DOP-C02 Configuration Management and IaC Practice Test 9 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a CloudFormation stack that creates an Auto Scaling group with a launch configuration. The stack creation fails with the error 'Resource handler returned message: "Invalid IAM Instance Profile name" (Service: AutoScaling, Status Code: 400)'. Which TWO are possible causes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM instance profile has not been created yet.. The error 'Invalid IAM Instance Profile name' indicates that the specified instance profile name is not recognized by AWS Auto Scaling. This can happen if the instance profile does not exist yet (Option A) due to a dependency issue or if the name in the launch configuration is misspelled (Option D). Option B is incorrect because a deleted instance profile would still show as 'not found' or a similar error, but the specific 'Invalid name' error points to a name mismatch or missing resource, not a deleted one. Option C is incorrect because even if the instance profile is in a different account, you would use an ARN to reference it, and the error would be different (e.g., access denied) if permissions were lacking. Option E is incorrect because insufficient permissions on the associated role would result in an authorization error, not an invalid name error.

Answer

The launch configuration references a deleted instance profile.

Answer

The instance profile is in a different AWS account.

Answer

The IAM role associated with the instance profile does not have sufficient permissions.

Question 2

A company uses AWS Systems Manager to manage patching of EC2 instances. They want to ensure that instances in a specific Auto Scaling group are patched before being allowed to serve traffic. Which THREE steps should be part of the solution?

Accepted Answer

Create a new launch configuration with the patched AMI.. Options A, B, and E are correct. Option A creates a new launch configuration with the patched AMI, ensuring that new instances launched from it are patched. Option B updates the Auto Scaling group to use the new launch configuration, causing the group to replace existing instances with patched ones (via instance refresh or scale-in/out). Option E uses an AWS Systems Manager Maintenance Window to apply patches to existing instances, which is necessary if you want to patch instances without replacing them entirely. Option C (CodeDeploy) is not appropriate for OS patching; it is used for application deployments. Option D (CloudWatch Events) could be used to automate the process but is not a required step for the core solution.

Answer

Deploy the patched version using AWS CodeDeploy.

Answer

Configure Amazon CloudWatch Events to trigger a Lambda function after patching.

Question 3

A DevOps engineer runs these commands to investigate a failed CloudFormation stack creation. The stack status is ROLLBACK_COMPLETE and the most recent event shows CREATE_FAILED. What should the engineer do next to identify the root cause?

Accepted Answer

Run describe-stack-events with a filter to see the ResourceStatusReason for the CREATE_FAILED event.. The correct next step is to run describe-stack-events with a filter to see the ResourceStatusReason for the CREATE_FAILED event (Option C). Describe-stack-events returns all events for the stack, and each event includes a ResourceStatusReason that explains why the resource creation failed. This is the most direct way to identify the root cause. Option A is wrong because update-stack cannot recreate a stack that has rolled back; it would attempt an update on a failed stack, which is not appropriate. Option B is wrong because describe-stacks does not include failure reasons; it only shows stack status and parameters. Option D is wrong because deleting and recreating the stack would lose the current events and not provide the failure reason from the original creation attempt.

Answer

Run update-stack to recreate the stack and examine the error.

Answer

Run describe-stacks with additional query to get the StackStatusReason.

Answer

Run delete-stack and recreate with debugging enabled.

Question 4

A company uses Terraform to manage a multi-account AWS environment. The Terraform state files are stored in an S3 bucket with DynamoDB locking. Recently, a DevOps engineer ran 'terraform apply' from a CI/CD pipeline, and it failed with the error: 'Error acquiring the state lock. Lock ID: "abc123". Possible causes: Another process has the lock; or a previous process crashed.' The engineer checks DynamoDB and sees that the lock item exists but there is no active Terraform process. The engineer needs to proceed with the deployment urgently. What should the engineer do?

Accepted Answer

Use the 'terraform force-unlock' command with the lock ID to remove the lock.. When a Terraform lock is orphaned (no active process holds it), the 'terraform force-unlock' command with the lock ID safely removes the lock from DynamoDB, allowing the pipeline to proceed. Option B is incorrect because DynamoDB locks do not expire automatically. Option C is wrong because deleting the state file causes data loss and is unnecessary. Option D is risky as manual DynamoDB manipulation may bypass Terraform's safeguards and corrupt the state.

Answer

Wait for the lock to expire automatically.

Answer

Delete the state file from S3 and recreate it from the last backup.

Answer

Manually delete the lock item from DynamoDB using the AWS Console.

Question 5

A company uses AWS CloudFormation StackSets to deploy a VPC with subnets across multiple accounts and regions. Recently, a new account was added to the organization, and the DevOps team wants to deploy the stack set to this new account without affecting existing stacks. The stack set has self-managed permissions. The engineer creates a new stack instance for the account and region, but the operation fails with an 'Access Denied' error when CloudFormation tries to create resources in the new account. The engineer has verified that the stack set's IAM roles exist in the new account. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role in the target account does not grant permissions to the administrator account.. The error 'Access Denied' when CloudFormation tries to create resources in the new account indicates a permissions issue. With self-managed permissions, the IAM role in the target account must have a trust policy that allows the administrator account to assume it. Even if the role exists, if its trust policy does not grant the administrator account the necessary permissions, the operation will fail. Option B correctly identifies this as the cause. Option A is incorrect because self-managed permissions do not require a trust relationship; the administrator account needs to trust the target account role. Option C is irrelevant; service limits would produce a different error. Option D is incorrect because the role names are verified to exist.

Answer

The stack set template contains a resource that is not supported in the target region.

Answer

The target account has reached a service limit for VPCs.

Answer

The IAM roles in the target account are not named correctly.

Question 6

An organization uses AWS CodeCommit to store CloudFormation templates. They have a requirement that all templates must pass a series of validation checks before being merged to the main branch. The checks include syntax validation, IAM policy linting, and compliance rules. The DevOps team wants to implement this validation using AWS services with minimal operational overhead. They already use AWS CodePipeline for CI/CD. What should the team do?

Accepted Answer

Set up a CodePipeline that is triggered by pull request creation, with a CodeBuild stage to run validation checks, and configure a branch policy to require the pipeline to succeed before merging.. CodePipeline with CodeBuild can run validation checks on pull requests using a branch policy. Option A is wrong because it requires managing Lambda functions. Option B is wrong because it doesn't integrate with pull request workflow. Option C is wrong because CloudFormation alone cannot enforce pre-merge validation.

Answer

Configure a CloudFormation stack to automatically validate templates and send notifications.

Answer

Create a Lambda function that triggers on CodeCommit events and runs validation.

Answer

Use AWS CloudFormation Guard as a pre-commit hook on local machines.

Question 7

A company manages a fleet of EC2 instances using AWS Systems Manager State Manager. They have a State Manager association that ensures a specific software package is installed on all instances. Recently, they noticed that some instances are reporting the association as 'Success' even though the software is not installed. The association uses a custom document that runs a script to install the package. The engineer checks the association execution history and sees that the script exited with code 0 on those instances. What is the most likely cause?

Accepted Answer

The script does not check the exit code of the installation command and always returns 0.. The script likely does not check the exit code of the installation command and always returns 0, so State Manager reports success even when installation fails. Option A is incorrect because the association is running on those instances, as shown by execution history. Option B is incorrect because compliance data is being sent (the 'Success' status is reported). Option C is incorrect because the association runs, indicating SSM Agent is installed.

Answer

The association is not targeting those instances.

Answer

The instances are not configured to send compliance data to Systems Manager.

Answer

The instances do not have the SSM Agent installed.

Question 8

A DevOps engineer runs this command to list resources of a CloudFormation stack. The stack status is 'CREATE_COMPLETE'. However, the EC2 instance 'i-0abcd1234efgh5678' was manually terminated by another team. The engineer wants to restore the stack to its intended state without deleting the stack. What should the engineer do?

Accepted Answer

Update the stack with the original template.. Updating the stack with the original template will cause CloudFormation to detect that the manually terminated EC2 instance is missing and recreate it, thereby restoring the stack to its intended state without deleting the stack. Option A is incorrect because importing a terminated instance is not feasible; import is used for existing resources, not terminated ones. Option C is incorrect because creating a new stack and deleting the old one involves deleting the stack, which contradicts the requirement to not delete the stack. Option D is incorrect because while drift detection and manual remediation could work, updating the stack with the original template is a more direct and automated method to restore the intended state.

Answer

Import the terminated instance back into the stack.

Answer

Create a new stack with the same template and delete the old one.

Answer

Perform a stack drift detection and then manually fix the drift.

Question 9

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Amazon ECS. The application uses multiple AWS services including RDS, ElastiCache, and SQS. Which TWO strategies should the team implement to ensure secure and auditable configuration management across environments?

Accepted Answer

Use AWS Secrets Manager to store and rotate database credentials.. AWS Secrets Manager (A) securely stores and rotates database credentials, preventing hardcoding and enabling automated rotation. AWS Config rules (B) enforce tagging and compliance standards, providing an audit trail and ensuring resources adhere to policies. Option C (storing credentials in version control) is insecure; D (manual review) is not scalable for CI/CD; E (granting developers direct S3 access) violates least privilege.

Answer

Store database credentials in a version-controlled configuration file.

Answer

Manually review configuration changes before deployment.

Answer

Grant developers direct S3 access to upload configuration files.

Question 10

A company manages multiple AWS accounts using AWS Organizations. The DevOps team needs to enforce that all newly created S3 buckets in any account automatically have versioning enabled and are encrypted with SSE-S3. Which THREE steps should the team take to achieve this using Infrastructure as Code and policy-based controls?

Accepted Answer

Create an SCP that denies s3:PutObject if the bucket does not have encryption enabled.. To enforce S3 bucket versioning and encryption using IaC and policy controls, three steps are effective. Option A: Create an SCP that denies s3:PutObject if encryption is not enabled, preventing non-compliant bucket creation. Option D: Use AWS CloudFormation StackSets to deploy a baseline template across all accounts that creates S3 buckets with versioning and SSE-S3 encryption. Option E: Deploy an AWS Config managed rule to check for versioning and use automatic remediation via SSM Automation to enable versioning on non-compliant buckets. Option B (CodePipeline) does not enforce policies proactively, and Option C (manual) is not scalable.

Answer

Configure AWS CodePipeline to run a script that checks bucket configurations after creation.

Answer

Manually configure each new bucket via the AWS Management Console.

Question 11

A startup uses AWS CloudFormation to manage its infrastructure. The team stores stack templates in an S3 bucket and creates stacks using the AWS CLI. Recently, a developer accidentally deleted a CloudFormation stack, causing a production outage. The team wants to prevent accidental stack deletions while allowing authorized users to delete stacks after approval. What is the MOST effective solution?

Accepted Answer

Apply a Service Control Policy that denies the cloudformation:DeleteStack action.. The most effective because a Service Control Policy (SCP) can deny the cloudformation:DeleteStack action at the AWS Organizations level, which applies even to the root user and all IAM users/roles in the account. This prevents accidental deletion by any user, including administrators, without needing to rely on a manual process. In contrast, option A (termination protection) can be disabled by users with permission to update the stack, option B (manual review) is not automated and depends on human compliance, and option D (IAM policy) can be bypassed by users with full administrative privileges.

Answer

Enable termination protection on the stack.

Answer

Implement a manual review process for all stack deletion requests.

Answer

Use an IAM policy that denies DeleteStack for all users.

Question 12

A company uses AWS OpsWorks for configuration management of a fleet of EC2 instances running a legacy application. The operations team needs to deploy a new version of the application across all instances without causing downtime. The application runs on each instance and requires a rolling update. Which approach should the team use?

Accepted Answer

Use the OpsWorks Deploy command to trigger a rolling update across the stack.. AWS OpsWorks supports rolling updates via the Deploy command (option D), which updates instances in batches across the stack, minimizing downtime. Option A (CodeDeploy blue/green) is a separate service and not integrated with OpsWorks for this legacy setup. Option B (new Auto Scaling group with updated AMI) is for immutable infrastructure, not rolling updates. Option C (manual layer reassignment) is not a built-in rolling update mechanism.

Answer

Use AWS CodeDeploy to perform a blue/green deployment on the existing instances.

Answer

Create a new Auto Scaling group with the updated AMI and terminate old instances.

Answer

Manually update each instance by adding a new layer and reassigning instances.

Question 13

A financial services company uses AWS CloudFormation to deploy a multi-tier application. The security team mandates that all data at rest must be encrypted using KMS CMKs. The CloudFormation template creates an RDS instance with encryption enabled using a KMS key. After deployment, the security team reports that the RDS instance is not using the specified KMS key. The DevOps engineer checks the template and finds the KMS Key ID is correct. What is the MOST likely cause?

Accepted Answer

The RDS instance was created without enabling encryption; encryption cannot be added later.. The most likely cause is that the RDS instance was created without encryption enabled. In CloudFormation, encryption at rest for RDS requires the StorageEncrypted property to be set to true. Even if the KmsKeyId parameter is specified, if StorageEncrypted is not true, encryption is not enabled and the key ID is ignored. Once an RDS instance is created without encryption, it cannot be enabled later. Option A correctly identifies this. Option B is less likely because cross-region KMS keys are possible but would require explicit cross-region references; the key ID being correct suggests it is in the same region. Option C is irrelevant because if the IAM role lacked KMS permissions, the stack creation would fail rather than produce an unencrypted instance. Option D is unrelated; KMS key policies are global and not constrained by VPCs.

Answer

The KMS key is in a different AWS region.

Answer

The IAM role used by CloudFormation lacks permissions to use the KMS key.

Answer

The RDS instance is inside a VPC that does not have a KMS key policy.

Question 14

A DevOps team manages AWS Lambda functions using the Serverless Application Model (SAM). They need to deploy a new version of a function that requires an increased memory allocation from 128 MB to 256 MB. The team updates the SAM template and runs sam deploy. The deployment succeeds, but the function's memory remains at 128 MB. What is the MOST likely reason?

Accepted Answer

The SAM CLI did not apply the change set because the stack policy does not allow updates to the Lambda function.. The SAM CLI uses AWS CloudFormation change sets to apply template updates. If the stack has a resource-level policy that denies modifications to the Lambda function (e.g., a stack policy that prevents updates to certain resources), the change set will fail to execute, and the configuration (including memory) will remain unchanged. Option A is incorrect because a rollback would be visible in the deployment status. Option B is incorrect because AWS CodeDeploy is typically used for traffic shifting canary deployments, not for basic SAM deployments unless explicitly configured. Option C is incorrect because the `--capabilities CAPABILITY_IAM` flag is required only when the template creates or modifies IAM resources, not for changing memory allocation.

Answer

The deployment triggered a rollback due to a health check failure.

Answer

AWS CodeDeploy is configured to control the update and requires manual approval.

Answer

The sam deploy command requires the --capabilities CAPABILITY_IAM flag to update memory.

Question 15

A large enterprise uses AWS Systems Manager to manage configuration drift on thousands of EC2 instances. The compliance team requires that instances must have a specific security configuration enforced by a Systems Manager State Manager association. The association is configured to run every 30 minutes. However, some instances consistently report a status of 'Failed' in the association compliance dashboard. The instances are running and have the SSM Agent installed. What is the MOST likely cause of the failures?

Accepted Answer

The instances do not have the required IAM instance profile to execute the association document.. The most likely cause is that the instances lack the required IAM instance profile permissions to execute the association document. State Manager associations require the EC2 instance to have an IAM role that grants permissions for the Systems Manager actions defined in the document. Without the correct instance profile, the association fails consistently. Option B (firewall) would affect all communication, not just the association. Option C (maintenance window conflict) would result in a different status, such as 'Pending'. Option D (outdated SSM Agent) would typically cause a different error or the agent would be automatically updated.

Answer

The instances are behind a firewall that blocks communication with the Systems Manager endpoint.

Answer

The association is configured to run at a specific time that conflicts with the instance's maintenance window.

Answer

The SSM Agent version on the instances is outdated and not compatible with the association document.