DOP-C02 Configuration Management and IaC Practice Test 4 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to implement a change management process where all stack updates must be reviewed before execution. Which AWS feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change Sets. Change Sets allow you to preview how proposed changes to a CloudFormation stack will impact your running resources before you execute them. This enables a review-and-approval workflow, making it the correct choice for implementing a change management process where all stack updates must be reviewed before execution.

Answer

Drift detection

Answer

StackSets

Answer

Stack policies

Question 2

A company uses AWS CloudFormation to deploy infrastructure across multiple accounts. They want to reuse a set of resource definitions for a standard VPC configuration. Which approach minimizes duplication and maintains centralized control?

Accepted Answer

Create a CloudFormation module for the VPC resources and reference it in each stack.. CloudFormation modules allow you to encapsulate a set of resource definitions into a reusable component that can be referenced across multiple stacks. This approach minimizes duplication because the module is defined once in a central registry (e.g., the CloudFormation public or private module registry) and each stack simply includes a `Module` declaration. It also maintains centralized control because updates to the module are automatically propagated to all stacks that reference it, without requiring manual template copying or stack updates.

Answer

Define the VPC resources in a CloudFormation macro and call the macro from each stack.

Answer

Publish the VPC template in AWS Service Catalog and have each account provision from it.

Answer

Use nested stacks by creating a separate template for the VPC and including it in each account's stack.

Question 3

A DevOps team uses AWS CodePipeline to deploy a web application. They notice that the deployment stage fails intermittently due to a missing configuration file. Which troubleshooting step should they take first?

Accepted Answer

Review the build logs in AWS CodeBuild to identify the error.. The deployment stage fails intermittently due to a missing configuration file. The first troubleshooting step should be to review the build logs in AWS CodeBuild, because CodeBuild generates detailed logs that capture the exact error message, including file paths and missing configuration details. This allows the team to pinpoint the root cause without making unnecessary changes to the pipeline or deployment group settings.

Answer

Switch to AWS CodeBuild for the deployment stage.

Answer

Recreate the pipeline with the same configuration to see if the issue repeats.

Answer

Verify the deployment group settings in AWS CodeDeploy.

Question 4

An organization manages multiple AWS accounts using AWS Organizations. They want to enforce that all Amazon S3 buckets across accounts have versioning enabled. Which approach is the most scalable and least error-prone?

Accepted Answer

Create an SCP that denies s3:PutBucketVersioning if versioning is not enabled.. A Service Control Policy (SCP) in AWS Organizations can deny the `s3:PutBucketVersioning` action unless versioning is already enabled, effectively preventing the creation or modification of buckets without versioning. This approach is scalable as it applies to all accounts in the organization automatically and is least error-prone because it enforces the policy at the API level, blocking non-compliant actions before they occur.

Answer

Use AWS Config rules to detect buckets without versioning and send alerts.

Answer

Deploy a CloudFormation StackSet to all accounts with a template that enables versioning.

Answer

Manually enable versioning on each bucket after creation.

Question 5

A company uses AWS Elastic Beanstalk for application deployments. They want to integrate infrastructure-as-code practices using AWS CloudFormation. Which approach allows them to manage the Elastic Beanstalk environment and underlying resources as part of a CloudFormation stack?

Accepted Answer

Define the Elastic Beanstalk environment in the CloudFormation template using the AWS::ElasticBeanstalk::Environment resource.. CloudFormation natively supports the AWS::ElasticBeanstalk::Environment resource, allowing you to define and manage the Elastic Beanstalk environment and its underlying resources directly within a CloudFormation stack. Option A is incorrect because a custom resource backed by Lambda is unnecessary when a native resource type exists for Elastic Beanstalk environments. Option B is incorrect because the CloudFormation import feature is used to bring existing resources under stack management, but it is not the primary approach for creating new environments as part of an IaC workflow. Option C is incorrect because while you can export an existing Elastic Beanstalk environment configuration to a CloudFormation template from the console, this is a one-time export and does not provide the same level of integration and repeatability as defining the resource directly in the template.

Answer

Use a custom resource backed by a Lambda function to create the Elastic Beanstalk environment.

Answer

Use the CloudFormation import feature to bring the existing Elastic Beanstalk environment into the stack.

Answer

Export the Elastic Beanstalk environment configuration as a CloudFormation template from the console.

Question 6

An operations team manages a fleet of Amazon EC2 instances that require periodic software updates. They want to use AWS Systems Manager to apply patches automatically while ensuring that patches are tested before production deployment. Which approach meets these requirements?

Accepted Answer

Use AWS Systems Manager Patch Manager with maintenance windows, and configure a patch baseline that approves patches after a test period.. AWS Systems Manager Patch Manager, when combined with maintenance windows and a patch baseline configured with an approval delay after a test period, allows patches to be automatically applied to test instances first and then, after a defined waiting period, to production instances. This ensures patches are tested before production deployment without manual intervention, meeting the requirement for automated, staged patching.

Answer

Use AWS Systems Manager Automation to create a runbook that patches instances one by one.

Answer

Create a patch baseline and assign it to all instances; enable automatic approval for all patches.

Answer

Use AWS Systems Manager Run Command to manually run patch commands on test instances, then on production.

Question 7

A team uses AWS CloudFormation to manage a multi-tier application. They update the stack and receive this error: 'UPDATE_ROLLBACK_FAILED'. The stack is in a state where some resources were updated, then rollback failed. What is the best course of action?

Accepted Answer

Use the 'ContinueUpdateRollback' API or AWS Management Console to resume rollback, and fix any underlying issues.. The 'UPDATE_ROLLBACK_FAILED' state indicates that CloudFormation attempted to roll back a failed stack update but encountered an error during the rollback process. The correct action is to use the 'ContinueUpdateRollback' API (or the AWS Management Console equivalent) to resume the rollback after fixing the underlying issue that caused the rollback to fail, such as a resource dependency or permission problem. This allows CloudFormation to complete the rollback and return the stack to a known stable state, rather than leaving it in an inconsistent or partially updated condition.

Answer

Ignore the error and use the stack as-is.

Answer

Attempt to continue the update again.

Answer

Delete the stack and recreate it.

Question 8

A company wants to use AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that the instances are automatically configured with the latest security patches upon boot. Which OpsWorks feature should they use?

Accepted Answer

Create a custom Chef recipe that installs security patches and assign it to the setup lifecycle event.. AWS OpsWorks uses Chef recipes to manage instance configuration. By creating a custom Chef recipe that installs the latest security patches and assigning it to the 'setup' lifecycle event, the recipe runs automatically on every new instance boot, ensuring patches are applied before the instance enters service. This is the native OpsWorks mechanism for configuration management during instance provisioning.

Answer

Configure the instances to run a user data script that updates packages.

Answer

Use AWS Systems Manager Patch Manager with an OpsWorks lifecycle event.

Answer

Use a CloudFormation template to apply patches during stack creation.

Question 9

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodePipeline and Amazon ECS. The pipeline should build a Docker image, push it to Amazon ECR, and deploy it to an ECS service. Which deployment action should they use in the pipeline?

Accepted Answer

Amazon ECS (Blue/Green) deployment provider with CodeDeploy.. Amazon ECS (Blue/Green) deployment provider with CodeDeploy is the native, fully managed deployment action in AWS CodePipeline for ECS services. It orchestrates traffic shifting, task set management, and rollback automatically using CodeDeploy's ECS blue/green deployment type, which is the recommended approach for containerized applications on ECS.

Answer

AWS Elastic Beanstalk deployment action.

Answer

AWS CodeBuild with a buildspec that runs aws ecs update-service.

Answer

AWS CloudFormation deployment action to update the ECS service.

Question 10

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to implement a change management process where all stack updates must be reviewed before execution. Which AWS feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a CloudFormation update with a rolling update policy on the Auto Scaling group.. CloudFormation's Auto Scaling group rolling update policy allows you to update the launch configuration or template (which includes the AMI ID) in a controlled, rolling fashion. By setting 'MinInstancesInService' to a value greater than 0, you ensure that a minimum number of instances remain in service during the update, preventing downtime. This approach replaces instances incrementally, so the application continues to serve traffic throughout the process. Additionally, a custom resource backed by Lambda can orchestrate a zero-downtime update using AWS Systems Manager Automation: it creates new instances from the new AMI, registers them with the load balancer, and then terminates the old instances after the new ones are healthy. This programmatic approach also achieves zero downtime by ensuring new instances are available before removing old ones.

Answer

Use CloudFormation stack update with 'UpdatePolicy' set to 'AutoScalingRollingUpdate' and 'MinInstancesInService' set to 0.

Answer

Delete the stack and recreate it with the new AMI.

Answer

Deploy the instances across multiple Availability Zones and update each zone separately.

Question 11

A team is using AWS CodeDeploy to deploy a web application to EC2 instances. They want to ensure that rollbacks occur automatically if the deployment fails. Which THREE configurations are necessary?

Accepted Answer

Enable automatic rollback in the deployment group settings.. To automatically roll back when a deployment fails, you only need to enable the 'Automatically roll back when a deployment fails' option in the CodeDeploy deployment group settings (D). CloudWatch alarms (C) can trigger rollback based on alarm state, but are not necessary for failure-triggered rollback. CloudWatch Events rules (B) provide a custom pattern for automating rollbacks, but are also optional. Therefore, the only necessary configuration among the options is D.

Answer

Add lifecycle event hooks to stop the deployment if a script fails.

Answer

Configure a CloudWatch Events rule to trigger a rollback on deployment failure.

Answer

Configure Amazon CloudWatch alarms on the deployment group.

Answer

Associate an Application Load Balancer with the deployment group.

Question 12

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. They want to ensure that the VPC has internet access for the public subnets. Which THREE resources must be included in the template?

Accepted Answer

AWS::EC2::Route (pointing to InternetGateway). An AWS::EC2::Route resource that points to an InternetGateway is required to direct traffic from the public subnet's route table to the internet. Without this route, instances in the public subnet cannot send or receive traffic from the internet, even if an Internet Gateway is attached to the VPC.

Answer

AWS::EC2::VPCEndpoint

Answer

AWS::EC2::NatGateway

Question 13

An administrator attaches the IAM policy shown in the exhibit to an IAM user. What is the effect on the user's ability to launch an EC2 instance in eu-west-1?

Accepted Answer

The user is allowed because the request region matches the condition exception.. The policy includes a Deny statement that blocks all EC2 actions unless the request comes from eu-west-1, due to the `aws:RequestedRegion` condition with a `StringNotEquals` operator. The `Deny` effect is overridden for eu-west-1 because the condition evaluates to false when the region matches, so the Deny does not apply. Since there is no explicit allow in the policy, the user relies on an implicit allow from a separate identity-based or resource-based policy (e.g., AWS-managed EC2FullAccess) to launch the instance.

Answer

The user is denied from launching instances in eu-west-1.

Answer

The user is allowed because the policy does not explicitly deny.

Answer

The user is allowed only if they also have an explicit allow policy.

Question 14

A DevOps engineer updated an EC2 instance's InstanceType in a CloudFormation stack and received the stack events shown in the exhibit. What is the most likely cause of the failure?

Accepted Answer

The engineer specified an invalid instance type (e.g., t2.large) that is not allowed by CloudFormation.. CloudFormation validates instance types against a whitelist of allowed types. If the engineer specified an instance type like 't2.large' that is not supported by the CloudFormation resource type (e.g., AWS::EC2::Instance), the stack update will fail with a validation error. The exhibit shows a stack event indicating a failure during the update, which aligns with CloudFormation rejecting the invalid instance type before attempting to modify the EC2 instance.

Answer

The engineer did not have permission to modify the instance type.

Answer

The AMI ID specified does not support the new instance type.

Answer

The VPC configuration does not support the new instance type.

Question 15

A team creates the CloudFormation template shown in the exhibit. What is a potential security concern with this configuration?

Accepted Answer

The bucket policy allows public read access to all objects.. The bucket policy in the exhibit explicitly grants `s3:GetObject` to `Principal: "*"`, which allows any unauthenticated user to read all objects in the bucket. This is a critical security concern because it exposes the bucket's contents to the public internet, potentially leading to data leakage or unauthorized access. Even if the bucket itself is private, a permissive policy overrides that default restriction.

Answer

The bucket name is not unique.

Answer

The bucket does not have server-side encryption enabled.

Answer

The bucket is not versioned.