DOP-C02 Configuration Management and IaC Practice Test 8 — 15 Questions

Question 1

A company wants to implement a configuration management strategy for their EC2 instances that are part of an Auto Scaling group. They need to ensure that new instances are automatically configured with the latest software packages and settings without manual intervention. Which TWO approaches meet these requirements? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CodeDeploy with an Auto Scaling lifecycle hook to deploy applications to new instances.. Options B and C are correct. Option B uses AWS CodeDeploy with an Auto Scaling lifecycle hook to automatically deploy applications to new instances as they launch. Option C uses EC2 user data scripts to install software and apply configurations during instance launch. Option A is incorrect because AWS OpsWorks is a configuration management service, but it does not automatically integrate with Auto Scaling groups without additional configuration; it is not the simplest automated approach. Option D is incorrect because AWS Config is used for compliance and auditing, not for proactively configuring instances. Option E is incorrect because AWS Systems Manager Run Command requires manual or scheduled execution and does not automatically run on instance launch.

Answer

Use AWS OpsWorks to manage configurations and associate with the Auto Scaling group.

Answer

Use AWS Config rules to enforce configuration settings.

Answer

Use AWS Systems Manager Run Command on a schedule to apply configurations.

Question 2

A DevOps team uses AWS CloudFormation to deploy a web application stack. The stack includes an EC2 instance, an RDS database, and an Application Load Balancer. After a successful deployment, they notice that the database security group does not allow inbound traffic from the instance security group. The team wants to enforce that the database security group always allows traffic only from the instance security group, even if the stack is updated. Which TWO methods should the team use? (Choose TWO.)

Accepted Answer

Use Fn::GetAtt or Ref to reference the instance security group in the database security group rule.. Options B and D are correct. Option B uses Fn::GetAtt or Ref to dynamically reference the instance security group in the database security group rule, ensuring proper traffic flow even after updates. Option D uses a CloudFormation parameter to pass the instance security group ID, which allows the database security group rule to always refer to the correct group. Option A is incorrect because hardcoding CIDRs is not dynamic and would fail if the instance security group changes. Option C is incorrect because AWS CloudTrail monitors API calls but does not enforce security group rules. Option E is incorrect because creating a rule outside CloudFormation means it is not managed by the template and could be inconsistent.

Answer

Hardcode the instance security group CIDR in the database security group ingress rule.

Answer

Use AWS CloudTrail to monitor and alert on security group changes.

Answer

Create a separate security group rule outside of CloudFormation using the AWS CLI.

Question 3

An organization uses AWS Elastic Beanstalk to manage a production web application. The application uses a custom AMI that needs to be updated periodically. The team wants to automate the process of updating the AMI and deploying it to the environment with zero downtime. Which THREE steps should the team include in the automation? (Choose THREE.)

Accepted Answer

Build a new AMI using a tool like Packer and store it in EC2 Image Builder.. To automate AMI updates with zero downtime, the team should: (1) Build a new AMI using a tool like Packer and store it in EC2 Image Builder for versioning (Option B). (2) Update the Elastic Beanstalk environment configuration to reference the new AMI ID (Option D). (3) Use Elastic Beanstalk's immutable update policy, which creates new instances with the new AMI and then swaps them with old instances, ensuring zero downtime (Option C). Options A and E are incorrect because deleting/recreating the environment or terminating instances without a controlled deployment strategy would cause downtime. Immutable updates provide a safer mechanism.

Answer

Delete the environment and recreate it with the new AMI.

Answer

Terminate all existing instances and allow Auto Scaling to launch new ones with the new AMI.

Question 4

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance in us-east-1. What will happen?

Accepted Answer

The action is allowed because StopInstances is explicitly allowed and not denied.. The policy explicitly allows ec2:StopInstances for all resources, and there is no explicit deny for StopInstances. The Deny only applies to TerminateInstances. Option A is incorrect because StopInstances is allowed. Option B is incorrect because the Deny is not ambiguous. Option C is incorrect because there is no condition key about instance state.

Answer

The action is denied because the policy does not explicitly allow stopping an instance that is running.

Answer

The action is denied because the Deny statement is ambiguous and could apply to StopInstances.

Answer

The action is allowed only if the instance is in a stopped state.

Question 5

A company runs a production e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) distributing traffic across EC2 instances in an Auto Scaling group. The application uses a custom configuration stored in an S3 bucket. The DevOps team uses AWS CodeDeploy to deploy application updates. Recently, a deployment failed because new instances launched by the Auto Scaling group did not have the latest configuration from S3. The team had manually updated the configuration in S3 but the deployment did not pull the new version. The team wants to ensure that all instances always have the latest configuration at launch. Current setup: The Auto Scaling group uses a launch template that specifies an IAM instance profile with permissions to read from S3. The user data script runs at launch to download configuration from S3. However, the user data script is static and does not account for configuration updates. The team wants a solution that automatically applies configuration changes to both existing and new instances without manual intervention.

Accepted Answer

Use AWS Systems Manager State Manager to associate a document that runs on all instances to fetch the latest configuration from S3 on a schedule and at instance startup.. AWS Systems Manager State Manager can enforce desired configuration on instances, pulling the latest config from S3 on a schedule and at instance startup, covering both existing and new instances. Option A is incorrect because AWS Config is for compliance monitoring, not for pushing configuration updates. Option B is incorrect because updating the launch template's user data only affects new instances launched after the change, not existing instances. Option C is incorrect because CodeDeploy is designed for application deployments and does not automatically trigger at instance launch without additional lifecycle hooks.

Answer

Use AWS Config with a custom rule to detect instances that do not have the latest configuration and trigger a Lambda function to update them.

Answer

Update the launch template with a new user data script that always fetches the latest configuration from S3. Then, update the Auto Scaling group to use the new launch template version.

Answer

Configure AWS CodeDeploy to deploy the configuration to all instances whenever the S3 object is updated, using an S3 event notification.

Question 6

A financial services company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Amazon RDS for PostgreSQL database. The database master password is stored in AWS Secrets Manager, and the CloudFormation template uses a dynamic reference to retrieve it during stack creation. The team recently rotated the database password in Secrets Manager. When they attempt to update the stack to change other parameters, the update fails with the error: 'Value of property MasterUserPassword must be a string.' The team is using the following template snippet for the password: 'MasterUserPassword': '{{resolve:secretsmanager:MySecret:SecretString:password}}'. The stack was originally created with AWS CloudFormation. What is the most likely cause of the failure?

Accepted Answer

Dynamic references in CloudFormation are only resolved at stack creation, not during updates. The team must use a different method to reference the rotated password.. Dynamic references in CloudFormation are resolved only at stack creation, not during updates. When the secret is rotated, the stack update does not re-evaluate the dynamic reference, causing the password to be invalid and resulting in the error. Option A is incorrect because the error is not due to rotation before creation but due to the update not re-resolving the reference. Option B is incorrect because the template syntax is correct. Option D is incorrect because the region of the secret is not relevant to this error.

Answer

The secret was rotated before the stack was created, causing a mismatch.

Answer

The template syntax is incorrect; it should use '{{resolve:secretsmanager:MySecret:SecretString:password}}' with different quotes.

Answer

The secret is in a different region than the stack.

Question 7

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create an EC2 instance with a custom AMI. The error message indicates that the AMI ID does not exist. The engineer is using a mapping in the template to select the AMI based on the region. However, the stack is being created in a region not covered by the mapping. What is the most efficient way to resolve this issue?

Accepted Answer

Retrieve the AMI ID dynamically using AWS Systems Manager Parameter Store and a dynamic reference in the template.. The most efficient way is to use AWS Systems Manager Parameter Store with a dynamic reference in the CloudFormation template. This allows the AMI ID to be resolved at deployment time based on the region, without hardcoding or maintaining mappings. Option B (creating a new mapping) is less efficient because it requires manual updates for each region. Option C (Run Command) is not designed for parameter retrieval. Option D (hardcoding) is not scalable and error-prone.

Answer

Create a new mapping entry for the region by updating the template.

Answer

Use AWS Systems Manager Run Command to find the correct AMI ID.

Answer

Hardcode the AMI ID in the template for the missing region.

Question 8

A DevOps team is using this IAM policy to allow a CI/CD pipeline to launch EC2 instances and retrieve parameters. However, the pipeline is failing with an 'AccessDenied' error when trying to create an instance. The pipeline uses a role with this policy attached. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on additional resources required for RunInstances, such as images and network interfaces.. The IAM policy likely only grants permissions on the 'ec2:RunInstances' action for the EC2 instance resource (arn:aws:ec2:region:account:instance/*), but creating an EC2 instance also requires permissions on other resources such as Amazon Machine Images (AMI), security groups, network interfaces, subnets, etc. Without explicit permissions on these additional resources, the RunInstances call fails with AccessDenied. Option A is incorrect because the condition syntax does not cause an AccessDenied; it would simply not match if poorly formatted. Option B is incorrect because the ssm:GetParameter action is allowed by the policy if it includes a resource specification, but the failure is on RunInstances, not SSM. Option D is incorrect because DescribeInstances does not require a Resource specification in the policy; the policy syntax is valid.

Answer

The condition StringEquals on InstanceType is incorrectly formatted.

Answer

The pipeline does not have permission to call ssm:GetParameter because the resource is not specified.

Answer

The policy must include a 'Resource' for the 'ec2:DescribeInstances' action to be valid.

Question 9

A company uses AWS OpsWorks for configuration management. They want to ensure that whenever a new instance is added to a layer, it automatically installs the latest security patches and joins a central logging system. What is the most efficient way to achieve this?

Accepted Answer

Use Chef recipes in a custom OpsWorks layer's Setup lifecycle event.. Chef recipes in an OpsWorks layer's Setup lifecycle event run automatically on every new instance added to the layer, ensuring patching and log configuration are applied consistently. Option A is wrong because a cron job runs on a schedule rather than immediately upon instance launch, and it requires managing the cron job separately on each instance, making it less efficient. Option C is wrong because user data scripts only execute during initial launch and do not run when an instance is stopped and started again, nor are they integrated with OpsWorks lifecycle events. Option D is wrong because manual SSH is not automated or scalable.

Answer

Schedule a cron job on each instance to check and apply patches daily.

Answer

Configure user data scripts in the launch configuration.

Answer

SSH into each instance and run the commands manually.

Question 10

An organization uses AWS Elastic Beanstalk for deploying a web application. They have a custom platform extension that modifies the nginx configuration. After a recent deployment, the custom configuration is not applied. The environment logs show that the platform extension script ran successfully. What should the engineer check first?

Accepted Answer

Check if the nginx configuration file is being overwritten by later deployment phases.. After the custom platform extension runs, later deployment phases (such as application deployment) may overwrite the nginx configuration file, causing the custom configuration to be lost. Option A is incorrect because the issue is with the platform extension, not the application source code. Option B is incorrect because the script ran successfully, indicating it had execute permissions. Option D could be a cause, but the most common and first check should be if the config is overwritten.

Answer

Review the application source code for errors.

Answer

Ensure the script has execute permissions.

Answer

Verify that the platform extension is in the correct folder.

Question 11

A company uses CloudFormation to manage infrastructure. They have a nested stack that creates an Amazon RDS instance. When updating the parent stack, the RDS instance is unexpectedly replaced even though no changes were made to its properties. The engineer suspects a 'Drift' detection issue. What is the most likely reason for the replacement?

Accepted Answer

The logical ID of the RDS resource was changed in the nested stack template.. If the logical ID of a resource in the nested stack template is changed, CloudFormation treats it as a new resource and replaces the old one. Option A is incorrect because drift detection does not cause replacement; it only detects changes. Option B is incorrect because a 'Retain' deletion policy prevents deletion but does not prevent replacement. Option D is incorrect because a stack policy may prevent updates but would not cause replacement; it would either allow or block the update.

Answer

The RDS instance has drifted from the template definition.

Answer

The deletion policy is set to 'Retain'.

Answer

The stack policy prevents updates to the RDS instance.

Question 12

A DevOps engineer is designing a Git-based workflow for Infrastructure as Code using AWS CodeCommit and CodePipeline. The pipeline should deploy infrastructure changes to a test environment automatically when a pull request is merged to the 'main' branch. What is the minimal set of resources required?

Accepted Answer

CodeCommit, CodePipeline, CodeBuild, CloudFormation.. CodeCommit, CodePipeline, CodeBuild, CloudFormation. CodeCommit provides the Git repository for storing IaC templates. CodePipeline automates the continuous delivery pipeline triggered by pull request merges to the 'main' branch. CodeBuild is used to validate templates, run linting, or execute custom scripts before deployment. CloudFormation deploys the infrastructure changes to the test environment. Option A is incorrect because CodeDeploy is for application deployment, not infrastructure. Option B is incorrect because it lacks a build stage (CodeBuild) for validation. Option C is incorrect because it omits CodePipeline, which is essential for automated orchestration and trigger on merge.

Answer

CodeCommit, CodePipeline, CodeDeploy.

Answer

CodeCommit, CodePipeline, CloudFormation.

Answer

CodeCommit, CloudFormation, IAM.

Question 13

A company uses Ansible for configuration management on EC2 instances. They want to ensure that only instances with a specific tag (Environment: Production) are targeted by their playbooks. What is the best way to achieve this?

Accepted Answer

Use the AWS EC2 dynamic inventory plugin to filter instances based on tags.. The best approach because the AWS EC2 dynamic inventory plugin allows filtering instances by tags (e.g., 'Environment: Production') at runtime, ensuring only tagged instances are targeted. Option A (adding a 'when' condition) is less efficient as it connects to all instances first. Option B (static inventory) requires manual updates and is not dynamic. Option D (ec2_tag module) is for assigning tags, not selecting instances.

Answer

Add a 'when' condition in the playbook to check the instance tag at runtime.

Answer

Maintain a static inventory file listing only Production instances.

Answer

Use the ec2_tag module to assign the tag to instances.

Question 14

A team uses Terraform to manage AWS infrastructure. After a recent update, a state file shows that a security group rule was created, but the rule does not exist in AWS. Running 'terraform plan' shows no changes. What is the most likely cause?

Accepted Answer

The 'terraform refresh' command was not run before the plan.. If a security group rule was deleted manually from AWS (e.g., via console or CLI), the state file still contains the resource. Without running 'terraform refresh', Terraform does not detect the deletion and assumes the state is accurate. Thus, 'terraform plan' shows no changes because it compares the current state (which still includes the rule) with the configuration (which likely does define it, otherwise plan would show a destroy). If 'terraform refresh' had been run, the state would be updated to remove the rule, and then plan would show a creation. Option A is incorrect because if the rule were imported into state but not defined in configuration, plan would show a destroy. Option C is incorrect because workspace conflicts typically cause state isolation issues, not missing resources. Option D is incorrect because adding a rule manually would create it, not cause it to be missing; the scenario states the rule does not exist in AWS.

Answer

The security group rule was imported into state but not defined in configuration.

Answer

There is a conflict between multiple Terraform workspaces.

Answer

The security group rule was added manually via the AWS console and is not managed by Terraform, causing state to be out of sync.

Question 15

A company is designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline. They want to use infrastructure as code to manage the pipeline itself. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. (AWS CodePipeline) is the CI/CD service being used to define and manage the pipeline itself. Option C (AWS CloudFormation) allows you to define CodePipeline resources as infrastructure as code, enabling version control and automated provisioning. Option A (AWS Service Catalog) is for creating and managing IT service catalogs, not for pipeline definition. Option D (AWS CodeDeploy) is a deployment service, not for defining pipelines. Option E (AWS Elastic Beanstalk) is a platform-as-a-service for deploying applications, not for pipeline infrastructure as code.

Answer

AWS Service Catalog

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk