20+ practice questions focused on Configuration Management and IaC — one of the most tested topics on the AWS Certified DevOps Engineer Professional DOP-C02 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Configuration Management and IaC PracticeA company uses AWS CloudFormation to deploy a multi-tier web application. The template includes a nested stack for the database layer. When updating the stack, the database stack fails with a 'CREATE_FAILED' status, but the parent stack continues updating other resources. What is the most likely cause and best practice to prevent this?
Explanation: None of the provided options are correct. The default update behavior in CloudFormation is to continue on failure. To ensure rollback on update failure, you should set 'RollbackOnFailure' to true in the stack update options (e.g., using the '--rollback-configuration' parameter in the AWS CLI). Option A incorrectly references the creation-only parameter 'OnFailure', while options B, C, and D are factually incorrect. The best practice is to enable rollback on update failure by configuring RollbackOnFailure.
A DevOps engineer manages infrastructure using Terraform. The team needs to store secrets such as database passwords in a secure manner and reference them in Terraform configurations. They have configured AWS Secrets Manager. What is the recommended approach to reference secrets in Terraform without exposing them in state files?
Explanation: The correct approach to avoid secrets in state files is to not store secret values in Terraform state at all. This can be achieved by using external secret management tools (e.g., HashiCorp Vault) that fetch values at runtime without persisting them, or by securing the state backend with encryption and strict access controls while accepting that data source results are stored. The 'sensitive = true' attribute only masks output, not state storage, so option D is not the recommended solution for the stated requirement.
A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?
Explanation: In AWS OpsWorks, lifecycle events (such as Configure) are tied to layers, not individual instances. To run a custom recipe on all instances during the Configure event, you must upload the recipe to a custom cookbook repository (e.g., S3 or Git) and then assign that recipe to the Configure lifecycle event in the stack's layer settings. This ensures OpsWorks Chef runs the recipe on every instance in that layer whenever the Configure event fires (e.g., after scaling or instance state changes).
An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?
Explanation: Immutable updates in AWS Elastic Beanstalk launch a completely new environment with the new application version. If the new environment fails health checks, Elastic Beanstalk automatically terminates it, leaving the original environment untouched. This ensures zero downtime and a safe rollback, which matches the requirement to keep the old environment intact if health checks fail.
A DevOps team is designing a CI/CD pipeline using AWS CodeBuild and CodePipeline. They want to use infrastructure as code to define the build environment. Which TWO options are valid approaches to define the build environment in CodeBuild?
Explanation: The buildspec.yml file is the primary mechanism in AWS CodeBuild to define the build environment, including runtime versions (e.g., runtime: nodejs:18) and environment variables. This file is placed at the root of the source code and instructs CodeBuild on how to execute the build phases, making it a valid infrastructure-as-code approach for environment configuration.
+15 more Configuration Management and IaC questions available
Practice all Configuration Management and IaC questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Configuration Management and IaC. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Configuration Management and IaC questions on the DOP-C02 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Configuration Management and IaC is tested as part of the AWS Certified DevOps Engineer Professional DOP-C02 blueprint. Practicing with targeted Configuration Management and IaC questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free DOP-C02 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Configuration Management and IaC is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Configuration Management and IaC practice session with instant scoring and detailed explanations.
Start Configuration Management and IaC Practice →