DOP-C02 Configuration Management and IaC Practice Test 6 — 15 Questions

Question 1

A company manages its AWS infrastructure with AWS CloudFormation. A DevOps engineer needs to update a production stack that includes an Amazon RDS DB instance. The update will change the DB instance class, which requires a reboot and causes downtime. The engineer wants to apply the change during a maintenance window and ensure that the stack update does not proceed if the change would cause an unexpected interruption. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a change set, review the changes to confirm that the DB instance will be replaced or modified as expected, and then execute the change set during the maintenance window.. A change set allows the engineer to preview the effects of a stack update before execution. Reviewing it confirms whether the RDS instance will be modified in place or replaced, which is critical to avoid unexpected downtime. Executing the change set during the maintenance window ensures the change occurs at the planned time, meeting both requirements.

Answer

Enable termination protection on the stack and then update the DB instance class; termination protection will prevent any unintended downtime.

Answer

Update the stack directly with the new DB instance class and rely on the RDS maintenance window to apply the change automatically.

Answer

Use a CloudFormation change set with the CAPABILITY_IMMEDIATE_UPDATES capability, review the changes, and then execute the change set during the maintenance window.

Question 2

A company uses AWS CloudFormation to manage a large number of resources. A DevOps engineer needs to update a stack that includes an AWS::EC2::Instance resource with a UserData property. The engineer wants to ensure that the instance is replaced with a new one when the UserData changes, but without causing a full stack update that affects other resources. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the AWS::EC2::Instance resource's UpdatePolicy attribute with AutoScalingReplacingUpdate or a custom resource to trigger replacement.. For a standalone EC2 instance, changes to the UserData property cause CloudFormation to replace the instance by default. If the instance is part of an Auto Scaling group, the UpdatePolicy attribute with AutoScalingReplacingUpdate can be used to replace instances. The engineer should verify the resource's update behavior and use the appropriate mechanism to ensure replacement without affecting other resources.

Answer

Use a change set to preview the changes and then execute only the changes related to the EC2 instance.

Answer

Use a stack policy to deny updates to all resources except the EC2 instance.

Answer

Use the AWS::EC2::Instance resource's UpdateReplacePolicy attribute set to Replace.

Question 3

A DevOps engineer needs to ensure that an AWS CloudFormation template can be deployed only in the us-east-1 and eu-west-1 regions. The template should also enforce that an Amazon EC2 instance type is limited to t3.micro. Which combination of CloudFormation features should the engineer use?

Accepted Answer

Use a parameter with AllowedValues for the instance type and a condition with Fn::Contains on AWS::Region.. To restrict regions, you can use a condition with Fn::Contains on AWS::Region and a list of allowed regions. This condition can be used to create a resource that fails if the region is not allowed, effectively preventing deployment. A parameter with AllowedValues enforces the instance type. The combination of these features meets the requirements.

Answer

Use a mapping to restrict regions and a parameter with AllowedValues for the instance type.

Answer

Use a parameter with AllowedValues for the instance type and a condition with Fn::Equals on AWS::Region.

Answer

Use a parameter with AllowedValues for the instance type and a condition to restrict regions.

Question 4

A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?

Accepted Answer

Upload the recipe to a custom cookbook repository and assign it to the 'Configure' lifecycle event in the stack settings.. In AWS OpsWorks, lifecycle events (such as Configure) are tied to layers, not individual instances. To run a custom recipe on all instances during the Configure event, you must upload the recipe to a custom cookbook repository (e.g., S3 or Git) and then assign that recipe to the Configure lifecycle event in the stack's layer settings. This ensures OpsWorks Chef runs the recipe on every instance in that layer whenever the Configure event fires (e.g., after scaling or instance state changes).

Answer

Modify the stack's CloudFormation template to include the recipe.

Answer

Add the recipe commands to the instance's user data script.

Answer

Use AWS CodeDeploy to trigger the recipe during the Configure event.

Question 5

A DevOps team uses AWS CodePipeline to automate deployments. The pipeline has a Deploy stage that uses AWS CloudFormation to create or update a stack. Recently, a stack update failed because the template referenced an AMI that was deprecated. The team wants to automatically roll back the stack to the last known good state if a deployment fails. What should they do?

Accepted Answer

Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.. The CloudFormation deployment action in CodePipeline supports a 'Rollback on failure' option when 'ActionMode' is set to 'CREATE_UPDATE'. When enabled, if the stack update fails, CloudFormation automatically rolls back the stack to the last known good state (the previously deployed stack). This directly addresses the team's requirement to revert to a stable state after a failed deployment due to a deprecated AMI.

Answer

Use the CodePipeline console to enable 'Automatic rollback' for the Deploy stage.

Answer

Set the stack's 'DisableRollback' parameter to 'true' in the template.

Answer

Add a stack policy to the CloudFormation stack that denies updates to the AMI parameter.

Question 6

An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?

Accepted Answer

Immutable update.. Immutable updates in AWS Elastic Beanstalk launch a completely new environment with the new application version. If the new environment fails health checks, Elastic Beanstalk automatically terminates it, leaving the original environment untouched. This ensures zero downtime and a safe rollback, which matches the requirement to keep the old environment intact if health checks fail.

Answer

Traffic splitting.

Answer

All at once.

Answer

Rolling update based on health.

Question 7

A developer wants to use AWS CloudFormation to create an Amazon RDS DB instance. The template includes a DB instance resource. Which property is required for the DB instance to be created successfully?

Accepted Answer

DBInstanceClass and Engine. In AWS CloudFormation, when creating an Amazon RDS DB instance using the AWS::RDS::DBInstance resource, the only truly required properties are DBInstanceClass (the compute and memory capacity) and Engine (the database engine, e.g., MySQL, PostgreSQL). These two properties are mandatory in the CloudFormation resource specification; without them, the template will fail validation. All other properties, such as AllocatedStorage, DBInstanceIdentifier, MasterUsername, and MasterUserPassword, have default behaviors or can be omitted under certain conditions (e.g., AllocatedStorage defaults to 20 GB for some engines, and MasterUsername/MasterUserPassword are not required if you use a snapshot or a source DB instance).

Answer

AllocatedStorage

Answer

DBInstanceIdentifier

Answer

MasterUsername and MasterUserPassword

Question 8

A company manages its infrastructure using AWS CloudFormation. They have a production stack that includes an Amazon RDS Multi-AZ DB instance. The stack was created using the 'aws cloudformation create-stack' command with default settings. The DB instance uses a custom DB parameter group. A DevOps engineer needs to modify a parameter in the DB parameter group and update the stack. The engineer updates the template to change the parameter value and runs 'aws cloudformation update-stack'. The update fails with a 'ROLLBACK_IN_PROGRESS' status. The engineer checks the CloudFormation console and sees that the DB instance was successfully modified, but the stack is rolling back. The rollback fails because the DB instance cannot be reverted to the original parameter value. The stack is now in 'UPDATE_ROLLBACK_FAILED' state. What should the engineer do to resolve this situation and apply the desired parameter change?

Accepted Answer

Use the 'aws cloudformation continue-update-rollback' command with the '--resources-to-skip' parameter to skip the DB instance, allowing the stack to reach 'UPDATE_ROLLBACK_COMPLETE'. Then apply a change set with the desired parameter change.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the `continue-update-rollback` command with `--resources-to-skip` allows you to skip the resource that cannot be rolled back (the RDS DB instance with the custom parameter group). This moves the stack to UPDATE_ROLLBACK_COMPLETE, after which you can apply a change set with the desired parameter change. This approach avoids manual intervention or stack deletion while preserving the modified DB instance.

Answer

Run 'aws cloudformation update-stack' again with the original template to revert the changes.

Answer

Revert the parameter value manually in the RDS console and then resume the rollback.

Answer

Delete the stack and recreate it with the updated template.

Question 9

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

Accepted Answer

Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.. The UpdatePolicy attribute with AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup resources, not for AWS::RDS::DBInstance. Therefore, option D is incorrect. Options A and C are also invalid (CreationPolicy is for signal-based creation, and AutoScalingRollingUpdate is for rolling updates on Auto Scaling groups). Option B, Stack Policy, can protect resources from being updated but does not control how a replacement occurs to minimize downtime or prevent data loss. Thus, none of the provided options are correct for ensuring minimal downtime and data safety during an RDS instance class change that requires replacement.

Answer

Set the CreationPolicy attribute on the database resource.

Answer

Configure a Stack Policy to protect the database resource.

Answer

Set the UpdatePolicy to AutoScalingRollingUpdate.

Question 10

A DevOps engineer is designing an AWS CloudFormation template to deploy a three-tier web application. The application must be highly available across multiple Availability Zones. The engineer needs to ensure that the database layer uses a Multi-AZ deployment. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Accepted Answer

Select a database engine that supports Multi-AZ deployments.. Not all AWS RDS database engines support Multi-AZ deployments; for example, Amazon Aurora uses a different high-availability mechanism (cluster volume) and does not use the standard Multi-AZ feature. The engineer must verify that the chosen engine (e.g., MySQL, PostgreSQL, Oracle, SQL Server) explicitly supports Multi-AZ to enable synchronous standby replication across Availability Zones. Option E is correct because setting the 'MultiAZ' property to 'true' on the 'AWS::RDS::DBInstance' resource directly instructs CloudFormation to provision a primary DB instance in one AZ and a standby in another AZ, with automatic failover.

Answer

Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets from at least two Availability Zones.

Answer

Deploy the database with multiple read replicas in different Availability Zones.

Answer

Configure the database to use a DB subnet group with subnets in a single Availability Zone.

Question 11

A DevOps engineer receives the error shown in the exhibit when attempting to update an existing CloudFormation stack that deploys a VPC with subnets. The stack was created successfully earlier using the same template. What is the most likely cause of this error?

Accepted Answer

The IAM role used for the stack update lacks the 'ec2:DescribeSubnets' permission.. When updating a CloudFormation stack that deploys a VPC with subnets, the update operation must be able to read the current state of the subnet resources to determine if changes are needed. The IAM role used for the stack update must have the 'ec2:DescribeSubnets' permission to query the existing subnet configuration. Without this permission, CloudFormation cannot verify the subnet's current properties, leading to the error shown in the exhibit.

Answer

The subnet ID in the template is already used by another stack in the same account.

Answer

The subnet specified in the template does not exist in the selected AWS region.

Answer

The CloudFormation template has a syntax error in the subnet definition.

Question 12

Drag and drop the steps to set up an AWS CodePipeline with a source stage from CodeCommit and a deploy stage to Elastic Beanstalk.

Accepted Answer

Create S3 bucket, then create CodeCommit repository and push code, then create pipeline, then configure source, then configure deploy.. The correct order is: first create the S3 bucket for artifacts, then create the CodeCommit repository and push code, then create the pipeline, then configure source, then configure deploy.

Answer

Create pipeline, then create S3 bucket, then create CodeCommit repository and push code, then configure source, then configure deploy.

Answer

Configure source, then configure deploy, then create S3 bucket, then create CodeCommit repository and push code, then create pipeline.

Answer

Create CodeCommit repository and push code, then create S3 bucket, then create pipeline, then configure deploy, then configure source.

Question 13

Match each AWS service to its primary function in a DevOps pipeline.

Accepted Answer

CodeCommit: Source control service for storing and managing code. In a DevOps pipeline, AWS CodeCommit provides source control, CodeBuild compiles and tests code, CodeDeploy automates deployments, and CodePipeline orchestrates the entire CI/CD process. Common confusions include mixing up the roles of CodeCommit and CodeDeploy or CodeCommit and CodeBuild.

Answer

CodeCommit: Service for deploying code to EC2 instances

Answer

CodeBuild: Service for managing source code repositories

Question 14

Match each AWS Config rule to its purpose.

Accepted Answer

s3-bucket-public-read-prohibited: Checks if S3 buckets allow public read access. The correct matches are: s3-bucket-public-read-prohibited with S3 public read check, restricted-ssh with SSH access check, iam-user-no-policies-check with no attached policies, and cloud-trail-cloud-watch-logs-enabled with CloudWatch integration. Common confusions include swapping definitions between different rule types.

Answer

s3-bucket-public-read-prohibited: Checks security groups for unrestricted SSH access

Answer

encrypted-volumes: Checks that no IAM users have inline policies

Question 15

A company uses AWS CodePipeline with a multi-branch strategy. The pipeline deploys a Lambda function using CloudFormation. The DevOps engineer notices that when a new branch is created, the pipeline executes but the CloudFormation stack fails because the stack name already exists. What is the MOST efficient way to resolve this issue?

Accepted Answer

Modify the pipeline to use a dynamic stack name parameter, such as the branch name.. Using a dynamic stack name parameter, such as the branch name, ensures each branch creates a unique CloudFormation stack. This avoids naming conflicts while allowing independent infrastructure per branch. In CodePipeline, you can pass the branch name as a variable (e.g., #{SourceVariables.BranchName}) to the CloudFormation deploy action, making the stack name unique without manual intervention.

Answer

Hardcode a different stack name for each branch in the pipeline.

Answer

Delete the existing stack before each deployment.

Answer

Use the CloudFormation 'Override' parameter to reuse the same stack.