Configuration Management and Infrastructure as Code — AWS Certified DevOps Engineer DOP-C02 practice questions

A team uses CloudFormation drift detection on a critical network stack. They want any detected drift to automatically trigger a Slack notification AND open an Incident Manager incident. Which integration is BEST?

1. Manually run drift detection weekly and post results to Slack by hand
2. Enable the AWS Config recorder, which automatically posts to Slack on any change
3. Schedule drift detection via EventBridge → an SSM Automation document that starts drift detection, then route results through AWS Chatbot to Slack and to Incident Manager
4. Rely on CloudTrail alerts alone, which don't detect CloudFormation-specific drift

Answer: C — Schedule drift detection via EventBridge → an SSM Automation document that starts drift detection, then route results through AWS Chatbot to Slack and to Incident Manager

CFN drift isn't continuous — schedule it. SSM Automation can chain the multi-target response. Chatbot integrates with Slack. B is custom. C/D miss CFN-specific drift.

A Systems Manager State Manager association installs the CloudWatch agent on every EC2 instance. New instances launched from an ASG aren't getting the agent until 30 minutes later. Which change BEST reduces the delay?

1. Use an EC2 launch template UserData that runs the SSM Run Command
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge for th
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: A — Use an EC2 launch template UserData that runs the SSM Run Command

State Manager is scheduled remediation. For boot-time install, bake into AMI or run at UserData. A increases load without helping new instances faster. C/D are wrong.

A CDK app needs to generate an IAM policy whose actions depend on a config file processed at synth time. Which construct/pattern is MOST appropriate?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge for th
3. Read the config in TypeScript and pass values into PolicyStatement
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: C — Read the config in TypeScript and pass values into PolicyStatement

CDK is code — synth-time config is just programmatic input. B is for cross-cutting concerns (e.g., tag enforcement). A introduces a macro for no reason. D runs at deploy, not synth.

A team's SAM template defines an API Gateway + Lambda. Local testing with 'sam local invoke' works, but deploy fails with 'Transform AWS::Serverless-2016-10-31 not supported'. What is the FIX?

1. Run 'sam build' then 'sam deploy --guided', which packages the template (resolving the Transform) before invoking CloudFormation
2. Switch the API Gateway resource to a plain CloudFormation resource instead of SAM
3. Add a Transform override flag to 'aws cloudformation deploy' to skip packaging
4. Deploy directly with 'aws cloudformation create-stack' using the unpackaged SAM template

Answer: A — Run 'sam build' then 'sam deploy --guided', which packages the template (resolving the Transform) before invoking CloudFormation

SAM templates require the Transform header; sam deploy handles it. Direct 'aws cloudformation deploy' on a SAM template without packaging will fail. B/C/D miss the point.

Which AWS service is BEST for ad-hoc infrastructure operations like patching, automation runbooks, and remote command execution?

1. AWS Config, which tracks resource configuration history but cannot execute commands
2. AWS Systems Manager — Run Command for ad-hoc execution, Patch Manager for automated patching, and Automation for runbooks
3. AWS CloudTrail, which logs API calls but has no remote execution capability
4. Amazon Inspector, which scans for vulnerabilities but cannot run remediation commands

Answer: B — AWS Systems Manager — Run Command for ad-hoc execution, Patch Manager for automated patching, and Automation for runbooks

Systems Manager: operations control plane. Run Command (ad-hoc), Patch Manager (auto-patching), State Manager (desired state), Automation (workflows), Session Manager (shell access), Parameter Store (config), Inventory. DOP staple.

CloudFormation Drift Detection:

1. A feature that automatically reverts resources back to the template definition
2. A CodePipeline stage that blocks deployment when drift is detected
3. A CloudTrail report of who modified a stack's resources
4. Identifies when actual resource configurations have diverged from what the CloudFormation template defines

Answer: D — Identifies when actual resource configurations have diverged from what the CloudFormation template defines

A) Drift detection reports differences; it doesn't auto-revert resources. B) CodePipeline doesn't natively gate on CloudFormation drift. C) CloudTrail logs who made a change, not whether it diverged from the template. D) Correct: Drift detection identifies when actual resource configuration has diverged from what the template defines.

A CloudFormation template references a SecureString parameter from SSM Parameter Store with dynamic reference {{resolve:ssm-secure:/db/pass}}. The deploy fails with a parser error. What is the MOST likely cause?

1. CloudFormation does not resolve ssm-secure for most resource
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: A — CloudFormation does not resolve ssm-secure for most resource

Dynamic ssm-secure references are restricted to a specific set of property types. C is wrong — it works on allowed properties. B/D are fabrications.

A CloudFormation stack deploys an Aurora cluster, an ElastiCache Redis cluster, and an ALB. During the deploy, the ALB's listener fails to create due to a missing target group. CloudFormation begins UPDATE_ROLLBACK. The team wants the rollback to also revert RDS schema migrations that ran in a custom resource. Which approach BEST achieves this?

1. Add an IsRollback parameter to the custom resource's Lambda
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: A — Add an IsRollback parameter to the custom resource's Lambda

Custom resources receive Delete events on rollback when the resource was Created in the failed update. The handler can run reverse logic. B is for alarm-driven rollback, not migration reversal. C ignores the problem. D doesn't undo schema.

AWS SYSTEMS MANAGER PATCH MANAGER:

1. Automated OS PATCHING for EC2 + on-premises servers
2. It is a purely detective control with no remediation
3. It only supports Amazon Linux 2 build environments
4. It only replicates data during scheduled maintenance

Answer: A — Automated OS PATCHING for EC2 + on-premises servers

Patch Manager: critical security. Baselines per OS. Approval rules (auto-approve security patches after N days). Compliance scans. Run via Maintenance Window or on-demand. Integrates with Inventory for tracking. Alternative: AWS Systems Manager Quick Setup for org-wide deployment. DOP security automation.

A team has a CloudFormation stack with 200+ resources. They want to break it into smaller stacks WITHOUT recreating any resources. Which is the CORRECT approach?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge for th
3. Use stack-import to move existing resources into new stacks
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: C — Use stack-import to move existing resources into new stacks

CloudFormation supports resource import — defining the resource in a new template and importing the existing physical resource. A causes outage. C/D don't move resources.

CloudFormation change sets?

Preview changes before applying. Rollback risk reduction.

CDK constructs levels?

L1 (CFN resources), L2 (curated APIs), L3 (patterns).

SSM Run Command vs State Manager?

Run Command: one-time. State Manager: maintain desired config.

OpsWorks?

Chef/Puppet managed service. Less common — Systems Manager preferred.