DOP-C02 Configuration Management and IaC Practice Question
A DevOps engineer is designing a configuration management strategy for a fleet of EC2 instances running Amazon Linux 2. The instances must be bootstrapped with custom software and continuously managed to ensure desired state compliance. Which combination of services should the engineer use?
⚠ Common exam trap
Many exam-takers confuse AWS Config (a compliance auditing service) with a configuration management tool, or assume CloudWatch Events can enforce state, when in fact Systems Manager State Manager is the native AWS service for desired state configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager State Manager for desired state configuration and AWS Systems Manager Run Command for initial bootstrapping
AWS Systems Manager State Manager provides a policy-driven mechanism to define and maintain desired state configuration for EC2 instances, while AWS Systems Manager Run Command enables ad-hoc or initial bootstrapping by executing scripts or commands (e.g., installing custom software) without requiring SSH. Together, they cover both the initial setup and ongoing compliance enforcement for Amazon Linux 2 instances, aligning with the requirement for continuous management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudFormation for bootstrapping and Amazon CloudWatch Events to enforce desired state
Why it's wrong here
AWS CloudFormation is an infrastructure-as-code service that provisions and updates resources at launch time, but it does not continuously manage OS-level configuration such as package versions or service states. Amazon CloudWatch Events (now EventBridge) can schedule or react to events, but by itself it holds no desired-state model and cannot enforce or remediate configuration drift. Together they lack a persistent mechanism for ongoing state enforcement, so this pair is not a configuration management solution.
- ✗
AWS OpsWorks for Chef Automate for configuration management and AWS CodeDeploy for deployments
Why it's wrong here
AWS OpsWorks for Chef Automate provides a managed Chef server that can apply configuration recipes, but it introduces significant operational overhead with cookbooks, nodes, and server management. AWS CodeDeploy is focused on deploying application revisions to targets, not on bootstrapping the base operating system or maintaining desired system state. The combination does not give a single, lightweight workflow for both initial bootstrap and ongoing desired-state enforcement, whereas Systems Manager covers both natively.
- ✓
AWS Systems Manager State Manager for desired state configuration and AWS Systems Manager Run Command for initial bootstrapping
Why this is correct
AWS Systems Manager State Manager uses associations to define and continuously enforce a desired configuration state, automatically reapplying or remediating drift for managed instances. AWS Systems Manager Run Command can execute one-time bootstrap scripts on instances via the SSM Agent, enabling initial setup like installing packages or joining domains. Because both services share the same agent and console, this combination provides a unified, serverless approach to bootstrap and ongoing configuration management.
- ✗
AWS Config for configuration management and Amazon CloudWatch Events for remediation
Why it's wrong here
AWS Config is a compliance and auditing service that records resource configurations and evaluates them against rules, but it does not impose or apply desired state changes to the instances themselves. Amazon CloudWatch Events can trigger Lambda functions or Systems Manager documents in response to events, but that requires building custom remediation pipelines and provides no built-in configuration management. This pair addresses monitoring and reaction, not the direct, automated enforcement of a specified system configuration.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.