DOP-C02 Configuration Management and IaC Practice Test 9 — 15 Questions

Question 1

An organization manages multiple AWS accounts using AWS Organizations. They want to enforce that all Amazon S3 buckets across accounts have versioning enabled. Which approach is the most scalable and least error-prone?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies s3:PutBucketVersioning if versioning is not enabled.. A Service Control Policy (SCP) in AWS Organizations can deny the `s3:PutBucketVersioning` action unless versioning is already enabled, effectively preventing the creation or modification of buckets without versioning. This approach is scalable as it applies to all accounts in the organization automatically and is least error-prone because it enforces the policy at the API level, blocking non-compliant actions before they occur.

Answer

Use AWS Config rules to detect buckets without versioning and send alerts.

Answer

Deploy a CloudFormation StackSet to all accounts with a template that enables versioning.

Answer

Manually enable versioning on each bucket after creation.

Question 2

A company uses AWS Elastic Beanstalk for application deployments. They want to integrate infrastructure-as-code practices using AWS CloudFormation. Which approach allows them to manage the Elastic Beanstalk environment and underlying resources as part of a CloudFormation stack?

Accepted Answer

Define the Elastic Beanstalk environment in the CloudFormation template using the AWS::ElasticBeanstalk::Environment resource.. CloudFormation natively supports Elastic Beanstalk through the AWS::ElasticBeanstalk::Environment and AWS::ElasticBeanstalk::Application resource types. Defining the environment in the template lets CloudFormation create, update, and delete the environment and its underlying resources (EC2, ASG, ELB, security groups) as part of the stack, giving full IaC lifecycle management.

Answer

Use a custom resource backed by a Lambda function to create the Elastic Beanstalk environment.

Answer

Use the CloudFormation import feature to bring the existing Elastic Beanstalk environment into the stack.

Answer

Export the Elastic Beanstalk environment configuration as a CloudFormation template from the console.

Question 3

A developer wants to provision AWS resources using AWS Cloud Development Kit (CDK) and ensure that the infrastructure can be version-controlled and reviewed. Which practice should they follow?

Accepted Answer

Write the CDK app in TypeScript, store it in a Git repository, and use CDK pipelines for deployment.. It follows the recommended practice of treating CDK application code as infrastructure source code, storing it in a version control system (Git), and using CDK Pipelines (a high-level construct that automatically synthesizes and deploys CloudFormation templates) to ensure repeatable, reviewed deployments. This approach enables infrastructure-as-code best practices: version history, peer review via pull requests, and automated deployment pipelines.

Answer

Write the CDK app and deploy directly without synthesis to avoid extra steps.

Answer

Write the CDK app to generate Terraform configurations and store them in Git.

Answer

Write raw CloudFormation templates instead of CDK to simplify version control.

Question 4

An operations team manages a fleet of Amazon EC2 instances that require periodic software updates. They want to use AWS Systems Manager to apply patches automatically while ensuring that patches are tested before production deployment. Which approach meets these requirements?

Accepted Answer

Use AWS Systems Manager Patch Manager with maintenance windows, and configure a patch baseline that approves patches after a test period.. AWS Systems Manager Patch Manager, when combined with maintenance windows and a patch baseline configured with an approval delay after a test period, allows patches to be automatically applied to test instances first and then, after a defined waiting period, to production instances. This ensures patches are tested before production deployment without manual intervention, meeting the requirement for automated, staged patching.

Answer

Use AWS Systems Manager Automation to create a runbook that patches instances one by one.

Answer

Create a patch baseline and assign it to all instances; enable automatic approval for all patches.

Answer

Use AWS Systems Manager Run Command to manually run patch commands on test instances, then on production.

Question 5

A team uses AWS CloudFormation to manage a multi-tier application. They update the stack and receive this error: 'UPDATE_ROLLBACK_FAILED'. The stack is in a state where some resources were updated, then rollback failed. What is the best course of action?

Accepted Answer

Use the 'ContinueUpdateRollback' API or AWS Management Console to resume rollback, and fix any underlying issues.. The 'UPDATE_ROLLBACK_FAILED' state indicates that CloudFormation attempted to roll back a failed stack update but encountered an error during the rollback process. The correct action is to use the 'ContinueUpdateRollback' API (or the AWS Management Console equivalent) to resume the rollback after fixing the underlying issue that caused the rollback to fail, such as a resource dependency or permission problem. This allows CloudFormation to complete the rollback and return the stack to a known stable state, rather than leaving it in an inconsistent or partially updated condition.

Answer

Ignore the error and use the stack as-is.

Answer

Attempt to continue the update again.

Answer

Delete the stack and recreate it.

Question 6

A company wants to use AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that the instances are automatically configured with the latest security patches upon boot. Which OpsWorks feature should they use?

Accepted Answer

Create a custom Chef recipe that installs security patches and assign it to the setup lifecycle event.. AWS OpsWorks uses Chef recipes to manage instance configuration. By creating a custom Chef recipe that installs the latest security patches and assigning it to the 'setup' lifecycle event, the recipe runs automatically on every new instance boot, ensuring patches are applied before the instance enters service. This is the native OpsWorks mechanism for configuration management during instance provisioning.

Answer

Configure the instances to run a user data script that updates packages.

Answer

Use AWS Systems Manager Patch Manager with an OpsWorks lifecycle event.

Answer

Use a CloudFormation template to apply patches during stack creation.

Question 7

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodePipeline and Amazon ECS. The pipeline should build a Docker image, push it to Amazon ECR, and deploy it to an ECS service. Which deployment action should they use in the pipeline?

Accepted Answer

Amazon ECS (Blue/Green) deployment provider with CodeDeploy.. Amazon ECS (Blue/Green) deployment provider with CodeDeploy is the native, fully managed deployment action in AWS CodePipeline for ECS services. It orchestrates traffic shifting, task set management, and rollback automatically using CodeDeploy's ECS blue/green deployment type, which is the recommended approach for containerized applications on ECS.

Answer

AWS Elastic Beanstalk deployment action.

Answer

AWS CodeBuild with a buildspec that runs aws ecs update-service.

Answer

AWS CloudFormation deployment action to update the ECS service.

Question 8

A company uses AWS CloudFormation to manage infrastructure. They have a stack that includes a VPC, subnets, and EC2 instances. They want to update the AMI ID of an EC2 instance without causing downtime. Which TWO approaches meet this requirement?

Accepted Answer

Use a CloudFormation update with a rolling update policy on the Auto Scaling group.. Option C is correct because attaching an AutoScalingRollingUpdate policy to the Auto Scaling group resource lets CloudFormation replace instances in batches, keeping a configurable number of instances in service (MinInstancesInService) so the AMI change is applied without downtime. Option D is correct because a custom resource backed by a Lambda function can orchestrate an in-place or rolling update via AWS Systems Manager (for example, SSM Run Command or Automation), allowing the AMI to be changed while maintaining availability. Option A is not correct because setting MinInstancesInService to 0 allows all instances to be taken out of service simultaneously, which causes downtime. Option B is not correct because deleting and recreating the stack destroys the existing resources, causing downtime and data loss. Option E is not correct because spreading instances across Availability Zones does not by itself update the AMI or guarantee zero-downtime replacement.

Answer

Use CloudFormation stack update with 'UpdatePolicy' set to 'AutoScalingRollingUpdate' and 'MinInstancesInService' set to 0.

Answer

Delete the stack and recreate it with the new AMI.

Answer

Deploy the instances across multiple Availability Zones and update each zone separately.

Question 9

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. They want to ensure that the VPC has internet access for the public subnets. Which THREE resources must be included in the template?

Accepted Answer

AWS::EC2::Route (pointing to InternetGateway). An AWS::EC2::Route resource that points to an InternetGateway is required to direct traffic from the public subnet's route table to the internet. Without this route, instances in the public subnet cannot send or receive traffic from the internet, even if an Internet Gateway is attached to the VPC.

Answer

AWS::EC2::VPCEndpoint

Answer

AWS::EC2::NatGateway

Question 10

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to ensure that stack updates are reviewed and approved by a senior engineer before being executed. Which feature should they implement?

Accepted Answer

Change sets. Change sets allow you to preview the proposed changes to a CloudFormation stack before executing them. This enables a senior engineer to review and approve the changes, ensuring that only validated updates are applied. Without change sets, updates would be applied immediately without a review step.

Answer

Stack policies

Answer

Drift detection

Answer

Stack sets

Question 11

An organization uses OpsWorks to manage application stacks. They notice that custom cookbooks are not being executed during the lifecycle events. What is the most likely cause?

Accepted Answer

The custom cookbook repository URL is misconfigured or inaccessible. Custom cookbooks in AWS OpsWorks are fetched from a repository (e.g., Git, S3, HTTP) during lifecycle events. If the repository URL is misconfigured (e.g., wrong branch, invalid path) or inaccessible (e.g., private repo without proper SSH keys or S3 bucket permissions), OpsWorks cannot retrieve the cookbooks, causing them to not execute. This is the most common cause of cookbook execution failures.

Answer

The layer's IAM role does not have permissions to execute the cookbook

Answer

The cookbook is not configured with CodeDeploy

Answer

The cookbook uses a Chef version that is not supported by OpsWorks

Question 12

A company uses AWS Systems Manager to manage hybrid servers. They want to automate the patching of Windows servers using Patch Manager. However, some servers are not showing up in the compliance reporting. What should the DevOps engineer check first?

Accepted Answer

Ensure the SSM Agent is installed and running on the servers. The SSM Agent is the core component that enables a server to communicate with AWS Systems Manager. Without the agent installed and running, the server cannot register with the service, receive patch commands, or report its compliance status. Therefore, this is the most fundamental prerequisite to check first when servers are missing from compliance reporting.

Answer

Verify that the servers have the correct patch baseline tags

Answer

Check that the Patch Baseline is configured to include the missing servers

Answer

Confirm that the servers have an IAM service role for Systems Manager

Question 13

A DevOps team uses Elastic Beanstalk to deploy a web application. They want to configure environment variables without modifying the application code. Where should they define these variables?

Accepted Answer

As environment properties in the Elastic Beanstalk environment. Elastic Beanstalk environment properties are key-value pairs defined in the environment configuration that are injected as environment variables into the application's runtime. They allow configuration changes without modifying application code, and can be set via the console, CLI, or .ebextensions. This is the standard mechanism for externalizing configuration in Elastic Beanstalk.

Answer

In the EC2 User Data script

Answer

In the instance metadata

Answer

In the application code

Question 14

A company uses AWS CodeBuild to build and test code. They need to securely store sensitive parameters, such as database passwords, and inject them into the build process. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it provides secure, hierarchical storage for configuration data and secrets, such as database passwords, and integrates natively with AWS CodeBuild via the `parameter-store` environment variable type. This allows you to reference parameters without hardcoding sensitive values, and you can optionally use secure string parameters encrypted with KMS for additional protection.

Answer

Storing them in the CodeBuild project environment variables

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Question 15

A company uses AWS Config to evaluate compliance of their AWS resources. They have a custom rule that checks whether EC2 instances have a specific tag. They notice that the rule is not triggering on existing instances. What is a possible reason?

Accepted Answer

The rule is not configured with a trigger type of 'Configuration changes' or 'Periodic'. AWS Config custom rules require a trigger type to evaluate resources. If a rule is not configured with either 'Configuration changes' (triggered when a resource changes) or 'Periodic' (triggered on a schedule), it will never evaluate resources, including existing instances. Without a trigger, the rule remains inactive and cannot perform compliance checks.

Answer

AWS Config does not support custom rules

Answer

The Lambda function does not have permission to describe EC2 instances

Answer

The EC2 instances are not in the resource types being recorded by AWS Config