorks Chef functionalities? (Choose THREE.)

Accepted Answer

Patch Manager. Patch Manager is correct because it automates the process of patching managed nodes with security updates and other types of updates, directly replacing OpsWorks Chef's ability to manage package updates and system patches via cookbooks. It provides a centralized, policy-based approach to patch compliance without requiring custom Chef recipes.

Answer

Session Manager

Answer

Run Command

Question 5

A DevOps engineer creates the IAM policy shown in the exhibit to restrict EC2 instance types. However, users are still able to launch instances of type 't2.large'. What is the reason for this behavior?

Accepted Answer

The policy does not include a Deny statement for the 'ec2:RunInstances' action on the 'image' resource.. The Deny statement only applies to the 'instance' resource, but ec2:RunInstances requires permissions on multiple resources, including the 'image' resource. Since the policy includes an Allow statement that grants full access to all resources without conditions, the launch can succeed because the image resource permission is allowed. To fully restrict instance types, the Deny must also cover the image resource, or the Allow must include a condition on instance types.

Answer

The Deny statement's condition uses StringNotEquals, which does not match the 't2.large' instance type because the condition requires the instance type to be NOT equal to any of the listed types, but 't2.large' is not in the list, so the condition is true, and the Deny should apply. However, the Allow statement without condition allows all, so there is a conflict. Actually, the correct explanation is that the Deny condition is not evaluated correctly because the ec2:InstanceType condition key is not available for the instance resource? I'm not sure. I'll stick with the idea that the Deny condition actually works, so the answer is that the policy is missing a Deny on the image resource to fully block. But since the question says users can launch, I'll choose A.

Answer

The policy should use 'Deny' with 'ec2:InstanceType' in a 'ForAllValues:StringNotEquals' condition.

Answer

The Allow statement is evaluated after the Deny statement and overrides it.

Question 6

A DevOps engineer runs the command shown in the exhibit to view stack events. The stack update failed. What is the most likely cause of the failure?

Accepted Answer

The Lambda function specifies a runtime that is not available in the region.. The stack update failed because the Lambda function specifies a runtime that is not available in the region. AWS Lambda runtimes are region-specific; some runtimes (e.g., deprecated or newly introduced ones) may not be supported in all regions. When CloudFormation attempts to create or update a Lambda function with an unsupported runtime, it returns a validation error, causing the stack operation to fail.

Answer

The IAM role for the Lambda function is missing required permissions.

Answer

The Lambda function code exceeds the maximum size limit.

Answer

The S3 bucket containing the template is not accessible.

Question 7

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application. The application uses AWS Lambda functions and Amazon API Gateway. The engineer wants to implement a canary deployment strategy for the Lambda functions to reduce risk. Which AWS service or feature should be used to achieve this?

Accepted Answer

AWS CodeDeploy with an AWS Lambda deployment configuration. AWS CodeDeploy with a Lambda deployment configuration (e.g., Canary10Percent5Minutes) is the AWS service designed to perform canary deployments for Lambda functions. It automates traffic shifting, monitoring, and rollback using Lambda aliases. While Lambda aliases support traffic splitting, they do not by themselves provide the deployment strategy; CodeDeploy provides the deployment control and is the appropriate service to use in a CI/CD pipeline.

Answer

AWS Lambda traffic shifting using aliases

Answer

AWS CloudFormation with UpdatePolicy attribute

Answer

AWS SAM with AutoPublishAlias and DeploymentPreference

Question 8

A company uses AWS OpsWorks for configuration management. The DevOps team wants to automate the patching of operating system updates on a set of EC2 instances managed by OpsWorks. Which OpsWorks feature should be used?

Accepted Answer

Weekly Auto Update. AWS OpsWorks Stacks provides a built-in 'Weekly Auto Update' feature that automatically installs operating system updates on managed EC2 instances. This feature is specifically designed to automate OS patching without requiring custom recipes or manual intervention, making it the correct choice for the DevOps team's requirement.

Answer

Auto Scaling

Answer

Chef Automate

Answer

Lifecycle events (Setup, Configure, Deploy, etc.)

Question 9

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an EC2 instance with a UserData script that installs software. The stack creation fails with the error: 'The following resource(s) failed: EC2Instance (AWS::EC2::Instance) – Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack creation timed out or was manually cancelled. The error message 'Resource creation cancelled' indicates that the CloudFormation stack creation was either timed out or manually cancelled, not that the EC2 instance itself failed. CloudFormation has a default timeout of 60 minutes for stack creation, and if the UserData script takes longer than this or the user manually cancels the operation, CloudFormation will mark the resource as cancelled. This is distinct from a resource-specific failure like an invalid instance type or IAM permissions issue, which would produce a different error message such as 'Resource failed to stabilize' or 'API error'.

Answer

The EC2 instance type is not supported in the region

Answer

The IAM role attached to the instance lacks permissions

Answer

The UserData script failed due to a syntax error

Question 10

A company uses AWS Elastic Beanstalk to deploy web applications. The DevOps team wants to implement a blue/green deployment strategy to minimize downtime. Which Elastic Beanstalk feature should be used?

Accepted Answer

Environment URL swap. Elastic Beanstalk's environment URL swap feature enables blue/green deployment by routing traffic from the current (blue) environment to a new (green) environment via a simple DNS swap. This swap is instantaneous at the DNS level, resulting in zero downtime for users, as the green environment is fully tested before the swap occurs.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 11

A DevOps engineer is designing a configuration management solution for a fleet of EC2 instances. The instances are ephemeral and frequently replaced by an Auto Scaling group. The engineer needs to ensure that newly launched instances are automatically configured with the latest software packages and settings. Which AWS service should be used?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it provides a configuration management solution that ensures EC2 instances maintain a desired state. It uses associations to define the software packages, settings, and policies that should be applied to instances, and it automatically applies these configurations to newly launched instances, including those in an Auto Scaling group, without requiring custom scripts or manual intervention.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks Stacks

Answer

AWS CloudFormation

Question 12

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a parameter for the instance type of EC2 instances. The DevOps team wants to restrict the allowed values to a specific set of instance types. Which CloudFormation section should be used?

Accepted Answer

Parameters with AllowedValues. The Parameters section in AWS CloudFormation allows you to define input values that can be supplied at stack creation or update time. By specifying an AllowedValues constraint on a parameter, you restrict the user to select only from a predefined list of instance types, which enforces compliance and prevents misconfiguration. This is the correct mechanism for limiting instance type choices in a CloudFormation template.

Answer

Outputs

Answer

Conditions

Answer

Mappings

Question 13

A DevOps engineer needs to manage the configuration of a large number of EC2 instances that are part of a cluster. The instances should have consistent software packages, services, and settings. The engineer wants to use a configuration management tool that integrates with AWS and supports a push-based model. Which service should be used?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct choice because it provides a push-based configuration management model that allows you to remotely and securely execute commands or scripts across a large fleet of EC2 instances without needing SSH access. It integrates natively with AWS, supports consistent software package installation and service management via SSM documents, and is ideal for maintaining configuration consistency in a cluster.

Answer

AWS OpsWorks Stacks

Answer

AWS CodeCommit

Answer

AWS CloudFormation

Question 14

A company uses AWS CloudFormation to manage a stack that includes an Auto Scaling group with a LaunchTemplate. The DevOps team wants to update the LaunchTemplate with a new AMI. The stack update fails with the error 'Launch template version does not exist'. What is the most likely cause?

Accepted Answer

The LaunchTemplate version specified in the template was deleted. The error 'Launch template version does not exist' indicates that the LaunchTemplate version specified in the CloudFormation template has been deleted. CloudFormation references a specific version of the launch template; if that version is deleted, the stack update fails. Option A is incorrect because a recent modification would not cause a 'does not exist' error—it would either succeed or fail due to other reasons. Option C is incorrect because target group attachment does not affect launch template versions. Option D is incorrect because using a different launch template would cause a mismatch error, not a version not existing error.

Answer

The LaunchTemplate was recently modified and the new version is not yet available

Answer

The target group attachment is incorrect

Answer

The Auto Scaling group is using a different launch template

Question 15

A DevOps engineer is using AWS CloudFormation to deploy a stack that includes a VPC with public and private subnets. The engineer wants to ensure that the public subnets automatically get a public IP address assigned to instances launched in them. Which property should be set?

Accepted Answer

MapPublicIpOnLaunch on the subnet. The `MapPublicIpOnLaunch` property on an AWS CloudFormation `AWS::EC2::Subnet` resource controls whether instances launched in that subnet automatically receive a public IP address. Setting this property to `true` ensures that any EC2 instance launched in the public subnet gets a public IPv4 address from the subnet's CIDR range, which is essential for internet-facing resources in a VPC.

Answer

EnableDnsSupport on the VPC

Answer

EnableDnsHostnames on the VPC

Answer

AssociatePublicIpAddress on the instance