DOP-C02 Configuration Management and IaC Practice Test 7 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template needs to reference the secret value dynamically during stack creation. How should the template retrieve the secret?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a dynamic reference with '{{resolve:secretsmanager:secret-id:secret-string}}' in the template.. CloudFormation dynamic references using the 'resolve:secretsmanager' syntax allow the template to retrieve secret values from AWS Secrets Manager at stack creation time. Option B correctly uses this dynamic reference to pull the password securely. Option A (mapping) cannot retrieve secrets dynamically; it only stores static values. Option C (hardcoding) is insecure and not dynamic. Option D (parameter with default ARN) does not retrieve the secret value; it only passes the ARN string, not the actual secret.

Answer

Use a CloudFormation mapping to store the secret ARN.

Answer

Hardcode the password in the template as a literal string.

Answer

Use a CloudFormation parameter with a default value referencing the secret ARN.

Question 2

A company is using AWS Elastic Beanstalk for a production environment. They have observed that during deployments, the environment's health status intermittently becomes 'Severe' even though the application is functioning correctly. The deployment uses rolling updates with a batch size of 50%. Which TWO configuration changes would improve deployment stability without completely redesigning the deployment process? (Select TWO.)

Accepted Answer

Increase the health check interval to allow more time for the application to stabilize.. Increasing the health check interval gives the application more time to stabilize after an update, reducing false 'Severe' health statuses. Option E is correct because decreasing the batch size to 25% reduces the number of instances updated at once, limiting the blast radius of any issues. Option A (switching to immutable updates) changes the deployment strategy, which may not be desired. Option C (increasing batch size to 75%) increases the number of instances updated simultaneously, worsening stability. Option D (decreasing deployment cooldown time) would shorten the wait between batches, not allowing enough time for the application to stabilize, potentially increasing instability.

Answer

Switch from rolling to immutable updates.

Answer

Increase the batch size to 75%.

Answer

Decrease the deployment cooldown time.

Question 3

A DevOps team is using AWS CodeBuild to run unit tests and package a Java application. They want to cache the Maven local repository (~/.m2) between builds to improve build times. Which TWO steps are necessary to enable caching in CodeBuild? (Select TWO.)

Accepted Answer

Add a 'cache' section in the buildspec file specifying the paths to cache.. To enable caching for the Maven local repository in AWS CodeBuild, two steps are required: (1) Add a `cache` section in the buildspec file specifying the paths to cache (e.g., ~/.m2) — this is option D. (2) Create an S3 bucket to store the cache and configure the CodeBuild project to use that bucket for caching — this is option E. Option A (setting MAVEN_OPTS) is not necessary because the default Maven repository path is already ~/.m2. Option B (uploading as a build artifact) is for saving output artifacts, not for caching. Option C ('Local cache' mode) is a different feature used for Docker layer caching, not for Maven dependencies. Therefore, options D and E are correct.

Answer

Set the MAVEN_OPTS environment variable to use a custom repository path.

Answer

Configure the buildspec to upload the Maven repository as a build artifact.

Answer

Enable 'Local cache' mode in the CodeBuild project.

Question 4

A CloudFormation stack creation failed. The engineer runs the describe-stack-events command and sees the output above. What is the root cause of the failure?

Accepted Answer

The EC2 instance failed to create because the AMI ID is invalid or does not exist in the region.. The describe-stack-events output shows a CREATE_FAILED event for the EC2 instance with a status reason indicating the AMI ID is invalid. Specifically, the error mentions 'Expected: 'ami-0abcdef1234567890'' which confirms the AMI ID provided does not exist or is incorrect in the region. Therefore, option D is correct. Option A is incorrect because the stack is rolling back due to the EC2 failure, not because a network resource failed. Option B is incorrect because the error is not about permissions; it's about an invalid AMI ID. Option C is incorrect because the failure is due to the AMI, not the instance type.

Answer

The stack is rolling back because a network resource failed to create.

Answer

The stack lacks permissions to launch EC2 instances.

Answer

The EC2 instance failed because the instance type 't2.micro' is not supported.

Question 5

A DevOps engineer creates the IAM policy above for an instance role. The role is attached to an EC2 instance that runs an application. The application starts and stops EC2 instances and reads a database password from Systems Manager Parameter Store. However, the application fails to retrieve the parameter. What is the most likely cause?

Accepted Answer

The parameter is a SecureString and the policy does not grant 'kms:Decrypt' permission for the KMS key.. The policy allows 'ssm:GetParameter' and 'ssm:GetParameters' on the specific parameter ARN. However, to retrieve a parameter, the action 'ssm:GetParameter' is sufficient, but the resource ARN must be correct. The given ARN includes the parameter name '/MyApp/DBPassword'. If the application is using a different path or the parameter is encrypted, the policy might be insufficient. But the most common issue is that the parameter is a SecureString and the policy also needs 'kms:Decrypt' access to the KMS key. Option C is correct because the policy does not include KMS permissions. Option A and B are less likely. Option D is incorrect because the actions are allowed.

Answer

The policy does not allow 'ssm:GetParameterHistory'.

Answer

The policy does not allow 'ec2:DescribeParameters'.

Answer

The policy does not allow 'ssm:GetParameter' on the specific resource.

Question 6

A CloudFormation template includes the above snippet. The stack creation fails with the error 'Unable to validate the following destination configurations'. What is the most likely cause?

Accepted Answer

The account has a public access block that denies public bucket policies.. The error 'Unable to validate the following destination configurations' occurs when S3 cannot validate the destination configuration for events, often due to public access block settings. If the account-level or bucket-level public access block is enabled to deny public bucket policies, then any attempt to set a bucket policy that grants public access will fail with this error. In this scenario, the CloudFormation template likely includes a bucket policy that grants public access, but the account has a public access block that denies such policies. Therefore, option D is correct. Option A is incorrect because the error is not a syntax error; it's a validation error. Option B is incorrect because the bucket name uniqueness is not the issue. Option C is incorrect because S3 bucket policies are supported in all regions.

Answer

The template has a syntax error in the PolicyDocument section.

Answer

The bucket name is not globally unique.

Answer

S3 Bucket Policy is not supported for this bucket region.

Question 7

A DevOps engineer uses AWS CodeBuild to build a Java application. The build fails with an error indicating that the build environment does not have the required Java version. What is the MOST efficient way to ensure the correct Java version is installed for all future builds?

Accepted Answer

Specify a managed image in the buildspec that includes the required Java version.. Using a managed image that already includes the required Java version ensures a consistent and efficient build environment without manual installation. Option A is incorrect because AWS Lambda is not involved in CodeBuild build environments; it would add unnecessary complexity. Option C is incorrect because installing Java via apt-get in the buildspec is less reliable, increases build time, and may fail. Option D is incorrect because while creating a custom Docker image is possible, it requires maintenance; the most efficient way is to use a managed image from AWS.

Answer

Use AWS Lambda to install Java on the build instance before the build starts.

Answer

Add a command in the buildspec to install the required Java version using apt-get.

Answer

Create a custom Docker image with the required Java version and reference it in the build project.

Question 8

A company uses AWS CloudFormation to manage infrastructure. After updating a stack, a resource fails to update because it requires a physical replacement. The stack update is set to 'Rollback on failure'. The engineer wants to test the effect of the change without affecting the production environment. Which approach should the engineer use?

Accepted Answer

Create a change set to review the proposed changes before executing the update.. Creating a change set allows you to preview the proposed changes (including whether a resource replacement is required) without actually applying them. This enables you to assess the impact on the production environment before executing the update. Option B is incorrect because disabling rollback still applies the changes, which could disrupt production. Option C is incorrect because creating a new stack does not test the update against the existing stack; it creates an independent environment. Option D is incorrect because using a different region does not replicate the exact state of the current stack and adds complexity.

Answer

Disable rollback on failure and update the stack, then manually revert if issues occur.

Answer

Create a new stack using the same template but with a different stack name.

Answer

Use a different AWS region and replicate the stack there for testing.

Question 9

A DevOps team manages a multi-account AWS environment using AWS Organizations. They need to enforce a mandatory tag (e.g., 'CostCenter') on all resources created across accounts. Which combination of services should be used to automatically remediate non-compliant resources?

Accepted Answer

AWS Config rules with automatic remediation using AWS Systems Manager Automation or Lambda.. AWS Config rules can evaluate resources for mandatory tags and trigger automatic remediation actions, such as AWS Systems Manager Automation or AWS Lambda functions, to add the missing tag. Option A is incorrect because SCPs only deny actions at the account level, but they do not remediate existing non-compliant resources or enforce tags on resources created outside the SCP scope. Option B is incorrect because CloudTrail only logs API calls and cannot automatically remediate non-compliant resources. Option D is incorrect because Tag Editor is a manual tool and does not provide automated enforcement or remediation.

Answer

AWS Service Control Policies (SCPs) to deny creation of resources without the tag.

Answer

AWS CloudTrail to detect non-compliant resource creation and send notifications.

Answer

AWS Resource Groups & Tag Editor to manually add tags to non-compliant resources.

Question 10

An engineer uses AWS Elastic Beanstalk to deploy a web application. The application needs to read from an S3 bucket. The engineer has configured an instance profile with the necessary S3 permissions. However, the application returns an access denied error. What is the MOST likely cause?

Accepted Answer

The instance profile has not been assigned to the Elastic Beanstalk environment.. The most likely cause is that the instance profile with the necessary S3 permissions has not been assigned to the Elastic Beanstalk environment. Elastic Beanstalk uses an instance profile to grant IAM permissions to the EC2 instances it launches. If the instance profile is not configured or assigned correctly, the application will not have the required S3 permissions, resulting in an access denied error. Option A is correct because the instance profile must be associated with the environment.

Answer

The S3 bucket policy denies access to the application.

Answer

The security group assigned to the environment does not allow outbound traffic to S3.

Answer

The S3 bucket is in a different region and the application is not configured to use the correct region.

Question 11

A company uses AWS OpsWorks for configuration management. The operations team needs to apply a configuration change to all instances in a layer without downtime. Which approach should they use?

Accepted Answer

Use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'.. The correct approach is to use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'. This allows applying configuration changes to all instances in the layer without downtime, as OpsWorks executes the recipe on each instance without requiring instance recreation. Option B is incorrect because Auto Scaling lifecycle hooks are used to execute actions during instance launch or termination, not for runtime configuration updates. Option C is incorrect because cloning a layer creates a new layer and does not apply changes to existing instances; switching traffic would involve additional steps and potential downtime. Option D is incorrect because manually SSHing into each instance is error-prone, not scalable, and violates best practices for configuration management.

Answer

Use an Auto Scaling lifecycle hook to apply the change during instance launch.

Answer

Clone the layer and update the clone with the new configuration, then switch traffic.

Answer

SSH into each instance and manually apply the change.

Question 12

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set with a new template version. The update fails in some accounts due to a resource conflict. What is the BEST way to resolve the conflict and complete the update?

Accepted Answer

Use the 'Skip accounts' option to temporarily exclude failing accounts, then fix and retry.. The best option is D: Use the 'Skip accounts' option to temporarily exclude failing accounts, then fix and retry. StackSets allows you to skip specific accounts or regions where operations fail, enabling you to resolve conflicts without disrupting the entire stack set. After fixing the resource conflicts in the failing accounts, you can retry the update. Option A is incorrect because deleting and recreating the stack set is disruptive and may cause data loss. Option B is incorrect because manually deleting conflicting resources is not a scalable approach and may violate infrastructure-as-code principles. Option C is incorrect because modifying the template to ignore resources with conditions is not appropriate for resolving actual resource conflicts; conditions are for conditional creation/deletion based on parameters or resource properties.

Answer

Delete the stack set and recreate it with the new template.

Answer

Manually delete the conflicting resources in the failing accounts and retry the update.

Answer

Modify the CloudFormation template to ignore the conflicting resources using a condition.

Question 13

A DevOps engineer uses AWS Secrets Manager to rotate database credentials. The rotation fails because the Lambda function used for rotation does not have network access to the database. The database is in a private VPC. How should the engineer fix this?

Accepted Answer

Configure the Lambda function to be VPC-enabled and place it in the same subnet as the database.. The Lambda function must be configured to run in the same VPC and subnet as the database to access it. Option B is incorrect because Secrets Manager uses Lambda for rotation, not direct access. Option C is incorrect because VPC Peering adds complexity and is unnecessary. Option D is incorrect because NAT Gateway is for outbound internet access, not inbound.

Answer

Assign a public IP address to the database and update the security group to allow access from the Lambda function.

Answer

Set up a VPC Peering connection between the Lambda service and the VPC.

Answer

Add a NAT Gateway to the VPC to allow Lambda to reach the database.

Question 14

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

Accepted Answer

The webhook in GitHub is not properly configured or has been removed.. The most likely cause is that the webhook in GitHub is not properly configured or has been removed. CodePipeline relies on a webhook to automatically detect changes in the GitHub repository. If the webhook is missing or misconfigured, the pipeline will not trigger on pushes. Option A is incorrect because the pipeline uses the master branch as specified. Option B is incorrect because AWS regions are independent of GitHub; the webhook is not region-specific. Option D is incorrect because pipeline permissions are not required for the webhook to function; the webhook itself is the key mechanism for triggering.

Answer

The pipeline uses a different branch name.

Answer

The GitHub repository is not in the same AWS region as the pipeline.

Answer

The pipeline does not have permission to access the GitHub repository.

Question 15

An organization uses AWS System Manager Patch Manager to patch EC2 instances. The patches are not being applied to some instances. The instances are running Amazon Linux 2 and have the SSM Agent installed. What is the MOST likely reason for the failure?

Accepted Answer

The instances are missing the required IAM role for Systems Manager.. Instances must have an IAM role that grants Systems Manager permissions to manage patches. Without this role, the SSM Agent cannot communicate with the Systems Manager service, preventing patch application. Option A is incorrect because instances can use VPC endpoints (e.g., AWS PrivateLink) to reach Systems Manager without internet access. Option B is incorrect: although an out-of-date SSM Agent can cause issues, the agent auto-updates by default, and the most common cause for patch failures is missing IAM permissions, not an outdated agent. Option D is incorrect because Amazon Linux 2 is a fully supported operating system for Patch Manager.

Answer

The instances do not have internet access to reach the Systems Manager endpoint.

Answer

The SSM Agent is out of date and needs to be updated.

Answer

The instances are not running a supported operating system.