DOP-C02 Configuration Management and IaC Practice Test 8 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage a production environment with multiple stacks. The DevOps team needs to implement a change management process that requires approval for any changes to the production stack. Which approaches meet this requirement? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require that all stack updates be performed through a change set that is reviewed and executed by a separate role.. Option B is correct because CloudFormation change sets let you preview exactly what modifications an update will make to the production stack, and gating the actual execution behind a separate role enforces a review-and-approve step before any changes are applied. Option C is correct because AWS CodePipeline supports a manual approval action that pauses the pipeline, allowing a designated approver to review the change set before the pipeline proceeds to execute it against the production stack. Option A is not correct because read-only versus write IAM policies only control who can modify stacks; they do not build a review/approval workflow into the change process. Option D is not correct because AWS Config rules detect and can remediate noncompliant resources after the fact, but they do not provide a pre-change approval gate for CloudFormation stack updates. Option E is not correct because an SCP restricting CloudFormation actions to a CI/CD role limits who can make changes but does not itself require human review or approval of those changes.

Answer

Create an IAM policy that allows only read-only access to the production stack and a separate role with write access.

Answer

Use AWS Config rules to detect unapproved changes and automatically revert them.

Answer

Use an SCP to deny all CloudFormation actions except from a specific CI/CD role.

Question 2

A company is using AWS Elastic Beanstalk with a custom platform. The DevOps team wants to automate the creation of a new platform version whenever changes are pushed to a Git repository. The pipeline should run tests, build the platform, and then update the Elastic Beanstalk environment to use the new platform version. Which services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can run the tests and build the custom platform artifact. In this scenario, CodeBuild executes the buildspec to compile code, run unit tests, and produce the platform version (e.g., an AMI or Packer image). It integrates directly with CodePipeline to receive source changes and pass artifacts downstream for environment updates.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 3

A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?

Accepted Answer

The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.. The CloudFormation template does not include a `SecurityGroup` or `SecurityGroupIds` property in the EC2 instance's `AWS::EC2::Instance` resource. Without this explicit reference, the instance launches with the default VPC security group, not the custom security group defined in the template. The security group resource is created successfully, but it is not attached to the instance.

Answer

The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.

Answer

The security group is created after the instance, so the instance cannot reference it.

Answer

The DependsOn clause should be removed because it causes a circular dependency.

Question 4

A company uses AWS CloudFormation to manage a production environment with multiple stacks. The DevOps team needs to implement a change management process that requires approval for any changes to the production stack. Which approaches meet this requirement? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeletionPolicy attribute with Retain. The DeletionPolicy attribute with the Retain value is the correct choice because it explicitly instructs CloudFormation to preserve the physical resource (e.g., an RDS database) when its corresponding logical resource is deleted from the stack template during an update or when the entire stack is deleted. This prevents accidental deletion of critical stateful resources by ensuring the resource remains in the AWS account even after the stack operation completes.

Answer

Stack policy

Answer

Termination protection

Answer

DependsOn attribute

Question 5

A company uses AWS OpsWorks for configuration management. The DevOps team wants to automate the patching of operating system updates on a set of EC2 instances managed by OpsWorks. Which OpsWorks feature should be used?

Accepted Answer

Weekly Auto Update. AWS OpsWorks Stacks provides a built-in 'Weekly Auto Update' feature that automatically installs operating system updates on managed EC2 instances. This feature is specifically designed to automate OS patching without requiring custom recipes or manual intervention, making it the correct choice for the DevOps team's requirement.

Answer

Auto Scaling

Answer

Chef Automate

Answer

Lifecycle events (Setup, Configure, Deploy, etc.)

Question 6

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an EC2 instance with a UserData script that installs software. The stack creation fails with the error: 'The following resource(s) failed: EC2Instance (AWS::EC2::Instance) – Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack creation timed out or was manually cancelled. The error message 'Resource creation cancelled' indicates that the CloudFormation stack creation was either timed out or manually cancelled, not that the EC2 instance itself failed. CloudFormation has a default timeout of 60 minutes for stack creation, and if the UserData script takes longer than this or the user manually cancels the operation, CloudFormation will mark the resource as cancelled. This is distinct from a resource-specific failure like an invalid instance type or IAM permissions issue, which would produce a different error message such as 'Resource failed to stabilize' or 'API error'.

Answer

The EC2 instance type is not supported in the region

Answer

The IAM role attached to the instance lacks permissions

Answer

The UserData script failed due to a syntax error

Question 7

A company uses AWS Elastic Beanstalk to deploy web applications. The DevOps team wants to implement a blue/green deployment strategy to minimize downtime. Which Elastic Beanstalk feature should be used?

Accepted Answer

Environment URL swap. Elastic Beanstalk's environment URL swap feature enables blue/green deployment by routing traffic from the current (blue) environment to a new (green) environment via a simple DNS swap. This swap is instantaneous at the DNS level, resulting in zero downtime for users, as the green environment is fully tested before the swap occurs.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 8

A DevOps engineer is designing a configuration management solution for a fleet of EC2 instances. The instances are ephemeral and frequently replaced by an Auto Scaling group. The engineer needs to ensure that newly launched instances are automatically configured with the latest software packages and settings. Which AWS service should be used?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it provides a configuration management solution that ensures EC2 instances maintain a desired state. It uses associations to define the software packages, settings, and policies that should be applied to instances, and it automatically applies these configurations to newly launched instances, including those in an Auto Scaling group, without requiring custom scripts or manual intervention.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks Stacks

Answer

AWS CloudFormation

Question 9

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a parameter for the instance type of EC2 instances. The DevOps team wants to restrict the allowed values to a specific set of instance types. Which CloudFormation section should be used?

Accepted Answer

Parameters with AllowedValues. The Parameters section in AWS CloudFormation allows you to define input values that can be supplied at stack creation or update time. By specifying an AllowedValues constraint on a parameter, you restrict the user to select only from a predefined list of instance types, which enforces compliance and prevents misconfiguration. This is the correct mechanism for limiting instance type choices in a CloudFormation template.

Answer

Outputs

Answer

Conditions

Answer

Mappings

Question 10

A DevOps engineer needs to manage the configuration of a large number of EC2 instances that are part of a cluster. The instances should have consistent software packages, services, and settings. The engineer wants to use a configuration management tool that integrates with AWS and supports a push-based model. Which service should be used?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct choice because it provides a push-based configuration management model that allows you to remotely and securely execute commands or scripts across a large fleet of EC2 instances without needing SSH access. It integrates natively with AWS, supports consistent software package installation and service management via SSM documents, and is ideal for maintaining configuration consistency in a cluster.

Answer

AWS OpsWorks Stacks

Answer

AWS CodeCommit

Answer

AWS CloudFormation

Question 11

A company uses AWS CloudFormation to manage a production environment with multiple stacks. The DevOps team needs to implement a change management process that requires approval for any changes to the production stack. Which approaches meet this requirement? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The LaunchTemplate version specified in the template was deleted. The error 'Launch template version does not exist' occurs when the CloudFormation template references a specific launch template version number that has been deleted. Launch template versions are immutable but can be deleted, and if the stack template or parameter references a deleted version, the stack update fails.

Answer

The LaunchTemplate was recently modified and the new version is not yet available

Answer

The target group attachment is incorrect

Answer

The Auto Scaling group is using a different launch template

Question 12

A DevOps engineer is using AWS CloudFormation to deploy a stack that includes a VPC with public and private subnets. The engineer wants to ensure that the public subnets automatically get a public IP address assigned to instances launched in them. Which property should be set?

Accepted Answer

MapPublicIpOnLaunch on the subnet. The `MapPublicIpOnLaunch` property on an AWS CloudFormation `AWS::EC2::Subnet` resource controls whether instances launched in that subnet automatically receive a public IP address. Setting this property to `true` ensures that any EC2 instance launched in the public subnet gets a public IPv4 address from the subnet's CIDR range, which is essential for internet-facing resources in a VPC.

Answer

EnableDnsSupport on the VPC

Answer

EnableDnsHostnames on the VPC

Answer

AssociatePublicIpAddress on the instance

Question 13

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to implement a change management process where all stack updates must be reviewed before execution. Which AWS feature should be used?

Accepted Answer

Change Sets. Change Sets allow you to preview how proposed changes to a CloudFormation stack will impact your running resources before you execute them. This enables a review-and-approval workflow, making it the correct choice for implementing a change management process where all stack updates must be reviewed before execution.

Answer

Drift detection

Answer

StackSets

Answer

Stack policies

Question 14

A company uses AWS CloudFormation to deploy infrastructure across multiple accounts. They want to reuse a set of resource definitions for a standard VPC configuration. Which approach minimizes duplication and maintains centralized control?

Accepted Answer

Create a CloudFormation module for the VPC resources and reference it in each stack.. CloudFormation modules allow you to encapsulate a set of resource definitions into a reusable component that can be referenced across multiple stacks. This approach minimizes duplication because the module is defined once in a central registry (e.g., the CloudFormation public or private module registry) and each stack simply includes a `Module` declaration. It also maintains centralized control because updates to the module are automatically propagated to all stacks that reference it, without requiring manual template copying or stack updates.

Answer

Define the VPC resources in a CloudFormation macro and call the macro from each stack.

Answer

Publish the VPC template in AWS Service Catalog and have each account provision from it.

Answer

Use nested stacks by creating a separate template for the VPC and including it in each account's stack.

Question 15

A DevOps team uses AWS CodePipeline to deploy a web application. They notice that the deployment stage fails intermittently due to a missing configuration file. Which troubleshooting step should they take first?

Accepted Answer

Review the build logs in AWS CodeBuild to identify the error.. The deployment stage fails intermittently due to a missing configuration file. The first troubleshooting step should be to review the build logs in AWS CodeBuild, because CodeBuild generates detailed logs that capture the exact error message, including file paths and missing configuration details. This allows the team to pinpoint the root cause without making unnecessary changes to the pipeline or deployment group settings.

Answer

Switch to AWS CodeBuild for the deployment stage.

Answer

Recreate the pipeline with the same configuration to see if the issue repeats.

Answer

Verify the deployment group settings in AWS CodeDeploy.