DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch

  Why it's wrong here

  Amazon CloudWatch is a monitoring and observability service that collects metrics, logs, and events from AWS resources and can trigger alarms or invoke actions, but it does not perform instance provisioning or configuration itself. Its automation role is limited to reacting to operational signals, such as triggering an Auto Scaling action, rather than installing software or applying settings on EC2 instances. Therefore, it is not a service used to automate the initial configuration of an instance.

• ✓

  EC2 user data

  Why this is correct

  EC2 user data is a feature that lets you pass a script or cloud-init directives to an instance at launch; the script runs automatically the first time the instance boots, enabling package installation, file creation, and service configuration. This provides imperative, instance-level configuration automation for initial setup, though it does not manage ongoing changes or coordinate multiple resources. It is a direct and valid way to automate EC2 configuration.

• ✓

  AWS CloudFormation

  Why this is correct

  AWS CloudFormation is an infrastructure as code service that declaratively provisions EC2 instances and related resources, and it automates configuration by injecting user data or by using the cfn-init helper with metadata to install and configure software in a controlled order. It also orchestrates dependencies and can signal successful configuration before dependent resources are created. This makes CloudFormation a correct service for automating EC2 configuration at scale.

• ✗

  Amazon Inspector

  Why it's wrong here

  Amazon Inspector is a vulnerability management and security assessment service that scans EC2 instances and workloads for software vulnerabilities, network exposure, and deviations from security best practices. It does not have any mechanism to install or configure software; it only reports findings after the instance is already running. Consequently, it is not a configuration automation service.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config continuously records and evaluates the configuration state of EC2 instances against desired rules, and it can invoke remediation actions through Systems Manager Automation documents when non-compliance is detected. However, it is fundamentally an evaluation and governance tool, not a provisioning or initial configuration service; it reacts to drift rather than automating setup at launch time. Therefore, it is incorrect for automating EC2 configuration.

Go deeper

Related to this question