DOP-C02 Configuration Management and IaC Practice Test 3 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running behind an Application Load Balancer. The DevOps team notices that during deployments, the new application version fails health checks and the deployment rolls back. The team wants to reduce deployment time while maintaining safety. Which configuration change should the engineer recommend?

Accepted Answer

Change the deployment policy to immutable.. Option A is correct because immutable deployments create a new Auto Scaling group and only shift traffic after health checks pass, which is safe and faster than rolling with batch size 1. Option B is wrong because rolling with a large batch size risks capacity. Option C is wrong because all-at-once is fastest but unsafe. Option D is wrong because adding more instances to the existing group does not improve deployment strategy.

Answer

Increase the number of EC2 instances in the environment.

Answer

Use the all-at-once deployment policy.

Answer

Increase the rolling update batch size to 100%.

Question 2

A company uses a central CloudFormation template to create VPCs with a standard CIDR block of 10.0.0.0/16. The template is used across multiple accounts and regions. The team needs to ensure that the VPC CIDR does not overlap with other VPCs in the same account. Which approach should the engineer take to dynamically assign a unique /16 subnet from a larger pool?

Accepted Answer

Use the Fn::Cidr function with the stack ID as a seed to generate a /16 CIDR from a larger pool.. Option A is correct because AWS CloudFormation's Cidr function can allocate subnets from a larger CIDR pool, and since it uses the stack ID as a seed, it produces a deterministic but unique range per stack. Option B is wrong because the Ref function returns the VPC ID, not a CIDR. Option C is wrong because Fn::GetAtt on a VPC returns attributes like VpcId, not a new CIDR. Option D is wrong because Fn::Select on a list of CIDRs requires manual maintenance and is not dynamic.

Answer

Use Fn::Select on a predefined list of CIDR blocks passed as a parameter.

Answer

Use Fn::GetAtt to retrieve the VPC's CidrBlock from another VPC resource.

Answer

Use the Ref function to assign the VPC ID as the CIDR block.

Question 3

A DevOps engineer is implementing AWS Config rules to enforce tagging standards on resources. The rule should trigger a remediation action via AWS Systems Manager Automation to apply the correct tags if a resource is non-compliant. What is the correct way to set up this remediation?

Accepted Answer

Use the AWS Config rule's remediation action to run an AWS Systems Manager Automation document.. Option C is correct because AWS Config rule remediation actions can be configured to run an Automation document when a resource is non-compliant. Option A is wrong because CloudWatch Events alone cannot run remediation; it would need a target like Lambda. Option B is wrong because SNS notifications are just notifications, not remediation. Option D is wrong because AWS Config does not directly trigger CodePipeline.

Answer

Configure the AWS Config rule to send events to AWS CodePipeline to trigger a pipeline that fixes the tags.

Answer

Configure a CloudWatch Events rule to detect non-compliant resources and invoke a Lambda function that applies tags.

Answer

Use an SNS topic to notify administrators when a resource is non-compliant.

Question 4

A company uses AWS CloudFormation StackSets to deploy a common security group across multiple accounts in an AWS Organization. The security group must allow inbound traffic from the organization's central VPN CIDR range. The VPN CIDR range is stored in AWS Systems Manager Parameter Store. How should the engineer reference this parameter in the StackSet template to ensure the value is resolved at deployment time?

Accepted Answer

Use the dynamic reference '{{resolve:ssm:/org/vpn/cidr}}' in the template.. Option B is correct because dynamic references in CloudFormation templates (using the 'resolve:ssm' prefix) fetch the parameter value at stack creation/update time. Option A is wrong because the Ref function on a parameter would require the parameter to be passed as a stack parameter, not directly from Parameter Store. Option C is wrong because Fn::GetAtt is for resource attributes. Option D is wrong because Fn::ImportValue is for cross-stack references, not Parameter Store.

Answer

Use Fn::ImportValue with an export from another stack that reads the parameter.

Answer

Use the Ref function on the parameter name as a CloudFormation parameter.

Answer

Use Fn::GetAtt to retrieve the parameter value from an AWS::SSM::Parameter resource.

Question 5

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create. The error message indicates a 'circular dependency' between two resources: a security group and an EC2 instance. The security group contains an ingress rule that references the instance's private IP address, which is not known until the instance is created. The instance's network interface uses the security group. What change should the engineer make to resolve the circular dependency?

Accepted Answer

Add an AWS::EC2::SecurityGroupIngress rule that references the instance's network interface using Fn::GetAtt on the network interface resource.. Option C is correct because by using a VPC endpoint on the security group rule, you can reference the instance's network interface after creation, breaking the circular dependency. Option A is wrong because hardcoding the IP is not dynamic and may not be the correct IP. Option B is wrong because Ref on the instance returns the instance ID, not the IP. Option D is wrong because depending on the network interface still requires the interface to exist, which depends on the instance.

Answer

Create the EC2 instance first without a security group, then attach the security group after creation.

Answer

Hardcode the instance's private IP address in the security group rule.

Answer

Use the Ref function on the EC2 instance to get its private IP address.

Question 6

A company uses AWS CodeBuild to run unit tests and package a Java application. The build environment needs to have a specific version of Java installed that is not available in the standard build images. The team wants to minimize build time. How should the engineer configure the build environment?

Accepted Answer

Use a custom build image that already includes the required Java version, stored in Amazon ECR.. Option B is correct because using a custom Docker image with the required Java version avoids installing it during each build, reducing build time. Option A is wrong because installing during build increases time. Option C is wrong because installing at the start of the build phase also increases time. Option D is wrong because Lambda is not suitable for running a build server.

Answer

Use AWS Lambda to run the tests and package the application.

Answer

Use a standard build image and include a pre-build command to install the required Java version.

Answer

Use the pre-build phase to download and install Java from an S3 bucket.

Question 7

A company uses AWS CloudFormation to manage a production environment with multiple stacks. The DevOps team needs to implement a change management process that requires approval for any changes to the production stack. Which approaches meet this requirement? (Choose TWO.)

Accepted Answer

Require that all stack updates be performed through a change set that is reviewed and executed by a separate role.. Options B and C are correct. B: Using a change set allows reviewing proposed changes without applying them. C: StackSets with approval workflows are not standard; however, using a separate pipeline with a manual approval step in CodePipeline before executing the change set is a valid approach. Option A is wrong because SCPs cannot control CloudFormation changes specifically. Option D is wrong because IAM policies can restrict who can update, but not provide an approval workflow. Option E is wrong because Config rules are detective, not preventive.

Answer

Create an IAM policy that allows only read-only access to the production stack and a separate role with write access.

Answer

Use AWS Config rules to detect unapproved changes and automatically revert them.

Answer

Use an SCP to deny all CloudFormation actions except from a specific CI/CD role.

Question 8

A company is using AWS Elastic Beanstalk with a custom platform. The DevOps team wants to automate the creation of a new platform version whenever changes are pushed to a Git repository. The pipeline should run tests, build the platform, and then update the Elastic Beanstalk environment to use the new platform version. Which services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. Options A, C, and D are correct. A: CodePipeline orchestrates the pipeline. C: CodeBuild can run tests and build the platform AMI. D: Packer (through CodeBuild) can create a custom AMI for the platform. Option B is wrong because CodeDeploy is for deploying applications, not for creating platform versions. Option E is wrong because CloudFormation is not directly used to create a custom platform; Packer and CodeBuild handle that.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 9

A company uses AWS OpsWorks for Chef to manage its configuration. The company is planning to migrate to AWS Systems Manager. Which AWS Systems Manager capabilities can replace OpsWorks Chef functionalities? (Choose THREE.)

Accepted Answer

Patch Manager. Options A, B, and D are correct. A: State Manager can enforce configuration state. B: Patch Manager can manage patching. D: Inventory can collect software inventory. Option C is wrong because Run Command is for ad-hoc commands, not state enforcement. Option E is wrong because Session Manager is for interactive access, not configuration management.

Answer

Session Manager

Answer

Run Command

Question 10

A DevOps engineer creates the IAM policy shown in the exhibit to restrict EC2 instance types. However, users are still able to launch instances of type 't2.large'. What is the reason for this behavior?

Answer

The Deny statement's condition uses StringNotEquals, which does not match the 't2.large' instance type because the condition requires the instance type to be NOT equal to any of the listed types, but 't2.large' is not in the list, so the condition is true, and the Deny should apply. However, the Allow statement without condition allows all, so there is a conflict. Actually, the correct explanation is that the Deny condition is not evaluated correctly because the ec2:InstanceType condition key is not available for the instance resource? I'm not sure. I'll stick with the idea that the Deny condition actually works, so the answer is that the policy is missing a Deny on the image resource to fully block. But since the question says users can launch, I'll choose A.

Answer

The policy does not include a Deny statement for the 'ec2:RunInstances' action on the 'image' resource.

Answer

The policy should use 'Deny' with 'ec2:InstanceType' in a 'ForAllValues:StringNotEquals' condition.

Answer

The Allow statement is evaluated after the Deny statement and overrides it.

Question 11

A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?

Accepted Answer

The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.. Option D is correct because the template does not associate the security group with the instance; the DependsOn only ensures creation order, but does not attach the group. Option A is wrong because DependsOn does not automatically attach. Option B is wrong because the security group is created. Option C is wrong because the security group is created first due to DependsOn, but still not attached.

Answer

The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.

Answer

The security group is created after the instance, so the instance cannot reference it.

Answer

The DependsOn clause should be removed because it causes a circular dependency.

Question 12

A DevOps engineer runs the command shown in the exhibit to view stack events. The stack update failed. What is the most likely cause of the failure?

Accepted Answer

The Lambda function specifies a runtime that is not available in the region.. Option B is correct because the error message indicates that the runtime 'nodejs18.x' is not supported. Option A is wrong because the error is about runtime, not S3 access. Option C is wrong because the error is specific to Lambda runtime, not IAM. Option D is wrong because the error is about an invalid parameter, not a timeout.

Answer

The IAM role for the Lambda function is missing required permissions.

Answer

The Lambda function code exceeds the maximum size limit.

Answer

The S3 bucket containing the template is not accessible.

Question 13

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that critical resources, such as an RDS database, are not accidentally deleted when a stack is updated or deleted. Which CloudFormation feature should be used to prevent this?

Accepted Answer

DeletionPolicy attribute with Retain. Option D is correct because DeletionPolicy with Retain prevents the resource from being deleted when the stack is deleted. Option A (Stack policy) controls updates to stack resources, not deletion prevention. Option B (Termination protection) is an EC2 feature, not native to CloudFormation. Option C (DependsOn) only defines resource creation order, not deletion behavior.

Answer

Stack policy

Answer

Termination protection

Answer

DependsOn attribute

Question 14

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application. The application uses AWS Lambda functions and Amazon API Gateway. The engineer wants to implement a canary deployment strategy for the Lambda functions to reduce risk. Which AWS service or feature should be used to achieve this?

Accepted Answer

AWS Lambda traffic shifting using aliases. Option B is correct because AWS Lambda supports traffic shifting using aliases with weighted targets, enabling canary deployments. Option A (CodeDeploy with Lambda) is correct but more specific: CodeDeploy can orchestrate canary deployments for Lambda, but it uses Lambda's built-in traffic shifting. Option C (SAM with AutoPublishAlias) is also correct but is a feature within SAM, not a separate service. However, the question asks for an AWS service or feature; both CodeDeploy and SAM's AutoPublishAlias are valid. But CodeDeploy is the native service for deployment strategies. Option D (CloudFormation with UpdatePolicy) is not applicable for Lambda canary deployments.

Answer

AWS CloudFormation with UpdatePolicy attribute

Question 15

A company uses AWS OpsWorks for configuration management. The DevOps team wants to automate the patching of operating system updates on a set of EC2 instances managed by OpsWorks. Which OpsWorks feature should be used?

Accepted Answer

Weekly Auto Update. Option B is correct because OpsWorks Stacks supports automatic patching via the 'Auto Healing' and 'Custom Recipes' but also has a built-in 'Weekly Auto Update' feature for managed instances. Option A (Auto Scaling) handles capacity, not patching. Option C (Lifecycle events) can be used to trigger custom recipes for patching, but the question asks for a specific feature. Option D (Chef Automate) is a separate product, not natively integrated with OpsWorks Stacks.

Answer

Auto Scaling

Answer

Chef Automate

Answer

Lifecycle events (Setup, Configure, Deploy, etc.)