Configuration Management and IaC — DOP-C02 Practice Quiz

Question 1

A platform team maintains a large CDK application (TypeScript) composed of dozens of stacks authored by multiple product teams. Governance requires that every S3 bucket in every stack must have server-side encryption enabled and every resource must carry a 'CostCenter' tag. The team wants to enforce these rules automatically at synthesis time so that non-compliant stacks fail the build, without asking each product team to modify their construct code. Which approach best meets these requirements?

Accepted Answer

Implement a CDK Aspect that visits every construct in the app, adds the required tags, and raises annotation errors when a bucket lacks encryption, then apply it via Aspects.of(app).add(...).

Answer

Enable CloudFormation drift detection on all deployed stacks and configure a nightly EventBridge rule to alert when buckets are found unencrypted or untagged.

Answer

Create an AWS Config conformance pack with managed rules for S3 encryption and required tags, deployed across the accounts via a StackSet.

Answer

Add a Service Control Policy that denies s3:CreateBucket unless encryption and the CostCenter tag are specified in the request.

Question 2

A DevOps team uses AWS CDK to define infrastructure for a service deployed through a CDK Pipelines self-mutating pipeline. Several stacks call methods like ec2.Vpc.fromLookup() and ssm.StringParameter.valueFromLookup() to resolve existing VPCs and configuration at synthesis time. The team notices that builds in the pipeline's CodeBuild synth step intermittently fail or produce templates that reference incorrect subnet IDs, and the errors do not reproduce on developers' laptops. What is the MOST likely root cause and the recommended fix?

Accepted Answer

Context lookups require AWS credentials and a populated cdk.context.json; the pipeline's synth environment resolves lookups against a different account/region than developers, so cache the context by committing cdk.context.json and ensure the synth role can perform the lookups in the correct target environment.

Answer

Lookups are non-deterministic because CDK caches nothing; disable all context lookups by hardcoding subnet IDs as CloudFormation parameters passed in at deploy time.

Answer

The synth step is using an outdated CDK CLI version; pin the CDK version in package.json and the problem will be fully resolved without any changes to context handling.

Answer

fromLookup() performs the lookup during CloudFormation deployment, so the CodeBuild role lacks deploy-time EC2 permissions; attach ec2:DescribeSubnets to the CloudFormation execution role instead.

Question 3

A DevOps team uses AWS CDK to define a multi-tier web application (VPC, ECS cluster, RDS database, and application services). They need to deploy this identical application to three separate AWS accounts (dev, staging, prod) within their organization. Each account must have its own isolated set of resources, and the team wants a single CDK codebase where the environment-specific account IDs and region are supplied at synth time, producing separate CloudFormation templates per environment. Which CDK approach best satisfies these requirements while keeping the code maintainable?

Accepted Answer

Define a reusable Stack subclass (or a Stage containing the stacks) and instantiate it once per environment in the CDK app, passing each environment's account and region via the stack/stage 'env' property.

Answer

Create a single CloudFormation StackSet from the CDK synthesized template and let StackSets fan the deployment out to all three accounts automatically.

Answer

Use CDK context lookups with cdk.context.json to hardcode all three account IDs into one stack, then deploy that one stack three times with --force.

Answer

Define one stack with no explicit 'env' property so it becomes environment-agnostic, then rely on the CLI credentials of each account to place resources correctly at deploy time.

Question 4

A team uses CDK Pipelines (the CodePipeline construct in the aws-cdk-lib/pipelines module) to deploy a multi-stage application. Developers add a new deployment stage to the pipeline definition in code and merge to the main branch. When the existing pipeline runs, they expect the new stage to appear, but they are concerned about how the pipeline picks up structural changes to its own definition. Which behavior of CDK Pipelines correctly explains how the new stage becomes part of the running pipeline?

Accepted Answer

The pipeline includes a self-mutation step that runs 'cdk deploy' on the pipeline stack itself early in execution, updating the pipeline (adding the new stage) before the application stages run.

Answer

The new stage is only added after an engineer manually runs 'cdk deploy' from a workstation; CDK Pipelines cannot modify its own structure during execution.

Answer

CodePipeline automatically detects the source change and re-synthesizes the pipeline on every action, so no dedicated mutation step is required.

Answer

The new stage is applied only on the next pipeline run after the current one completes, because CloudFormation cannot update a stack while its pipeline is executing.

Question 5

A platform team maintains an AWS CDK (v2, TypeScript) library of reusable constructs that application teams import to provision workloads. One construct needs to place resources into an existing VPC that already lives in each application team's account. The application accounts vary, and the platform team wants the synthesized CloudFormation to reference the correct VPC subnets deterministically at deploy time without hard-coding subnet IDs in the construct. During code review, a developer used ec2.Vpc.fromLookup() and CDK synthesis failed in the CI pipeline with an error about missing environment/account context. What is the MOST appropriate way to make this reusable construct resolve the existing VPC reliably across accounts?

Accepted Answer

Configure the consuming stack with an explicit env (account and region), ensure CDK can assume a role with describe permissions in the target account so fromLookup() performs a context lookup, and commit the generated cdk.context.json for reproducible synth.

Answer

Replace fromLookup() with ec2.Vpc.fromVpcAttributes() and pass CloudFormation parameters for the VPC ID and subnet IDs, requiring each app team to supply values at deploy time.

Answer

Keep fromLookup() but set the stack env to the CDK default (agnostic) environment so it works for any account without additional configuration.

Answer

Use a custom resource backed by a Lambda function that calls ec2:DescribeVpcs during stack deployment and returns the subnet IDs to the rest of the template.

Question 6

A team uses AWS CDK to define two stacks in the same app: a NetworkStack that creates a VPC and exports a shared security group, and an AppStack that references that security group via a CDK cross-stack reference (the security group object is passed directly between stack constructs). During a routine change, a developer removes the security group usage from AppStack and redeploys, intending to later delete the security group entirely from NetworkStack. The AppStack deployment succeeds, but when they subsequently try to delete the security group from NetworkStack, the NetworkStack update fails. What is the MOST likely cause and correct approach?

Accepted Answer

The failure occurs because CloudFormation will not delete an exported value that is still imported by another stack; deploying both stacks together with `cdk deploy --all` lets CDK sequence the AppStack update (dropping the import) before the NetworkStack export removal, resolving the dependency safely.

Answer

CDK automatically manages the CloudFormation Export/Import created by the cross-stack reference; the developer must deploy AppStack (removing the import) BEFORE deploying NetworkStack (removing the export), which was done, so the failure indicates a manual template edit is required.

Answer

CDK cross-stack references create a CloudFormation Export in NetworkStack consumed by an Import in AppStack; a stale export can still be referenced. The developer should ensure AppStack no longer imports the value, deploy AppStack first, then deploy NetworkStack to remove the export and the resource — CDK orchestrates this ordering when both stacks are deployed together.

Answer

Cross-stack references in CDK use SSM Parameter Store rather than CloudFormation Exports, so the deletion failure is caused by a leftover parameter; the developer should manually delete the SSM parameter before redeploying NetworkStack.

Question 7

A DevOps team manages a production CloudFormation stack that deploys an application tier. They need to migrate an existing manually-created DynamoDB table into this stack so it becomes CloudFormation-managed, without any downtime or data loss. The table receives constant read/write traffic. Which approach correctly brings the table under management while minimizing risk?

Accepted Answer

Add the DynamoDB table resource to the template with a DeletionPolicy of Retain, then use a resource import operation (import change set) that maps the existing table's physical ID to the new logical resource, and review the change set before executing.

Answer

Delete the existing table, add the resource to the template, and redeploy the stack so CloudFormation recreates the table with the same name.

Answer

Add the table to the template and run a standard stack update; CloudFormation will automatically detect the existing physical resource by name and adopt it.

Answer

Enable drift detection on the stack, which will import any out-of-band resources it discovers into the stack's managed resource set.

Question 8

A DevOps team manages a production RDS database and its surrounding networking through a single CloudFormation stack deployed via a CodePipeline. During a routine template update that modifies the DB instance's DBInstanceIdentifier property, the team wants an automated safeguard in the pipeline that halts the deployment BEFORE any resource is replaced, so an engineer can review whether the change would destroy the existing database. Which approach best meets this requirement?

Accepted Answer

Add a stage that creates a CloudFormation change set with the CREATE_CHANGE_SET action, inspect the change set's 'Replacement' field for resources, and gate progression on a manual approval before executing the change set.

Answer

Enable termination protection on the stack so CloudFormation blocks any update that would replace a resource until an administrator disables it.

Answer

Attach a stack policy that denies Update:Replace on the RDS resource, causing the pipeline deployment to pause and prompt for approval when a replacement is attempted.

Answer

Run CloudFormation drift detection at the start of the deploy stage and fail the pipeline if the DB instance shows drift before applying the update.

Question 9

A DevOps team uses AWS CDK to provision infrastructure. One stack must register a third-party SaaS webhook during creation and deregister it during stack deletion, calling an external REST API that CloudFormation cannot natively manage. They implement a Lambda-backed custom resource using the CDK Provider framework. During testing, the stack creates successfully, but when they run 'cdk destroy', the stack becomes stuck in DELETE_IN_PROGRESS for over an hour and eventually rolls into DELETE_FAILED. The Lambda function's own logs show the deregistration call completed in under two seconds. What is the MOST likely cause?

Accepted Answer

The custom resource Lambda handler is not sending a response signal back to the pre-signed S3 response URL on the Delete event, so CloudFormation waits until the timeout expires.

Answer

CloudFormation custom resources do not support the Delete lifecycle event, so the deregistration logic can never be triggered during stack deletion.

Answer

The Lambda execution role lost permission to call the SaaS API, causing CloudFormation to silently retry the deletion indefinitely.

Answer

The CDK Provider framework requires a DeletionPolicy of Retain on custom resources, and its absence blocks the delete operation.

Question 10

A team manages an S3 bucket, an IAM role, and a DynamoDB table through a single CloudFormation stack. An engineer, bypassing the pipeline, manually edited the S3 bucket policy and added a new lifecycle rule directly in the console during an incident. The next scheduled pipeline run deploys an unrelated change (adding a CloudWatch alarm) via a change set. The team wants to ensure the manual changes are reconciled to match the template AND wants ongoing visibility when future out-of-band changes occur, without deleting or recreating any resources. Which approach best meets these requirements?

Accepted Answer

Run CloudFormation drift detection on the stack to identify the divergence, then perform a normal stack update from the template so CloudFormation resets the drifted properties to the template-defined values; schedule periodic drift detection with EventBridge notifications for ongoing visibility.

Answer

Delete the stack with a Retain deletion policy on all resources, then re-import the resources into a fresh stack to guarantee the template and live state are identical.

Answer

Enable termination protection on the stack, which prevents any future manual modifications to the managed resources and automatically reverts unauthorized changes.

Answer

Add a stack policy that denies all Update actions on the S3 bucket, then rely on the next change set to overwrite the manual changes when the alarm is added.

Question 11

A platform engineering team distributes infrastructure changes across 40 AWS accounts using CDK Pipelines that deploy CloudFormation stacks. Security requires that no stack deployment be allowed to create an S3 bucket without a bucket policy denying non-TLS access, and this must be enforced at deploy time BEFORE resources are provisioned — regardless of whether developers use the correct CDK constructs. The team wants a solution that is centrally managed, applies automatically to all stack operations in every account, and blocks the CloudFormation operation itself if the rule is violated. Which approach meets these requirements?

Accepted Answer

Create a CloudFormation Hook (Guard-based) published to a private registry and activate it organization-wide via CloudFormation StackSets, configuring it in FAIL mode to block non-compliant provisioning.

Answer

Add an AWS Config managed rule (s3-bucket-ssl-requests-only) as an organization Config rule with auto-remediation via SSM Automation.

Answer

Implement a CDK Aspect in the shared construct library that validates bucket policies during synthesis and throws an error if TLS enforcement is missing.

Answer

Attach a Service Control Policy (SCP) to the organization denying s3:CreateBucket unless a bucket policy condition is present.

Question 12

A DevOps team deploys a fleet of EC2 instances using a CloudFormation template. They want the instances to install packages, write configuration files, and start services automatically at launch, with the ability to update this configuration by simply updating the CloudFormation stack. They also want a clean signal to CloudFormation indicating whether the bootstrap configuration succeeded, so a failed configuration causes the stack update to roll back. Which approach best meets these requirements using native CloudFormation capabilities?

Accepted Answer

Define the configuration in the AWS::CloudFormation::Init metadata on the instance resource, run cfn-init in the UserData to apply it, and use cfn-signal with a CreationPolicy/UpdatePolicy so CloudFormation waits for and evaluates the success signal.

Answer

Embed all package installs and file writes as a bash script in the UserData block, and rely on the instance reaching the 'running' state as the success indicator for CloudFormation.

Answer

Store the configuration commands in an SSM Parameter Store hierarchy and use a Lambda-backed custom resource to SSH into each instance and apply the changes during stack updates.

Answer

Bake all configuration into a golden AMI and reference the AMI ID in the template, updating the AMI ID parameter whenever configuration changes are required.

Question 13

A DevOps team uses AWS CDK (v2) to deploy an application consisting of a parent stack with several nested stacks. Each nested stack references Lambda functions bundled from local source code as assets. The team runs 'cdk deploy' targeting a new region (eu-west-1) for the first time, but the deployment fails immediately with an error stating that the assets cannot be published because the environment is not bootstrapped. The same application deploys successfully in us-east-1. What is the correct way to resolve this while following AWS best practices for multi-region CDK deployments?

Accepted Answer

Run 'cdk bootstrap aws://ACCOUNT-ID/eu-west-1' to provision the CDKToolkit stack (including the asset S3 bucket and ECR repository) in the target region before deploying.

Answer

Manually create an S3 bucket in eu-west-1 named 'cdk-assets' and set the CDK_DEFAULT_BUCKET environment variable to point CDK at it.

Answer

Add a 'crossRegionReferences: true' property to the parent stack so CDK automatically copies assets from the us-east-1 bootstrap bucket to eu-west-1 at deploy time.

Answer

Change the nested stacks to inline the Lambda code using 'lambda.Code.fromInline' so that no asset publishing or bootstrapping is required in the new region.

Question 14

A DevOps team manages a CDK application that synthesizes a parent CloudFormation stack containing several nested stacks. A shared 'NetworkStack' nested stack exports a VPC ID and subnet IDs that are consumed by an 'AppStack' nested stack via CloudFormation cross-stack references (Fn::ImportValue on exported outputs). During a deployment that both changes the CIDR of a subnet in NetworkStack and updates an EC2 launch template in AppStack, the deployment fails with an error that an export cannot be updated because it is in use by another stack. The team needs a reliable pattern to allow the shared network values to change over time without blocking dependent stack updates. Which approach BEST resolves this?

Accepted Answer

Replace the Fn::ImportValue cross-stack references between the nested stacks with direct CDK object references (passing constructs/props), letting CDK pass values as nested stack parameters instead of using account-level exports.

Answer

Add a DeletionPolicy of Retain to the exported resources so CloudFormation does not attempt to delete the exports during the update.

Answer

Split the deployment into two separate pipeline executions, deploying NetworkStack changes first and AppStack changes in a later run, keeping the Fn::ImportValue references.

Answer

Convert the nested stacks into fully independent top-level stacks and use SSM Parameter Store to publish the VPC and subnet IDs, reading them at synth time in AppStack.

Question 15

A DevOps team deploys an application using a CloudFormation nested stack architecture. One nested stack provisions an Auto Scaling group of EC2 instances that run a lengthy bootstrap process via cfn-init before the application is ready. During recent stack updates, the parent stack update repeatedly succeeds and reports UPDATE_COMPLETE even though several instances fail to finish their bootstrap and never become healthy, causing the application to serve errors after the deployment. The team wants CloudFormation to treat the update as failed and roll back automatically when instances do not complete initialization. Which change to the EC2 nested stack template will achieve this?

Accepted Answer

Add a CreationPolicy with a ResourceSignal count and timeout to the Auto Scaling group, and have the bootstrap script call cfn-signal reporting success or failure; also configure an UpdatePolicy with WaitOnResourceSignals for rolling updates.

Answer

Add a DependsOn attribute from the Auto Scaling group to the launch template so the group waits until the launch template is fully created before scaling.

Answer

Enable termination protection on the nested stack and set the parent stack's OnFailure parameter to ROLLBACK.

Answer

Increase the parent stack's timeout by adding a longer TimeoutInMinutes value to the AWS::CloudFormation::Stack resource pointing to the nested stack.

Question 16

A DevOps team maintains a single CloudFormation template used to deploy an application across us-east-1, eu-west-1, and ap-southeast-2. The template launches EC2 instances that must use a region-specific, hardened AMI ID owned by the security team. The AMI IDs are updated roughly once per quarter through a separate golden-AMI pipeline. Deployments are triggered via a CodePipeline that runs the same template in all three regions. The team wants the correct AMI to be selected automatically per region at deploy time, without editing the template body and without manually passing AMI IDs as parameters on each run. Which approach best meets these requirements?

Accepted Answer

Store each region's latest hardened AMI ID in a Systems Manager Parameter Store parameter (same name per region) and reference it in the template using an SSM parameter type (AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>) so each stack resolves the value at deploy time.

Answer

Define a CloudFormation Mappings section that hardcodes the AMI ID for each region and use Fn::FindInMap with AWS::Region to select the value.

Answer

Pass the AMI ID as a CloudFormation parameter and have the CodePipeline deploy action supply the value from a variable configured per region in the pipeline.

Answer

Use a Lambda-backed custom resource that calls the EC2 DescribeImages API during every stack update to look up the newest AMI matching a name filter.

Question 17

A DevOps team manages a production VPC, subnets, and an RDS instance that were all created manually through the AWS console over two years ago. Management now requires all infrastructure to be managed as code using CloudFormation so that changes go through the change-set review process. The team must bring these existing, live resources under CloudFormation management WITHOUT deleting them or causing any downtime to the running RDS database. Which approach meets these requirements?

Accepted Answer

Author a CloudFormation template that describes the existing resources, then use the resource import operation (create change set with import) to bring the resources into a new or existing stack, matching each logical resource to its physical resource identifier.

Answer

Delete the manually created resources and recreate them by deploying a new CloudFormation stack that defines the VPC, subnets, and RDS instance from scratch.

Answer

Enable drift detection on an empty stack, which will automatically detect the orphaned resources and adopt them into the stack once remediation is applied.

Answer

Add a DeletionPolicy of Retain to a new template and deploy it; CloudFormation will recognize the identically named existing resources and take over their management.

Question 18

A DevOps team manages a shared networking stack and multiple application stacks in the same account and region using AWS CDK. Application stacks need to reference the VPC ID and subnet IDs produced by the networking stack. Currently they use CloudFormation cross-stack exports (Fn::ImportValue). The team frequently needs to modify the networking stack's subnet configuration, but CloudFormation blocks these updates because the values are exported and consumed by other stacks. They want a decoupling approach that still keeps everything defined as code and allows the networking stack to update independently while application stacks pick up current values. What should they do?

Accepted Answer

Have the networking stack write the VPC ID and subnet IDs to SSM Parameter Store parameters, and have application stacks read those parameters at deploy time (e.g., via CDK StringParameter.valueFromLookup or CloudFormation SSM dynamic references).

Answer

Convert the networking stack into a nested stack of each application stack so the resources are recreated per application and no cross-stack dependency exists.

Answer

Add a DeletionPolicy of Retain to the exported outputs so CloudFormation permits updates to the exported values while consumers keep the old references.

Answer

Enable termination protection on the networking stack and manually copy the subnet IDs into each application stack's parameters whenever they change.

Question 19

A DevOps team maintains a production CDK application that provisions a critical DynamoDB table and an S3 bucket. To improve readability, a developer refactors the code by wrapping several resources inside a new nested Construct and renames the construct scope. During the next pipeline run, `cdk diff` shows the DynamoDB table and S3 bucket will be destroyed and recreated. Both resources contain production data that must not be lost. Which approach allows the refactor to proceed WITHOUT data loss and with minimal manual intervention?

Accepted Answer

Apply the `overrideLogicalId` method (or explicitly set the logical IDs) so the refactored resources keep their original CloudFormation logical IDs, preventing replacement.

Answer

Add a `DeletionPolicy: Retain` to the resources, deploy the refactor, then manually re-import the orphaned resources into the stack.

Answer

Enable termination protection on the stack so CloudFormation refuses to delete the DynamoDB table and S3 bucket during the update.

Answer

Run `cdk deploy` with the `--force` flag to skip the diff confirmation, since CDK automatically preserves stateful resources during refactors.

Question 20

A DevOps team manages a production CloudFormation stack containing a shared VPC, transit gateway attachments, and a KMS key used by multiple downstream stacks. During a recent incident, an engineer ran `aws cloudformation delete-stack` against the wrong stack name from a scripting error, and the deletion began before it was cancelled. The team wants to guarantee that no accidental or automated API call can delete this foundational stack, while still allowing normal stack UPDATE operations to proceed through their CI/CD pipeline. What should they implement?

Accepted Answer

Enable termination protection on the stack so delete-stack calls are rejected until protection is explicitly disabled.

Answer

Enable termination protection on the stack, and set DeletionPolicy: Retain on the resources inside the stack.

Answer

Apply a stack policy that denies the Update:Delete action on all resources in the stack.

Answer

Attach an IAM policy to all pipeline roles that denies cloudformation:DeleteStack on every stack in the account.

More DOP-C02 practice