DOP-C02 Configuration Management and IaC Practice Question
A company uses Terraform with an S3 backend to manage infrastructure. The DevOps engineer notices that after a colleague runs 'terraform apply' locally, the state file in S3 becomes corrupted and subsequent runs fail. What is the BEST way to prevent this issue?
⚠ Common exam trap
Candidates often confuse recovery mechanisms (like S3 versioning) with prevention mechanisms (like state locking), leading them to choose Option D even though it only mitigates damage after corruption occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use DynamoDB for state locking and enable consistency checks.
Enabling DynamoDB for state locking prevents concurrent modifications that can corrupt the state file. When a user runs 'terraform apply', Terraform acquires a lock in DynamoDB, ensuring only one operation modifies the state at a time. Consistency checks (e.g., using DynamoDB's conditional writes) further validate that the state hasn't been tampered with, directly addressing the corruption issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the state file locally and commit it to version control.
Why it's wrong here
Storing state locally couples the state file to a single developer's machine and provides no locking, so concurrent `terraform apply` commands can overwrite the same state file and produce corruption or lost updates. Committing the state file to version control also leaks sensitive data such as resource attributes, connection strings, and outputs, and it bypasses Terraform's remote state locking mechanisms. This is therefore a recognized anti-pattern for team-based infrastructure.
- ✓
Use DynamoDB for state locking and enable consistency checks.
Why this is correct
The DynamoDB lock table uses conditional writes to ensure that only one Terraform run can hold the state lock at a time, preventing two `apply` executions from simultaneously updating the same S3 object and causing corruption. Enabling consistency checks (for example, verifying the lock acquisition and using DynamoDB's strongly consistent reads) ensures that the state pulled before a plan or apply is the latest known-good version, so stale or partially written state is never used as the basis for changes.
- ✗
Use S3 server-side encryption to protect the state file.
Why it's wrong here
S3 server-side encryption (SSE-S3, SSE-KMS, or SSE-C) only encrypts the state file at rest and in transit, protecting the confidentiality of any secrets stored in the state. It does not add any integrity validation, atomicity, or concurrency control; a corrupted or partially written state file is still indistinguishable from a valid one, and encryption provides no defense against concurrent writers.
- ✗
Enable S3 versioning on the state bucket to recover previous versions.
Why it's wrong here
Versioning stores previous versions of the state object after overwrites, allowing operators to manually roll back if corruption is discovered. However, it does not prevent the corruption itself—concurrent Terraform runs can still interleave writes, and versioning does not enforce locking. In fact, versioning can hide the problem by silently preserving multiple divergent states, making it harder to determine which version is authoritative.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.