DOP-C02 Configuration Management and IaC Practice Test 6 — 15 Questions

Question 1

A DevOps engineer is troubleshooting an AWS CloudFormation stack that failed to create. The error message indicates that a resource 'AWS::Lambda::Function' timed out while being created. The Lambda function code is packaged as a ZIP file in Amazon S3. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda deployment package is very large, causing the S3 download to exceed the resource creation timeout.. AWS CloudFormation has a default timeout for creating resources, and if the Lambda deployment package is very large, downloading it from S3 can exceed that timeout. Option A is incorrect because the Lambda function's timeout setting (e.g., 3 seconds) applies to function execution, not to the creation process; the creation timeout is controlled by CloudFormation. Option B is incorrect because if the execution role lacks permissions to download the ZIP file, it would result in an access denied error, not a timeout. Option D is incorrect because the CloudFormation service role permissions affect stack operations broadly, but they do not directly cause a resource-specific timeout; the timeout here is due to package size.

Answer

The Lambda function has a very short timeout (e.g., 3 seconds) configured in the function properties.

Answer

The Lambda function's execution role does not have permission to download the ZIP file from S3.

Answer

The CloudFormation service role does not have permissions to create Lambda functions.

Question 2

A company uses AWS OpsWorks for configuration management. They want to automate the installation of a custom agent on new EC2 instances. Which OpsWorks feature should they use?

Accepted Answer

Use a custom Chef recipe in the layer's configuration to run the installation.. AWS OpsWorks allows you to define custom Chef recipes that run during specific lifecycle events (e.g., Setup) on new instances. By adding a custom recipe to the layer's configuration, you can automate the installation of a custom agent. Option B is incorrect because the layer's built-in configuration is for default OpsWorks settings, not custom agent installation. Option C is incorrect because custom JSON passes attribute data to recipes but does not execute installation commands directly. Option D is incorrect because storing scripts in a cookbook repository does not automatically run them; you must assign the recipe to the layer's lifecycle events.

Answer

Define the agent installation in the layer's built-in configuration.

Answer

Use custom JSON to pass the installation commands.

Answer

Create a cookbook repository and upload the agent installation script.

Question 3

A team is using AWS CodeDeploy to deploy an application to EC2 instances. They want to ensure that if a deployment fails, the instances are automatically rolled back to the previous version. What should they configure?

Accepted Answer

Enable automatic rollback in the deployment group settings.. CodeDeploy supports automatic rollback configuration. When enabled, if a deployment fails, CodeDeploy automatically redeploys the last successful revision. Option A is wrong because a hook is a lifecycle event, not a rollback mechanism. Option B is wrong because a deployment group contains instances but does not have a rollback setting. Option C is wrong because a deployment configuration specifies traffic routing and failure thresholds, not automatic rollback.

Answer

Add a BeforeBlockTraffic hook to the AppSpec file to run a rollback script.

Answer

Set the deployment configuration to 'CodeDeployDefault.OneAtATime' for a gradual deployment.

Answer

Configure the deployment group to use the same Auto Scaling group for rollback.

Question 4

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts. They notice that a stack instance in one account is in a 'FAILED' status because of a permissions issue. After fixing the permissions, what is the most efficient way to retry the stack instance operation?

Accepted Answer

Use the 'Update stack instances' operation for the failed target account.. StackSets allow you to update stack instances individually; you can retry the specific failed instance without affecting others. Option A is wrong because updating the entire stack set would affect all accounts, which is inefficient. Option C is wrong because deleting and recreating the stack instance is disruptive. Option D is wrong because manual stack creation outside StackSets defeats the purpose.

Answer

Manually create the stack in the failed account using the same template.

Answer

Update the entire stack set to retry all stack instances.

Answer

Delete the stack instance from the stack set and add it again.

Question 5

Which TWO are benefits of using AWS CloudFormation for infrastructure as code? (Select TWO.)

Accepted Answer

Enables declarative infrastructure definition.. AWS CloudFormation uses a declarative approach to infrastructure as code, where you define the desired end state of your resources in a template (JSON or YAML), and CloudFormation handles the provisioning and configuration to achieve that state. This contrasts with imperative scripting, where you must specify every step. Declarative definitions reduce complexity and improve reliability by letting the service manage the orchestration.

Answer

Manages both AWS and on-premises resources.

Answer

Provides a graphical interface for designing infrastructure.

Answer

Automatically optimizes resource costs.

Question 6

Which THREE are valid AWS Systems Manager capabilities for configuration management? (Select THREE.)

Accepted Answer

Run Command. Run Command enables you to manage configuration by remotely executing commands on instances. Patch Manager automates the process of patching managed instances. State Manager helps you define and maintain the desired state of your instances. OpsCenter (B) is an operational data hub for viewing and resolving operational issues, not primarily for configuration management. Parameter Store (C) provides secure storage for configuration data and secrets, but it is a supporting service rather than a configuration management capability itself.

Answer

OpsCenter

Answer

Parameter Store

Question 7

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. AWS Organizations can centrally manage accounts, and StackSets can be enabled with trusted access to deploy stacks across accounts. Option D is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts. Option B is incorrect because CloudFormation cannot automatically create new AWS accounts. Option C is incorrect because nested stacks operate within a single stack and cannot deploy resources across different accounts from a single template. Option E is incorrect because cross-stack references only work within the same account and region.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.

Question 8

A DevOps team is using AWS CloudFormation to manage infrastructure. They want to reuse the same template across multiple environments (dev, test, prod) with minor parameter variations. Which CloudFormation feature should they use to pass environment-specific values without modifying the template?

Accepted Answer

Parameters. (Parameters). Parameters allow you to input custom values into a CloudFormation template at stack creation or update time, making them ideal for passing environment-specific settings (e.g., different instance sizes or AMI IDs) without altering the template itself. Mappings (C) are static lookup tables that cannot be changed per stack instance, Conditions (A) control whether resources are created but do not pass values, and Outputs (B) are for retrieving stack attributes after creation. Therefore, D is the appropriate feature for this use case.

Answer

Conditions

Answer

Outputs

Answer

Mappings

Question 9

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a custom script on all instances every time the instance is started. The script is stored in an S3 bucket. Which approach ensures the script runs automatically on every instance start with minimal administrative overhead?

Accepted Answer

Create a State Manager association with the AWS-RunDocument document, targeting the instances, and set the schedule to 'On Instance Start'.. Associating a State Manager association with the AWS-RunDocument document and targeting the instances ensures the script runs on every instance start. Option A is correct because State Manager can be configured to run on instance start. Options B, C, and D are either manual or not triggered automatically on start.

Answer

Place the script in /etc/rc.local on a custom AMI.

Answer

Use AWS Config rules to invoke a Lambda function that runs the script.

Answer

Create an EC2 launch template that includes the script in user data.

Question 10

An organization uses AWS Elastic Beanstalk to deploy a web application. They need to ensure that configuration changes (e.g., environment variables, instance types) are version-controlled and can be rolled back. Which approach meets these requirements?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and store the configuration files in a version control system.. Elastic Beanstalk saved configurations allow you to capture the complete environment settings (including environment variables, instance types, and other configuration options) as a YAML or JSON file. By storing these configuration files in a version control system (e.g., Git), you achieve version-controlled configuration that can be applied to recreate or roll back an environment to a known state using the `eb config` command or the AWS Management Console.

Answer

Use AWS Systems Manager Parameter Store to store configuration values.

Answer

Create a custom script that uses the Elastic Beanstalk API to apply configuration and store the script in a Git repository.

Answer

Manually record all configuration changes in a spreadsheet.

Question 11

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture on AWS. They want to use AWS CodeDeploy to deploy applications to an Auto Scaling group. The pipeline must ensure that only a small percentage of instances are updated at a time, and if health checks fail, the deployment is automatically rolled back. Which deployment configuration should be used?

Accepted Answer

In-place deployment with 'CodeDeployDefault.OneAtATime' configuration and automatic rollback enabled.. The 'CodeDeployDefault.OneAtATime' configuration deploys to one instance at a time, ensuring only a small percentage of instances are updated simultaneously. Enabling automatic rollback triggers a rollback if health checks fail, meeting the requirement. Option D is correct. Option A (blue/green) is not in-place and typically updates all instances at once, not a small percentage. Option B (AllAtOnce) updates all instances simultaneously. Option C (HalfAtATime) updates half the instances, which is not as granular as OneAtATime and may not satisfy the 'small percentage' constraint.

Answer

Blue/green deployment with a fixed number of instances.

Answer

In-place deployment with 'CodeDeployDefault.AllAtOnce' configuration.

Answer

In-place deployment with 'CodeDeployDefault.HalfAtATime' configuration.

Question 12

A company uses AWS OpsWorks for configuration management. They need to automate the installation of a custom package on all instances in a layer. Which OpsWorks feature should they use?

Accepted Answer

Custom Chef recipes associated with lifecycle events. Custom Chef recipes associated with lifecycle events in AWS OpsWorks allow running Chef recipes automatically on instance lifecycle events such as Setup, Configure, Deploy, Undeploy, and Shutdown. This is the correct feature for automating package installation on all instances in a layer. Option A is incorrect because AWS CodeDeploy AppSpec file is used for CodeDeploy deployments, not OpsWorks. Option B is incorrect because AWS CloudFormation custom resources are used to extend CloudFormation templates, not for OpsWorks automation. Option D is incorrect because AWS Systems Manager Run Command is a separate service for managing instances, not OpsWorks.

Answer

AWS CodeDeploy AppSpec file

Answer

AWS CloudFormation custom resources

Answer

AWS Systems Manager Run Command

Question 13

A team uses AWS CloudFormation to manage a VPC with multiple subnets. They want to ensure that when a stack is updated, the update does not accidentally replace the VPC or any subnet. Which CloudFormation property should they set on the resources?

Accepted Answer

UpdateReplacePolicy. The 'DeletionPolicy' attribute with 'Retain' keeps the resource if the stack is deleted, but does not prevent replacement during update. To prevent replacement, use 'UpdateReplacePolicy' with 'Retain', or design the template to avoid replacement. However, the most direct way is to use 'UpdateReplacePolicy'. Option C is correct because it specifically handles update replacement.

Answer

CreationPolicy

Answer

DependsOn

Answer

DeletionPolicy

Question 14

A company uses AWS CodePipeline to orchestrate a multi-stage CI/CD pipeline. The build stage uses AWS CodeBuild and the deploy stage uses AWS CodeDeploy. The pipeline includes a manual approval step between build and deploy. The team wants to automatically trigger the pipeline when changes are pushed to a Git repository hosted in AWS CodeCommit. Which pipeline configuration is required for automatic triggers?

Accepted Answer

Configure the source stage to use CodeCommit as the source provider and enable 'Amazon CloudWatch Events' (EventBridge) to detect changes.. To automatically trigger the pipeline on code changes, the source stage must use CodeCommit as a source action with 'Amazon CloudWatch Events' (now Amazon EventBridge) configured to detect changes. CodePipeline integrates with EventBridge to start the pipeline on repository events. Option D is correct. Options A, B, and C are not sufficient alone.

Answer

Configure the source stage to use periodic polling of the CodeCommit repository.

Answer

Set up an SNS topic to notify the pipeline when code changes occur.

Answer

Add a Lambda function that calls StartPipelineExecution in response to CodeCommit events.

Question 15

A DevOps engineer needs to manage configuration files for multiple applications across several EC2 instances. The configuration values are sensitive (e.g., database passwords) and must be encrypted at rest and in transit. Which AWS service should be used to store and retrieve these configuration values?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store supports secure string parameters that are encrypted at rest using AWS KMS. It integrates with EC2 instances via the SSM Agent for secure retrieval in transit, making it ideal for sensitive configuration values like database passwords. Option A is correct. Option B (CloudFormation template parameters) are not designed for storing secrets and are passed at stack creation time, not dynamic retrieval. Option C (DynamoDB with encryption) is a NoSQL database, not a configuration store. Option D (S3 with SSE) is object storage, not optimized for parameter management or EC2 integration.

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption