AWS Certified DevOps Engineer - Professional

Question 1

A company uses AWS Certificate Manager (ACM) to issue public TLS certificates for several externally imported certificates that ACM cannot auto-renew (they were imported from a third-party CA). The security team was recently caught off guard when one imported certificate expired, causing a production outage. They need an automated, low-maintenance solution that proactively alerts the operations team at least 30 days before ANY imported certificate expires, across all accounts in the organization. Which approach BEST meets this requirement?

Accepted Answer

Enable the AWS Config managed rule acm-certificate-expiration-check across the organization, and configure a conformance pack with EventBridge to notify an SNS topic when a certificate is flagged noncompliant.

Answer

Create a Lambda function scheduled with EventBridge that calls acm:ListCertificates daily and publishes to SNS, deploying it manually in every account.

Answer

Rely on the ACM.expiryEventsDaysBeforeExpiry AWS Health event, which ACM automatically emits for imported certificates, and route it to SNS via EventBridge.

Answer

Enable Security Hub and use the AWS Foundational Security Best Practices control for ACM, which suppresses findings until a certificate is within 30 days of expiry.

Question 2

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB) spread across three Availability Zones. An Auto Scaling group maintains 3 instances per AZ. During a recent single-AZ impairment, monitoring showed that clients connected through the affected AZ received elevated latency and some 5xx errors even though healthy instances existed in the other two AZs. The DevOps team wants to ensure that a single-AZ failure does not degrade the user experience, with minimal ongoing management. Which action BEST addresses this requirement?

Accepted Answer

Confirm cross-zone load balancing is enabled on the ALB so requests are distributed evenly to healthy targets in all AZs regardless of which AZ received the request.

Answer

Enable ALB health checks with a lower unhealthy threshold and rely on the Auto Scaling group to replace failed instances in the impaired AZ.

Answer

Configure Route 53 latency-based routing with health checks pointing to per-AZ ALB nodes so traffic avoids the impaired AZ.

Answer

Increase the Auto Scaling group desired capacity and use a target tracking policy on ALB request count to add capacity when an AZ fails.

Question 3

A media streaming company runs a stateful session service on an EC2 Auto Scaling group behind a Network Load Balancer. During scale-in events, users report abruptly dropped streams because instances terminate while active sessions are still in progress. Each session can last up to 8 minutes and the application can persist session state to DynamoDB if given time. The DevOps team must ensure that instances chosen for termination complete in-flight sessions before shutting down, without changing the streaming protocol. What is the MOST appropriate way to achieve this?

Accepted Answer

Add an Auto Scaling lifecycle hook for the terminating state that pauses the instance in Terminating:Wait, and use a script on the instance to drain sessions and call CompleteLifecycleAction before the heartbeat timeout expires.

Answer

Increase the NLB deregistration delay (connection draining) to 600 seconds so sessions finish before the instance is removed from the target group.

Answer

Enable instance scale-in protection on all instances in the Auto Scaling group so that no instance with active sessions is ever terminated.

Answer

Configure a target tracking scaling policy with a longer cooldown period to delay scale-in until sessions naturally complete.

Question 4

A media company runs a stateless web tier on an EC2 Auto Scaling group behind an ALB. During flash-sale events, traffic ramps sharply then drops in irregular waves. The team currently uses simple scaling policies with CloudWatch alarms on average CPU, plus a 300-second cooldown period. They observe that the group repeatedly scales out and scales in within short intervals (flapping), causing instances to churn and users to hit brief connection errors while capacity settles. The team wants scaling to respond quickly to sustained demand while avoiding rapid oscillation, with minimal manual tuning of thresholds. Which change best meets these requirements?

Accepted Answer

Replace the simple scaling policies with a target tracking scaling policy on average CPU utilization, allowing Auto Scaling to compute the required capacity and manage the scaling thresholds automatically.

Answer

Increase the cooldown period to 1800 seconds so the group cannot scale in or out more than once every 30 minutes during the event.

Answer

Switch to scheduled scaling that sets a fixed desired capacity for the duration of every flash-sale window based on the previous event's peak.

Answer

Add a second simple scaling policy on network throughput and lower the CPU alarm threshold so the group reacts faster to traffic spikes.

Question 5

A financial services company runs a stateless order-matching service on an EC2 Auto Scaling group behind an Application Load Balancer. During market-open bursts, demand spikes within seconds. The application AMI is large and requires roughly 6 minutes to boot, run configuration scripts, and warm its JVM cache before it can pass ALB health checks. Scale-out driven by target-tracking on request count is too slow, causing dropped orders during the first few minutes of each spike. The team wants to reduce scale-out latency without permanently running (and paying for full price on) many idle instances. Which approach best meets these requirements?

Accepted Answer

Configure an Auto Scaling group warm pool with instances kept in the Stopped state, using lifecycle hooks to complete initialization before stopping so warmed instances can be quickly returned to service.

Answer

Increase the target-tracking metric's target value and set a shorter cooldown period so the group launches instances more aggressively during spikes.

Answer

Replace target-tracking with scheduled scaling that sets the desired capacity to the peak value 10 minutes before market open every day.

Answer

Enable predictive scaling only, relying on its machine-learning forecast to provision the exact number of instances needed at each moment.

Question 6

A financial services company runs a mission-critical application on an Amazon Aurora MySQL-Compatible cluster. During a faulty deployment, an application bug executed a bad UPDATE statement that silently corrupted several tables. The problem was discovered 45 minutes later. The team needs to recover the database to the exact state moments before the corruption with the least amount of downtime and without provisioning a new cluster endpoint that would require application reconfiguration. Which approach best meets these requirements?

Accepted Answer

Use Aurora Backtrack to rewind the existing cluster to a timestamp just before the bad UPDATE executed.

Answer

Restore the most recent automated snapshot to a new Aurora cluster and update the application connection string to the new endpoint.

Answer

Perform a point-in-time restore (PITR) to a new cluster at the timestamp before corruption and repoint the application.

Answer

Promote an Aurora Replica to a standalone cluster and replay binary logs up to the point before the corruption.

Question 7

A financial services company runs a critical transaction processing application on an Amazon Aurora PostgreSQL cluster in us-east-1. Compliance requires an RPO of under 1 second and an RTO of under 5 minutes in the event of a full regional outage, and the disaster recovery region (us-west-2) must be able to accept application traffic quickly. The DevOps team must automate failover so that operators are not required to reconfigure the database endpoint manually during a regional event. Which approach BEST meets these requirements?

Accepted Answer

Configure an Aurora Global Database with a secondary cluster in us-west-2, and use a Route 53 health check with an Amazon EventBridge rule that triggers a Lambda function to perform a managed planned/unplanned failover promoting the secondary.

Answer

Enable automated cross-region snapshot copy of the Aurora cluster to us-west-2 every hour, and restore the most recent snapshot with a Lambda function when CloudWatch detects the primary is unhealthy.

Answer

Deploy a Multi-AZ Aurora cluster in us-east-1 with read replicas across three Availability Zones, relying on Aurora's automatic AZ failover to satisfy the regional recovery requirement.

Answer

Use AWS Database Migration Service with ongoing change data capture replication from us-east-1 to a standalone Aurora cluster in us-west-2, and switch the application connection string manually during an outage.

Question 8

A financial services company must implement a centralized, automated disaster recovery strategy for a fleet of EC2 instances, EBS volumes, and DynamoDB tables spread across multiple accounts in an AWS Organization. Compliance requires that all backups be retained for 7 years, be immutable (protected against deletion even by administrators), and be copied to a second AWS Region for DR. The team wants to minimize custom scripting and manage the policy centrally. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a delegated administrator account, create a backup policy in AWS Organizations that assigns backup plans with cross-Region copy actions, and enable AWS Backup Vault Lock in compliance mode on the destination vaults.

Answer

Write Lambda functions triggered by EventBridge in each account to create EBS snapshots and DynamoDB exports, copy them cross-Region, and apply S3 Object Lock for immutability.

Answer

Use AWS Backup in each account independently with local backup plans, then use Data Lifecycle Manager to copy snapshots to the second Region and enable Vault Lock in governance mode.

Answer

Enable AWS Backup with cross-Region copy and apply Vault Lock in governance mode centrally through a delegated administrator, relying on SCPs to prevent deletion.

Question 9

A platform team maintains a large CDK application (TypeScript) composed of dozens of stacks authored by multiple product teams. Governance requires that every S3 bucket in every stack must have server-side encryption enabled and every resource must carry a 'CostCenter' tag. The team wants to enforce these rules automatically at synthesis time so that non-compliant stacks fail the build, without asking each product team to modify their construct code. Which approach best meets these requirements?

Accepted Answer

Implement a CDK Aspect that visits every construct in the app, adds the required tags, and raises annotation errors when a bucket lacks encryption, then apply it via Aspects.of(app).add(...).

Answer

Enable CloudFormation drift detection on all deployed stacks and configure a nightly EventBridge rule to alert when buckets are found unencrypted or untagged.

Answer

Create an AWS Config conformance pack with managed rules for S3 encryption and required tags, deployed across the accounts via a StackSet.

Answer

Add a Service Control Policy that denies s3:CreateBucket unless encryption and the CostCenter tag are specified in the request.

Question 10

A DevOps team uses AWS CDK to define infrastructure for a service deployed through a CDK Pipelines self-mutating pipeline. Several stacks call methods like ec2.Vpc.fromLookup() and ssm.StringParameter.valueFromLookup() to resolve existing VPCs and configuration at synthesis time. The team notices that builds in the pipeline's CodeBuild synth step intermittently fail or produce templates that reference incorrect subnet IDs, and the errors do not reproduce on developers' laptops. What is the MOST likely root cause and the recommended fix?

Accepted Answer

Context lookups require AWS credentials and a populated cdk.context.json; the pipeline's synth environment resolves lookups against a different account/region than developers, so cache the context by committing cdk.context.json and ensure the synth role can perform the lookups in the correct target environment.

Answer

Lookups are non-deterministic because CDK caches nothing; disable all context lookups by hardcoding subnet IDs as CloudFormation parameters passed in at deploy time.

Answer

The synth step is using an outdated CDK CLI version; pin the CDK version in package.json and the problem will be fully resolved without any changes to context handling.

Answer

fromLookup() performs the lookup during CloudFormation deployment, so the CodeBuild role lacks deploy-time EC2 permissions; attach ec2:DescribeSubnets to the CloudFormation execution role instead.

Question 11

A DevOps team uses AWS CDK to define a multi-tier web application (VPC, ECS cluster, RDS database, and application services). They need to deploy this identical application to three separate AWS accounts (dev, staging, prod) within their organization. Each account must have its own isolated set of resources, and the team wants a single CDK codebase where the environment-specific account IDs and region are supplied at synth time, producing separate CloudFormation templates per environment. Which CDK approach best satisfies these requirements while keeping the code maintainable?

Accepted Answer

Define a reusable Stack subclass (or a Stage containing the stacks) and instantiate it once per environment in the CDK app, passing each environment's account and region via the stack/stage 'env' property.

Answer

Create a single CloudFormation StackSet from the CDK synthesized template and let StackSets fan the deployment out to all three accounts automatically.

Answer

Use CDK context lookups with cdk.context.json to hardcode all three account IDs into one stack, then deploy that one stack three times with --force.

Answer

Define one stack with no explicit 'env' property so it becomes environment-agnostic, then rely on the CLI credentials of each account to place resources correctly at deploy time.

Question 12

A team uses CDK Pipelines (the CodePipeline construct in the aws-cdk-lib/pipelines module) to deploy a multi-stage application. Developers add a new deployment stage to the pipeline definition in code and merge to the main branch. When the existing pipeline runs, they expect the new stage to appear, but they are concerned about how the pipeline picks up structural changes to its own definition. Which behavior of CDK Pipelines correctly explains how the new stage becomes part of the running pipeline?

Accepted Answer

The pipeline includes a self-mutation step that runs 'cdk deploy' on the pipeline stack itself early in execution, updating the pipeline (adding the new stage) before the application stages run.

Answer

The new stage is only added after an engineer manually runs 'cdk deploy' from a workstation; CDK Pipelines cannot modify its own structure during execution.

Answer

CodePipeline automatically detects the source change and re-synthesizes the pipeline on every action, so no dedicated mutation step is required.

Answer

The new stage is applied only on the next pipeline run after the current one completes, because CloudFormation cannot update a stack while its pipeline is executing.

Question 13

A platform team maintains an AWS CDK (v2, TypeScript) library of reusable constructs that application teams import to provision workloads. One construct needs to place resources into an existing VPC that already lives in each application team's account. The application accounts vary, and the platform team wants the synthesized CloudFormation to reference the correct VPC subnets deterministically at deploy time without hard-coding subnet IDs in the construct. During code review, a developer used ec2.Vpc.fromLookup() and CDK synthesis failed in the CI pipeline with an error about missing environment/account context. What is the MOST appropriate way to make this reusable construct resolve the existing VPC reliably across accounts?

Accepted Answer

Configure the consuming stack with an explicit env (account and region), ensure CDK can assume a role with describe permissions in the target account so fromLookup() performs a context lookup, and commit the generated cdk.context.json for reproducible synth.

Answer

Replace fromLookup() with ec2.Vpc.fromVpcAttributes() and pass CloudFormation parameters for the VPC ID and subnet IDs, requiring each app team to supply values at deploy time.

Answer

Keep fromLookup() but set the stack env to the CDK default (agnostic) environment so it works for any account without additional configuration.

Answer

Use a custom resource backed by a Lambda function that calls ec2:DescribeVpcs during stack deployment and returns the subnet IDs to the rest of the template.

Question 14

A team uses AWS CDK to define two stacks in the same app: a NetworkStack that creates a VPC and exports a shared security group, and an AppStack that references that security group via a CDK cross-stack reference (the security group object is passed directly between stack constructs). During a routine change, a developer removes the security group usage from AppStack and redeploys, intending to later delete the security group entirely from NetworkStack. The AppStack deployment succeeds, but when they subsequently try to delete the security group from NetworkStack, the NetworkStack update fails. What is the MOST likely cause and correct approach?

Accepted Answer

The failure occurs because CloudFormation will not delete an exported value that is still imported by another stack; deploying both stacks together with `cdk deploy --all` lets CDK sequence the AppStack update (dropping the import) before the NetworkStack export removal, resolving the dependency safely.

Answer

CDK automatically manages the CloudFormation Export/Import created by the cross-stack reference; the developer must deploy AppStack (removing the import) BEFORE deploying NetworkStack (removing the export), which was done, so the failure indicates a manual template edit is required.

Answer

CDK cross-stack references create a CloudFormation Export in NetworkStack consumed by an Import in AppStack; a stale export can still be referenced. The developer should ensure AppStack no longer imports the value, deploy AppStack first, then deploy NetworkStack to remove the export and the resource — CDK orchestrates this ordering when both stacks are deployed together.

Answer

Cross-stack references in CDK use SSM Parameter Store rather than CloudFormation Exports, so the deletion failure is caused by a leftover parameter; the developer should manually delete the SSM parameter before redeploying NetworkStack.

Question 15

A DevOps team manages a production CloudFormation stack that deploys an application tier. They need to migrate an existing manually-created DynamoDB table into this stack so it becomes CloudFormation-managed, without any downtime or data loss. The table receives constant read/write traffic. Which approach correctly brings the table under management while minimizing risk?

Accepted Answer

Add the DynamoDB table resource to the template with a DeletionPolicy of Retain, then use a resource import operation (import change set) that maps the existing table's physical ID to the new logical resource, and review the change set before executing.

Answer

Delete the existing table, add the resource to the template, and redeploy the stack so CloudFormation recreates the table with the same name.

Answer

Add the table to the template and run a standard stack update; CloudFormation will automatically detect the existing physical resource by name and adopt it.

Answer

Enable drift detection on the stack, which will import any out-of-band resources it discovers into the stack's managed resource set.

Question 16

A DevOps team manages a production RDS database and its surrounding networking through a single CloudFormation stack deployed via a CodePipeline. During a routine template update that modifies the DB instance's DBInstanceIdentifier property, the team wants an automated safeguard in the pipeline that halts the deployment BEFORE any resource is replaced, so an engineer can review whether the change would destroy the existing database. Which approach best meets this requirement?

Accepted Answer

Add a stage that creates a CloudFormation change set with the CREATE_CHANGE_SET action, inspect the change set's 'Replacement' field for resources, and gate progression on a manual approval before executing the change set.

Answer

Enable termination protection on the stack so CloudFormation blocks any update that would replace a resource until an administrator disables it.

Answer

Attach a stack policy that denies Update:Replace on the RDS resource, causing the pipeline deployment to pause and prompt for approval when a replacement is attempted.

Answer

Run CloudFormation drift detection at the start of the deploy stage and fail the pipeline if the DB instance shows drift before applying the update.

Question 17

A DevOps team uses AWS CDK to provision infrastructure. One stack must register a third-party SaaS webhook during creation and deregister it during stack deletion, calling an external REST API that CloudFormation cannot natively manage. They implement a Lambda-backed custom resource using the CDK Provider framework. During testing, the stack creates successfully, but when they run 'cdk destroy', the stack becomes stuck in DELETE_IN_PROGRESS for over an hour and eventually rolls into DELETE_FAILED. The Lambda function's own logs show the deregistration call completed in under two seconds. What is the MOST likely cause?

Accepted Answer

The custom resource Lambda handler is not sending a response signal back to the pre-signed S3 response URL on the Delete event, so CloudFormation waits until the timeout expires.

Answer

CloudFormation custom resources do not support the Delete lifecycle event, so the deregistration logic can never be triggered during stack deletion.

Answer

The Lambda execution role lost permission to call the SaaS API, causing CloudFormation to silently retry the deletion indefinitely.

Answer

The CDK Provider framework requires a DeletionPolicy of Retain on custom resources, and its absence blocks the delete operation.

Question 18

A team manages an S3 bucket, an IAM role, and a DynamoDB table through a single CloudFormation stack. An engineer, bypassing the pipeline, manually edited the S3 bucket policy and added a new lifecycle rule directly in the console during an incident. The next scheduled pipeline run deploys an unrelated change (adding a CloudWatch alarm) via a change set. The team wants to ensure the manual changes are reconciled to match the template AND wants ongoing visibility when future out-of-band changes occur, without deleting or recreating any resources. Which approach best meets these requirements?

Accepted Answer

Run CloudFormation drift detection on the stack to identify the divergence, then perform a normal stack update from the template so CloudFormation resets the drifted properties to the template-defined values; schedule periodic drift detection with EventBridge notifications for ongoing visibility.

Answer

Delete the stack with a Retain deletion policy on all resources, then re-import the resources into a fresh stack to guarantee the template and live state are identical.

Answer

Enable termination protection on the stack, which prevents any future manual modifications to the managed resources and automatically reverts unauthorized changes.

Answer

Add a stack policy that denies all Update actions on the S3 bucket, then rely on the next change set to overwrite the manual changes when the alarm is added.

Question 19

A platform engineering team distributes infrastructure changes across 40 AWS accounts using CDK Pipelines that deploy CloudFormation stacks. Security requires that no stack deployment be allowed to create an S3 bucket without a bucket policy denying non-TLS access, and this must be enforced at deploy time BEFORE resources are provisioned — regardless of whether developers use the correct CDK constructs. The team wants a solution that is centrally managed, applies automatically to all stack operations in every account, and blocks the CloudFormation operation itself if the rule is violated. Which approach meets these requirements?

Accepted Answer

Create a CloudFormation Hook (Guard-based) published to a private registry and activate it organization-wide via CloudFormation StackSets, configuring it in FAIL mode to block non-compliant provisioning.

Answer

Add an AWS Config managed rule (s3-bucket-ssl-requests-only) as an organization Config rule with auto-remediation via SSM Automation.

Answer

Implement a CDK Aspect in the shared construct library that validates bucket policies during synthesis and throws an error if TLS enforcement is missing.

Answer

Attach a Service Control Policy (SCP) to the organization denying s3:CreateBucket unless a bucket policy condition is present.

Question 20

A DevOps team deploys a fleet of EC2 instances using a CloudFormation template. They want the instances to install packages, write configuration files, and start services automatically at launch, with the ability to update this configuration by simply updating the CloudFormation stack. They also want a clean signal to CloudFormation indicating whether the bootstrap configuration succeeded, so a failed configuration causes the stack update to roll back. Which approach best meets these requirements using native CloudFormation capabilities?

Accepted Answer

Define the configuration in the AWS::CloudFormation::Init metadata on the instance resource, run cfn-init in the UserData to apply it, and use cfn-signal with a CreationPolicy/UpdatePolicy so CloudFormation waits for and evaluates the success signal.

Answer

Embed all package installs and file writes as a bash script in the UserData block, and rely on the instance reaching the 'running' state as the success indicator for CloudFormation.

Answer

Store the configuration commands in an SSM Parameter Store hierarchy and use a Lambda-backed custom resource to SSH into each instance and apply the changes during stack updates.

Answer

Bake all configuration into a golden AMI and reference the AMI ID in the template, updating the AMI ID parameter whenever configuration changes are required.

Question 21

A DevOps team uses AWS CDK (v2) to deploy an application consisting of a parent stack with several nested stacks. Each nested stack references Lambda functions bundled from local source code as assets. The team runs 'cdk deploy' targeting a new region (eu-west-1) for the first time, but the deployment fails immediately with an error stating that the assets cannot be published because the environment is not bootstrapped. The same application deploys successfully in us-east-1. What is the correct way to resolve this while following AWS best practices for multi-region CDK deployments?

Accepted Answer

Run 'cdk bootstrap aws://ACCOUNT-ID/eu-west-1' to provision the CDKToolkit stack (including the asset S3 bucket and ECR repository) in the target region before deploying.

Answer

Manually create an S3 bucket in eu-west-1 named 'cdk-assets' and set the CDK_DEFAULT_BUCKET environment variable to point CDK at it.

Answer

Add a 'crossRegionReferences: true' property to the parent stack so CDK automatically copies assets from the us-east-1 bootstrap bucket to eu-west-1 at deploy time.

Answer

Change the nested stacks to inline the Lambda code using 'lambda.Code.fromInline' so that no asset publishing or bootstrapping is required in the new region.

Question 22

A DevOps team manages a CDK application that synthesizes a parent CloudFormation stack containing several nested stacks. A shared 'NetworkStack' nested stack exports a VPC ID and subnet IDs that are consumed by an 'AppStack' nested stack via CloudFormation cross-stack references (Fn::ImportValue on exported outputs). During a deployment that both changes the CIDR of a subnet in NetworkStack and updates an EC2 launch template in AppStack, the deployment fails with an error that an export cannot be updated because it is in use by another stack. The team needs a reliable pattern to allow the shared network values to change over time without blocking dependent stack updates. Which approach BEST resolves this?

Accepted Answer

Replace the Fn::ImportValue cross-stack references between the nested stacks with direct CDK object references (passing constructs/props), letting CDK pass values as nested stack parameters instead of using account-level exports.

Answer

Add a DeletionPolicy of Retain to the exported resources so CloudFormation does not attempt to delete the exports during the update.

Answer

Split the deployment into two separate pipeline executions, deploying NetworkStack changes first and AppStack changes in a later run, keeping the Fn::ImportValue references.

Answer

Convert the nested stacks into fully independent top-level stacks and use SSM Parameter Store to publish the VPC and subnet IDs, reading them at synth time in AppStack.

Question 23

A DevOps team deploys an application using a CloudFormation nested stack architecture. One nested stack provisions an Auto Scaling group of EC2 instances that run a lengthy bootstrap process via cfn-init before the application is ready. During recent stack updates, the parent stack update repeatedly succeeds and reports UPDATE_COMPLETE even though several instances fail to finish their bootstrap and never become healthy, causing the application to serve errors after the deployment. The team wants CloudFormation to treat the update as failed and roll back automatically when instances do not complete initialization. Which change to the EC2 nested stack template will achieve this?

Accepted Answer

Add a CreationPolicy with a ResourceSignal count and timeout to the Auto Scaling group, and have the bootstrap script call cfn-signal reporting success or failure; also configure an UpdatePolicy with WaitOnResourceSignals for rolling updates.

Answer

Add a DependsOn attribute from the Auto Scaling group to the launch template so the group waits until the launch template is fully created before scaling.

Answer

Enable termination protection on the nested stack and set the parent stack's OnFailure parameter to ROLLBACK.

Answer

Increase the parent stack's timeout by adding a longer TimeoutInMinutes value to the AWS::CloudFormation::Stack resource pointing to the nested stack.

Question 24

A DevOps team maintains a single CloudFormation template used to deploy an application across us-east-1, eu-west-1, and ap-southeast-2. The template launches EC2 instances that must use a region-specific, hardened AMI ID owned by the security team. The AMI IDs are updated roughly once per quarter through a separate golden-AMI pipeline. Deployments are triggered via a CodePipeline that runs the same template in all three regions. The team wants the correct AMI to be selected automatically per region at deploy time, without editing the template body and without manually passing AMI IDs as parameters on each run. Which approach best meets these requirements?

Accepted Answer

Store each region's latest hardened AMI ID in a Systems Manager Parameter Store parameter (same name per region) and reference it in the template using an SSM parameter type (AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>) so each stack resolves the value at deploy time.

Answer

Define a CloudFormation Mappings section that hardcodes the AMI ID for each region and use Fn::FindInMap with AWS::Region to select the value.

Answer

Pass the AMI ID as a CloudFormation parameter and have the CodePipeline deploy action supply the value from a variable configured per region in the pipeline.

Answer

Use a Lambda-backed custom resource that calls the EC2 DescribeImages API during every stack update to look up the newest AMI matching a name filter.

Question 25

A DevOps team manages a production VPC, subnets, and an RDS instance that were all created manually through the AWS console over two years ago. Management now requires all infrastructure to be managed as code using CloudFormation so that changes go through the change-set review process. The team must bring these existing, live resources under CloudFormation management WITHOUT deleting them or causing any downtime to the running RDS database. Which approach meets these requirements?

Accepted Answer

Author a CloudFormation template that describes the existing resources, then use the resource import operation (create change set with import) to bring the resources into a new or existing stack, matching each logical resource to its physical resource identifier.

Answer

Delete the manually created resources and recreate them by deploying a new CloudFormation stack that defines the VPC, subnets, and RDS instance from scratch.

Answer

Enable drift detection on an empty stack, which will automatically detect the orphaned resources and adopt them into the stack once remediation is applied.

Answer

Add a DeletionPolicy of Retain to a new template and deploy it; CloudFormation will recognize the identically named existing resources and take over their management.

Question 26

A DevOps team manages a shared networking stack and multiple application stacks in the same account and region using AWS CDK. Application stacks need to reference the VPC ID and subnet IDs produced by the networking stack. Currently they use CloudFormation cross-stack exports (Fn::ImportValue). The team frequently needs to modify the networking stack's subnet configuration, but CloudFormation blocks these updates because the values are exported and consumed by other stacks. They want a decoupling approach that still keeps everything defined as code and allows the networking stack to update independently while application stacks pick up current values. What should they do?

Accepted Answer

Have the networking stack write the VPC ID and subnet IDs to SSM Parameter Store parameters, and have application stacks read those parameters at deploy time (e.g., via CDK StringParameter.valueFromLookup or CloudFormation SSM dynamic references).

Answer

Convert the networking stack into a nested stack of each application stack so the resources are recreated per application and no cross-stack dependency exists.

Answer

Add a DeletionPolicy of Retain to the exported outputs so CloudFormation permits updates to the exported values while consumers keep the old references.

Answer

Enable termination protection on the networking stack and manually copy the subnet IDs into each application stack's parameters whenever they change.

Question 27

A DevOps team maintains a production CDK application that provisions a critical DynamoDB table and an S3 bucket. To improve readability, a developer refactors the code by wrapping several resources inside a new nested Construct and renames the construct scope. During the next pipeline run, `cdk diff` shows the DynamoDB table and S3 bucket will be destroyed and recreated. Both resources contain production data that must not be lost. Which approach allows the refactor to proceed WITHOUT data loss and with minimal manual intervention?

Accepted Answer

Apply the `overrideLogicalId` method (or explicitly set the logical IDs) so the refactored resources keep their original CloudFormation logical IDs, preventing replacement.

Answer

Add a `DeletionPolicy: Retain` to the resources, deploy the refactor, then manually re-import the orphaned resources into the stack.

Answer

Enable termination protection on the stack so CloudFormation refuses to delete the DynamoDB table and S3 bucket during the update.

Answer

Run `cdk deploy` with the `--force` flag to skip the diff confirmation, since CDK automatically preserves stateful resources during refactors.

Question 28

A DevOps team manages a production CloudFormation stack containing a shared VPC, transit gateway attachments, and a KMS key used by multiple downstream stacks. During a recent incident, an engineer ran `aws cloudformation delete-stack` against the wrong stack name from a scripting error, and the deletion began before it was cancelled. The team wants to guarantee that no accidental or automated API call can delete this foundational stack, while still allowing normal stack UPDATE operations to proceed through their CI/CD pipeline. What should they implement?

Accepted Answer

Enable termination protection on the stack so delete-stack calls are rejected until protection is explicitly disabled.

Answer

Enable termination protection on the stack, and set DeletionPolicy: Retain on the resources inside the stack.

Answer

Apply a stack policy that denies the Update:Delete action on all resources in the stack.

Answer

Attach an IAM policy to all pipeline roles that denies cloudformation:DeleteStack on every stack in the account.

Question 29

A DevOps team manages a production CloudFormation stack that includes an Amazon RDS DB instance and several Lambda functions. Recent template updates have occasionally caused unexpected resource replacements, resulting in unplanned downtime. The team wants a process that lets them see exactly which resources will be added, modified, or replaced before any changes are applied, and requires an explicit approval step before execution. Which approach BEST meets these requirements?

Accepted Answer

Create a CloudFormation change set from the updated template, review the proposed actions (including the Replacement column), and execute the change set only after approval.

Answer

Enable termination protection on the stack and run update-stack directly, relying on the rollback-on-failure behavior to undo any unwanted replacements.

Answer

Run CloudFormation drift detection before each update-stack call to identify which resources will be replaced by the deployment.

Answer

Add a DeletionPolicy of Retain to all resources so that any replacement preserves the original resource instead of causing downtime.

Question 30

A DevOps team manages a networking CloudFormation stack that uses the Outputs section with the Export field to publish a VPC ID and subnet IDs. Several application stacks consume these values using Fn::ImportValue. During a planned refactor, the team attempts to update the networking stack to remove one of the exported subnet outputs, but the stack update fails. What is the reason for the failure, and how should the team proceed?

Accepted Answer

CloudFormation blocks removal or modification of an exported output while another stack imports it; the team must first update the consuming stacks to stop importing the value, then update the networking stack.

Answer

Exported outputs can only be changed by enabling termination protection on the networking stack first; the team should enable it and retry the update.

Answer

The update failed because exports are region-scoped; the team should recreate the export in every region before removing it from the networking stack.

Answer

CloudFormation requires a stack policy allowing 'Update:Delete' on the Outputs resource; the team should add the policy and rerun the update.

Question 31

A DevOps team manages a production application using a single CloudFormation stack that provisions an Amazon RDS database, an S3 bucket containing user uploads, and several stateless compute resources. During a planned refactor, the team must remove the compute resources by deleting and recreating the stack under a new name, but they cannot afford to lose the RDS data or the S3 objects. They also want CloudFormation to leave the existing database and bucket in place — without creating final snapshots that incur extra cost — when the old stack is deleted. Which approach ensures the stateful resources survive the stack deletion with the least operational risk?

Accepted Answer

Add a DeletionPolicy of Retain to the RDS and S3 resources in the template, update the stack to apply it, then delete the old stack.

Answer

Add a DeletionPolicy of Snapshot to both the RDS instance and the S3 bucket, then delete the old stack so recoverable copies remain.

Answer

Enable termination protection on the stack, then delete the stack and confirm that stateful resources are automatically preserved.

Answer

Manually export the RDS data and copy the S3 objects to another bucket before deleting the stack, then re-import them after recreation.

Question 32

A DevOps team manages an RDS instance using CloudFormation. Company policy prohibits storing database passwords in template parameters, plaintext, or version control. The password is already stored in AWS Secrets Manager under the secret name 'prod/rds/master'. The team wants CloudFormation to inject the password into the RDS instance's MasterUserPassword property at deploy time without ever exposing the value in the template, change set, or stack events. Which approach meets these requirements?

Accepted Answer

Use a dynamic reference in the MasterUserPassword property with the syntax '{{resolve:secretsmanager:prod/rds/master:SecretString:password}}'.

Answer

Add a NoEcho parameter for the password and pass the Secrets Manager value into it via the deployment pipeline at stack creation.

Answer

Reference the secret using an SSM dynamic reference '{{resolve:ssm-secure:prod/rds/master}}' so the value stays encrypted.

Answer

Use a Lambda-backed custom resource that calls GetSecretValue and returns the password as a resource attribute for MasterUserPassword.

Question 33

A platform team maintains a large CloudFormation template that provisions VPC, security, database, and application resources. The single template has grown past 500 resources and repeatedly hits the per-stack resource limit and exceeds the template body size limit during deployment. The team wants to break the template into logically separated components that are still deployed and updated together as one atomic unit, while allowing values (such as subnet IDs and security group IDs) to flow between the components without relying on cross-stack Exports that would block future refactoring. Which approach best meets these requirements?

Accepted Answer

Refactor the template into nested stacks using AWS::CloudFormation::Stack resources in a root stack, passing values between child stacks via the root stack's parameters and the children's Outputs.

Answer

Split the template into fully independent stacks and use CloudFormation cross-stack references with Export/Fn::ImportValue to share subnet and security group IDs between them.

Answer

Convert the template to a CloudFormation StackSet and deploy each logical component as a separate stack instance across the same account and region.

Answer

Keep a single template but move most resource definitions into an AWS::Include transform macro stored in S3 to bypass the template body size limit.

Question 34

A DevOps team manages a large CloudFormation parent stack that references three nested stacks (network, application, and database). During a recent update to modify an Auto Scaling group configuration in the application nested stack, the update failed and the entire deployment rolled back — including unrelated resources in the network nested stack that had already succeeded. The team wants to reduce the blast radius so that a failure in one nested stack's update does not force a rollback of resources in the other nested stacks, while still managing everything as a cohesive infrastructure set. What is the MOST appropriate approach?

Accepted Answer

Refactor the nested stacks into independent standalone stacks and use cross-stack references (Exports/Fn::ImportValue) to share values between them, deploying each stack independently.

Answer

Enable a stack policy on the parent stack that denies updates to the network nested stack resources so they cannot be rolled back.

Answer

Set the DisableRollback option to true on the parent stack update so no resources are ever rolled back on failure.

Answer

Add a DeletionPolicy of Retain to all resources in the network nested stack so they survive the rollback.

Question 35

A DevOps team manages a large application using CloudFormation. They currently use a single monolithic template that provisions a VPC, an RDS database, and an ECS service. The networking team wants to update VPC subnets independently without risking the RDS or ECS resources, while the application team wants to deploy ECS changes frequently. The team decides to split the monolith. They want the VPC to be reusable by multiple unrelated application stacks that are deployed and updated on separate lifecycles, and they must avoid a situation where updating the VPC forces an update or replacement evaluation of the application stacks. Which approach best meets these requirements?

Accepted Answer

Split the resources into separate root stacks and share the VPC outputs using cross-stack references (Export/ImportValue), so each stack has an independent deployment lifecycle.

Answer

Convert the template into a parent stack with nested stacks for VPC, RDS, and ECS, passing values between them as nested stack parameters.

Answer

Keep a single template but add Conditions and separate change sets so each team executes only its portion of the stack.

Answer

Use a single StackSet that deploys the VPC, RDS, and ECS as three stack instances into the same account and region.

Question 36

A DevOps team manages a production CloudFormation stack that contains an RDS database, an EC2 Auto Scaling group, and several application resources. During routine template updates, engineers have accidentally triggered replacement of the RDS instance twice, causing outages. The team wants a mechanism that blocks updates to the database resource specifically while still allowing the rest of the stack to be updated freely through the normal pipeline, without relying on engineers remembering to add flags at deploy time. Which approach BEST satisfies this requirement?

Accepted Answer

Apply a stack policy to the stack that denies Update:Replace and Update:Delete actions on the RDS resource's logical ID while allowing all update actions on other resources.

Answer

Add a DeletionPolicy of Retain to the RDS resource in the template so the database is never replaced during updates.

Answer

Enable termination protection on the stack so that no resources can be replaced during an update operation.

Answer

Move the RDS resource into a nested stack and set the nested stack's UpdateReplacePolicy to Retain so the parent stack cannot modify it.

Question 37

A DevOps team manages a security baseline (IAM roles and Config rules) across an AWS Organization using a service-managed CloudFormation StackSet deployed to an organizational unit (OU) containing 40 accounts. A regulatory change requires that a new set of resources be rolled out to only 3 specific accounts within that OU first, as a controlled pilot, before a full OU-wide rollout. The team must not deploy to the other 37 accounts yet, and must avoid manually removing accounts from the OU or creating a separate OU. Which approach accomplishes this with the least operational overhead?

Accepted Answer

Update the StackSet with a deployment target that specifies the OU as the organizational unit and set the account filter type to INTERSECTION (or DIFFERENCE), providing the 3 pilot account IDs so the stack instances deploy only to those accounts.

Answer

Create a new self-managed StackSet and manually add the 3 pilot account IDs and target region, using an administrator role in the management account and execution roles in each pilot account.

Answer

Move the 3 pilot accounts into a new temporary OU, deploy the StackSet to that OU, then move the accounts back after validation.

Answer

Enable automatic deployment on the StackSet and set the maximum concurrent accounts to 3 so that CloudFormation only rolls out to 3 accounts at a time.

Question 38

A platform team deploys a baseline security stack to 200 accounts using a service-managed CloudFormation StackSet targeting the entire organization. Recently, a bad template change caused the stack operation to succeed in the first several accounts before an IAM misconfiguration was noticed, requiring a painful manual cleanup across dozens of accounts. The team wants a way to automatically halt the StackSet operation early — before it reaches most accounts — if deployments start failing, while still allowing a small number of transient failures. Which configuration change should they make?

Accepted Answer

Set a low FailureTolerancePercentage (or FailureToleranceCount) combined with a low MaxConcurrentPercentage so the operation stops rolling out after only a few account failures.

Answer

Enable drift detection on the StackSet before every deployment so failing accounts are detected and skipped automatically.

Answer

Switch the StackSet permission model from service-managed to self-managed so each account validates the template with its own IAM role.

Answer

Add a stack policy to each stack instance that denies updates to IAM resources during the operation.

Question 39

A DevOps team manages a service-managed CloudFormation StackSet with automatic deployment enabled, targeting an entire Organizational Unit (OU) that contains 40 production accounts. Each stack deploys a baseline security configuration including IAM roles and a CloudTrail trail. The security team needs to move one account out of the target OU into a separate 'quarantine' OU for investigation, but they require that the baseline security stack (including CloudTrail logging) REMAINS active in that account after the move so evidence continues to be collected. What is the correct approach?

Accepted Answer

Before moving the account, use the StackSet 'automatic deployment' setting configured to retain stacks on OU removal, then move the account to the quarantine OU.

Answer

Move the account to the quarantine OU; with automatic deployment, StackSets will retain the stack instance by default when an account leaves the target OU.

Answer

Disable automatic deployment on the entire StackSet, then move the account to the quarantine OU to prevent any stack instance removal.

Answer

Move the account, then immediately re-add the quarantine OU as an additional deployment target so the stack instance is re-created.

Question 40

A company manages infrastructure across an AWS Organization with 200 accounts. The cloud platform team, which does not have access to the Organization management account, needs to deploy and manage service-managed CloudFormation StackSets that automatically deploy to new accounts as they join specific OUs. The security team requires that the management account not be used for day-to-day StackSet operations. How should the platform team be enabled to perform these StackSet operations?

Accepted Answer

Register the platform team's member account as a delegated administrator for CloudFormation StackSets in the Organization, then create service-managed StackSets from that account with automatic deployment enabled.

Answer

Grant the platform team an IAM role in the management account with AWSCloudFormationStackSetAdministrator permissions and have them assume it for each deployment.

Answer

Use self-managed StackSets and manually create the AWSCloudFormationStackSetExecutionRole in every current and future member account via a bootstrap script.

Answer

Create the StackSets in the management account with service-managed permissions and share them to the platform account using AWS Resource Access Manager (RAM).

Question 41

A DevOps team manages a baseline security configuration (IAM roles, AWS Config rules, and a CloudTrail trail) across 40 accounts in an AWS Organization using a service-managed CloudFormation StackSet with automatic deployment enabled for new accounts. During a recent audit, the team discovered that engineers in several accounts had manually modified the deployed IAM roles directly in the console, weakening the intended permissions boundary. The team needs a repeatable, automated way to identify which stack instances no longer match the StackSet template and then restore them to the defined configuration with minimal manual effort. Which approach meets these requirements?

Accepted Answer

Run drift detection on the StackSet to identify DRIFTED stack instances, then perform a StackSet operation that redeploys the current template to the affected instances to bring resources back into alignment.

Answer

Enable termination protection on each stack instance and instruct engineers to stop making manual changes, then re-run the StackSet creation to overwrite existing resources.

Answer

Delete and recreate the entire StackSet with the RetainStacksOnAccountRemoval option so that all accounts receive a fresh copy of the template.

Answer

Configure an AWS Config aggregator to flag noncompliant IAM roles and rely on Config auto-remediation to reapply the CloudFormation template to each account.

Question 42

A DevOps team manages a service-managed CloudFormation StackSet that deploys a standardized VPC configuration across all accounts in an Organizational Unit. The base template defines a parameter 'CidrBlock' with a default value. During deployment to a new region, the team needs specific accounts in that region to use a different CIDR range than the default, without editing the base template or maintaining separate StackSets. What is the correct approach to achieve this?

Accepted Answer

Use parameter overrides when creating stack instances for the specific accounts/region, supplying the alternate CidrBlock value.

Answer

Create a separate StackSet for the accounts requiring a different CIDR and manage them independently.

Answer

Edit the base template to add a Mappings section keyed on account ID and region, then update the entire StackSet.

Answer

Enable drift detection on the StackSet and manually update the drifted stack instances with the new CIDR.

Question 43

A company manages baseline networking (VPCs, subnets, VPC endpoints) across 40 accounts in an AWS Organization using a service-managed CloudFormation StackSet. The security team wants to guarantee that any manual change to a deployed stack instance is automatically detected, reported centrally, and then reverted to the template-defined configuration within 24 hours, without requiring an engineer to log into member accounts. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create an EventBridge scheduled rule in the management account that triggers a Lambda function to run StackSet drift detection daily, and on detecting DRIFTED instances, invokes a StackSet operation that re-deploys the current template to overwrite the drifted resources.

Answer

Enable AWS Config in each account with an organization conformance pack that flags noncompliant VPC resources, then manually re-deploy the StackSet when findings appear.

Answer

Convert the networking baseline to an AWS CDK application and run 'cdk deploy' from a nightly CodeBuild job assuming a role in each account to force the desired state.

Answer

Enable drift detection on the StackSet and rely on the automatic remediation feature of StackSets to revert drifted stack instances on a schedule.

Question 44

A company manages a shared logging and monitoring baseline (CloudWatch log groups, IAM roles, and Config recorders) that must be deployed identically into 40 accounts across 3 OUs in AWS Organizations. New accounts are frequently created and must automatically receive the baseline within minutes of joining an OU, with no manual step and without creating administrator roles in each target account. Which approach best meets these requirements?

Accepted Answer

Use a service-managed CloudFormation StackSet targeting the OUs with automatic deployment (auto-deployment) enabled so new accounts in those OUs receive the baseline automatically.

Answer

Use a self-managed CloudFormation StackSet and pre-create the AWSCloudFormationStackSetExecutionRole and administration role in every current and future account via a bootstrap script.

Answer

Build a CDK Pipeline in the management account that runs 'cdk deploy' against each account, triggered by an EventBridge rule watching for new account creation events.

Answer

Create a single nested CloudFormation stack in the management account that references each target account's resources through cross-stack exports.

Question 45

A company manages application configuration for a fleet of EC2 instances across 200 accounts. They currently store the config as JSON files baked into AMIs and re-deploy AMIs whenever a value changes, which takes hours. The DevOps team wants a solution where operators can update non-secret configuration values (feature flags, timeouts, endpoints) centrally and have running instances pick up changes within minutes without redeploying instances. Changes must be version-tracked and auditable, and the solution must integrate with their existing CloudFormation-based provisioning. Which approach best meets these requirements?

Accepted Answer

Store the configuration values as SSM Parameter Store parameters organized in a hierarchy, reference them in the application via the SSM API/agent, and provision the parameters through CloudFormation; use Parameter Store versioning and CloudTrail for audit.

Answer

Continue baking config into AMIs but automate the AMI build with EC2 Image Builder pipelines triggered by CloudFormation stack updates so rebuilds finish faster.

Answer

Store each configuration value as a CloudFormation stack output and use CloudFormation StackSets to push updated stacks to all 200 accounts whenever a value changes.

Answer

Place the configuration in AWS Secrets Manager with automatic rotation enabled and have the application fetch values on each request through the Secrets Manager cache.

Question 46

A company uses CloudFormation StackSets with service-managed permissions to deploy a logging configuration stack to all accounts in an AWS Organizations OU. The stack template accepts a parameter, CentralLogBucketArn, that must point to a different destination bucket depending on which region the stack instance is deployed in (each region has its own regional log bucket). The DevOps team currently maintains a single stack set and wants a single deployment operation to populate the correct bucket ARN per region without maintaining separate stack sets. What is the MOST appropriate way to achieve this?

Accepted Answer

Use a single global parameter value and add a Mappings section in the template keyed on AWS::Region to resolve the correct bucket ARN at stack creation time.

Answer

Define parameter overrides per region using the StackSet operation's region-level override capability, supplying the region-specific CentralLogBucketArn when creating stack instances in each target region.

Answer

Create a separate stack set for each region, each hardcoding its own CentralLogBucketArn as a template default, and deploy them independently.

Answer

Store the per-region bucket ARNs in Parameter Store and reference them from the StackSet parameters using a dynamic ssm reference resolved at deploy time.

Question 47

A company originally deployed a CloudFormation StackSet using the self-managed permission model across 40 member accounts, manually creating the AWSCloudFormationStackSetExecutionRole in each account. The company has now enabled trusted access between AWS Organizations and CloudFormation and wants to switch the StackSet to the service-managed permission model so that new accounts joining the organization automatically receive the stacks. A DevOps engineer attempts to update the existing StackSet's permission model in place but the operation fails. What is the correct approach to achieve automatic deployment to new accounts?

Accepted Answer

Create a new service-managed StackSet with automatic deployment enabled targeting the organization or specific OUs, and import or redeploy the stack instances there, because the permission model of an existing StackSet cannot be changed between self-managed and service-managed.

Answer

Update the existing self-managed StackSet and set AutoDeployment to Enabled, which converts it to service-managed once trusted access is active.

Answer

Delete the manually created AWSCloudFormationStackSetExecutionRole in each account so CloudFormation falls back to organization-managed roles automatically.

Answer

Add the organization root ID as a deployment target on the existing self-managed StackSet, which enables auto-deployment for new accounts without changing the permission model.

Question 48

A DevOps engineer manages a CloudFormation StackSet in service-managed permission mode, deployed from the organization's management account to an OU containing 40 member accounts. The StackSet provisions a standardized IAM role and an S3 bucket with a specific KMS-encrypted policy in each account. After a recent security initiative, the security team attached a new Service Control Policy (SCP) to the OU that denies all s3:PutEncryptionConfiguration and kms:CreateGrant actions unless a specific tag condition is met. The next StackSet operation fails in every target account during resource creation. The engineer needs the standardized resources to deploy successfully across all 40 accounts while keeping the SCP guardrail intact. What is the MOST appropriate action?

Accepted Answer

Update the CloudFormation template so the created resources include the required tag that satisfies the SCP condition, then rerun the StackSet operation.

Answer

Switch the StackSet from service-managed to self-managed permission mode so that the administration and execution roles bypass the SCP restrictions during deployment.

Answer

Move the target accounts out of the OU temporarily, run the StackSet operation, then move them back into the OU once deployment completes.

Answer

Add a stack policy to the StackSet that grants an explicit Allow for s3:PutEncryptionConfiguration and kms:CreateGrant to override the SCP.

Question 49

A DevOps engineer needs to deploy a baseline security stack to 40 existing AWS accounts using CloudFormation StackSets. The organization does NOT use AWS Organizations trusted access, and the accounts were onboarded before StackSets was configured. The engineer must deploy the stack across these accounts with the least ongoing operational effort while working within these constraints. Which approach correctly enables the deployment?

Accepted Answer

Use the SELF_MANAGED permission model, creating an AWSCloudFormationStackSetAdministrationRole in the admin account and an AWSCloudFormationStackSetExecutionRole in each target account that trusts the administration role.

Answer

Use the SERVICE_MANAGED permission model and enable automatic deployment so new accounts in the organization are automatically included.

Answer

Enable trusted access for CloudFormation StackSets in AWS Organizations, then deploy using the SERVICE_MANAGED model targeting the organization root.

Answer

Deploy individual CloudFormation stacks in each target account via a cross-account CodePipeline, since StackSets requires AWS Organizations.

Question 50

A DevOps team manages a CloudFormation StackSet that deploys a baseline security stack to 120 member accounts across 4 regions. During a recent rollout, a malformed template caused stack operations to fail in dozens of accounts before the team noticed, forcing a lengthy manual cleanup. The team wants future rollouts to halt automatically as soon as failures begin, while still deploying to a few accounts at a time to validate changes before broad propagation. Which combination of StackSet operation preferences achieves this?

Accepted Answer

Set FailureToleranceCount to 0 and MaxConcurrentCount to a small value (e.g., 2), and set RegionConcurrencyType to SEQUENTIAL.

Answer

Set MaxConcurrentPercentage to 100 and FailureTolerancePercentage to 100 so all accounts update simultaneously and errors surface at once.

Answer

Enable automatic deployment and set FailureTolerancePercentage to 50 so half the accounts must fail before the operation stops.

Answer

Set RetainStacks to true and increase MaxConcurrentCount to 20 so failed stacks are preserved for inspection while deploying quickly.

Question 51

A DevOps team manages a global application using a single CloudFormation StackSet that deploys to 12 accounts across 4 regions. The template creates a primary DynamoDB global table configuration and Lambda functions that reference it. During deployment, the team requires that the us-east-1 region always deploys and completes successfully FIRST, because it provisions a shared global resource that all other regions depend on. If us-east-1 fails, no other region should be attempted. The team currently deploys to all regions with default concurrency settings and occasionally sees other regions fail because the shared resource is not yet available. Which approach best enforces the required ordering?

Accepted Answer

Configure the StackSet operation with RegionOrder listing us-east-1 first, set MaxConcurrentCount to 1, and set FailureTolerance to 0 so regions deploy sequentially and any failure halts the operation.

Answer

Increase the region concurrency to deploy all regions in parallel and add a WaitCondition in each regional stack that polls for the shared resource before proceeding.

Answer

Split the shared resource into a separate StackSet, but keep both StackSets using default region concurrency so they deploy at the same time to reduce total deployment time.

Answer

Enable service-managed permissions with automatic deployment so new accounts inherit the resource, and rely on eventual consistency for the region ordering.

Question 52

A company uses AWS Organizations with a central management account. The security team maintains a CloudFormation StackSet that deploys a baseline set of IAM roles and a logging configuration to all member accounts. New accounts are frequently created through Account Factory as teams onboard. The security team reports that new accounts do not automatically receive the baseline stack and must be manually added. They want new accounts in the targeted OUs to receive the baseline automatically, with no manual intervention. What is the MOST operationally efficient way to achieve this?

Accepted Answer

Recreate the StackSet with service-managed permissions and enable automatic deployment (auto-deployment), targeting the appropriate OUs so new accounts are enrolled automatically.

Answer

Keep the self-managed StackSet and create an EventBridge rule on CreateAccountResult that triggers a Lambda function to call CreateStackInstances for each new account.

Answer

Convert the StackSet to a nested stack and export the outputs so new accounts import the baseline values on creation.

Answer

Enable drift detection on the StackSet and schedule a daily remediation job that re-deploys stack instances to any accounts missing the baseline.

Question 53

A company uses a CloudFormation StackSet with the SERVICE_MANAGED permission model to deploy a standardized VPC baseline to all accounts in an Organizational Unit (OU). Application teams have local administrative access in their member accounts and occasionally modify the VPC resources deployed by the StackSet, causing configuration drift. Leadership wants to guarantee that these baseline resources cannot be modified or deleted by application teams in the first place, rather than detecting and remediating drift after it occurs. Which approach BEST meets this requirement?

Accepted Answer

Attach a Service Control Policy (SCP) to the OU that denies the relevant ec2 modification and deletion actions on the baseline resources for all principals except the StackSet execution role.

Answer

Enable automatic drift detection on the StackSet and configure an EventBridge rule to re-deploy the stack instances whenever drift is reported.

Answer

Add a stack policy to each stack instance that denies Update actions on the VPC resources.

Answer

Set a DeletionPolicy of Retain on the VPC resources and enable stack termination protection on every stack instance.

Question 54

A platform team manages a foundational networking layer (VPCs, transit gateway attachments, route tables) that is deployed to 40 accounts using AWS CloudFormation with the AWS CDK to synthesize the templates. The team wants a repeatable way to author the templates once, run unit-style assertions against the synthesized output before deployment, and package the constructs so that application teams in other repositories can consume the exact same networking primitives as versioned building blocks. Which approach best meets these goals?

Accepted Answer

Publish the networking constructs as a versioned CDK construct library to a package registry (e.g., CodeArtifact), and use the CDK assertions module in the CI pipeline to validate synthesized templates before deploying.

Answer

Write raw CloudFormation JSON templates, store them in S3, and have each application team copy the templates into their own stacks, validating with cfn-lint before deployment.

Answer

Use CloudFormation StackSets with a single monolithic template and rely on drift detection to confirm the networking resources match the intended configuration after deployment.

Answer

Export all networking resource attributes via CloudFormation Outputs and have application teams use Fn::ImportValue to reference them directly across accounts.

Question 55

A company manages a fleet of standardized bastion EC2 instances across 40 accounts using CloudFormation StackSets deployed from the organization's management account. Each account requires the same base configuration (installing a monitoring agent, configuring a hardened SSH banner, and applying OS package updates) applied at instance launch, and the operations team wants this configuration to be reapplied automatically whenever the underlying AMI is refreshed via a StackSet update. The team wants a solution that keeps the configuration declarative within the same CloudFormation template and executes reliably during instance provisioning. Which approach best meets these requirements?

Accepted Answer

Define the configuration steps in the AWS::CloudFormation::Init metadata on the instance's launch resource and invoke cfn-init and cfn-signal from the instance UserData, using a CreationPolicy to gate stack completion on successful configuration.

Answer

Package the configuration into a separate Systems Manager Automation runbook and trigger it from an EventBridge rule that fires on each StackSet operation, passing the account and instance IDs as parameters.

Answer

Embed the full sequence of shell commands directly in the instance UserData script so they run at every boot, and rely on StackSet drift detection to confirm the commands executed.

Answer

Store the configuration in an S3 bucket and use a Lambda-backed custom resource that copies and executes the script on each instance over SSH during stack creation.

Question 56

A company runs a fleet of EC2 instances hosting a Java application that writes structured JSON application logs to local files. The DevOps team must centralize these logs in CloudWatch Logs and, without adding any code to the application, generate a custom CloudWatch metric for the number of log entries whose JSON field "level" equals "ERROR", then trigger an alarm when the error count exceeds a threshold over a 5-minute window. Which approach meets these requirements with the LEAST operational overhead?

Accepted Answer

Install the CloudWatch agent to ship the logs to a log group, create a metric filter on the log group using a JSON pattern that matches { $.level = "ERROR" } to publish a custom metric, and configure a CloudWatch alarm on that metric.

Answer

Modify the application to use the embedded metric format (EMF) so each ERROR log line publishes a metric, ship logs with the CloudWatch agent, and alarm on the EMF-generated metric.

Answer

Ship logs to CloudWatch Logs, schedule a CloudWatch Logs Insights query every 5 minutes via EventBridge and a Lambda function that counts ERROR entries and calls PutMetricData, then alarm on the metric.

Answer

Create a Kinesis Data Firehose subscription filter on the log group that delivers logs to Lambda, which parses each record for ERROR and publishes a custom metric, then alarm on the metric.

Question 57

A DevOps team runs a three-tier web application. Their monitoring setup fires individual CloudWatch alarms for high database CPU, elevated API latency, and increased 5xx errors. During a recent database maintenance event, all three alarms triggered simultaneously, paging the on-call engineer three separate times for what was fundamentally a single underlying issue. The team wants to be paged only once when the database problem causes cascading symptoms, while still keeping the individual alarms for dashboards and troubleshooting. Which approach best meets this requirement?

Accepted Answer

Create a CloudWatch composite alarm using an alarm rule that combines the child alarms with logical operators, and configure only the composite alarm to send the SNS notification to the on-call topic.

Answer

Delete the three individual alarms and create a single metric math alarm that averages database CPU, latency, and error count into one metric before evaluating a threshold.

Answer

Add all three alarms to the same SNS topic but enable SNS message filtering so only the first message within a five-minute window is delivered.

Answer

Configure each alarm's actions with a longer evaluation period and increase the datapoints-to-alarm value so the alarms rarely trigger together.

Question 58

A DevOps engineer manages a payment processing service on EC2. The team wants a CloudWatch alarm on the p99 latency metric (published every minute) to notify the on-call engineer via SNS when the service is genuinely degraded. During load testing they observed that a single elevated 1-minute datapoint occurs frequently due to garbage collection pauses, but these are not real incidents. Real degradation is characterized by latency staying high across most of a 5-minute window. Which alarm configuration best reduces false alarms while still catching sustained degradation quickly?

Accepted Answer

Configure the alarm with Period 60 seconds, Evaluation Periods 5, and Datapoints to Alarm 3 (M of N).

Answer

Configure the alarm with Period 300 seconds, Evaluation Periods 1, and Datapoints to Alarm 1.

Answer

Configure the alarm with Period 60 seconds, Evaluation Periods 1, and Datapoints to Alarm 1.

Answer

Configure the alarm with Period 60 seconds, Evaluation Periods 5, and Datapoints to Alarm 5, treating missing data as breaching.

Question 59

A DevOps team monitors a batch-processing Lambda function that only runs a few times per hour. They created a CloudWatch alarm on a custom 'ProcessingErrors' metric that the function publishes only when an error occurs. During periods when the function runs successfully, no data points are emitted for the metric. The team reports that the alarm frequently transitions to the INSUFFICIENT_DATA state and occasionally sends false alerts. They want the alarm to trigger only when actual errors are reported and to remain stable (not fire) during periods with no data. Which configuration change should they make?

Accepted Answer

Set the alarm's 'Treat missing data as' setting to 'notBreaching' so that periods with no data points are considered healthy.

Answer

Set the alarm's 'Treat missing data as' setting to 'breaching' to ensure any gap in metrics is caught immediately.

Answer

Reduce the alarm evaluation period to 10 seconds so gaps in data are evaluated faster.

Answer

Enable anomaly detection on the metric so CloudWatch automatically fills in missing data points.

Question 60

A DevOps team runs a fleet of application servers that send logs to a single CloudWatch Logs log group. Support engineers report that intermittent surges in application error messages are only noticed hours later when customers complain. The team wants an automated, low-maintenance way to detect statistically abnormal spikes in the rate of ERROR-level log entries without manually defining static thresholds, since normal error volume varies significantly by time of day. What approach best meets this requirement?

Accepted Answer

Create a metric filter that increments a custom metric for ERROR entries, then enable a CloudWatch anomaly detection alarm on that metric using a band based on the anomaly detection model.

Answer

Create a metric filter for ERROR entries and configure a static CloudWatch alarm that triggers when the count exceeds a fixed threshold of 100 per minute.

Answer

Schedule a CloudWatch Logs Insights query to run every hour that counts ERROR entries and email the results to the support team.

Answer

Enable CloudWatch Logs live tail on the log group so engineers can watch ERROR entries stream in real time during business hours.

Question 61

A company operates 40 AWS accounts within an AWS Organization. The platform team wants a single monitoring account where engineers can query CloudWatch metrics, logs, and X-Ray traces from all member accounts through unified dashboards, without having to switch roles or log into each source account individually. The solution must scale automatically as new member accounts are added and require minimal per-account configuration. What is the MOST operationally efficient approach?

Accepted Answer

Enable CloudWatch cross-account observability by designating the platform account as the monitoring account and linking source accounts (or an entire OU) as source accounts, sharing metrics, logs, and traces.

Answer

Create a CloudWatch metric stream and Kinesis Data Firehose in each account to forward all metrics and logs to a centralized S3 bucket, then query them with Athena.

Answer

Configure a CloudWatch Logs subscription filter in every account to stream logs to a central Kinesis stream, and use cross-account IAM roles that engineers assume to view metrics and traces.

Answer

Build a Lambda function in the monitoring account that periodically assumes a role in each member account, calls GetMetricData and FilterLogEvents, and stores the results in a shared DynamoDB table for dashboarding.

Question 62

A DevOps team manages 12 microservices, each deployed in its own AWS account under a single AWS Organization. The observability team needs a single CloudWatch dashboard in a central monitoring account that displays CPU and error-rate metrics from all 12 accounts, updated in near real time, without copying metric data or running custom scripts. What is the MOST operationally efficient way to achieve this?

Accepted Answer

Enable CloudWatch cross-account observability by configuring each service account as a source account and the monitoring account as a monitoring account, then build the dashboard referencing the shared source-account metrics.

Answer

Create a Lambda function in each account that calls GetMetricData on a schedule and uses PutMetricData to push the values into the monitoring account, then build the dashboard from the copied metrics.

Answer

Configure a metric stream in each account that delivers metrics to a Kinesis Data Firehose targeting an S3 bucket in the monitoring account, then query the data with Athena for the dashboard.

Answer

Use CloudWatch metric math with a cross-account IAM role assumed by the dashboard widget to read each account's metrics directly at render time.

Question 63

A team runs a high-throughput payment service on AWS Lambda. They need per-customer latency and error metrics for thousands of customers, but calling PutMetricData for each customer on every invocation is causing throttling and increasing invocation duration. They want custom metrics generated asynchronously without adding synchronous API calls in the hot path, while keeping the raw structured log data queryable. Which approach best meets these requirements?

Accepted Answer

Emit logs using the CloudWatch Embedded Metric Format (EMF) to stdout so CloudWatch automatically extracts custom metrics from the structured log entries while preserving the raw logs.

Answer

Batch all customer measurements in memory and call PutMetricData once per invocation with multiple MetricData entries to reduce the number of API calls.

Answer

Write the measurements to a CloudWatch Logs log group and create a metric filter per customer to convert matching log events into custom metrics.

Answer

Send the measurements to Amazon Kinesis Data Firehose and use a Lambda transform to call PutMetricData in batches downstream.

Question 64

A DevOps team operates a microservices platform where each service runs in a separate AWS account and ships application logs to a CloudWatch Logs log group in its own account. During a recent incident, engineers needed to correlate 5xx error patterns across all services but had to log in to each account individually and run separate queries, which delayed the investigation. The team wants to enable engineers in a central operations account to run a single CloudWatch Logs Insights query spanning log groups in all the service accounts, with the least ongoing operational overhead. Which approach should they implement?

Accepted Answer

Configure CloudWatch cross-account observability by designating the operations account as the monitoring account and linking each service account as a source account sharing logs, then run Logs Insights queries across the linked log groups.

Answer

Create a Kinesis Data Firehose subscription filter in each service account that streams all logs to a centralized S3 bucket, then use Athena to query the aggregated logs.

Answer

Set up a scheduled Lambda function in each account that runs Logs Insights queries locally and publishes the results to an SNS topic subscribed by the operations team.

Answer

Use a CloudWatch Logs subscription filter in each account to forward log events to a single log group in the operations account via a cross-account Kinesis Data Stream, then query that consolidated log group.

Exam domain	Exam weight	Practice
SDLC Automation	22%	Practice this topic
Configuration Management and IaC	17%	Practice this topic
Resilient Cloud Solutions	15%	Practice this topic
Monitoring and Logging	15%	Practice this topic
Incident and Event Response	14%	Practice this topic
Security and Compliance	17%	Practice this topic

AWS Certified DevOps Engineer - Professional (DOP-C02) practice exam & study guide

Start studying DOP-C02

All DOP-C02 study resources

DOP-C02 exam domains

Sample DOP-C02 questions

Key DOP-C02 terms

DOP-C02 frequently asked questions

SDLC Automation (22%)

Configuration Management and IaC (17%)

Resilient Cloud Solutions (15%)

Monitoring and Logging (15%)

Incident and Event Response (14%)

Security and Compliance (17%)