DOP-C02 Configuration Management and IaC Practice Test 5 — 15 Questions

Question 1

An organization uses AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that all instances have the latest security patches applied automatically. Which action should the team take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a custom Chef recipe in OpsWorks to run 'yum update' on a schedule.. AWS OpsWorks uses Chef recipes for configuration management. To ensure instances have the latest security patches automatically, the team should configure a custom Chef recipe that runs 'yum update' (or equivalent) on a schedule. This leverages OpsWorks' native automation capabilities. Therefore, option A is correct.

Answer

Create an AWS Config rule to check for missing patches and trigger an auto-remediation.

Answer

Update the AMI used by the OpsWorks layer to include the latest patches.

Answer

Enable AWS Systems Manager Patch Manager to patch all instances managed by OpsWorks.

Question 2

A DevOps engineer needs to deploy a configuration management solution that can manage both Windows and Linux servers across on-premises and AWS environments. The solution must support a Git-based workflow for version control of configurations. Which AWS service should the engineer choose?

Accepted Answer

AWS OpsWorks for Chef Automate. AWS OpsWorks for Chef Automate (and AWS OpsWorks Stacks / OpsWorks for Puppet Enterprise) reached end-of-life on May 5, 2024 and is no longer available to any AWS customer. This question should be rewritten to reference a currently supported solution for hybrid, Git-versioned, cross-OS configuration management, such as AWS Systems Manager (State Manager / Distributor) or a self-hosted Chef/Puppet/Ansible control plane on EC2.

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 3

A company uses AWS CloudFormation to deploy a microservices architecture. The Operations team needs to update a stack that contains a Lambda function and an API Gateway REST API. They want to ensure that the Lambda function code is updated without downtime. Which update policy should be used for the Lambda function in the CloudFormation template?

Accepted Answer

Use an UpdateReplacePolicy of 'Snapshot'. UpdateReplacePolicy of 'Snapshot'. This policy is used to take a snapshot of the old Lambda function's code and configuration before it is replaced during a stack update. While this does not directly prevent downtime, it provides a means for quick rollback if needed, and it is the only valid policy among the options that supports an update scenario without resorting to invalid values. Options B and D are not valid values for UpdateReplacePolicy; valid values are Snapshot, Retain, and Delete. Option C (Retain) would keep the old resource, which can cause naming conflicts for Lambda functions because the new function cannot use the same name.

Answer

Use an UpdateReplacePolicy of 'Replace'

Answer

Use an UpdateReplacePolicy of 'Retain'

Answer

Use an UpdateReplacePolicy of 'Rollback'

Question 4

A company uses AWS CodeCommit to store source code. The development team wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which TWO resources must be configured to accomplish this? (Select TWO.)

Accepted Answer

An Amazon CloudWatch Events rule that listens for CodeCommit pull request events.. AWS CodeBuild supports webhooks only for GitHub and GitHub Enterprise repositories, not for AWS CodeCommit. For CodeCommit, the recommended and native event-driven approach is to use Amazon CloudWatch Events (EventBridge) to capture pull request state changes and target a CodeBuild project directly. Therefore, the resources required are a CloudWatch Events rule (C) and a CodeBuild project (not necessarily with a webhook). Since the only CodeBuild project option (E) incorrectly specifies a webhook, it should not be selected.

Answer

An AWS Lambda function to process the pull request event.

Answer

An AWS CodePipeline pipeline with a source stage for CodeCommit.

Answer

An Amazon Simple Notification Service (SNS) topic to send notifications.

Answer

An AWS CodeBuild project with a webhook configured.

Question 5

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that when a stack update fails, the stack automatically rolls back to its previous state. However, they also want to preserve any resources that were created outside of CloudFormation (drift). What should they do?

Accepted Answer

Use a stack policy that denies updates to resources created outside CloudFormation. Then enable rollback on failure.. A stack policy can be used to deny updates to specific resources, such as those that have drifted. When a stack update fails and rollback is enabled, CloudFormation will attempt to revert changes. By denying updates to drifted resources via a stack policy, those resources are preserved in their current state. This ensures both rollback on failure and preservation of drift.

Answer

Enable termination protection on the stack to prevent deletion during rollback.

Answer

Use a CloudFormation resource policy with a 'Retain' rule for resources that might have drifted. Then enable rollback on failure.

Answer

Enable rollback on failure in the stack options. CloudFormation will automatically roll back, preserving all resources.

Question 6

A company uses AWS CloudFormation to manage its infrastructure. The Operations team needs to update a stack that contains an EC2 instance. They want to change the instance type from t2.micro to t2.small without recreating the instance. Which CloudFormation stack update policy should they use?

Accepted Answer

Use a ChangeSet with Replacement set to False. Using a ChangeSet allows previewing changes, and although 'Replacement set to False' is not a real parameter, reviewing a ChangeSet helps identify that changing the instance type for a standalone EC2 instance requires replacement. No update policy can achieve this without recreation, so the best option is to use a ChangeSet to verify the impact. Options B, C, and D are irrelevant—CreationPolicy is for resource creation, DeletionPolicy handles deletion, and AutoScalingRollingUpdate applies only to Auto Scaling groups, not standalone instances.

Answer

Use a CreationPolicy with a Timeout

Answer

Use a DeletionPolicy with Retain

Answer

Use an UpdatePolicy with AutoScalingRollingUpdate

Question 7

A company wants to use AWS Elastic Beanstalk to deploy a web application. They need to ensure that the application can be updated with zero downtime. Which deployment policy should they use?

Accepted Answer

Rolling. The Rolling deployment policy in AWS Elastic Beanstalk updates instances in batches, replacing a subset of the current environment's instances with new ones while keeping the rest serving traffic. This ensures that the application remains available throughout the update process, achieving zero downtime as long as the health check passes for each batch before proceeding.

Answer

Immutable

Answer

All at once

Answer

Traffic splitting

Question 8

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group, and an RDS database. The DevOps engineer needs to update the stack to change the DB instance type. The engineer wants to minimize downtime. Which strategy should they use?

Accepted Answer

Create a new DB instance with the new type, update the application stack to point to the new DB, then remove the old DB. It minimizes downtime by provisioning a new DB instance with the desired type in parallel, updating the application stack to reference the new DB endpoint (e.g., via a CloudFormation parameter or SSM parameter), and then decommissioning the old instance. This avoids any interruption to the existing database during the transition, as the old DB remains fully operational until the application is switched over.

Answer

Create a new CloudFormation stack with the new DB instance type and update DNS to point to the new DB

Answer

Modify the DB instance to use Multi-AZ deployment before the update

Answer

Update the stack directly by changing the DBInstanceType property

Question 9

A company uses AWS CloudFormation to manage infrastructure. They have a nested stack that creates an ECS cluster. The parent stack fails with the error: 'The following resource(s) failed to create: [ECSCluster]'. Which TWO are possible causes? (Choose TWO.)

Accepted Answer

The parent stack's IAM role does not have permission to create the nested stack's resources. Option D is correct because when a parent stack creates a nested stack via AWS::CloudFormation::Stack, CloudFormation uses the parent stack's IAM role (or the user's credentials) to provision the nested stack's resources, so missing permissions such as cloudformation:CreateStack or ecs:CreateCluster will cause the ECSCluster resource creation to fail. Option E is correct because an invalid resource property in the nested stack template (for example, a bad value for a required ECS cluster property) causes the nested stack to fail, which surfaces in the parent as 'The following resource(s) failed to create: [ECSCluster]'. Option A is incorrect because a missing output reference would typically produce a different error, such as 'Template error: instance of Fn::GetAtt references undefined resource' or a missing Outputs value, not a resource creation failure for ECSCluster. Option B is incorrect because nested stacks must be in the same region as the parent stack, and a cross-region nested stack is not a supported configuration that would produce this specific error. Option C is incorrect because CloudFormation stack names must be unique within an account and region, but the parent stack generates the nested stack name automatically, so a duplicate name is not a typical cause of this failure.

Answer

The parent stack is referencing an output from the nested stack that does not exist

Answer

The nested stack is in a different AWS region from the parent stack

Answer

The nested stack's name is not unique among all stacks in the account

Question 10

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the latest security patches are applied to all instances. Which THREE steps should they include in their Ansible playbook? (Choose THREE.)

Accepted Answer

Use the 'command' module to run 'yum update -y'. Option B is correct because the 'command' module can execute 'yum update -y' on RHEL/CentOS/Amazon Linux EC2 instances, applying all available security and package updates non-interactively. Option D is correct because the 'package' module with state=latest is the generic, OS-agnostic way to ensure the newest versions of specified packages are installed, which is ideal for applying the latest security patches across a mixed fleet. Option E is correct because the 'yum' module with state=latest is the RHEL-family-specific module that upgrades packages to their newest available versions, directly satisfying the patching requirement. Option A is not required for patching itself; restarting services is a follow-up action and not one of the three core patch-application steps. Option C is incorrect because the 'copy' module transfers files from the control node to managed hosts and does not download patch files or install updates.

Answer

Use the 'service' module to restart services after patching

Answer

Use the 'copy' module to download patch files

Question 11

A company uses AWS Config to evaluate resource compliance. They have a custom AWS Config rule that checks whether EC2 instances have a specific tag. The rule is triggered by configuration changes. The DevOps engineer notices that the rule evaluation results show 'NON_COMPLIANT' for some instances that actually have the tag. Which TWO could be causes? (Choose TWO.)

Accepted Answer

The Lambda function that evaluates the rule has a logic error. Option B is correct because a custom AWS Config rule is backed by a Lambda function, and if that function's tag-checking logic is flawed (for example, comparing the wrong tag key, using case-sensitive matching incorrectly, or reading the wrong field from the configuration item), it can return NON_COMPLIANT even when the required tag is present. Option E is correct because if the AWS Config service role lacks lambda:InvokeFunction permission on the rule's Lambda function, Config cannot successfully invoke the evaluator; the evaluation fails or returns an incorrect/error result, which can surface as NON_COMPLIANT for resources that actually have the tag. Option A is not a cause because maximum execution frequency only controls periodic evaluations, and this rule is triggered by configuration changes, so a 24-hour frequency would not produce false NON_COMPLIANT results on change-triggered evaluations. Option C is not a cause because change-triggered Config rules are driven by configuration item changes recorded by AWS Config, not by CloudTrail events directly. Option D is not a cause because if the rule only evaluated a resource type that excludes EC2, EC2 instances would not be evaluated at all rather than being reported NON_COMPLIANT.

Answer

The rule's maximum execution frequency is set to 24 hours

Answer

The rule is not being triggered by CloudTrail events

Answer

The rule is configured to evaluate only for a specific resource type that does not include EC2

Question 12

A company uses AWS CloudFormation to deploy its infrastructure. They have a production stack that includes an RDS PostgreSQL instance with a read replica. The stack update to modify the DB instance class fails with the error: 'The parameter group cannot be changed during a read replica update.' The DevOps engineer needs to update the DB instance class while minimizing downtime and without losing the read replica. The current configuration: the RDS instance is using a custom parameter group. The read replica is using the same parameter group. The update changes the DBInstanceClass property from db.r5.large to db.r5.xlarge. What should the engineer do to successfully update the stack?

Accepted Answer

Remove the read replica from the stack, update the master instance, then add the read replica back. The error occurs because CloudFormation attempts to update both the master and the read replica in the same stack update, and the replica's parameter group cannot be changed during the update. However, the actual change is the DB instance class, not the parameter group. The recommended approach is to remove the read replica from the stack, update the master instance class, then add the read replica back. This minimizes downtime and ensures the replica is created with the correct configuration. Option A correctly implements this. Option B is incorrect because the read replica must match the master's instance class, so updating the replica first would fail or cause inconsistency. Option C causes configuration drift and is not a best practice. Option D does not address the instance class change; the error is not about the parameter group.

Answer

Update the read replica first to the new instance class, then update the master instance

Answer

Use the AWS Management Console to modify the DB instance class directly, bypassing CloudFormation

Answer

Create a new parameter group for the master instance and associate it before the update

Question 13

A company runs a critical web application on AWS using an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with a blue/green deployment configuration. The DevOps team is responsible for configuration management using AWS Systems Manager State Manager. They have set up a State Manager association to ensure that the instances have a specific security configuration (e.g., firewall rules). Recently, after a new deployment, the team noticed that the security configuration is missing on some new instances. The old instances still have the correct configuration. The association is configured to apply the configuration only at instance launch (using the AWS-RunShellScript document). The team suspects that the new instances are not being targeted by the association. Upon investigation, they find that the association is set to target instances based on tags, and the new instances do have the required tags. However, the association status shows 'Success' for the old instances but no status for the new instances. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The State Manager association was created before the new instances were launched, and the association is not configured to automatically apply to new instances. The association needs to be updated or scheduled to run periodically.. State Manager associations are created at a specific time and target instances that exist at that time. New instances launched after the association creation will not automatically be targeted unless the association is configured with a schedule or the 'Apply only at next update' option. The association is set to run only at launch, but the association itself must be applied to the instance at launch time. If the association was created before the new instances, it won't apply to them unless it is updated. Option B is wrong because the association can target instances by tags; tagging is not the issue. Option C is wrong because the problem is not about the script failing; the association is not running on new instances. Option D is wrong because the S3 bucket policy would affect the ability to store logs, but the association status would show error, not missing status.

Answer

The new instances have a different tag than the one specified in the association.

Answer

The association is trying to download a script from an S3 bucket, but the bucket policy denies access to new instances.

Answer

The AWS-RunShellScript document failed to execute on the new instances due to a missing IAM role.

Question 14

A company uses AWS CodeCommit to store infrastructure as code templates. The DevOps team has set up an AWS CodePipeline that automatically deploys a CloudFormation stack when changes are pushed to the main branch. The pipeline includes a deployment action that uses the CloudFormation create/update stack action. Recently, a developer pushed a change that caused the CloudFormation stack update to fail because the change would have deleted a critical resource. The pipeline did not catch this issue, and the stack update failed midway, leaving the stack in a partially updated state. The team wants to implement a safety mechanism to prevent such issues in the future. Which solution should they implement?

Accepted Answer

Add a CloudFormation change set action in the pipeline with a manual approval step to review the changes before executing the stack update.. A CloudFormation change set action generates a summary of the exact changes (adds, modifies, deletes) that will be applied to the stack, allowing the team to review the impact before execution. By adding a manual approval step after the change set is created, the pipeline pauses and a human can verify that no critical resources will be deleted. This directly prevents the scenario where an unintended deletion causes a failed update and a partially updated stack, because the change set must be explicitly executed after approval.

Answer

Create a stack policy that denies deletion of critical resources, and include the policy in the CloudFormation template.

Answer

Add a manual approval step before the deployment action to review the code change.

Answer

Add a 'Test' stage in the pipeline that deploys the stack to a test environment first.

Question 15

A company is using AWS CloudFormation to manage its infrastructure. The DevOps team wants to implement a strategy that allows for rollback in case a stack update fails. Which TWO approaches should the team consider? (Choose TWO.)

Accepted Answer

Use nested stacks to isolate changes; if a nested stack fails, the parent stack automatically rolls back.. Option E is correct because CloudFormation's default behavior is to enable 'Rollback on failure' during a stack update; when a resource update fails, CloudFormation automatically rolls the stack back to the last known good state, which is exactly the rollback strategy the team needs. Option D is correct because nested stacks propagate failure upward: if a nested stack update fails, the parent stack's update fails and CloudFormation rolls back the parent stack (and its nested stacks) to the previous stable configuration, isolating changes and providing automatic rollback. Option A is not appropriate because disabling rollback and manually reverting changes removes the automated safety net and is error-prone. Option B is incorrect because a change set only previews changes and, once executed, a failed update does not leave the stack unchanged—CloudFormation still rolls back or leaves the stack in UPDATE_ROLLBACK_FAILED unless rollback is configured. Option C is incorrect because AWS Backup snapshots do not provide CloudFormation stack-level rollback of template-defined resources and are not an integrated rollback mechanism for stack updates.

Answer

Disable the 'Rollback on failure' option and manually revert changes using the AWS Management Console.

Answer

Create and execute a change set. If the update fails, the stack remains unchanged.

Answer

Use AWS Backup to create manual snapshots of all resources before the update.