DOP-C02 Configuration Management and IaC Practice Test 9 — 15 Questions

Question 1

A company runs a production e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) distributing traffic across EC2 instances in an Auto Scaling group. The application uses a custom configuration stored in an S3 bucket. The DevOps team uses AWS CodeDeploy to deploy application updates. Recently, a deployment failed because new instances launched by the Auto Scaling group did not have the latest configuration from S3. The team had manually updated the configuration in S3 but the deployment did not pull the new version. The team wants to ensure that all instances always have the latest configuration at launch. Current setup: The Auto Scaling group uses a launch template that specifies an IAM instance profile with permissions to read from S3. The user data script runs at launch to download configuration from S3. However, the user data script is static and does not account for configuration updates. The team wants a solution that automatically applies configuration changes to both existing and new instances without manual intervention.

Accepted Answer

Use AWS Systems Manager State Manager to associate a document that runs on all instances to fetch the latest configuration from S3 on a schedule and at instance startup.. Option B is correct because AWS Systems Manager State Manager can enforce configuration on instances, pull the latest config from S3, and apply it to both existing and new instances. Option A is incorrect because updating the user data script in the launch template only affects new instances, not existing ones. Option C is incorrect because CodeDeploy does not run at instance launch unless triggered by a lifecycle hook, and it requires additional setup. Option D is incorrect because AWS Config is for compliance, not for pushing configurations.

Answer

Use AWS Config with a custom rule to detect instances that do not have the latest configuration and trigger a Lambda function to update them.

Answer

Update the launch template with a new user data script that always fetches the latest configuration from S3. Then, update the Auto Scaling group to use the new launch template version.

Answer

Configure AWS CodeDeploy to deploy the configuration to all instances whenever the S3 object is updated, using an S3 event notification.

Question 2

A financial services company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Amazon RDS for PostgreSQL database. The database master password is stored in AWS Secrets Manager, and the CloudFormation template uses a dynamic reference to retrieve it during stack creation. The team recently rotated the database password in Secrets Manager. When they attempt to update the stack to change other parameters, the update fails with the error: 'Value of property MasterUserPassword must be a string.' The team is using the following template snippet for the password: 'MasterUserPassword': '{{resolve:secretsmanager:MySecret:SecretString:password}}'. The stack was originally created with AWS CloudFormation. What is the most likely cause of the failure?

Accepted Answer

Dynamic references in CloudFormation are only resolved at stack creation, not during updates. The team must use a different method to reference the rotated password.. Option A is correct because dynamic references are only resolved during stack creation and not during updates. To update the password, the team must use a different approach. Option B is incorrect because Secrets Manager rotation does not invalidate the secret immediately. Option C is incorrect because the template syntax is correct. Option D is incorrect because Secrets Manager is not region-bound in this context.

Answer

The secret was rotated before the stack was created, causing a mismatch.

Answer

The template syntax is incorrect; it should use '{{resolve:secretsmanager:MySecret:SecretString:password}}' with different quotes.

Answer

The secret is in a different region than the stack.

Question 3

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create an EC2 instance with a custom AMI. The error message indicates that the AMI ID does not exist. The engineer is using a mapping in the template to select the AMI based on the region. However, the stack is being created in a region not covered by the mapping. What is the most efficient way to resolve this issue?

Accepted Answer

Retrieve the AMI ID dynamically using AWS Systems Manager Parameter Store and a dynamic reference in the template.. Option D is correct because AWS Systems Manager Parameter Store can be used to store AMI IDs per region dynamically, eliminating the need to update mappings. Option A is wrong because it doesn't guarantee correct AMI for the region. Option B is wrong because SSM Run Command is not for parameter retrieval. Option C is wrong because it is less dynamic and harder to maintain.

Answer

Create a new mapping entry for the region by updating the template.

Answer

Use AWS Systems Manager Run Command to find the correct AMI ID.

Answer

Hardcode the AMI ID in the template for the missing region.

Question 4

A DevOps team is using this IAM policy to allow a CI/CD pipeline to launch EC2 instances and retrieve parameters. However, the pipeline is failing with an 'AccessDenied' error when trying to create an instance. The pipeline uses a role with this policy attached. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on additional resources required for RunInstances, such as images and network interfaces.. Option A is correct because the policy only allows RunInstances for instance resource, but creating an instance also requires permissions on other resources like images, security groups, etc. Option B is wrong because the condition is on instance type, not on resource level. Option C is wrong because ssm:GetParameter is allowed. Option D is wrong because the policy is valid syntax.

Answer

The condition StringEquals on InstanceType is incorrectly formatted.

Answer

The pipeline does not have permission to call ssm:GetParameter because the resource is not specified.

Answer

The policy must include a 'Resource' for the 'ec2:DescribeInstances' action to be valid.

Question 5

A company uses AWS OpsWorks for configuration management. They want to ensure that whenever a new instance is added to a layer, it automatically installs the latest security patches and joins a central logging system. What is the most efficient way to achieve this?

Accepted Answer

Use Chef recipes in a custom OpsWorks layer's Setup lifecycle event.. Option B is correct because Chef recipes in OpsWorks lifecycle events (Setup) run on new instances. Option A is wrong because user data runs only at launch and may not run again if instance is stopped/started. Option C is wrong because it requires manual intervention. Option D is wrong because it is not real-time.

Answer

Schedule a cron job on each instance to check and apply patches daily.

Answer

Configure user data scripts in the launch configuration.

Answer

SSH into each instance and run the commands manually.

Question 6

An organization uses AWS Elastic Beanstalk for deploying a web application. They have a custom platform extension that modifies the nginx configuration. After a recent deployment, the custom configuration is not applied. The environment logs show that the platform extension script ran successfully. What should the engineer check first?

Accepted Answer

Check if the nginx configuration file is being overwritten by later deployment phases.. Option A is correct because if the file is overwritten after the script runs, the changes are lost. Option B is wrong because the script ran successfully. Option C is wrong because the script ran. Option D is wrong because it is less likely the first check.

Answer

Review the application source code for errors.

Answer

Ensure the script has execute permissions.

Answer

Verify that the platform extension is in the correct folder.

Question 7

A company uses CloudFormation to manage infrastructure. They have a nested stack that creates an Amazon RDS instance. When updating the parent stack, the RDS instance is unexpectedly replaced even though no changes were made to its properties. The engineer suspects a 'Drift' detection issue. What is the most likely reason for the replacement?

Accepted Answer

The logical ID of the RDS resource was changed in the nested stack template.. Option D is correct because if the logical ID in the template changes, CloudFormation treats it as a new resource and replaces the old one. Option A is wrong because replacement may occur without drift. Option B is wrong because stack policy doesn't always prevent replacement. Option C is wrong because deletion policy doesn't cause replacement.

Answer

The RDS instance has drifted from the template definition.

Answer

The deletion policy is set to 'Retain'.

Answer

The stack policy prevents updates to the RDS instance.

Question 8

A DevOps engineer is designing a Git-based workflow for Infrastructure as Code using AWS CodeCommit and CodePipeline. The pipeline should deploy infrastructure changes to a test environment automatically when a pull request is merged to the 'main' branch. What is the minimal set of resources required?

Accepted Answer

CodeCommit, CodePipeline, CodeBuild, CloudFormation.. Option C is correct because CodeCommit triggers on pull request merge, CodeBuild runs the deployment, and CloudFormation executes the stack. Option A is wrong because CodeDeploy is for application deployment, not infrastructure. Option B is wrong because it lacks a build step. Option D is wrong because it lacks automation.

Answer

CodeCommit, CodePipeline, CodeDeploy.

Answer

CodeCommit, CodePipeline, CloudFormation.

Answer

CodeCommit, CloudFormation, IAM.

Question 9

A company uses Ansible for configuration management on EC2 instances. They want to ensure that only instances with a specific tag (Environment: Production) are targeted by their playbooks. What is the best way to achieve this?

Accepted Answer

Use the AWS EC2 dynamic inventory plugin to filter instances based on tags.. Option B is correct because Ansible dynamic inventory with AWS EC2 plugin can filter by tags. Option A is wrong because it assigns tags to instances, not select them. Option C is wrong because it is less dynamic. Option D is wrong because it modifies the playbook to check tags after connecting, which is inefficient.

Answer

Add a 'when' condition in the playbook to check the instance tag at runtime.

Answer

Maintain a static inventory file listing only Production instances.

Answer

Use the ec2_tag module to assign the tag to instances.

Question 10

A team uses Terraform to manage AWS infrastructure. After a recent update, a state file shows that a security group rule was created, but the rule does not exist in AWS. Running 'terraform plan' shows no changes. What is the most likely cause?

Accepted Answer

The security group rule was added manually via the AWS console and is not managed by Terraform, causing state to be out of sync.. Option A is correct because if the rule was created outside Terraform, the state file may be out of sync, and Terraform detects no drift if the rule is not managed. Option B is wrong because 'terraform refresh' would update state, but plan shows no changes. Option C is wrong because if import is needed, plan would show changes. Option D is wrong because it would cause errors, not missing rules.

Answer

The security group rule was imported into state but not defined in configuration.

Answer

The 'terraform refresh' command was not run before the plan.

Answer

There is a conflict between multiple Terraform workspaces.

Question 11

A company is designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline. They want to use infrastructure as code to manage the pipeline itself. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. Option A (CloudFormation) and Option D (CodePipeline) are correct because CloudFormation can define the pipeline resource, and CodePipeline is the service being defined. Option B (CodeDeploy) is for deployment, not pipeline definition. Option C (Elastic Beanstalk) is for application deployment. Option E (Service Catalog) is for product portfolios.

Answer

AWS Service Catalog

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 12

A DevOps engineer is troubleshooting a CloudFormation stack that creates an Auto Scaling group with a launch configuration. The stack creation fails with the error 'Resource handler returned message: "Invalid IAM Instance Profile name" (Service: AutoScaling, Status Code: 400)'. Which TWO are possible causes?

Accepted Answer

The IAM instance profile has not been created yet.. Option A (IAM instance profile does not exist) and Option C (Instance profile name misspelled) are correct. Option B is wrong because insufficient IAM permissions would cause AccessDenied, not Invalid name. Option D is wrong because instance profile can be in same or different account? But cross-account would need ARN. Option E is wrong because it would cause a different error.

Answer

The launch configuration references a deleted instance profile.

Answer

The instance profile is in a different AWS account.

Answer

The IAM role associated with the instance profile does not have sufficient permissions.

Question 13

A company uses AWS Systems Manager to manage patching of EC2 instances. They want to ensure that instances in a specific Auto Scaling group are patched before being allowed to serve traffic. Which THREE steps should be part of the solution?

Accepted Answer

Create a new launch configuration with the patched AMI.. Options A, B, and E are correct. Option A ensures instances are patched before use. Option B creates new instances. Option E updates the Auto Scaling group to use the new launch configuration. Option C (CodeDeploy) is not needed for patching. Option D (CloudWatch Events) is optional and not required.

Answer

Deploy the patched version using AWS CodeDeploy.

Answer

Configure Amazon CloudWatch Events to trigger a Lambda function after patching.

Question 14

A DevOps engineer runs these commands to investigate a failed CloudFormation stack creation. The stack status is ROLLBACK_COMPLETE and the most recent event shows CREATE_FAILED. What should the engineer do next to identify the root cause?

Accepted Answer

Run describe-stack-events with a filter to see the ResourceStatusReason for the CREATE_FAILED event.. Option A is correct because the stack events will show the failure reason in the ResourceStatusReason field. Option B is wrong because the stack has already rolled back. Option C is wrong because describe-stacks does not show failure reasons. Option D is wrong because the stack is already rolled back.

Answer

Run update-stack to recreate the stack and examine the error.

Answer

Run describe-stacks with additional query to get the StackStatusReason.

Answer

Run delete-stack and recreate with debugging enabled.

Question 15

A company uses Terraform to manage a multi-account AWS environment. The Terraform state files are stored in an S3 bucket with DynamoDB locking. Recently, a DevOps engineer ran 'terraform apply' from a CI/CD pipeline, and it failed with the error: 'Error acquiring the state lock. Lock ID: "abc123". Possible causes: Another process has the lock; or a previous process crashed.' The engineer checks DynamoDB and sees that the lock item exists but there is no active Terraform process. The engineer needs to proceed with the deployment urgently. What should the engineer do?

Accepted Answer

Use the 'terraform force-unlock' command with the lock ID to remove the lock.. Option C is correct because force-unlock removes the lock item, allowing the pipeline to proceed. Option A is wrong because waiting may be futile if no process holds the lock. Option B is wrong because deleting the state file would cause data loss. Option D is wrong because manual editing of state is risky and unnecessary.

Answer

Wait for the lock to expire automatically.

Answer

Delete the state file from S3 and recreate it from the last backup.

Answer

Manually delete the lock item from DynamoDB using the AWS Console.