AWS DevOps DevOps Configuration Management & Infrastructure as Code 3 — Questions and Answers
Question 1: A DevOps engineer needs to store database passwords used by Lambda functions securely and rotate them automatically. Which AWS service is best suited for this?
- AWS Systems Manager Parameter Store (Standard)
- AWS Secrets Manager (Correct answer)
- AWS KMS key aliases
- Amazon S3 server-side encryption
Correct answer: AWS Secrets Manager
AWS Secrets Manager provides built-in secret rotation with Lambda integration and is specifically designed for credentials like database passwords.
Question 2: In a CloudFormation template, which intrinsic function retrieves the value of a resource's attribute, such as an S3 bucket's ARN?
- !Ref
- !GetAtt (Correct answer)
- !Sub
- !ImportValue
Correct answer: !GetAtt
!GetAtt retrieves specific attributes of a resource, like the ARN or DNS name, whereas !Ref typically returns just the resource's primary identifier.
Question 3: Which CloudFormation feature allows you to create reusable templates for common infrastructure patterns that can be shared across accounts?
- CloudFormation StackSets
- CloudFormation Modules (Correct answer)
- CloudFormation Macros
- CloudFormation Change Sets
Correct answer: CloudFormation Modules
CloudFormation Modules allow you to package reusable resource configurations and share them through the CloudFormation registry across accounts.
Question 4: A team wants to deploy identical infrastructure across 20 AWS accounts in 3 regions simultaneously using CloudFormation. Which feature enables this?
- CloudFormation Nested Stacks
- CloudFormation StackSets (Correct answer)
- AWS Service Catalog
- AWS Control Tower
Correct answer: CloudFormation StackSets
CloudFormation StackSets extend CloudFormation stacks by enabling deployment of the same template across multiple accounts and regions from a single operation.
Question 5: In AWS CDK, what is a 'Construct' at its most fundamental level?
- A CloudFormation stack
- A reusable cloud component representing one or more AWS resources (Correct answer)
- An IAM policy document
- A CDK deployment pipeline stage
Correct answer: A reusable cloud component representing one or more AWS resources
A Construct is the basic building block of CDK apps, representing a cloud component that can encapsulate one or more AWS resources with their configuration.
Question 6: Which Ansible concept describes a collection of tasks, handlers, variables, and templates organized as a reusable unit of automation?
- Playbook
- Inventory
- Role (Correct answer)
- Module
Correct answer: Role
An Ansible Role is a standardized file structure that groups related tasks, handlers, variables, and templates into a self-contained, reusable automation unit.
Question 7: A CloudFormation template needs to accept different instance types for dev vs. prod environments. Which CloudFormation feature enables this without duplicating templates?
- CloudFormation Mappings with FindInMap
- CloudFormation Parameters (Correct answer)
- CloudFormation Conditions with Fn::If
- CloudFormation Outputs
Correct answer: CloudFormation Parameters
CloudFormation Parameters allow users to pass in custom values at stack creation or update time, making a single template adaptable to multiple environments.
AWS DevOps DevOps Configuration Management & Infrastructure as Code 3
A DevOps engineer needs to store database passwords used by Lambda functions securely and rotate them automatically.
Which AWS service is best suited for this?