DOP-C02 Configuration Management and IaC Practice Test 5 — 15 Questions

Question 1

A company wants to use AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that the instances are automatically configured with the latest security patches upon boot. Which OpsWorks feature should they use?

Accepted Answer

Create a custom Chef recipe that installs security patches and assign it to the setup lifecycle event.. Option B is correct because OpsWorks uses Chef or Puppet recipes to configure instances. A custom recipe can be created to apply patches during the setup lifecycle event. Option A is wrong because OpsWorks does not integrate directly with Systems Manager Patch Manager. Option C is wrong because user data is an EC2 feature, not OpsWorks. Option D is wrong because CloudFormation is for provisioning, not configuration management.

Answer

Configure the instances to run a user data script that updates packages.

Answer

Use AWS Systems Manager Patch Manager with an OpsWorks lifecycle event.

Answer

Use a CloudFormation template to apply patches during stack creation.

Question 2

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodePipeline and Amazon ECS. The pipeline should build a Docker image, push it to Amazon ECR, and deploy it to an ECS service. Which deployment action should they use in the pipeline?

Accepted Answer

Amazon ECS (Blue/Green) deployment provider with CodeDeploy.. Option B is correct because the ECS deployment provider in CodePipeline supports deploying to ECS services, including blue/green deployments with CodeDeploy. Option A is wrong because CodeBuild is for building, not deploying. Option C is wrong because Elastic Beanstalk is for web applications, not ECS. Option D is wrong because CloudFormation is not a direct deployment action for ECS services.

Answer

AWS Elastic Beanstalk deployment action.

Answer

AWS CodeBuild with a buildspec that runs aws ecs update-service.

Answer

AWS CloudFormation deployment action to update the ECS service.

Question 3

A company uses AWS CloudFormation to manage infrastructure. They have a stack that includes a VPC, subnets, and EC2 instances. They want to update the AMI ID of an EC2 instance without causing downtime. Which TWO approaches meet this requirement?

Accepted Answer

Use a CloudFormation update with a rolling update policy on the Auto Scaling group.. Option A is correct because a rolling update can replace instances one at a time, minimizing downtime. Option D is correct because a custom resource can run a script to update the instance without replacing it. Option B is wrong because deleting and recreating the stack causes downtime. Option C is wrong because update with replacement replaces the instance, causing downtime. Option E is wrong because multi-AZ is for RDS, not EC2.

Answer

Use CloudFormation stack update with 'UpdatePolicy' set to 'AutoScalingRollingUpdate' and 'MinInstancesInService' set to 0.

Answer

Delete the stack and recreate it with the new AMI.

Answer

Deploy the instances across multiple Availability Zones and update each zone separately.

Question 4

A team is using AWS CodeDeploy to deploy a web application to EC2 instances. They want to ensure that rollbacks occur automatically if the deployment fails. Which THREE configurations are necessary?

Accepted Answer

Configure a CloudWatch Events rule to trigger a rollback on deployment failure.. Option A is correct because a trigger can invoke a rollback when a deployment fails. Option C is correct because rollback configuration in the deployment group enables automatic rollback. Option D is correct because alarms can trigger rollback based on health metrics. Option B is wrong because load balancer is not required for rollback. Option E is wrong because lifecycle hooks are for running scripts, not for rollback.

Answer

Add lifecycle event hooks to stop the deployment if a script fails.

Answer

Associate an Application Load Balancer with the deployment group.

Question 5

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. They want to ensure that the VPC has internet access for the public subnets. Which THREE resources must be included in the template?

Accepted Answer

AWS::EC2::Route (pointing to InternetGateway). Option A is correct because an internet gateway is required for internet access. Option B is correct because a route table is needed to route traffic. Option D is correct because a route to the internet gateway must be added to the route table. Option C is wrong because a NAT gateway is for private subnets. Option E is wrong because a VPC endpoint is for private connectivity to AWS services.

Answer

AWS::EC2::VPCEndpoint

Answer

AWS::EC2::NatGateway

Question 6

An administrator attaches the IAM policy shown in the exhibit to an IAM user. What is the effect on the user's ability to launch an EC2 instance in eu-west-1?

Accepted Answer

The user is allowed because the request region matches the condition exception.. Option D is correct because the policy denies all EC2 actions when the requested region is NOT us-east-1 or eu-west-1. Since the requested region is eu-west-1, the condition is not met, so the deny does not apply. By default, actions are allowed if not explicitly denied. Option A is wrong because the deny only applies when the region is not in the list. Option B is wrong because the policy does not explicitly allow. Option C is wrong because there is no explicit allow, but the default allow applies.

Answer

The user is denied from launching instances in eu-west-1.

Answer

The user is allowed because the policy does not explicitly deny.

Answer

The user is allowed only if they also have an explicit allow policy.

Question 7

A DevOps engineer updated an EC2 instance's InstanceType in a CloudFormation stack and received the stack events shown in the exhibit. What is the most likely cause of the failure?

Accepted Answer

The engineer specified an invalid instance type (e.g., t2.large) that is not allowed by CloudFormation.. Option B is correct because the error message states that the InstanceType value must be one of the allowed types. The engineer likely specified an invalid instance type like t2.large. Option A is wrong because the error is about instance type, not AMI. Option C is wrong because the error is not about IAM. Option D is wrong because the error is not about network.

Answer

The engineer did not have permission to modify the instance type.

Answer

The AMI ID specified does not support the new instance type.

Answer

The VPC configuration does not support the new instance type.

Question 8

A team creates the CloudFormation template shown in the exhibit. What is a potential security concern with this configuration?

Accepted Answer

The bucket policy allows public read access to all objects.. Option C is correct because the bucket policy allows anonymous access (Principal: "*") to get objects, which can lead to unauthorized access if the bucket contains sensitive data. Option A is wrong because versioning is enabled. Option B is wrong because the bucket name is unique. Option D is wrong because there is no encryption specified, but the primary concern is the public access.

Answer

The bucket name is not unique.

Answer

The bucket does not have server-side encryption enabled.

Answer

The bucket is not versioned.

Question 9

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to ensure that stack updates are reviewed and approved by a senior engineer before being executed. Which feature should they implement?

Accepted Answer

Change sets. Change sets allow you to preview proposed changes before applying them. Option B is correct. Option A is incorrect because stack policies protect stack resources during updates but do not provide a review mechanism. Option C is incorrect because drift detection detects changes outside of CloudFormation. Option D is incorrect because stack sets deploy stacks across accounts/regions.

Answer

Stack policies

Answer

Drift detection

Answer

Stack sets

Question 10

An organization uses OpsWorks to manage application stacks. They notice that custom cookbooks are not being executed during the lifecycle events. What is the most likely cause?

Accepted Answer

The custom cookbook repository URL is misconfigured or inaccessible. Custom cookbooks must be stored in a repository (S3, Git, etc.) and the layer must be configured to use that repository. Option D is correct. Option A is incorrect because Chef version compatibility is usually not the cause for non-execution. Option B is incorrect because IAM roles are for AWS API calls, not cookbook execution. Option C is incorrect because OpsWorks does not use CodeDeploy for cookbook execution.

Answer

The layer's IAM role does not have permissions to execute the cookbook

Answer

The cookbook is not configured with CodeDeploy

Answer

The cookbook uses a Chef version that is not supported by OpsWorks

Question 11

A company uses AWS Systems Manager to manage hybrid servers. They want to automate the patching of Windows servers using Patch Manager. However, some servers are not showing up in the compliance reporting. What should the DevOps engineer check first?

Accepted Answer

Ensure the SSM Agent is installed and running on the servers. The SSM Agent must be installed and running on the servers to communicate with Systems Manager. Option B is correct. Option A is incorrect because tags are used for targeting but not for basic connectivity. Option C is incorrect because the Patch Baseline is a configuration, not a connectivity requirement. Option D is incorrect because the IAM instance profile must be attached to the instance, not a service role.

Answer

Verify that the servers have the correct patch baseline tags

Answer

Check that the Patch Baseline is configured to include the missing servers

Answer

Confirm that the servers have an IAM service role for Systems Manager

Question 12

A DevOps team uses Elastic Beanstalk to deploy a web application. They want to configure environment variables without modifying the application code. Where should they define these variables?

Accepted Answer

As environment properties in the Elastic Beanstalk environment. Elastic Beanstalk allows environment properties to be set in the console, CLI, or via .ebextensions. These are exposed as environment variables to the application. Option C is correct. Option A is incorrect because the application code is the wrong place. Option B is incorrect because User Data is for EC2 initialization, not for application environment variables. Option D is incorrect because Instance Metadata does not expose custom environment variables automatically.

Answer

In the EC2 User Data script

Answer

In the instance metadata

Answer

In the application code

Question 13

A company uses AWS CodeBuild to build and test code. They need to securely store sensitive parameters, such as database passwords, and inject them into the build process. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is designed to store configuration data and secrets securely. Option D is correct. Option A is incorrect because Secrets Manager can also store secrets but is more expensive and not necessary for simple build parameters. Option B is incorrect because KMS is a key management service, not a parameter store. Option C is incorrect because CodeBuild does not store secrets natively.

Answer

Storing them in the CodeBuild project environment variables

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Question 14

A company uses AWS Config to evaluate compliance of their AWS resources. They have a custom rule that checks whether EC2 instances have a specific tag. They notice that the rule is not triggering on existing instances. What is a possible reason?

Accepted Answer

The rule is not configured with a trigger type of 'Configuration changes' or 'Periodic'. AWS Config custom rules evaluate resources only when they are created or changed, or during periodic evaluations. If the rule is not configured for periodic evaluation, it won't check existing resources until a change occurs. Option C is correct. Option A is incorrect because permissions are needed for the rule to invoke the Lambda function, but if it's not triggering at all, it's not a permission issue. Option B is incorrect because AWS Config supports custom rules with Lambda. Option D is incorrect because resource types must be recorded, but that is usually set up initially.

Answer

AWS Config does not support custom rules

Answer

The Lambda function does not have permission to describe EC2 instances

Answer

The EC2 instances are not in the resource types being recorded by AWS Config

Question 15

A team uses CloudFormation to deploy a multi-container Docker environment on Amazon ECS. They need to pass environment variables to the containers from Parameter Store. How should they reference these values in the CloudFormation template?

Accepted Answer

Using the 'resolve:ssm' dynamic reference. CloudFormation has a dynamic reference resolution feature that allows you to use the 'resolve:ssm' or 'resolve:ssm-secure' syntax to fetch values from Parameter Store at stack creation/update time. Option B is correct. Option A is incorrect because there is no 'aws:paramstore' intrinsic function. Option C is incorrect because Ref returns the parameter name, not its value. Option D is incorrect because Fn::GetAtt is for resource attributes, not for Parameter Store values.

Answer

Using the 'Ref' function with the parameter name

Answer

Using the 'Fn::ParamStore' intrinsic function

Answer

Using 'Fn::GetAtt' on the Parameter Store resource