DOP-C02 Configuration Management and IaC Practice Test 5 — 15 Questions

Question 1

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to ensure that stack updates are reviewed and approved by a senior engineer before being executed. Which feature should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change sets. Change sets allow you to preview the proposed changes to a CloudFormation stack before executing them. This enables a senior engineer to review and approve the changes, ensuring that only validated updates are applied. Without change sets, updates would be applied immediately without a review step.

Answer

Stack policies

Answer

Drift detection

Answer

Stack sets

Question 2

An organization uses OpsWorks to manage application stacks. They notice that custom cookbooks are not being executed during the lifecycle events. What is the most likely cause?

Accepted Answer

The custom cookbook repository URL is misconfigured or inaccessible. Custom cookbooks in AWS OpsWorks are fetched from a repository (e.g., Git, S3, HTTP) during lifecycle events. If the repository URL is misconfigured (e.g., wrong branch, invalid path) or inaccessible (e.g., private repo without proper SSH keys or S3 bucket permissions), OpsWorks cannot retrieve the cookbooks, causing them to not execute. This is the most common cause of cookbook execution failures.

Answer

The layer's IAM role does not have permissions to execute the cookbook

Answer

The cookbook is not configured with CodeDeploy

Answer

The cookbook uses a Chef version that is not supported by OpsWorks

Question 3

A DevOps team uses Elastic Beanstalk to deploy a web application. They want to configure environment variables without modifying the application code. Where should they define these variables?

Accepted Answer

As environment properties in the Elastic Beanstalk environment. Elastic Beanstalk environment properties are specifically designed to set environment variables without modifying application code. They can be configured in the Elastic Beanstalk console, CLI, or via .ebextensions, and are exposed as environment variables to the application runtime. Option A is correct. Option B (EC2 User Data) is for instance initialization scripts, not for application configuration. Option C (instance metadata) is read-only metadata about the instance, not custom environment variables. Option D (application code) would require modifying the code, which contradicts the requirement.

Answer

In the EC2 User Data script

Answer

In the instance metadata

Answer

In the application code

Question 4

A company uses AWS Config to evaluate compliance of their AWS resources. They have a custom rule that checks whether EC2 instances have a specific tag. They notice that the rule is not triggering on existing instances. What is a possible reason?

Accepted Answer

The rule is not configured with a trigger type of 'Configuration changes' or 'Periodic'. AWS Config custom rules require a trigger type to evaluate resources. If a rule is not configured with either 'Configuration changes' (triggered when a resource changes) or 'Periodic' (triggered on a schedule), it will never evaluate resources, including existing instances. Without a trigger, the rule remains inactive and cannot perform compliance checks.

Answer

AWS Config does not support custom rules

Answer

The Lambda function does not have permission to describe EC2 instances

Answer

The EC2 instances are not in the resource types being recorded by AWS Config

Question 5

A team uses CloudFormation to deploy a multi-container Docker environment on Amazon ECS. They need to pass environment variables to the containers from Parameter Store. How should they reference these values in the CloudFormation template?

Accepted Answer

Using the 'resolve:ssm' dynamic reference. CloudFormation supports dynamic references using the 'resolve:ssm' prefix to retrieve values from AWS Systems Manager Parameter Store at stack creation or update time. This allows environment variables in an ECS task definition to be populated directly from Parameter Store without hardcoding secrets or using custom Lambda-backed custom resources.

Answer

Using the 'Ref' function with the parameter name

Answer

Using the 'Fn::ParamStore' intrinsic function

Answer

Using 'Fn::GetAtt' on the Parameter Store resource

Question 6

A company uses AWS OpsWorks for configuration management. They want to ensure that a custom recipe runs on all instances in a layer every 30 minutes. What should they do?

Accepted Answer

Set a custom chef recipe with a cron schedule. OpsWorks allows you to define custom Chef recipes and associate them with a cron-based schedule using the 'cron' attribute in the layer's custom recipes configuration. This ensures the recipe runs automatically every 30 minutes on all instances in the layer, independent of lifecycle events.

Answer

Add the recipe to the 'Setup' lifecycle event

Answer

Add the recipe to the 'Deploy' lifecycle event

Answer

Add the recipe to the 'Configure' lifecycle event

Question 7

A DevOps engineer is troubleshooting a CloudFormation stack that is in UPDATE_ROLLBACK_FAILED state. The stack attempted to update an Auto Scaling group but failed due to insufficient capacity in the Availability Zone. What is the recommended next step?

Accepted Answer

Use the ContinueUpdateRollback operation to skip the resources that failed. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended next step is to use the ContinueUpdateRollback operation with the 'ResourcesToSkip' parameter to skip the resources that failed during rollback. This allows CloudFormation to complete the rollback of the remaining resources and move the stack to a stable state, after which you can investigate and fix the underlying issue (e.g., insufficient capacity in the AZ) before attempting the update again. Option C directly aligns with AWS documentation for handling this specific stack state.

Answer

Execute a new stack update with the same template

Answer

Manually increase the Auto Scaling group capacity in the affected AZ

Answer

Delete the Auto Scaling group and recreate it

Question 8

A company is designing a CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy. They need to ensure that the pipeline can deploy to multiple environments (dev, test, prod) with manual approval gates. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create separate stages in the pipeline for dev, test, and prod. AWS CodePipeline allows you to define separate stages for each environment (dev, test, prod) within a single pipeline. This enables sequential or parallel deployments with clear separation of concerns, and each stage can have its own actions, such as deployment to a specific CodeDeploy application or environment. Option D is correct because you can add a manual approval action as a stage gate before each environment deployment, ensuring that a human reviewer must explicitly approve the promotion before the pipeline proceeds to the next environment.

Answer

Configure a single pipeline with multiple branches in the source stage

Answer

Use CodeDeploy deployment groups to represent each environment

Answer

Use CodeBuild batch builds to manage environment promotion

Question 9

A DevOps team is using AWS Elastic Beanstalk to deploy a web application. They need to customize the software configuration on the EC2 instances that are part of the Elastic Beanstalk environment. Which THREE methods can they use? (Choose THREE.)

Accepted Answer

Use saved configurations to create reusable environment templates. Saved configurations in Elastic Beanstalk allow you to capture the environment's settings, including custom software configurations, and reuse them as templates for future environments. This enables consistent deployment without manual reconfiguration, directly addressing the need to customize software on EC2 instances.

Answer

Create a custom AMI with the desired configuration

Answer

Use OpsWorks to manage the instances

Question 10

A company uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to ensure that updates to the stack set are rolled out in a controlled manner, with the ability to roll back if errors occur. Which THREE strategies should they implement? (Choose THREE.)

Accepted Answer

Set a failure tolerance to allow a certain number of stack operation failures before the overall operation fails. AWS CloudFormation StackSets allows you to set a failure tolerance, which specifies the number or percentage of stack operation failures that can occur in a region before the overall operation is considered failed. This enables controlled rollouts by allowing a limited number of failures to be tolerated, after which the operation stops and can be rolled back, preventing widespread impact.

Answer

Use a canary deployment strategy by updating only a subset of accounts first

Answer

Pause stack instances manually if errors are detected

Question 11

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to ensure that stack updates are reviewed and approved by a senior engineer before being executed. Which feature should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the stack directly by submitting the updated template to CloudFormation.. Updating the stack directly by submitting the updated template is the standard method for CloudFormation updates, allowing the service to automatically compute and apply changes with minimal disruption. Option B is incorrect because manually modifying the security group causes configuration drift. Option C is incorrect because deleting and recreating the stack results in downtime. Option D is incorrect because although change sets allow preview, they require an additional execution step and are not necessary for this simple update; the direct update achieves the same minimal disruption without extra steps.

Answer

Manually modify the security group in the EC2 console and then import the resource into CloudFormation.

Answer

Delete the stack and create a new stack with the updated template.

Answer

Use a change set to review the changes and then execute it.

Question 12

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. They want to ensure that all instances have a specific software package installed. Which approach should they take?

Accepted Answer

Create a State Manager association with a custom document that installs the package.. State Manager associations can enforce desired configurations, such as installing software packages, on a schedule or continuously. Option B is wrong because Run Command is for one-time ad-hoc execution, not ongoing compliance. Option C is wrong because Patch Manager focuses on OS patches, not arbitrary software packages. Option A is wrong because OpsCenter is for operational issues, not configuration management.

Answer

Use OpsCenter to create an OpsItem for each instance.

Answer

Use Run Command to execute the installation on all instances.

Answer

Create a Patch Baseline that includes the package.

Question 13

A company is using AWS CodePipeline for CI/CD with CloudFormation as the deployment action. The pipeline fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What is the most likely cause and solution?

Accepted Answer

The CloudFormation API rate limit is being hit; request a limit increase from AWS Support.. The 'Rate exceeded' error is a standard AWS API throttling error, indicating that CloudFormation API requests are being made faster than the account-level or region-level rate limit allows. CodePipeline can trigger multiple concurrent stack operations, especially during parallel stage executions or frequent commits, which can exceed the default CloudFormation API rate limit (e.g., 0.5 requests per second per account per region for CreateStack/UpdateStack). Requesting a limit increase from AWS Support is the correct solution to accommodate higher throughput.

Answer

The stack has a stack policy that prevents updates; modify the stack policy.

Answer

The IAM role used by CloudFormation does not have sufficient permissions; update the role policy.

Answer

The pipeline is exceeding the CodePipeline execution frequency limit; reduce the number of pipeline executions.

Question 14

A developer is writing an AWS CloudFormation template to create an Amazon S3 bucket. The bucket name must be unique across all AWS accounts. Which property should the developer use to ensure the name is unique?

Accepted Answer

Omit the BucketName property so CloudFormation generates a unique name.. Omit the BucketName property so CloudFormation generates a unique name. Amazon S3 bucket names must be globally unique across all AWS accounts. If you specify a custom BucketName, you must ensure its uniqueness yourself, which is error-prone. By omitting BucketName, CloudFormation automatically generates a unique name that includes a random suffix, guaranteeing global uniqueness. Option A (DeletionPolicy) controls what happens when the stack is deleted, not naming. Option B (setting BucketName to a unique value via parameter) still requires manual uniqueness and is not a property that ensures uniqueness automatically. Option C (UpdateReplacePolicy) controls replacement behavior on updates, not naming. Therefore, omitting BucketName is the simplest way to ensure a unique name.

Answer

Use the DeletionPolicy attribute to retain the bucket.

Answer

Set the BucketName property to a unique value using a parameter.

Answer

Use the UpdateReplacePolicy attribute to control replacement.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. They want to ensure that configuration changes (e.g., environment variables, instance type) are version-controlled and can be rolled back. Which strategy should they use?

Accepted Answer

Store configuration in a configuration file (e.g., .ebextensions) included with the application source code.. Storing configuration in .ebextensions files (YAML/JSON) within the application source bundle allows version control of environment settings (e.g., environment variables, instance type) alongside the code. When the application is deployed or updated, Elastic Beanstalk applies these configuration files automatically, enabling consistent rollback by redeploying a previous source bundle version. This approach integrates configuration management with the application lifecycle, ensuring that changes are tracked and reversible.

Answer

Use AWS CloudFormation to manage the Beanstalk environment outside of Beanstalk.

Answer

Use Elastic Beanstalk saved configurations to store environment settings.

Answer

Manually change environment configuration using the Elastic Beanstalk console when needed.