DOP-C02 Configuration Management and IaC Practice Test 4 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an EC2 instance with a UserData script that installs software. The stack creation fails with the error: 'The following resource(s) failed: EC2Instance (AWS::EC2::Instance) – Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack creation timed out or was manually cancelled. Option D is correct because Resource creation cancelled indicates the stack creation timed out or was manually cancelled. UserData scripts do not affect CloudFormation resource status unless the instance is created with a CreationPolicy or WaitCondition. Option A is incorrect because UserData failure does not cause a CloudFormation error. Option B is incorrect because Resource creation cancelled is not due to API rate limiting. Option C is incorrect because missing IAM role would cause an 'AccessDenied' error, not cancellation.

Answer

The EC2 instance type is not supported in the region

Answer

The IAM role attached to the instance lacks permissions

Answer

The UserData script failed due to a syntax error

Question 2

A company uses AWS Elastic Beanstalk to deploy web applications. The DevOps team wants to implement a blue/green deployment strategy to minimize downtime. Which Elastic Beanstalk feature should be used?

Accepted Answer

Environment URL swap. Option C is correct because Elastic Beanstalk supports blue/green deployments by swapping environment URLs between two environments. Option A (Rolling update) updates instances incrementally, not blue/green. Option B (Immutable update) creates a new Auto Scaling group but does not swap URLs. Option D (Canary deployment) is not supported natively in Elastic Beanstalk; it is for Lambda.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 3

A DevOps engineer is designing a configuration management solution for a fleet of EC2 instances. The instances are ephemeral and frequently replaced by an Auto Scaling group. The engineer needs to ensure that newly launched instances are automatically configured with the latest software packages and settings. Which AWS service should be used?

Accepted Answer

AWS Systems Manager State Manager. Option A is correct because AWS Systems Manager State Manager can associate a configuration with instances based on tags or resource groups, ensuring new instances are configured automatically. Option B (OpsWorks) is suited for long-lived instances. Option C (CloudFormation) is for infrastructure provisioning, not ongoing configuration. Option D (CodeDeploy) is for deploying applications, not system configuration.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks Stacks

Answer

AWS CloudFormation

Question 4

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a parameter for the instance type of EC2 instances. The DevOps team wants to restrict the allowed values to a specific set of instance types. Which CloudFormation section should be used?

Accepted Answer

Parameters with AllowedValues. Option C is correct because the AllowedValues property in the Parameters section restricts input values. Option A (Mappings) maps keys to values, not input restriction. Option B (Conditions) determine resource creation. Option D (Outputs) return values after stack creation.

Answer

Outputs

Answer

Conditions

Answer

Mappings

Question 5

A DevOps engineer needs to manage the configuration of a large number of EC2 instances that are part of a cluster. The instances should have consistent software packages, services, and settings. The engineer wants to use a configuration management tool that integrates with AWS and supports a push-based model. Which service should be used?

Accepted Answer

AWS Systems Manager Run Command. Option D is correct because AWS Systems Manager Run Command uses a push-based model to execute commands and manage configuration on instances. Option A (OpsWorks) is pull-based. Option B (CloudFormation) is for infrastructure, not configuration. Option C (CodeCommit) is a source control service.

Answer

AWS OpsWorks Stacks

Answer

AWS CodeCommit

Answer

AWS CloudFormation

Question 6

A company uses AWS CloudFormation to manage a stack that includes an Auto Scaling group with a LaunchTemplate. The DevOps team wants to update the LaunchTemplate with a new AMI. The stack update fails with the error 'Launch template version does not exist'. What is the most likely cause?

Accepted Answer

The LaunchTemplate version specified in the template was deleted. Option A is correct because CloudFormation references a specific LaunchTemplate version. If the version is deleted, the update fails. Option B is incorrect because the error is about version not existing, not a recent modification. Option C is incorrect because the Auto Scaling group uses the template version, not the default. Option D is incorrect because target group attachment does not affect LaunchTemplate versions.

Answer

The LaunchTemplate was recently modified and the new version is not yet available

Answer

The target group attachment is incorrect

Answer

The Auto Scaling group is using a different launch template

Question 7

A DevOps engineer is using AWS CloudFormation to deploy a stack that includes a VPC with public and private subnets. The engineer wants to ensure that the public subnets automatically get a public IP address assigned to instances launched in them. Which property should be set?

Accepted Answer

MapPublicIpOnLaunch on the subnet. Option D is correct because MapPublicIpOnLaunch set to true allows public IP assignment. Option A (AssociatePublicIpAddress) is not a subnet property. Option B (EnableDnsHostnames) is for VPC DNS. Option C (EnableDnsSupport) is also for VPC DNS.

Answer

EnableDnsSupport on the VPC

Answer

EnableDnsHostnames on the VPC

Answer

AssociatePublicIpAddress on the instance

Question 8

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to implement a change management process where all stack updates must be reviewed before execution. Which AWS feature should be used?

Accepted Answer

Change Sets. Option C is correct because Change Sets allow you to review proposed changes before executing them. Option A (Stack policy) controls update permissions. Option B (StackSets) manage stacks across accounts. Option D (Drift detection) detects configuration drift.

Answer

Drift detection

Answer

StackSets

Answer

Stack policies

Question 9

A company uses AWS CloudFormation to deploy infrastructure across multiple accounts. They want to reuse a set of resource definitions for a standard VPC configuration. Which approach minimizes duplication and maintains centralized control?

Accepted Answer

Create a CloudFormation module for the VPC resources and reference it in each stack.. Option A is correct because AWS CloudFormation modules allow packaging reusable resource configurations that can be shared across stacks and accounts, reducing duplication and enabling centralized updates. Option B is wrong because nested stacks require separate templates, not reuse within a template. Option C is wrong because macros are for template processing, not reusable components. Option D is wrong because Service Catalog is for end-user product provisioning, not infrastructure reuse.

Answer

Define the VPC resources in a CloudFormation macro and call the macro from each stack.

Answer

Publish the VPC template in AWS Service Catalog and have each account provision from it.

Answer

Use nested stacks by creating a separate template for the VPC and including it in each account's stack.

Question 10

A DevOps team uses AWS CodePipeline to deploy a web application. They notice that the deployment stage fails intermittently due to a missing configuration file. Which troubleshooting step should they take first?

Accepted Answer

Review the build logs in AWS CodeBuild to identify the error.. Option A is correct because checking the build logs is the first step to identify why the file is missing. Option B is wrong because recreating the pipeline does not address the root cause. Option C is wrong because CodeBuild is for building, not deployment. Option D is wrong because CodeDeploy logs are relevant only if the file is missing at deployment time, but the issue occurs during the build stage.

Answer

Switch to AWS CodeBuild for the deployment stage.

Answer

Recreate the pipeline with the same configuration to see if the issue repeats.

Answer

Verify the deployment group settings in AWS CodeDeploy.

Question 11

An organization manages multiple AWS accounts using AWS Organizations. They want to enforce that all Amazon S3 buckets across accounts have versioning enabled. Which approach is the most scalable and least error-prone?

Accepted Answer

Create an SCP that denies s3:PutBucketVersioning if versioning is not enabled.. Option C is correct because using a service control policy (SCP) at the organizational level can deny the creation of S3 buckets without versioning, enforcing compliance across all accounts. Option A is wrong because it is not automated and depends on each account owner. Option B is wrong because Config rules only detect non-compliance, they do not prevent it. Option D is wrong because CloudFormation StackSets would require deploying a template to every account and region, which is more complex than an SCP.

Answer

Use AWS Config rules to detect buckets without versioning and send alerts.

Answer

Deploy a CloudFormation StackSet to all accounts with a template that enables versioning.

Answer

Manually enable versioning on each bucket after creation.

Question 12

A company uses AWS Elastic Beanstalk for application deployments. They want to integrate infrastructure-as-code practices using AWS CloudFormation. Which approach allows them to manage the Elastic Beanstalk environment and underlying resources as part of a CloudFormation stack?

Accepted Answer

Define the Elastic Beanstalk environment in the CloudFormation template using the AWS::ElasticBeanstalk::Environment resource.. Option B is correct because CloudFormation supports the AWS::ElasticBeanstalk::Environment resource type, which can be used to create and manage Elastic Beanstalk environments within a stack. Option A is wrong because Elastic Beanstalk environments are not directly compatible with CloudFormation custom resources. Option C is wrong because CloudFormation does not import existing Elastic Beanstalk environments. Option D is wrong because Elastic Beanstalk does not generate CloudFormation templates automatically.

Answer

Use a custom resource backed by a Lambda function to create the Elastic Beanstalk environment.

Answer

Use the CloudFormation import feature to bring the existing Elastic Beanstalk environment into the stack.

Answer

Export the Elastic Beanstalk environment configuration as a CloudFormation template from the console.

Question 13

A developer wants to provision AWS resources using AWS Cloud Development Kit (CDK) and ensure that the infrastructure can be version-controlled and reviewed. Which practice should they follow?

Accepted Answer

Write the CDK app in TypeScript, store it in a Git repository, and use CDK pipelines for deployment.. Option A is correct because CDK apps should be written in a supported programming language, synthesized to CloudFormation templates, and deployed. Version control of the source code enables review. Option B is wrong because CDK does not generate Terraform. Option C is wrong because CDK apps are not deployed directly; they are synthesized. Option D is wrong because CDK does not require separate templates; it generates them.

Answer

Write the CDK app and deploy directly without synthesis to avoid extra steps.

Answer

Write the CDK app to generate Terraform configurations and store them in Git.

Answer

Write raw CloudFormation templates instead of CDK to simplify version control.

Question 14

An operations team manages a fleet of Amazon EC2 instances that require periodic software updates. They want to use AWS Systems Manager to apply patches automatically while ensuring that patches are tested before production deployment. Which approach meets these requirements?

Accepted Answer

Use AWS Systems Manager Patch Manager with maintenance windows, and configure a patch baseline that approves patches after a test period.. Option C is correct because Systems Manager Patch Manager supports patch baselines and maintenance windows, and can be used with State Manager to schedule patching. By creating separate patching schedules for test and production, patches can be tested first. Option A is wrong because Patch Manager does not automatically install patches without a maintenance window. Option B is wrong because Run Command is manual. Option D is wrong because Automation is not designed for patching.

Answer

Use AWS Systems Manager Automation to create a runbook that patches instances one by one.

Answer

Create a patch baseline and assign it to all instances; enable automatic approval for all patches.

Answer

Use AWS Systems Manager Run Command to manually run patch commands on test instances, then on production.

Question 15

A team uses AWS CloudFormation to manage a multi-tier application. They update the stack and receive this error: 'UPDATE_ROLLBACK_FAILED'. The stack is in a state where some resources were updated, then rollback failed. What is the best course of action?

Accepted Answer

Use the 'ContinueUpdateRollback' API or AWS Management Console to resume rollback, and fix any underlying issues.. Option D is correct because when a rollback fails, the stack may have resources that could not be rolled back. The recommended approach is to continue rolling back the stack, which may require manual intervention to fix the failing resource. Option A is wrong because continuing update may cause further issues. Option B is wrong because deleting the stack may lose data. Option C is wrong because the stack is not in a healthy state.

Answer

Ignore the error and use the stack as-is.

Answer

Attempt to continue the update again.

Answer

Delete the stack and recreate it.