DOP-C02 Configuration Management and IaC Practice Question
A team manages a large fleet of EC2 instances using AWS Systems Manager. They want to enforce a consistent configuration across all instances, including installed software packages, firewall rules, and user accounts. The team also needs to audit configuration changes and remediate drift automatically. Which AWS service should the team use?
⚠ Common exam trap
Test-takers frequently confuse AWS Config (which only audits and detects drift) with State Manager (which enforces and remediates drift), leading candidates to choose Config because they focus on the auditing requirement without realizing it lacks enforcement capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager State Manager
AWS Systems Manager State Manager is the correct choice because it is designed to enforce a consistent configuration across EC2 instances by defining and applying desired state configurations (DSCs). It can manage software packages, firewall rules, and user accounts, and it automatically remediates drift by re-applying the desired state on a schedule. This directly meets the requirement for configuration enforcement, auditing, and automated drift remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS OpsWorks for Chef Automate
Why it's wrong here
AWS OpsWorks for Chef Automate relies on a Chef server and cookbook architecture that requires manual setup of recipes and run-lists, lacking the native drift remediation and state-level configuration enforcement that Systems Manager State Manager provides via associations. It is tempting because Chef Automate excels at configuration management for fleets with custom, complex cookbook workflows, but it does not integrate directly with Systems Manager’s inventory and patch baselines to audit and automatically correct drift across EC2 instances without additional tooling.
- ✓
AWS Systems Manager State Manager
Why this is correct
AWS Systems Manager State Manager is the correct choice because it lets you define a desired configuration state (such as specific software packages, user accounts, or agent settings) and automatically apply and maintain that state on your EC2 fleet. It uses associations that run on a schedule, detect drift from the defined state, and reapply the configuration whenever needed. Unlike ad-hoc tools, State Manager continuously enforces the desired state across instances with built-in rate controls and error handling, making it ideal for managing large fleets.
- ✗
AWS Systems Manager Run Command
Why it's wrong here
AWS Systems Manager Run Command is intended for running one-off, on-demand commands against a targeted set of instances, not for maintaining a persistent desired state. While you could manually invoke Run Command on a schedule using an external trigger, it does not natively detect or correct drift over time. Run Command executes a command once per invocation and forgets the desired state, so it lacks the continuous enforcement and automatic remediation that State Manager provides through associations.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service that records resource configurations and evaluates them against compliance rules, such as checking whether an EC2 instance has certain tags or security group settings. However, AWS Config only observes and reports on configuration drift; it does not install software, manage user accounts, or modify the operating system on an instance. While AWS Config can integrate with SSM Automation to perform corrective actions, that still requires additional setup and is not a native, direct mechanism for enforcing a desired state on the OS.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps team manages hundreds of EC2 instances using AWS Systems Manager State Manager. They need to ensure that a specific configuration (e.g., a custom firewall rule) is applied to all instances and remains enforced. Which THREE steps should they take? (Choose THREE.)
hard- ✓ A.Ensure the instances have an IAM role that allows Systems Manager to perform actions.
- ✓ B.Create a State Manager association using a custom document that defines the firewall rule.
- C.Use AWS Config rules to detect non-compliance.
- D.Use Run Command to execute the configuration once.
- ✓ E.Set the association to apply the configuration on a schedule (e.g., every 30 minutes).
Why A: AWS Systems Manager requires instances to have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) for the SSM Agent to communicate with the Systems Manager service. Without this role, State Manager cannot apply or enforce any configuration, including custom firewall rules.
Variation 2. An organization uses AWS Systems Manager to manage a fleet of EC2 instances. They want to ensure that all instances have a specific software package installed. Which approach should they take?
medium- A.Use OpsCenter to create an OpsItem for each instance.
- B.Use Run Command to execute the installation on all instances.
- C.Create a Patch Baseline that includes the package.
- ✓ D.Create a State Manager association with a custom document that installs the package.
Why D: State Manager associations can enforce desired configurations, such as installing software packages, on a schedule or continuously. Option B is wrong because Run Command is for one-time ad-hoc execution, not ongoing compliance. Option C is wrong because Patch Manager focuses on OS patches, not arbitrary software packages. Option A is wrong because OpsCenter is for operational issues, not configuration management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.