AWS DevOps DevOps Configuration Management & Infrastructure as Code 4 — Questions and Answers
Question 1: What does 'configuration drift' mean in the context of infrastructure management?
- Gradual degradation of network performance over time
- Differences between the intended configuration state and the actual running state of resources (Correct answer)
- Automatic version upgrades applied by AWS managed services
- A CloudFormation rollback caused by a failed update
Correct answer: Differences between the intended configuration state and the actual running state of resources
Configuration drift occurs when the actual state of infrastructure diverges from the desired state defined in configuration code or templates.
Question 2: A team uses AWS Config to monitor CloudFormation stacks. Which AWS Config feature detects when a stack's actual resource configuration diverges from its template?
- AWS Config Rules
- CloudFormation Drift Detection (Correct answer)
- AWS Config Conformance Packs
- CloudWatch Alarms on Config
Correct answer: CloudFormation Drift Detection
CloudFormation Drift Detection compares the current configuration of stack resources against the expected configuration defined in the stack template.
Question 3: In a CI/CD pipeline for infrastructure, which practice involves testing CloudFormation templates for syntax errors and policy compliance before deployment?
- Blue/green infrastructure deployment
- Infrastructure pipeline with linting and policy-as-code gates (Correct answer)
- Immutable infrastructure replacement
- Manual change approval via change sets
Correct answer: Infrastructure pipeline with linting and policy-as-code gates
Running linters (like cfn-lint) and policy-as-code tools (like cfn-guard or OPA) in the pipeline catches template errors and compliance violations before any resources are deployed.
Question 4: Which AWS service enables you to author, test, and deploy OpsCenter runbooks (automation documents) to remediate operational issues automatically?
- AWS Lambda
- AWS Systems Manager Automation (Correct answer)
- AWS Step Functions
- Amazon EventBridge
Correct answer: AWS Systems Manager Automation
AWS Systems Manager Automation runs runbooks (SSM Documents of type Automation) that can perform multi-step remediation tasks across AWS resources.
Question 5: When using Terraform with a remote backend on Amazon S3, why is DynamoDB table locking recommended?
- To encrypt the Terraform state file at rest
- To prevent concurrent state modifications that could corrupt the state file (Correct answer)
- To enable cross-region replication of state
- To allow Terraform plan output to be cached
Correct answer: To prevent concurrent state modifications that could corrupt the state file
DynamoDB state locking prevents multiple team members or pipeline runs from simultaneously modifying the Terraform state file, which would cause corruption.
Question 6: A CloudFormation stack uses a Lambda-backed custom resource. When should the custom resource's Lambda function signal SUCCESS or FAILURE to CloudFormation?
- Only when explicitly invoked via the CloudFormation console
- By sending a response to the pre-signed S3 URL provided in the CloudFormation event (Correct answer)
- By returning a status code from the Lambda function handler
- By updating an SSM parameter with the result
Correct answer: By sending a response to the pre-signed S3 URL provided in the CloudFormation event
Lambda-backed custom resources must send a JSON response to the pre-signed S3 URL in the CloudFormation event's ResponseURL field to signal completion status.
Question 7: Which feature of AWS AppConfig differentiates it from SSM Parameter Store for feature flag management?
- AppConfig supports higher parameter value size limits
- AppConfig provides built-in deployment strategies with monitoring and automatic rollback (Correct answer)
- AppConfig integrates with CloudFormation natively
- AppConfig supports KMS encryption for stored values
Correct answer: AppConfig provides built-in deployment strategies with monitoring and automatic rollback
AppConfig adds deployment strategies (linear, exponential, all-at-once) with CloudWatch alarm integration for automatic rollback, making it safer than directly reading from Parameter Store.
AWS DevOps DevOps Configuration Management & Infrastructure as Code 4
What does 'configuration drift' mean in the context of infrastructure management?