How should I use these Configuration Management and IaC practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Configuration Management and IaC questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Configuration Management and IaC domain.

DOP-C02 · topic practice

Configuration Management and IaC practice questions

Practise AWS Certified DevOps Engineer Professional DOP-C02 Configuration Management and IaC practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Configuration Management and IaC

Practice 10 questions Browse domain →

What the exam tests

What to know about Configuration Management and IaC

Configuration Management and IaC questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Configuration Management and IaC exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Configuration Management and IaC questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Configuration Management and IaC explanation →

A company uses AWS CloudFormation to deploy a multi-tier web application. The template includes a nested stack for the database layer. When updating the stack, the database stack fails with a 'CREATE_FAILED' status, but the parent stack continues updating other resources. What is the most likely cause and best practice to prevent this?

Trap 1: The parent stack was created without the '--capabilities'…

The capabilities parameter is for IAM resources, not related to rollback behavior.

Trap 2: The nested stack failure automatically triggers a rollback of the…

By default, CloudFormation does not roll back the parent stack when a nested stack fails; it continues.

Trap 3: The parent stack is configured with 'OnFailure' set to 'DO_NOTHING'

'DO_NOTHING' is not a valid value; default is 'ROLLBACK' for stack creation but 'CONTINUE' for updates. This is incorrect.

Study all Configuration Management and IaC common traps →

A
The parent stack's update policy is set to 'CONTINUE' by default. To prevent this, set 'OnFailure' to 'ROLLBACK' in the stack update options.
Setting 'OnFailure' to 'ROLLBACK' during update ensures the entire stack rolls back if any resource fails, maintaining consistency.
B
The parent stack was created without the '--capabilities' parameter, so it cannot roll back.
Why wrong: The capabilities parameter is for IAM resources, not related to rollback behavior.
C
The nested stack failure automatically triggers a rollback of the parent stack, but the rollback also failed.
Why wrong: By default, CloudFormation does not roll back the parent stack when a nested stack fails; it continues.
D
The parent stack is configured with 'OnFailure' set to 'DO_NOTHING'. Change it to 'DELETE'.
Why wrong: 'DO_NOTHING' is not a valid value; default is 'ROLLBACK' for stack creation but 'CONTINUE' for updates. This is incorrect.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Configuration Management and IaC explanation →

A DevOps engineer manages infrastructure using Terraform. The team needs to store secrets such as database passwords in a secure manner and reference them in Terraform configurations. They have configured AWS Secrets Manager. What is the recommended approach to reference secrets in Terraform without exposing them in state files?

Trap 1: Store the secret ARN in a Terraform variable and use…

The ARN is not sensitive, but the secret value still needs retrieval; this does not address state exposure.

Trap 2: Store the secret in AWS Systems Manager Parameter Store and…

While this retrieves the secret, it can still appear in state if not handled properly; also, Secrets Manager is already in use.

Trap 3: Pass the secret as an environment variable to Terraform and…

Environment variables can be captured in state if used in resources, leading to exposure.

Study all Configuration Management and IaC common traps →

A
Store the secret ARN in a Terraform variable and use 'var.secret_arn' in the resource.
Why wrong: The ARN is not sensitive, but the secret value still needs retrieval; this does not address state exposure.
B
Store the secret in AWS Systems Manager Parameter Store and reference it using 'data.aws_ssm_parameter'.
Why wrong: While this retrieves the secret, it can still appear in state if not handled properly; also, Secrets Manager is already in use.
C
Pass the secret as an environment variable to Terraform and reference it with 'var.secret_value'.
Why wrong: Environment variables can be captured in state if used in resources, leading to exposure.
D
Use the 'data.aws_secretsmanager_secret_version' data source and mark the attribute as 'sensitive = true' in the output.
The data source retrieves the secret, and marking outputs as sensitive prevents them from being shown in logs or state.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Configuration Management and IaC explanation →

A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?

Trap 1: Modify the stack's CloudFormation template to include the recipe.

OpsWorks stacks are not defined by CloudFormation templates.

Trap 2: Add the recipe commands to the instance's user data script.

User data runs only once at boot, not during each Configure event.

Trap 3: Use AWS CodeDeploy to trigger the recipe during the Configure event.

CodeDeploy is for application deployment, not OpsWorks lifecycle events.

Study all Configuration Management and IaC common traps →

A
Modify the stack's CloudFormation template to include the recipe.
Why wrong: OpsWorks stacks are not defined by CloudFormation templates.
B
Upload the recipe to a custom cookbook repository and assign it to the 'Configure' lifecycle event in the stack settings.
This is the standard way to run custom recipes on OpsWorks lifecycle events.
C
Add the recipe commands to the instance's user data script.
Why wrong: User data runs only once at boot, not during each Configure event.
D
Use AWS CodeDeploy to trigger the recipe during the Configure event.
Why wrong: CodeDeploy is for application deployment, not OpsWorks lifecycle events.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Configuration Management and IaC explanation →

A DevOps team uses AWS CodePipeline to automate deployments. The pipeline has a Deploy stage that uses AWS CloudFormation to create or update a stack. Recently, a stack update failed because the template referenced an AMI that was deprecated. The team wants to automatically roll back the stack to the last known good state if a deployment fails. What should they do?

Trap 1: Use the CodePipeline console to enable 'Automatic rollback' for the…

CodePipeline does not have an automatic rollback for stage failures; it has 'Stage transition' settings.

Trap 2: Set the stack's 'DisableRollback' parameter to 'true' in the…

Disabling rollback would cause the stack to remain in a failed state, not roll back.

Trap 3: Add a stack policy to the CloudFormation stack that denies updates…

A stack policy prevents updates to specific resources, but does not trigger rollback.

Study all Configuration Management and IaC common traps →

A
Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.
CodePipeline's CloudFormation action supports automatic rollback on failure.
B
Use the CodePipeline console to enable 'Automatic rollback' for the Deploy stage.
Why wrong: CodePipeline does not have an automatic rollback for stage failures; it has 'Stage transition' settings.
C
Set the stack's 'DisableRollback' parameter to 'true' in the template.
Why wrong: Disabling rollback would cause the stack to remain in a failed state, not roll back.
D
Add a stack policy to the CloudFormation stack that denies updates to the AMI parameter.
Why wrong: A stack policy prevents updates to specific resources, but does not trigger rollback.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Configuration Management and IaC explanation →

An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?

Trap 1: Traffic splitting.

Traffic splitting is for canary deployments, not immutable.

Trap 2: All at once.

All at once replaces all instances at once, causing full downtime if it fails.

Trap 3: Rolling update based on health.

Rolling updates can cause partial downtime and do not fully preserve the old environment.

Study all Configuration Management and IaC common traps →

A
Traffic splitting.
Why wrong: Traffic splitting is for canary deployments, not immutable.
B
Immutable update.
Immutable updates create a completely new environment and only swap when healthy.
C
All at once.
Why wrong: All at once replaces all instances at once, causing full downtime if it fails.
D
Rolling update based on health.
Why wrong: Rolling updates can cause partial downtime and do not fully preserve the old environment.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Configuration Management and IaC explanation →

A developer wants to use AWS CloudFormation to create an Amazon RDS DB instance. The template includes a DB instance resource. Which property is required for the DB instance to be created successfully?

Trap 1: AllocatedStorage

This is required for some engines, but not all; for example, Aurora uses storage auto-scaling.

Trap 2: DBInstanceIdentifier

This is optional; AWS can generate a default identifier.

Trap 3: MasterUsername and MasterUserPassword

These are also required, but the question asks 'which property' singular; multiple correct properties exist, but A is a pair that is required.

Study all Configuration Management and IaC common traps →

A
DBInstanceClass and Engine
These are required properties for the DB instance resource.
B
AllocatedStorage
Why wrong: This is required for some engines, but not all; for example, Aurora uses storage auto-scaling.
C
DBInstanceIdentifier
Why wrong: This is optional; AWS can generate a default identifier.
D
MasterUsername and MasterUserPassword
Why wrong: These are also required, but the question asks 'which property' singular; multiple correct properties exist, but A is a pair that is required.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Configuration Management and IaC explanation →

A DevOps team is designing a CI/CD pipeline using AWS CodeBuild and CodePipeline. They want to use infrastructure as code to define the build environment. Which TWO options are valid approaches to define the build environment in CodeBuild?

Trap 1: Configure CodeDeploy to set up the build environment before the…

CodeDeploy is for application deployment, not build environment setup.

Trap 2: Use an Elastic Beanstalk environment to run the build.

Elastic Beanstalk is for running applications, not for CI/CD build environments.

Trap 3: Use an AWS CloudFormation template to specify the build environment…

CloudFormation is for provisioning resources, not for CodeBuild build environment definitions.

Study all Configuration Management and IaC common traps →

A
Configure CodeDeploy to set up the build environment before the build starts.
Why wrong: CodeDeploy is for application deployment, not build environment setup.
B
Define the build environment using a buildspec.yml file that includes runtime versions and environment variables.
The buildspec file is the primary way to define build commands and environment.
C
Use an Elastic Beanstalk environment to run the build.
Why wrong: Elastic Beanstalk is for running applications, not for CI/CD build environments.
D
Use a custom Docker image stored in Amazon ECR as the build environment.
CodeBuild allows you to specify a custom image to run builds in.
E
Use an AWS CloudFormation template to specify the build environment configuration.
Why wrong: CloudFormation is for provisioning resources, not for CodeBuild build environment definitions.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Configuration Management and IaC explanation →

A company manages its infrastructure using AWS CloudFormation. They have a production stack that includes an Amazon RDS Multi-AZ DB instance. The stack was created using the 'aws cloudformation create-stack' command with default settings. The DB instance uses a custom DB parameter group. A DevOps engineer needs to modify a parameter in the DB parameter group and update the stack. The engineer updates the template to change the parameter value and runs 'aws cloudformation update-stack'. The update fails with a 'ROLLBACK_IN_PROGRESS' status. The engineer checks the CloudFormation console and sees that the DB instance was successfully modified, but the stack is rolling back. The rollback fails because the DB instance cannot be reverted to the original parameter value. The stack is now in 'UPDATE_ROLLBACK_FAILED' state. What should the engineer do to resolve this situation and apply the desired parameter change?

Trap 1: Run 'aws cloudformation update-stack' again with the original…

You cannot update a stack that is in 'UPDATE_ROLLBACK_FAILED' state; you must first complete the rollback.

Trap 2: Revert the parameter value manually in the RDS console and then…

Manual intervention may work, but the stack remains in 'UPDATE_ROLLBACK_FAILED' state; it is better to use CloudFormation's built-in recovery.

Trap 3: Delete the stack and recreate it with the updated template.

Deleting a production stack with a Multi-AZ DB instance is risky and may cause data loss.

Study all Configuration Management and IaC common traps →

A
Run 'aws cloudformation update-stack' again with the original template to revert the changes.
Why wrong: You cannot update a stack that is in 'UPDATE_ROLLBACK_FAILED' state; you must first complete the rollback.
B
Use the 'aws cloudformation continue-update-rollback' command with the '--resources-to-skip' parameter to skip the DB instance, allowing the stack to reach 'UPDATE_ROLLBACK_COMPLETE'. Then apply a change set with the desired parameter change.
This is the recommended approach to recover from a failed rollback without deleting the stack.
C
Revert the parameter value manually in the RDS console and then resume the rollback.
Why wrong: Manual intervention may work, but the stack remains in 'UPDATE_ROLLBACK_FAILED' state; it is better to use CloudFormation's built-in recovery.
D
Delete the stack and recreate it with the updated template.
Why wrong: Deleting a production stack with a Multi-AZ DB instance is risky and may cause data loss.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Configuration Management and IaC explanation →

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

Trap 1: Set the CreationPolicy attribute on the database resource.

CreationPolicy is for signaling during creation, not updates.

Trap 2: Configure a Stack Policy to protect the database resource.

StackPolicy prevents updates but does not manage replacement behavior.

Trap 3: Set the UpdatePolicy to AutoScalingRollingUpdate.

AutoScalingRollingUpdate is for Auto Scaling groups, not RDS.

Study all Configuration Management and IaC common traps →

A
Set the CreationPolicy attribute on the database resource.
Why wrong: CreationPolicy is for signaling during creation, not updates.
B
Configure a Stack Policy to protect the database resource.
Why wrong: StackPolicy prevents updates but does not manage replacement behavior.
C
Set the UpdatePolicy to AutoScalingRollingUpdate.
Why wrong: AutoScalingRollingUpdate is for Auto Scaling groups, not RDS.
D
Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.
This policy handles replacement of a resource with minimal downtime.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Configuration Management and IaC explanation →

A DevOps engineer is designing an AWS CloudFormation template to deploy a three-tier web application. The application must be highly available across multiple Availability Zones. The engineer needs to ensure that the database layer uses a Multi-AZ deployment. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Trap 1: Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets…

A subnet group is recommended but not sufficient; Multi-AZ must be explicitly enabled.

Trap 2: Deploy the database with multiple read replicas in different…

Read replicas are for read scaling, not for high availability failover.

Trap 3: Configure the database to use a DB subnet group with subnets in a…

Single AZ does not provide multi-AZ high availability.

Study all Configuration Management and IaC common traps →

A
Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets from at least two Availability Zones.
Why wrong: A subnet group is recommended but not sufficient; Multi-AZ must be explicitly enabled.
B
Deploy the database with multiple read replicas in different Availability Zones.
Why wrong: Read replicas are for read scaling, not for high availability failover.
C
Select a database engine that supports Multi-AZ deployments.
Not all engines support Multi-AZ; e.g., Microsoft SQL Server requires specific editions.
D
Configure the database to use a DB subnet group with subnets in a single Availability Zone.
Why wrong: Single AZ does not provide multi-AZ high availability.
E
Set the 'MultiAZ' property of the 'AWS::RDS::DBInstance' resource to 'true'.
This enables Multi-AZ deployment with automatic failover.

Full breakdown with real-world context →

Question 11hardmultiple choice

Review the full subnetting walkthrough →

A DevOps engineer receives the error shown in the exhibit when attempting to update an existing CloudFormation stack that deploys a VPC with subnets. The stack was created successfully earlier using the same template. What is the most likely cause of this error?

Exhibit

Refer to the exhibit.

Error log from AWS CloudFormation stack update:

"Resource handler returned message: 'User: arn:aws:sts::123456789012:assumed-role/AdminRole/UpdateUser is not authorized to perform: ec2:DescribeSubnets on resource: arn:aws:ec2:us-east-1:123456789012:subnet/subnet-0bb1c79de3EXAMPLE' (Service: Ec2, Status Code: 403, Request ID: ...)"

Trap 1: The subnet ID in the template is already used by another stack in…

The error is an authorization failure, not a conflict.

Trap 2: The subnet specified in the template does not exist in the selected…

The error is about authorization, not existence.

Trap 3: The CloudFormation template has a syntax error in the subnet…

The template was successfully used before, so syntax is likely fine.

Study all Configuration Management and IaC common traps →

A
The subnet ID in the template is already used by another stack in the same account.
Why wrong: The error is an authorization failure, not a conflict.
B
The IAM role used for the stack update lacks the 'ec2:DescribeSubnets' permission.
The error message explicitly states the user is not authorized to perform ec2:DescribeSubnets.
C
The subnet specified in the template does not exist in the selected AWS region.
Why wrong: The error is about authorization, not existence.
D
The CloudFormation template has a syntax error in the subnet definition.
Why wrong: The template was successfully used before, so syntax is likely fine.

Full breakdown with real-world context →

Question 12mediumdrag order

Read the full Configuration Management and IaC explanation →

Drag and drop the steps to set up an AWS CodePipeline with a source stage from CodeCommit and a deploy stage to Elastic Beanstalk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediumdrag order

Read the full Configuration Management and IaC explanation →

Drag and drop the steps to set up an AWS Lambda function triggered by an S3 event.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediummatching

Read the full Configuration Management and IaC explanation →

Match each AWS service to its primary function in a DevOps pipeline.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Continuous delivery service for release pipelines

Fully managed continuous integration build service

Automates code deployments to any instance

Unified user interface for managing software development activities

Fully managed source control service hosting Git repositories

Question 15mediummatching

Read the full Configuration Management and IaC explanation →

Match each AWS Config rule to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Checks that resources have specified tags

Ensures EBS volumes are encrypted

Prevents public read access on S3 buckets

Verifies CloudTrail is enabled

Checks for IAM policies granting full admin access

Question 16mediummultiple choice

Read the full Configuration Management and IaC explanation →

A company uses AWS CodePipeline with a multi-branch strategy. The pipeline deploys a Lambda function using CloudFormation. The DevOps engineer notices that when a new branch is created, the pipeline executes but the CloudFormation stack fails because the stack name already exists. What is the MOST efficient way to resolve this issue?

Trap 1: Hardcode a different stack name for each branch in the pipeline.

Not scalable and requires manual updates.

Trap 2: Delete the existing stack before each deployment.

This may cause downtime and is not efficient.

Trap 3: Use the CloudFormation 'Override' parameter to reuse the same stack.

CloudFormation does not support overriding stack names.

Study all Configuration Management and IaC common traps →

A
Modify the pipeline to use a dynamic stack name parameter, such as the branch name.
This creates unique stacks per branch, avoiding conflicts.
B
Hardcode a different stack name for each branch in the pipeline.
Why wrong: Not scalable and requires manual updates.
C
Delete the existing stack before each deployment.
Why wrong: This may cause downtime and is not efficient.
D
Use the CloudFormation 'Override' parameter to reuse the same stack.
Why wrong: CloudFormation does not support overriding stack names.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full Configuration Management and IaC explanation →

An organization uses AWS OpsWorks for configuration management. They want to migrate to AWS Systems Manager to reduce costs and improve flexibility. Their current stack includes custom Chef recipes that manage package installations and service configurations. What is the MOST effective migration strategy?

Trap 1: Use AWS CloudFormation to recreate the entire infrastructure and…

CloudFormation is for infrastructure, not configuration management.

Trap 2: Use AWS CodeDeploy to replace OpsWorks and manage configurations.

CodeDeploy is for application deployments, not configuration management.

Trap 3: Keep OpsWorks but integrate it with Systems Manager for hybrid…

This does not achieve the goal of reducing costs and improving flexibility.

Study all Configuration Management and IaC common traps →

A
Use AWS CloudFormation to recreate the entire infrastructure and manage configurations.
Why wrong: CloudFormation is for infrastructure, not configuration management.
B
Use AWS CodeDeploy to replace OpsWorks and manage configurations.
Why wrong: CodeDeploy is for application deployments, not configuration management.
C
Translate Chef recipes into Systems Manager State Manager associations and use Run Command for ad-hoc tasks.
State Manager manages configurations similarly to Chef, and Run Command provides ad-hoc execution.
D
Keep OpsWorks but integrate it with Systems Manager for hybrid management.
Why wrong: This does not achieve the goal of reducing costs and improving flexibility.

Full breakdown with real-world context →

Question 18easymultiple choice

Read the full Configuration Management and IaC explanation →

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

Trap 1: UpdatePolicy attribute with AutoScalingRollingUpdate

Used for auto-scaling groups, not general resource replacement.

Trap 2: DeletionPolicy attribute set to Retain

Controls what happens on stack deletion, not update behavior.

Trap 3: DependsOn attribute to specify creation order

Only defines dependencies, not replacement behavior.

Study all Configuration Management and IaC common traps →

A
UpdatePolicy attribute with AutoScalingRollingUpdate
Why wrong: Used for auto-scaling groups, not general resource replacement.
B
CreationPolicy attribute with CreateBeforeDestroy
Ensures new resource is created before old one is deleted.
C
DeletionPolicy attribute set to Retain
Why wrong: Controls what happens on stack deletion, not update behavior.
D
DependsOn attribute to specify creation order
Why wrong: Only defines dependencies, not replacement behavior.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full Configuration Management and IaC explanation →

A company uses Terraform with an S3 backend to manage infrastructure. The DevOps engineer notices that after a colleague runs 'terraform apply' locally, the state file in S3 becomes corrupted and subsequent runs fail. What is the BEST way to prevent this issue?

Trap 1: Store the state file locally and commit it to version control.

Not a best practice; state files should not be in version control.

Trap 2: Use S3 server-side encryption to protect the state file.

Does not prevent corruption.

Trap 3: Enable S3 versioning on the state bucket to recover previous…

Does not prevent corruption; only aids recovery.

Study all Configuration Management and IaC common traps →

A
Store the state file locally and commit it to version control.
Why wrong: Not a best practice; state files should not be in version control.
B
Use DynamoDB for state locking and enable consistency checks.
Prevents concurrent modifications that cause corruption.
C
Use S3 server-side encryption to protect the state file.
Why wrong: Does not prevent corruption.
D
Enable S3 versioning on the state bucket to recover previous versions.
Why wrong: Does not prevent corruption; only aids recovery.

Full breakdown with real-world context →

Question 20hardmultiple choice

Read the full Configuration Management and IaC explanation →

A large enterprise uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set that contains a custom resource backed by a Lambda function. The update changes the Lambda function code. What is the CORRECT approach to ensure the Lambda function is updated without manual intervention?

Trap 1: Use a Lambda function alias and point the custom resource to the…

Custom resources do not support aliases.

Trap 2: Create a new stack set for the updated Lambda and delete the old…

Unnecessary; StackSets support updates.

Trap 3: Manually update the Lambda function in each account, then update…

Not scalable and error prone.

Study all Configuration Management and IaC common traps →

A
Use a Lambda function alias and point the custom resource to the alias.
Why wrong: Custom resources do not support aliases.
B
Create a new stack set for the updated Lambda and delete the old one.
Why wrong: Unnecessary; StackSets support updates.
C
Update the stack set with a new template version that references the updated Lambda code, and let CloudFormation handle the update.
CloudFormation will automatically update the Lambda function as part of the stack update.
D
Manually update the Lambda function in each account, then update the stack set.
Why wrong: Not scalable and error prone.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Configuration Management and IaC sessions

Start a Configuration Management and IaC only practice session

Every question in these sessions is drawn from the Configuration Management and IaC domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Configuration Management and IaC questions →Mixed DOP-C02 session

Frequently asked questions

What does the DOP-C02 exam test about Configuration Management and IaC?: Configuration Management and IaC questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Configuration Management and IaC questions in a focused session?: Yes — the session launcher on this page draws every question from the Configuration Management and IaC domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other DOP-C02 topics?: Use the topic links above to move to related areas, or go back to the DOP-C02 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the DOP-C02 exam covers. They are not copied from any real exam or dump site.

Configuration Management and IaC only

10 questions 20 questions 30 questions 50 questions

Mixed DOP-C02 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All DOP-C02 questions Configuration Management and IaC domain overview DOP-C02 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Configuration Management and IaC practice questions

What to know about Configuration Management and IaC

Common Configuration Management and IaC exam traps

Configuration Management and IaC questions

A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?

An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?

A developer wants to use AWS CloudFormation to create an Amazon RDS DB instance. The template includes a DB instance resource. Which property is required for the DB instance to be created successfully?

A DevOps team is designing a CI/CD pipeline using AWS CodeBuild and CodePipeline. They want to use infrastructure as code to define the build environment. Which TWO options are valid approaches to define the build environment in CodeBuild?

A DevOps engineer receives the error shown in the exhibit when attempting to update an existing CloudFormation stack that deploys a VPC with subnets. The stack was created successfully earlier using the same template. What is the most likely cause of this error?

Exhibit

Drag and drop the steps to set up an AWS CodePipeline with a source stage from CodeCommit and a deploy stage to Elastic Beanstalk.

Drag and drop the steps to set up an AWS Lambda function triggered by an S3 event.

Match each AWS service to its primary function in a DevOps pipeline.

Match each AWS Config rule to its purpose.

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

A company uses Terraform with an S3 backend to manage infrastructure. The DevOps engineer notices that after a colleague runs 'terraform apply' locally, the state file in S3 becomes corrupted and subsequent runs fail. What is the BEST way to prevent this issue?

Track your progress over time

Start a Configuration Management and IaC only practice session

Related DOP-C02 topic practice pages