CCNA Configuration Management and IaC Questions

Patch Manager automates the entire patching process by using a patch baseline to define which patches are approved, when they are approved (e.g., after a test period expressed in days), and how those rules are applied to tagged instance groups. Maintenance windows schedule when the patching runs on test and production fleets, ensuring production patches are installed only after the baseline's approval delay lets the test fleet validate them. This combination provides automation, a testing gate, and controlled rollout windows, which directly satisfies the requirement.

The Execute Recipes feature in AWS OpsWorks Stacks allows you to run a specified recipe on selected instances immediately. This initiates an ad-hoc Chef run that pulls the latest cookbook from your configured source and executes the recipe's logic, directly applying the changes to the existing instances. It is the intended mechanism for manually applying cookbook updates without recreating or redeploying instances.

In a CloudFormation template, the Lambda function's Code property, when referencing an S3 bucket, can include the S3ObjectVersion attribute. Because CloudFormation treats any template property change as a stack update trigger, explicitly specifying the object version creates a new template value whenever the zip file in S3 is modified. Without this version, CloudFormation compares only the bucket and key, both of which stay constant, so it considers the resource unrmodified and skips the Lambda update—even if the S3 object's contents were replaced. Adding the S3ObjectVersion forces a resource replacement or update, making it the simplest and most direct way to ensure the stack updates on code changes.

AWS Systems Manager Run Command is a capability of AWS Systems Manager that lets you securely push commands to managed EC2 instances and on-premises machines without requiring SSH, RDP, or bastion hosts. The SSM Agent polls for commands, executes them, and can report status back, enabling admins to run scripts, install software, or change system settings across a fleet. Features such as tag-based targets, rate controls, and integration with IAM make it specifically designed for this kind of on-demand configuration activity.

The DependsOn attribute explicitly declares a dependency edge from the Lambda function back to the S3 bucket, forcing CloudFormation to wait until the bucket resource has reached CREATE_COMPLETE before it starts provisioning the Lambda function. This is the definitive way to guarantee creation order, especially when the function needs the bucket to exist for side effects such as populating an environment variable, writing to the bucket, or associating permissions, and no implicit dependency exists in the template. Unlike implicit references, DependsOn works even if the bucket is not directly referenced in any property of the Lambda function, making it the correct answer.

Using a dynamic stack name parameter, such as inserting the branch name into the stack name (e.g., `MyApp-${Branch}`), lets each branch deploy to a unique CloudFormation stack. This isolation prevents resource name collisions when multiple branches are deployed concurrently, supports per-branch rollback and lifecycle management, and eliminates the need to manually reconfigure the pipeline when a new branch is created.

A manual approval action in CodePipeline is a first-class, natively integrated gate that pauses the pipeline execution at a defined stage boundary (e.g., after build, before deploy). When the action runs, CodePipeline sends an SNS notification to the designated approver topic, and the execution remains in a Waiting state until an authorized user explicitly approves or rejects it via the console, CLI, or SDK. This is the intended AWS pattern for a human review gate because it is fully managed, has no custom polling logic, and automatically resumes the pipeline only upon approval — making it superior to any ad-hoc script or external approval mechanism.

When a CloudFormation stack that contains an AWS::S3::Bucket with DeletionPolicy: Retain is deleted, the template's deletion intent is to leave that bucket in place. The bucket, including any objects and versions, remains in your AWS account and is no longer under CloudFormation's management. The stack itself shows DELETE_COMPLETE because CloudFormation treats the Retain policy as a successful completion of the resource deletion step, even though no physical deletion occurred.

Change sets provide an itemized, read-only prediction of the exact modifications CloudFormation will apply to a stack when an updated template or parameter set is executed, listing each resource as being added, removed, or replaced without actually altering the stack. They are generated by calling CreateChangeSet, allowing the team to inspect the impact in a CI/CD pipeline and then explicitly execute the change set only after human approval. This makes change sets the correct mechanism for implementing a controlled pre-update review and approval workflow.

A service role is an IAM role that CloudFormation assumes to make API calls on your behalf when creating, updating, or deleting stacks. By specifying a service role with least privilege, you ensure CloudFormation only has the permissions required to provision the intended resources, limiting the impact if a resource definition is malicious or misconfigured. This also enables separation of duties because users can create stacks without holding direct resource permissions, and all actions are attributed to the service role.

CloudFormation identifies resources by logical ID; changing it makes the template treat the RDS instance as a new resource, so the old one is deleted and a replacement created. This replacement occurs regardless of unchanged properties, matching the stem's unexpected replacement with no property edits.

The correct procedure is to increment the version number in your platform definition file and then run the AWS CLI command `aws elasticbeanstalk create-platform-version`, which uploads the new packer template and associated configuration to build a fresh, immutable platform version. This new version can then be used as the `PlatformArn` in your environment's configuration, allowing the patched AMI to be deployed without affecting existing environments that reference the old version. This workflow is the documented way to apply changes to a custom platform.

Using CodeBuild to run unit tests on feature branches is correct because it provides fast, isolated feedback on each commit before the code is merged into develop. CodeBuild can be configured to respond to branch push or pull request webhooks, allowing tests to run without requiring a full CodePipeline execution. This validates code early in the development cycle, reducing the chance of integration problems and aligning with GitFlow's feature branch workflow.

This is the correct approach: a dynamic reference of the form {{resolve:secretsmanager:MySecret:SecretString:password}} instructs CloudFormation to call the GetSecretValue API during stack creation and extract the field named 'password' from the SecretString of 'MySecret'. The resolved value is then substituted directly into the supported resource property, and it never appears as a literal in the template or the saved stack template. This is the official mechanism for injecting Secrets Manager values into CloudFormation templates without using a custom resource.

Adding a 'cache' section to the buildspec is the correct way to declare which paths CodeBuild should cache. You specify relative or absolute paths, such as /root/.m2, and CodeBuild saves the contents to a configurable S3 cache bucket after the build. On subsequent builds, CodeBuild restores those paths before the build starts, so dependency resolution skips re-downloading artifacts. This is the official mechanism for Maven dependency caching in CodeBuild.

Use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command' is correct because OpsWorks Stacks can execute a recipe on any currently online instance without waiting for a lifecycle event. This converges the specified layer's existing instances to the updated configuration immediately, and Chef's idempotent execution ensures only necessary changes are applied. You can target a single instance, a whole layer, or use custom Chef JSON to pass parameters.

SSHing into a failed instance and manually running the install script is the most direct way to diagnose the failure, because you can reproduce the exact command and see the script's stderr, exit code, missing dependencies, permission errors, or incorrect path assumptions. CodeDeploy lifecycle scripts run under the instance's configured user environment, so executing the same script from the deployment archive directory (for example, /opt/codedeploy-agent/deployment-root/<deployment-id>/.../deployment-archive) exposes the root cause and lets you test a fix locally. This is the standard first step in troubleshooting a failed lifecycle hook.

State Manager associations continuously enforce a desired configuration on managed nodes, so the custom document's install command runs on any instance lacking the package and re-applies if it drifts. This satisfies the requirement that all instances maintain the specific software package without manual intervention.

Fn::GetAZs returns a list of all Availability Zones available in the current region, and Fn::Select chooses an element via its zero-based index. By combining them, you can assign the first AZ to one subnet (Fn::Select [0, Fn::GetAZs ""]) and the second AZ to another (Fn::Select [1, Fn::GetAZs ""]), ensuring two distinct AZs without hardcoding region-specific names. This approach remains valid even as the region's AZ list changes and keeps the template portable across regions.

Custom Chef recipes are the native configuration-management mechanism in AWS OpsWorks. Assigning a recipe that invokes the platform package manager (e.g., `apt-get update` and `apt-get upgrade -y` or `yum update -y`) to the setup lifecycle event ensures it runs on every instance immediately after boot, before any application deployment. The setup event runs only once at instance launch, making it the correct hook for initial patch application, and OpsWorks propagates any recipe changes when instances are updated or started.

Configuring an UpdatePolicy with AutoScalingRollingUpdate on the AWS::AutoScaling::AutoScalingGroup resource is the native CloudFormation way to replace instances with a new AMI while maintaining availability. CloudFormation automatically batches instance replacements by terminating old instances and launching new ones that use the updated launch template or configuration, with MinInstancesInService and MaxBatchSize controlling how many instances remain available. This integrates cleanly with the stack update workflow and is the recommended pattern for AMI rollouts in CloudFormation-managed Auto Scaling groups.

When the BucketName property is omitted from an S3 bucket resource, CloudFormation automatically generates a globally unique name by combining the stack name with a random suffix (e.g., my-stack-s3bucket-1a2b3c4d5e6f). This generated name guarantees uniqueness across all AWS accounts and regions, because the random component virtually eliminates collision risk. CloudFormation then exposes this generated name through the Ref function and the resource's physical ID, allowing other resources to reference it without ever needing to know the exact value beforehand. This is the simplest and most reliable way to avoid bucket-name conflicts without manual input.

In CloudFormation's AWS::RDS::DBInstance resource, DBInstanceClass and Engine are mandatory properties for every instance. DBInstanceClass defines the instance's compute and memory capacity, while Engine specifies the database engine (e.g., mysql, postgres). Without these, the resource automatically fails validation because CloudFormation can't provision a database without a compute class and an engine type. This makes this pair the correct answer for the property required universally.

The IAM policy includes an explicit Allow for ec2:StopInstances, and no explicit Deny statement covers StopInstances. Under IAM evaluation logic, an explicit Allow overrides the default implicit Deny, and since no explicit Deny applies, the request is permitted. Therefore, the user can stop the instance regardless of its running state.

Adding a manual approval action between the build and deploy stages creates a required gate that pauses pipeline execution, satisfying the constraint that only authorised personnel can approve production deployments. Configuring the SNS topic enables the pipeline to send email or SMS notifications to the designated approvers, ensuring they are alerted to review and approve the change before CodeDeploy proceeds.

The `SecurityGroupIds` property of an EC2 instance is typed as a list of security group IDs. When you use `!Ref` on a security group resource, CloudFormation resolves it to the security group's physical ID as a single string, not an array. Because the property requires a `List<AWS::EC2::SecurityGroup::Id>`, passing a bare `!Ref` causes a type-validation failure. To fix it, you must wrap the reference in a list literal, e.g., `SecurityGroupIds: [!Ref MySecurityGroup]`, or use `Fn::Split` if composing from a string.

.ebextensions files are processed by Elastic Beanstalk during environment creation and every instance deployment, allowing you to use a container command to copy the configuration from a private S3 bucket. Using an IAM instance role with a least-privilege policy scoped to that bucket keeps credentials out of code, and the configuration can be updated independently of the application.

If the ZIP file is exceptionally large (approaching Lambda's 50 MB compressed limit), the time CloudFormation takes to download it from S3 and create the Lambda resource can exceed the stack resource creation timeout. This manifests as a 'Resource creation timed out' error in the stack event, even though the function is valid. In contrast, a small package deploys quickly regardless of the Lambda function's configured timeout or role permissions.

AWS Config is the correct choice because it provides a continuous, account-wide compliance evaluation of resource configurations. You can use the managed AWS Config rule 'required-tags' (or a custom Lambda-backed rule) to check that every EC2 instance has the mandatory tags, and the rule can be paired with an auto-remediation action, such as an SSM Automation document, to automatically add missing tags. Since AWS Config records every EC2 instance as a configuration item and re-evaluates on configuration changes, it can both detect and enforce tag compliance for all existing and newly launched instances, regardless of how they were created.

Correct. Enabling VPC integration for the Lambda function makes AWS attach a Hyperplane Elastic Network Interface directly inside your chosen subnets, so the function can communicate with the database over private IP addresses without crossing the internet. Placing the Lambda ENI in the same subnets (or at least with a valid local route to the DB subnet) lets traffic flow entirely within the VPC. You must still allow the Lambda ENI's security group in the database's security group inbound rule, and the subnets must have proper routing; this preserves the database's private posture, which is the key requirement for Secrets Manager rotation.

The CodeBuild project must be explicitly configured to use the CodeCommit repository as its source and to specify the main branch as the source version. This ensures the build fetches the latest code from that branch whenever a build is initiated, whether manually or via an event. Without this configuration, CodeBuild would have no source to use, so this is a prerequisite that makes the other correct answers functional.

The 'Update stack instances' operation is the correct remediation because it targets only the specific stack instance that failed inside the target account/region. CloudFormation StackSets treats a failed stack instance as an operation that can be retried without affecting other stack instances or the stack set definition. This operation re-invokes the deployment logic for that single instance, allowing transient issues such as permission timeouts or resource contention to resolve while preserving the centralized management model.

With self-managed permissions, StackSets assumes an execution role that must exist in each target account with sufficient permissions. Absent that role, resource creation fails with insufficient IAM permissions, satisfying the stem's error condition rather than an organisational or service-managed role issue.

Multi-AZ availability is not universally available across all RDS database engines; for example, Microsoft SQL Server supports Multi-AZ only on Enterprise or Standard editions (and not on Express/Web), while Oracle requires Enterprise Edition. If an engine/edition lacks Multi-AZ support, setting MultiAZ=true in CloudFormation will fail validation or be ignored. Therefore, confirming engine support is a necessary prerequisite before enabling Multi-AZ in the template.

A custom build image with the required Java version already installed, stored in Amazon ECR, is the correct architecture because CodeBuild can be configured to pull that image at build time. Baking the JDK, build tool, and dependency caches into Docker layers means the runtime is available immediately, eliminating per-build installation overhead and making versioning deterministic. This approach is the intended pattern for non-standard language versions.

An SCP attached to the root OU acts as an organization-wide permission guardrail, denying s3:PutPublicAccessBlock for every principal in all member accounts, regardless of IAM policies or account-level configurations. Since this action is a prerequisite for making a bucket publicly accessible through the console or API, explicitly denying it prevents bucket owners from disabling the public-access block that keeps objects private. This preventive control is the only option here that applies consistently across the entire AWS organization.

Manually deleting the RDS DB instance from the RDS console removes the physical database object from the account, circumventing CloudFormation's inability to delete it automatically. This is a valid operational workaround when the stack is stuck in DELETE_FAILED because the DB instance is protected by RDS deletion protection or has a DeletionPolicy of Retain. Once the resource is gone, a subsequent stack delete operation will succeed because CloudFormation no longer attempts to delete that DB instance.

This option is correct because the CloudFormation error explicitly states that the imageId is invalid, which is the EC2 API's validation response for an AMI ID that is malformed, deregistered, or not present in the account/region. During a stack update, CloudFormation passes the AMI ID from the template to the EC2 RunInstances API, and EC2 rejects it with an error like 'InvalidAMIID.NotFound' or 'InvalidAMIID.Malformed', causing the stack update to roll back. This commonly happens when a template references a hard-coded AMI that was deregistered or copied from a different region.

This is correct because CodeDeploy deployment groups support automatic rollback for trigger events such as DEPLOYMENT_FAILURE, DEPLOYMENT_STOP_REQUEST, and ALARM_ACTIVE. When any of these events occurs, CodeDeploy automatically initiates a new deployment of the last known-good revision to the same deployment group, with no custom code required. This native mechanism is the standard and recommended way to recover from a failed deployment while preserving deployment-group settings such as traffic routing and alarm monitoring.

Elastic Beanstalk's native Environment Properties are key-value pairs defined at the environment level and injected directly into the operating system as environment variables on each EC2 instance, or as container environment variables for ECS-based platforms. This allows platform-managed settings to be consumed by your application with no extra code, and they are automatically updated on configuration changes without requiring a new deployment. They also support encrypted values when set through the AWS CLI or saved configurations with KMS, making them the standard, service-supported approach.

MapPublicIpOnLaunch is a subnet-level attribute that, when set to true, automatically assigns a public IPv4 address to every instance's primary network interface upon launch. This is the correct control for achieving subnet-wide public IP assignment, as it directly applies at the subnet boundary and affects all instances regardless of individual launch configuration. Changing this attribute is the standard CloudFormation approach to provision instances in a public subnet with reachable IP addresses.

The DeletionPolicy attribute with Retain ensures that the DynamoDB table is preserved when the stack is deleted. This is the correct way to keep the table and its data. Other resources without this policy will be deleted as usual, matching the requirement.

Drift detection compares the live S3 bucket policy against the CloudFormation template and reports resource drift. An EventBridge rule listens for CloudFormation drift-detection status-change events and invokes Lambda, which re-applies the original bucket policy or triggers a stack update to restore the resource. This closes the loop between detecting drift and automatically remediating it.

RunInstances requires permissions on dependent resources beyond the instance itself: AMIs, network interfaces, volumes, key pairs and subnets. The policy grants only the instance action, so EC2 authorisation fails when it evaluates those referenced resources, producing AccessDenied. This satisfies the stem's constraint that the pipeline role lacks the necessary dependent-resource permissions.

AWS Config can be enabled to record configuration changes to Elastic Beanstalk environments and their underlying AWS resources (such as EC2 instances, security groups, and load balancers). By authoring or using managed Config rules, you can compare the actual environment settings to the desired baseline and receive SNS notifications or trigger SSM remediation when drift is detected. This provides a continuous, auditable change history and alerts you to unauthorised or accidental configuration modifications, allowing you to restore the correct settings quickly.

Files placed in the .ebextensions directory of your application source bundle are processed automatically by Elastic Beanstalk during each deployment lifecycle. A .config file in this directory can use the 'files' key to write configuration content directly to absolute paths on the instance, and it can also run commands or container_commands in sequence with deployment events. Because these configuration files are part of the versioned source bundle, they are associated with a specific application version and are re-applied consistently whenever that version is deployed, making this the correct way to inject a configuration file into each instance during deployment.

Run Command is a Systems Manager capability that lets you execute shell scripts or PowerShell commands on one or more EC2 instances via the SSM Agent, without the need for SSH/RDP or opening inbound ports. By invoking documents like AWS-RunShellScript or AWS-RunPowerShellScript, you can directly enforce configuration settings, install software, or remediate configuration drift on demand. It supports rate control, error thresholds, and IAM-based permission scoping, making it a direct and flexible mechanism for enforcing instance configuration.

AWS Config rules continuously evaluate resource configurations, including tags, against your desired policy and can trigger automatic remediation when a resource is non-compliant. Remediation actions are implemented through AWS Systems Manager Automation runbooks, such as AWS-TagEC2Instance to add the required tag or AWS-StopEC2Instance to stop the resource, or through a custom Lambda function. This provides a fully automated, auditable corrective control that detects and fixes tag non-compliance at scale without manual intervention.

Parameters with AllowedValues is the correct mechanism because it defines an input variable whose acceptable values are explicitly enumerated at template authoring time. When the stack is created or updated, CloudFormation validates any supplied value against that list and rejects the operation if the value is not present. This provides a controlled menu of environment-specific options (e.g., Dev, Staging, Prod) or instance types, ensuring the multi-tier app is deployed with a valid, pre-approved configuration.

Elastic Beanstalk saved configurations are YAML files that capture the environment's option settings, environment variables, and platform configuration. You can store these files in source control, which gives you versioned, auditable, and reproducible configuration snapshots. When you need to roll back a problematic change, you can apply an older saved configuration via the EB CLI or console, restoring the exact previous runtime settings without re-provisioning infrastructure.

CloudFormation supports the `resolve:secretsmanager` dynamic reference to fetch secret values from AWS Secrets Manager during stack operations. This allows the RDS instance to use the secret without hardcoding it. The dynamic reference retrieves the secret at deployment time, and CloudFormation manages the value securely. This is the correct and secure approach for referencing Secrets Manager secrets in templates.

The policy's only explicit Allow is ec2:DescribeInstances; because ec2:StopInstances is a separate action in the IAM action namespace, no permission is granted to perform a stop. When the user calls StopInstances, IAM finds no allow and defaults to an implicit deny, so the API request fails. The Deny statement on RunInstances does not counteract this, so the missing start/stop Allow is precisely the cause.

State Manager judges an association as successful based on the exit code returned by the script; if the script's last command always returns 0, or it explicitly ends with `exit 0`, then even a failed installation will be recorded as compliant. To correctly reflect failures, the script must inspect `$?` (or `$LASTEXITCODE` in PowerShell) after the installer and propagate a non-zero exit. Because this script ignores the installer's failure and exits 0, compliance shows Success despite the software not being installed.

The DynamoDB lock table uses conditional writes to ensure that only one Terraform run can hold the state lock at a time, preventing two `apply` executions from simultaneously updating the same S3 object and causing corruption. Enabling consistency checks (for example, verifying the lock acquisition and using DynamoDB's strongly consistent reads) ensures that the state pulled before a plan or apply is the latest known-good version, so stale or partially written state is never used as the basis for changes.

Commit the variables in a .ebextensions/*.config file (e.g., option_settings for namespace aws:elasticbeanstalk:application:environment). CodePipeline packages the entire source into the application version, and the Elastic Beanstalk deployment agent processes this file automatically, injecting the values into the Node.js process's environment. This makes environment configuration declarative, versioned, and reproducible for every pipeline run, eliminating manual or post-deployment steps.

DeletionPolicy: Retain on a resource instructs AWS CloudFormation to preserve that physical resource when the stack is deleted. Without it, DeleteStack removes every resource in the template; with Retain, the resource is simply left in place and becomes orphaned, allowing you to keep critical data such as databases or S3 buckets. This is the standard way to prevent accidental data loss during stack deletion.

AWS AppConfig is the correct choice because it is purpose-built for managing application configuration independently of code deployments. It supports creating and maintaining configurations in a central store, validating them with format or semantic checks, and rolling them out gradually across accounts and regions using deployment strategies. Unlike the other options, AppConfig also provides built-in monitoring, automatic rollback, and the ability to retrieve configuration at runtime, making it an enterprise-grade configuration management service.

The Elastic Beanstalk saved configuration feature exports the current environment's settings into a YAML file via `eb config save`, which can be downloaded and committed to version control. This file captures the complete environment configuration—platform, instance type, environment variables, scaling limits, health-check settings, and other option settings—without including transient data like application versions. Storing this file in Git enables you to recreate the same environment later with `eb config put`, apply it across regions or accounts, and revert to older configurations through normal version-control history.

An UpdateWaitCondition (typically implemented as a WaitCondition resource or UpdatePolicy with WaitOnSignals) makes CloudFormation pause the stack update until each new instance sends a success signal, usually via cfn-signal after it has passed health checks and is ready to serve traffic. This ensures that CloudFormation does not complete the update and potentially remove old resources until the new capacity is confirmed operational, directly preventing application downtime during the replacement process.

EC2 Instance Connect opens a temporary SSH session through the AWS Console, giving you direct interactive access to the running instance. Once connected, you can read /var/log/cloud-init-output.log, which captures the output of cloud-init including your user-data script, so any error or traceback from the script will be visible there. It is an effective diagnostic because it accesses the primary log source without requiring pre-installed agents or external log forwarding.

AWS Config rules natively support an automated remediation feature that links a non-compliant rule evaluation to an AWS Systems Manager Automation document. This is the intended, first-party mechanism: the Automation document can run pre-built or custom steps (e.g., AWS-TagResource) to fix tag violations, and Config can automatically apply remediation to affected resources. Because it is built into the Config service itself, it avoids the need to wire separate event routing or manual workflows, making it the most direct and operationally efficient option.

Run Command is a valid Systems Manager capability because it lets you execute operational commands and scripts on EC2 instances and on-premises machines via the SSM agent, without opening inbound ports like SSH or RDP. It supports ad-hoc execution across targets defined by tags, resource groups, or individual instance IDs, with features like rate control, error thresholds, and integration with EventBridge for automation.

Change sets preview exactly which resources CloudFormation will add, modify or delete, so a separate role can review that diff before execution. This enforces approval at the stack level, satisfying the change management requirement without altering the template itself.