DOP-C02 - Configuration Management and Infrastructure as Code (17% of the exam) - Section 2.5

Configure and manage instances at scale with AWS Systems Manager State Manager, Run Command, Patch Manager and Parameter Store.

Manage instance configuration at scale with AWS Systems Manager State Manager associations, Run Command for ad hoc operations, and Patch Manager for OS patching schedules. Store environment-specific settings and secrets in Parameter Store with appropriate tiers and access controls.

Systems Manager State ManagerRun CommandPatch ManagerParameter Store

Practice question for this objective

Free sampleConfiguration Management and Infrastructure as Codemedium

A payments service running on Amazon EC2 reads configuration from AWS Systems Manager Parameter Store under the hierarchy /payments/prod/, which holds plaintext settings and one database password. Security requires that the password is encrypted at rest with a customer managed key, that the database value never appears in plaintext in the parameter listing, and that the instance role can read only the parameters beneath /payments/prod/ and nothing else. Which TWO actions together meet these requirements? (Select TWO.)

AStore the database password as a SecureString parameter encrypted with a customer managed AWS KMS key, and grant the instance role kms:Decrypt on that specific key so the value is returned only when explicitly decrypted. Correct
BStore the database password as a standard String parameter and rely on the Amazon EC2 instance metadata service plus the instance role to keep the value private to the running instance only.
CAttach an IAM policy to the instance role that allows ssm:GetParameter and ssm:GetParametersByPath only on the resource ARN matching arn:aws:ssm:region:account:parameter/payments/prod/*. Correct
DGrant the instance role ssm:GetParameter on the resource arn:aws:ssm:region:account:parameter/* and use a parameter naming convention so engineers know which values are production.

Protect a secret in Parameter Store with a SecureString and scope the instance role to the parameter path ARN for least-privilege access. SecureString parameters encrypt the value at rest with a KMS key and return it encrypted unless decryption is requested, so the password is never shown in plaintext, and granting kms:Decrypt only on that key keeps the cryptographic control tight. Scoping ssm:GetParameter and ssm:GetParametersByPath to the /payments/prod/* ARN limits the instance role to one branch of the hierarchy, which is the least-privilege boundary the scenario demands.

Why A is correct: A SecureString parameter encrypts the value at rest with the chosen KMS key and is returned ciphered unless decryption is requested, and scoping kms:Decrypt to that key keeps the password protected while still readable by the service.

Why B is wrong: A standard String parameter stores the value in plaintext and the metadata service has nothing to do with Parameter Store, so the password would be exposed in the parameter listing, violating the encryption requirement.

Why C is correct: Scoping the parameter actions to the ARN pattern for the /payments/prod/ path grants least-privilege read access to exactly that hierarchy and denies the other branches by omission, meeting the scoping requirement.

Why D is wrong: A wildcard on the whole parameter namespace is tempting for simplicity, but it lets the role read every parameter in the account, breaking least privilege, and a naming convention is not an access control.

See more DOP-C02 practice questions, answers explained.

Exam traps in Configuration Management and Infrastructure as Code

Answers that look right on this material and are not. Each one is a distractor from a different question in the DOP-C02 bank for this domain.

Use "Run Command" to push the agent configuration document to all current instances whenever the operations team needs the configuration applied.
Why it is wrong: Run Command performs a one-off action on the instances selected at invocation time, so it neither reapplies after drift nor automatically covers instances launched later, failing the continuous-enforcement requirement.
Open an "AWS Systems Manager Session Manager" session to each instance in turn and restart the service manually so the engineer controls the pace by hand.
Why it is wrong: Session Manager removes the need for SSH and gives shell access, but driving 1,200 instances by hand cannot enforce a concurrency cap or an automatic error threshold, so it does not meet the controlled-rollout requirement.
Schedule an "AWS Lambda" function with "Amazon EventBridge" that calls "Run Command" to install operating-system updates on every managed instance during the agreed window each week.
Why it is wrong: A Lambda that drives Run Command can install updates on a schedule, but it makes you build and maintain the scan-then-patch logic, compliance reporting and window handling by hand, which is more overhead than the managed patch service.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.