DOP-C02 Configuration Management and IaC Practice Question
A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)
⚠ Common exam trap
It's easy for candidates to confuse Parameter Store (a data store) with a configuration management tool, or thinking OpsCenter (an operations dashboard) can enforce state, when only Run Command, State Manager, and Patch Manager directly execute actions to achieve and maintain a desired configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run Command
Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run Command
Why this is correct
Run Command is a Systems Manager capability that lets you execute shell scripts or PowerShell commands on one or more EC2 instances via the SSM Agent, without the need for SSH/RDP or opening inbound ports. By invoking documents like AWS-RunShellScript or AWS-RunPowerShellScript, you can directly enforce configuration settings, install software, or remediate configuration drift on demand. It supports rate control, error thresholds, and IAM-based permission scoping, making it a direct and flexible mechanism for enforcing instance configuration.
- ✗
OpsCenter
Why it's wrong here
OpsCenter aggregates operational issues, such as Amazon CloudWatch alarms and AWS Config alerts, into OpsItems, providing operators with a centralized console to view, triage, and run diagnostics or remediation runbooks. While it can invoke Systems Manager documents to resolve an issue, OpsCenter itself is a management and tracking tool for operational work items, not a mechanism that applies or enforces EC2 configuration changes. It does not maintain a desired instance state or execute arbitrary configuration scripts on its own, so it is not the appropriate answer for instance configuration management.
- ✗
Parameter Store
Why it's wrong here
Parameter Store is a secure, hierarchical store for configuration data such as AMI IDs, license keys, and environment variables, supporting plaintext or KMS-encrypted strings and advanced parameters with expiration policies. It provides configuration values to Systems Manager documents, Lambda functions, or EC2 user data, but it cannot execute commands, apply settings, or enforce a desired state on an instance; it simply supplies the data that other tools consume. Thus it is not the mechanism that manages or enforces EC2 instance configurations.
- ✓
Patch Manager
Why this is correct
Patch Manager automates the process of patching managed instances with security updates and other types of updates, using patch baselines to define which patches should be installed and whether approval is automatic. It ensures instances are compliant with your organization's patch policies, which is a specific subset of overall configuration management. This makes it a correct option when the configuration task is specifically about patch compliance, but it does not address broader settings such as file contents, services, or registry values, which are handled by general-purpose command execution.
- ✓
State Manager
Why this is correct
State Manager defines and maintains the desired state of your EC2 instances by associating SSM documents, including run commands, with instances on a schedule or when triggered by events. It can enforce consistent configuration, such as installing software, updating settings, or collecting inventory, and it automatically remediates drift from the defined state. This is the declarative, ongoing approach to instance configuration, whereas Run Command is used for one-time or on-demand execution; both are valid but State Manager is designed for continuous maintenance rather than immediate enforcement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.