AWS DevOps DevOps Configuration Management & Infrastructure as Code 5 — Questions and Answers
Question 1: A team wants to enforce that all EC2 instances launched via CloudFormation must use approved AMIs. Which AWS service enforces this as a preventive control?
- AWS Config Rules
- AWS CloudFormation Guard (cfn-guard) (Correct answer)
- Amazon Inspector
- AWS Trusted Advisor
Correct answer: AWS CloudFormation Guard (cfn-guard)
CloudFormation Guard allows you to write policy-as-code rules that validate CloudFormation templates before deployment, blocking non-compliant resources from being created.
Question 2: In AWS CloudFormation, what is the purpose of a Change Set?
- To automatically roll back a failed stack update
- To preview proposed changes to a stack before executing the update (Correct answer)
- To replicate a stack to another AWS region
- To export stack outputs for cross-stack references
Correct answer: To preview proposed changes to a stack before executing the update
A Change Set shows a summary of proposed changes to a CloudFormation stack, allowing you to review and understand the impact before executing the actual update.
Question 3: A DevOps team uses Chef for configuration management. What is the Chef component that contains configuration policies defining the desired state of a node?
- Recipe (Correct answer)
- Cookbook
- Run List
- Knife
Correct answer: Recipe
A Chef Recipe is a Ruby-based file containing resources that define the desired state of a system component, and Cookbooks group related recipes together.
Question 4: Which AWS CDK command updates the CloudFormation bootstrap stack in an account/region to support CDK deployments?
- cdk init
- cdk deploy --bootstrap
- cdk bootstrap (Correct answer)
- cdk synth --bootstrap
Correct answer: cdk bootstrap
`cdk bootstrap` provisions the CDKToolkit CloudFormation stack that creates the S3 bucket and IAM roles needed for CDK deployments in an account/region.
Question 5: A CloudFormation template references outputs from another stack. Which intrinsic function is used to import these cross-stack values?
- !GetAtt
- !Ref
- !ImportValue (Correct answer)
- !Sub
Correct answer: !ImportValue
!ImportValue retrieves the value of an output exported by another CloudFormation stack, enabling cross-stack resource sharing.
Question 6: When should you use AWS Systems Manager Parameter Store SecureString type over the String type?
- When the parameter value exceeds 4KB in size
- When the value is sensitive data like passwords or API keys that must be encrypted at rest (Correct answer)
- When the parameter needs to be accessed across multiple AWS regions
- When the parameter is referenced by CloudFormation templates
Correct answer: When the value is sensitive data like passwords or API keys that must be encrypted at rest
SecureString uses AWS KMS to encrypt sensitive parameter values at rest, making it appropriate for secrets, passwords, and API keys.
Question 7: A team wants to use immutable infrastructure by replacing EC2 instances instead of updating them in place. Which deployment pattern best supports this with CloudFormation?
- Rolling update with CloudFormation UpdatePolicy
- Blue/green deployment using separate CloudFormation stacks and Route 53 DNS swap (Correct answer)
- In-place SSM Run Command updates
- CloudFormation stack drift remediation
Correct answer: Blue/green deployment using separate CloudFormation stacks and Route 53 DNS swap
Blue/green with separate stacks creates entirely new infrastructure (green) alongside the old (blue), then shifts traffic via DNS, embodying immutable infrastructure principles.
AWS DevOps DevOps Configuration Management & Infrastructure as Code 5
A team wants to enforce that all EC2 instances launched via CloudFormation must use approved AMIs.
Which AWS service enforces this as a preventive control?