DOP-C02 Configuration Management and IaC Practice Test 8 — 15 Questions

Question 1

A DevOps engineer creates the IAM policy above for an instance role. The role is attached to an EC2 instance that runs an application. The application starts and stops EC2 instances and reads a database password from Systems Manager Parameter Store. However, the application fails to retrieve the parameter. What is the most likely cause?

Accepted Answer

The parameter is a SecureString and the policy does not grant 'kms:Decrypt' permission for the KMS key.. The policy allows 'ssm:GetParameter' and 'ssm:GetParameters' on the specific parameter ARN. However, to retrieve a parameter, the action 'ssm:GetParameter' is sufficient, but the resource ARN must be correct. The given ARN includes the parameter name '/MyApp/DBPassword'. If the application is using a different path or the parameter is encrypted, the policy might be insufficient. But the most common issue is that the parameter is a SecureString and the policy also needs 'kms:Decrypt' access to the KMS key. Option C is correct because the policy does not include KMS permissions. Option A and B are less likely. Option D is incorrect because the actions are allowed.

Answer

The policy does not allow 'ssm:GetParameterHistory'.

Answer

The policy does not allow 'ec2:DescribeParameters'.

Answer

The policy does not allow 'ssm:GetParameter' on the specific resource.

Question 2

A CloudFormation template includes the above snippet. The stack creation fails with the error 'Unable to validate the following destination configurations'. What is the most likely cause?

Accepted Answer

The account has a public access block that denies public bucket policies.. The error 'Unable to validate the following destination configurations' typically occurs when a bucket policy grants public access but the bucket's public access block settings are enabled. By default, S3 blocks public access. Option B is correct. Option A is incorrect because the bucket name is unique. Option C is incorrect because bucket policies are supported. Option D is incorrect because the template is valid YAML.

Answer

The template has a syntax error in the PolicyDocument section.

Answer

The bucket name is not globally unique.

Answer

S3 Bucket Policy is not supported for this bucket region.

Question 3

A DevOps engineer uses AWS CodeBuild to build a Java application. The build fails with an error indicating that the build environment does not have the required Java version. What is the MOST efficient way to ensure the correct Java version is installed for all future builds?

Accepted Answer

Specify a managed image in the buildspec that includes the required Java version.. Option A is correct because using an AWS CodeBuild managed image with the required Java version ensures a consistent build environment without manual installation steps. Option B is incorrect because installing Java via a command may be unreliable and increases build time. Option C is incorrect because managing a custom image requires additional maintenance. Option D is incorrect because Lambda is not used for build environments.

Answer

Use AWS Lambda to install Java on the build instance before the build starts.

Answer

Add a command in the buildspec to install the required Java version using apt-get.

Answer

Create a custom Docker image with the required Java version and reference it in the build project.

Question 4

A company uses AWS CloudFormation to manage infrastructure. After updating a stack, a resource fails to update because it requires a physical replacement. The stack update is set to 'Rollback on failure'. The engineer wants to test the effect of the change without affecting the production environment. Which approach should the engineer use?

Accepted Answer

Create a change set to review the proposed changes before executing the update.. Option D is correct because a change set allows previewing changes without applying them. Option A is incorrect because disabling rollback still applies changes. Option B is incorrect because using a different stack set requires manual synchronization. Option C is incorrect because a new stack does not compare changes against the existing stack.

Answer

Disable rollback on failure and update the stack, then manually revert if issues occur.

Answer

Create a new stack using the same template but with a different stack name.

Answer

Use a different AWS region and replicate the stack there for testing.

Question 5

A DevOps team manages a multi-account AWS environment using AWS Organizations. They need to enforce a mandatory tag (e.g., 'CostCenter') on all resources created across accounts. Which combination of services should be used to automatically remediate non-compliant resources?

Accepted Answer

AWS Config rules with automatic remediation using AWS Systems Manager Automation or Lambda.. Option B is correct because AWS Config can detect non-compliant resources and trigger a custom Lambda function to automatically add the missing tag. Option A is incorrect because SCPs only prevent certain actions but do not remediate existing resources. Option C is incorrect because CloudTrail logs events but does not remediate. Option D is incorrect because Tag Editor is a manual tool, not automated.

Answer

AWS Service Control Policies (SCPs) to deny creation of resources without the tag.

Answer

AWS CloudTrail to detect non-compliant resource creation and send notifications.

Answer

AWS Resource Groups & Tag Editor to manually add tags to non-compliant resources.

Question 6

An engineer uses AWS Elastic Beanstalk to deploy a web application. The application needs to read from an S3 bucket. The engineer has configured an instance profile with the necessary S3 permissions. However, the application returns an access denied error. What is the MOST likely cause?

Accepted Answer

The instance profile has not been assigned to the Elastic Beanstalk environment.. Option B is correct because the instance profile must be associated with the EC2 instances launched by Elastic Beanstalk. Option A is incorrect because security groups control network traffic, not S3 permissions. Option C is incorrect because environment variables are not used for IAM permissions. Option D is incorrect because a bucket policy is not needed if the instance profile grants access.

Answer

The S3 bucket policy denies access to the application.

Answer

The security group assigned to the environment does not allow outbound traffic to S3.

Answer

The S3 bucket is in a different region and the application is not configured to use the correct region.

Question 7

A company uses AWS OpsWorks for configuration management. The operations team needs to apply a configuration change to all instances in a layer without downtime. Which approach should they use?

Accepted Answer

Use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'.. Option D is correct because OpsWorks allows running custom recipes on a layer, which can be applied without recreating instances. Option A is incorrect because cloning does not apply changes. Option B is incorrect because Chef solo is not managed by OpsWorks. Option C is incorrect because Auto Scaling does not apply configuration updates.

Answer

Use an Auto Scaling lifecycle hook to apply the change during instance launch.

Answer

Clone the layer and update the clone with the new configuration, then switch traffic.

Answer

SSH into each instance and manually apply the change.

Question 8

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set with a new template version. The update fails in some accounts due to a resource conflict. What is the BEST way to resolve the conflict and complete the update?

Accepted Answer

Use the 'Skip accounts' option to temporarily exclude failing accounts, then fix and retry.. Option C is correct because StackSets allows skipping accounts or regions that fail, and the engineer can retry later. Option A is incorrect because manual deletion may cause data loss. Option B is incorrect because changing the template may not resolve the conflict. Option D is incorrect because recreating the stack set is disruptive.

Answer

Delete the stack set and recreate it with the new template.

Answer

Manually delete the conflicting resources in the failing accounts and retry the update.

Answer

Modify the CloudFormation template to ignore the conflicting resources using a condition.

Question 9

A DevOps engineer uses AWS Secrets Manager to rotate database credentials. The rotation fails because the Lambda function used for rotation does not have network access to the database. The database is in a private VPC. How should the engineer fix this?

Accepted Answer

Configure the Lambda function to be VPC-enabled and place it in the same subnet as the database.. Option A is correct because the Lambda function must be configured to run in the same VPC and subnet as the database to access it. Option B is incorrect because Secrets Manager uses Lambda for rotation, not direct access. Option C is incorrect because VPC Peering adds complexity and is unnecessary. Option D is incorrect because NAT Gateway is for outbound internet access, not inbound.

Answer

Assign a public IP address to the database and update the security group to allow access from the Lambda function.

Answer

Set up a VPC Peering connection between the Lambda service and the VPC.

Answer

Add a NAT Gateway to the VPC to allow Lambda to reach the database.

Question 10

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

Accepted Answer

The webhook in GitHub is not properly configured or has been removed.. Option B is correct because CodePipeline uses webhooks to detect changes in GitHub. If the webhook is not properly configured, changes may not trigger the pipeline. Option A is incorrect because the branch is specified. Option C is incorrect because the pipeline can access public repositories. Option D is incorrect because the pipeline does not need to be in the same region as GitHub.

Answer

The pipeline uses a different branch name.

Answer

The GitHub repository is not in the same AWS region as the pipeline.

Answer

The pipeline does not have permission to access the GitHub repository.

Question 11

An organization uses AWS System Manager Patch Manager to patch EC2 instances. The patches are not being applied to some instances. The instances are running Amazon Linux 2 and have the SSM Agent installed. What is the MOST likely reason for the failure?

Accepted Answer

The instances are missing the required IAM role for Systems Manager.. Option C is correct because instances must have an IAM role that allows SSM to manage patches. Without the role, SSM Agent cannot communicate with the service. Option A is incorrect because SSM Agent does not require internet access if using VPC endpoints. Option B is incorrect because Patch Manager supports Amazon Linux 2. Option D is incorrect because SSM Agent is not patched, it is used to apply patches.

Answer

The instances do not have internet access to reach the Systems Manager endpoint.

Answer

The SSM Agent is out of date and needs to be updated.

Answer

The instances are not running a supported operating system.

Question 12

A company wants to implement a configuration management strategy for their EC2 instances that are part of an Auto Scaling group. They need to ensure that new instances are automatically configured with the latest software packages and settings without manual intervention. Which TWO approaches meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CodeDeploy with an Auto Scaling lifecycle hook to deploy applications to new instances.. Options A and C are correct. Option A uses a bootstrapping script in the user data to install packages on launch. Option C uses AWS CodeDeploy to automatically deploy applications to new instances. Option B is incorrect because AWS Config is for compliance, not configuration management. Option D is incorrect because AWS OpsWorks is a separate service, not directly integrated with Auto Scaling groups. Option E is incorrect because Systems Manager Run Command is manual, not automatic on launch.

Answer

Use AWS OpsWorks to manage configurations and associate with the Auto Scaling group.

Answer

Use AWS Config rules to enforce configuration settings.

Answer

Use AWS Systems Manager Run Command on a schedule to apply configurations.

Question 13

A DevOps team uses AWS CloudFormation to deploy a web application stack. The stack includes an EC2 instance, an RDS database, and an Application Load Balancer. After a successful deployment, they notice that the database security group does not allow inbound traffic from the instance security group. The team wants to enforce that the database security group always allows traffic only from the instance security group, even if the stack is updated. Which TWO methods should the team use? (Choose TWO.)

Accepted Answer

Use Fn::GetAtt or Ref to reference the instance security group in the database security group rule.. Options B and D are correct. Option B uses a parameter to pass the instance security group ID into the database security group rule, ensuring dynamic referencing. Option D uses a Fn::GetAtt to retrieve the security group ID and reference it in the rule. Option A is incorrect because hardcoding IP addresses is not dynamic. Option C is incorrect because a security group rule outside the template is not managed by CloudFormation. Option E is incorrect because VPC flow logs do not enforce security group rules.

Answer

Hardcode the instance security group CIDR in the database security group ingress rule.

Answer

Use AWS CloudTrail to monitor and alert on security group changes.

Answer

Create a separate security group rule outside of CloudFormation using the AWS CLI.

Question 14

An organization uses AWS Elastic Beanstalk to manage a production web application. The application uses a custom AMI that needs to be updated periodically. The team wants to automate the process of updating the AMI and deploying it to the environment with zero downtime. Which THREE steps should the team include in the automation? (Choose THREE.)

Accepted Answer

Build a new AMI using a tool like Packer and store it in EC2 Image Builder.. Options A, C, and E are correct. Option A creates a new AMI version. Option C updates the environment configuration with a rolling update to minimize downtime. Option E uses an immutable update for zero downtime. Option B is incorrect because terminating instances without a deployment strategy causes downtime. Option D is incorrect because deleting the environment is disruptive.

Answer

Delete the environment and recreate it with the new AMI.

Answer

Terminate all existing instances and allow Auto Scaling to launch new ones with the new AMI.

Question 15

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance in us-east-1. What will happen?

Accepted Answer

The action is allowed because StopInstances is explicitly allowed and not denied.. Option D is correct because the policy explicitly allows ec2:StopInstances for all resources, and there is no explicit deny for StopInstances. The Deny only applies to TerminateInstances. Option A is incorrect because StopInstances is allowed. Option B is incorrect because the Deny is not ambiguous. Option C is incorrect because there is no condition key about instance state.

Answer

The action is denied because the policy does not explicitly allow stopping an instance that is running.

Answer

The action is denied because the Deny statement is ambiguous and could apply to StopInstances.

Answer

The action is allowed only if the instance is in a stopped state.

DOP-C02 Configuration Management and IaC Practice Test 8 — 15 Questions

Exhibit

DOP-C02 Configuration Management and IaC Practice Test 8 — 15 Questions

Exhibit