DOP-C02 Practice Exam 59 — 20 Questions

Question 1

A company is running a production microservices architecture on Amazon ECS with Fargate. The operations team wants to set up centralized logging across all services, including the ability to search logs in near real-time and retain them for 3 years. The logs are currently sent to CloudWatch Logs. Which combination of services would meet these requirements with the least operational overhead?

Accepted Answer

Set a retention policy of 3 years on the CloudWatch Logs log groups and use CloudWatch Logs Insights for searching.. Option C is correct because CloudWatch Logs provides near real-time search and can set retention to 3 years. Option A is wrong because S3 + Athena is not real-time and adds complexity. Option B is wrong because Elasticsearch Service adds operational overhead. Option D is wrong because Firehose to S3 alone lacks search capability.

Answer

Stream logs to Amazon OpenSearch Service (Elasticsearch) using a CloudWatch Logs subscription filter.

Answer

Export logs to Amazon S3 and use Amazon Athena to query them.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon S3 with a 3-year lifecycle policy.

Question 2

A company is using Amazon CloudWatch Logs to collect application logs. They need to search and analyze the logs in near real-time. Which TWO AWS services can be used to achieve this?

Accepted Answer

Amazon CloudWatch Logs Insights. A and D are correct: CloudWatch Logs Insights allows querying logs directly, and Amazon OpenSearch Service can ingest logs via a subscription filter for analysis. B is wrong because Athena queries data in S3, not directly from CloudWatch Logs. C is wrong because Kinesis Data Analytics processes streaming data, but not directly from CloudWatch Logs. E is wrong because CloudWatch Synthetics is for canaries, not log analysis.

Answer

Amazon CloudWatch Synthetics

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Athena

Question 3

A company is using Amazon CloudWatch Logs to collect logs from multiple EC2 instances. They need to filter logs in real time and send specific log events to a custom application for processing. Which TWO services can they use to achieve this?

Accepted Answer

Configure a CloudWatch Logs subscription filter that invokes an AWS Lambda function.. Correct: A (CloudWatch Logs subscription filter with Lambda) and D (CloudWatch Logs subscription filter with Kinesis Data Firehose). Option B is wrong because Kinesis Data Analytics is for analytics, not forwarding. Option C is wrong because CloudWatch Events is for events, not log filtering. Option E is wrong because S3 is a destination, not a real-time processing service.

Answer

Use Amazon Kinesis Data Analytics to process the log stream.

Answer

Create a CloudWatch Events rule to capture log events and send them to Amazon SQS.

Answer

Use Amazon S3 event notifications to trigger a Lambda function on new log files.

Question 4

A company runs a containerized microservices application on Amazon ECS with Fargate. The operations team wants to collect custom application metrics (e.g., request latency, error counts) and send them to CloudWatch. The team wants to avoid managing any servers or agents. Which solution meets these requirements?

Accepted Answer

Use the CloudWatch Embedded Metric Format to emit metrics from the application code as structured logs. Option B is correct because the CloudWatch Embedded Metric Format (EMF) allows applications to output structured JSON logs that CloudWatch automatically converts to metrics, and Fargate tasks can output logs to CloudWatch Logs without an agent. Option A is wrong because the CloudWatch Agent requires running on EC2 or on-premises, not Fargate. Option C is wrong because StatsD requires a server or sidecar agent. Option D is wrong because CloudTrail does not capture custom application metrics.

Answer

Install the CloudWatch Agent in the container image and configure it to collect custom metrics

Answer

Enable AWS CloudTrail for the ECS service to capture API calls and derive metrics

Answer

Run a StatsD daemon in a sidecar container and configure it to forward metrics to CloudWatch

Question 5

A company uses Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a web application. The DevOps team needs to create a metric filter that parses logs for HTTP status codes (e.g., 4xx and 5xx) and increment a metric. Additionally, they need to create a CloudWatch alarm on the error count. Which of the following are required to achieve this? (Select TWO.)

Accepted Answer

Define the metric filter pattern to match HTTP status codes in the log entries.. Option A is correct because a metric filter is defined on a log group to extract metrics. Option C is correct because the metric filter pattern must match the log format to extract the status code. Option B (IAM role) is not required because the CloudWatch Logs agent uses credentials from the instance profile. Option D (subscription filter) is for streaming logs to other destinations, not for metric filters. Option E (CloudWatch Agent) is not required; the default CloudWatch Logs agent can send logs.

Answer

Create an IAM role that allows CloudWatch Logs to read the log data and publish metrics.

Answer

Configure a subscription filter to forward the logs to a Lambda function that creates the metric.

Answer

Install the CloudWatch Agent on the EC2 instances to send the logs.

Question 6

A DevOps engineer is troubleshooting a slow API response. They suspect that the issue is related to database queries. The application runs on EC2 instances behind an ALB and uses Amazon RDS for MySQL. Which monitoring approach will provide the most granular insight into database query performance?

Accepted Answer

Enable Enhanced Monitoring and Performance Insights for the RDS instance.. Option D is correct because Enhanced Monitoring provides OS-level metrics, and Performance Insights offers query-level performance data. Option A is wrong because ELB metrics only show overall latency. Option B is wrong because CloudWatch agent captures OS metrics but not query-specific data. Option C is wrong because CloudWatch Logs requires logs to be sent manually.

Answer

Enable CloudWatch Logs for the RDS instance and query the error log.

Answer

Install the CloudWatch agent on the EC2 instances to collect database performance counters.

Answer

Monitor the ALB's 'TargetResponseTime' metric and correlate with RDS 'CPUUtilization'.

Question 7

A company is running a production application on Amazon ECS with AWS Fargate. The application has unpredictable traffic patterns and occasionally experiences increased latency. The DevOps team needs to configure scaling based on a custom metric that tracks the number of active user sessions in real time. Which solution will allow the team to scale the ECS service based on this custom metric?

Accepted Answer

Publish the custom metric to Amazon CloudWatch, then create a target tracking scaling policy in Application Auto Scaling for the ECS service.. Option B is correct because CloudWatch custom metrics can be used with ECS Service Auto Scaling. Option A is wrong because Application Auto Scaling is the correct service, but it is not direct. Option C is wrong because Lambda cannot directly scale ECS services. Option D is wrong because CloudWatch dashboards are for visualization only.

Answer

Use AWS Auto Scaling to scale the ECS service based on the custom metric.

Answer

Create a CloudWatch dashboard to visualize the metric and manually adjust the service count.

Answer

Use an AWS Lambda function to directly update the desired count of the ECS service based on the metric.

Question 8

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). They need to implement a monitoring strategy that provides detailed visibility into application performance, including request-level latency and error codes. Which THREE actions should they take?

Accepted Answer

Enable ALB access logs and store them in Amazon S3.. Correct: A (Enable ALB access logs), C (Enable detailed CloudWatch metrics for the ALB), and D (Enable CloudWatch agent on EC2 instances for application logs). Option B is wrong because VPC Flow Logs are for network traffic, not application performance. Option E is wrong because CloudTrail is for API calls, not application metrics.

Answer

Enable VPC Flow Logs to capture traffic patterns.

Answer

Enable AWS CloudTrail to log API calls made to the load balancer.

Question 9

An organization wants to ensure that all API calls made in their AWS account are logged for security analysis. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records all API calls made in the account. Option B is wrong because CloudWatch Logs stores logs but does not capture API calls. Option C is wrong because VPC Flow Logs capture network traffic. Option D is wrong because AWS Config tracks resource configuration changes.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 10

A company is using Amazon RDS for MySQL and needs to monitor slow queries to optimize database performance. The team has enabled slow query logs and wants to centralize logging in Amazon CloudWatch Logs for real-time analysis and alerting. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Modify the DB parameter group to enable slow_query_log and set log_output to FILE, then configure the RDS instance to publish the slowquery log file to CloudWatch Logs.. Option B is correct because publishing RDS MySQL slow query logs to CloudWatch Logs can be achieved natively by configuring the DB parameter group to set 'slow_query_log' to 1 and 'log_output' to 'FILE', then enabling the 'slowquery' log export in the RDS console or CLI. This automatically streams logs to CloudWatch without additional infrastructure. Option A is wrong because Enhanced Monitoring provides OS-level metrics, not slow query logs. Option C is wrong because exporting logs to S3 and then using Lambda to push to CloudWatch adds unnecessary complexity. Option D is wrong because enabling Performance Insights does not automatically send slow query logs to CloudWatch; it provides a different performance schema.

Answer

Enable Performance Insights on the RDS instance and use the Performance Insights dashboard to view slow queries.

Answer

Enable Enhanced Monitoring on the RDS instance and configure CloudWatch alarms based on the metrics.

Answer

Configure the RDS instance to export slow query logs to an S3 bucket, then set up a Lambda function to read the logs and send them to CloudWatch Logs.

Question 11

A DevOps engineer is designing a monitoring solution for a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS database. The engineer needs to monitor the health of each component and receive alerts when any component becomes unhealthy. Which of the following CloudWatch metrics should the engineer monitor? (Select THREE.)

Accepted Answer

EC2's StatusCheckFailed metric.. Option A is correct because ALB's HealthyHostCount indicates how many targets are healthy. Option B is correct because EC2's StatusCheckFailed (instance status) detects underlying issues. Option D is correct because RDS's DatabaseConnections can indicate if the database is overwhelmed. Option C (ALB's RequestCount) measures traffic, not health. Option E (RDS's ReadLatency) is a performance metric, not a direct health indicator.

Answer

RDS's ReadLatency metric.

Answer

Application Load Balancer's RequestCount metric.

Question 12

A company's DevOps team notices that their Amazon RDS for PostgreSQL instance's CPU utilization spikes to 90% every day at 10:00 AM, causing application latency. They want to be notified when the CPU utilization exceeds 80% for more than 5 minutes to investigate the cause. Which solution should they implement?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and a threshold of 80, and set the alarm action to send a notification to an Amazon SNS topic.. Option D is correct because a CloudWatch alarm with a metric math expression can trigger an SNS notification when CPUUtilization exceeds 80% for 5 minutes. Option A is wrong because CloudTrail does not monitor CPU utilization. Option B is wrong because Trusted Advisor does not create custom alarms. Option C is wrong because CloudWatch Logs Insights is for log analysis, not metric alarms.

Answer

Use Amazon CloudWatch Logs Insights to query the RDS logs and trigger an SNS notification when CPU utilization is high.

Answer

Enable AWS Trusted Advisor to automatically create a CloudWatch alarm on the CPU utilization metric.

Answer

Create an AWS CloudTrail trail to monitor CPU utilization and trigger an AWS Lambda function to send an email notification.

Question 13

A company wants to collect and analyze logs from on-premises servers and send them to AWS for centralized monitoring. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Agent on the on-premises servers to send logs to Amazon CloudWatch Logs.. Option A is correct: CloudWatch Agent collects logs from on-prem servers and sends to CloudWatch Logs. Option B is wrong because Kinesis Agent is for streaming data to Kinesis, not CloudWatch Logs directly. Option C is wrong because the unified CloudWatch Agent is the recommended tool. Option D is wrong because SSM Agent does not collect logs.

Answer

Amazon Kinesis Agent on the on-premises servers to send logs to Amazon Kinesis Data Firehose, then to Amazon S3.

Answer

Amazon CloudWatch Agent with the awslogs configuration to send logs to Amazon CloudWatch Logs.

Answer

AWS Systems Manager Agent to collect logs and send to Amazon CloudWatch Logs.

Question 14

A DevOps engineer manages a production environment with EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 5xx errors from the ALB. The engineer needs to identify whether the errors originate from the targets or the ALB itself. Which CloudWatch metric should be examined to differentiate between these two sources?

Accepted Answer

HTTPCode_Target_5XX_Count. Option B is correct because HTTPCode_Target_5XX_Count indicates errors from the target (EC2 instances), while HTTPCode_ELB_5XX_Count indicates errors from the ALB. Option A is wrong because RequestCount is total requests. Option C is wrong because TargetResponseTime measures latency. Option D is wrong because UnhealthyHostCount indicates unhealthy targets, not specific error codes.

Answer

TargetResponseTime

Answer

UnhealthyHostCount

Answer

RequestCount

Question 15

A company runs a critical application on Amazon EKS. The operations team needs to monitor the health of the Kubernetes cluster and the applications running on it. Which THREE services can be used together to achieve comprehensive monitoring? (Choose THREE.)

Accepted Answer

AWS X-Ray. Correct options: A, C, D. Option A: CloudWatch Container Insights provides metrics and logs for EKS. Option C: Prometheus (via AWS managed service or self-hosted) is a common open-source monitoring tool for Kubernetes. Option D: AWS X-Ray can trace requests across microservices. Option B is wrong because CloudTrail logs API calls, not cluster health. Option E is wrong because VPC Flow Logs capture network traffic, not application health.

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 16

A company uses Amazon RDS for PostgreSQL and wants to monitor database performance metrics such as CPU utilization, memory, and disk I/O. Which AWS service should be used to set up custom dashboards and alarms for these metrics?

Accepted Answer

Amazon CloudWatch. Option A is correct because CloudWatch provides metrics for RDS and allows dashboards and alarms. Option B is wrong because CloudTrail logs API calls, not performance metrics. Option C is wrong because VPC Flow Logs capture network traffic. Option D is wrong because X-Ray is for tracing requests.

Answer

AWS X-Ray

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 17

A DevOps engineer needs to collect and analyze logs from multiple AWS services, including EC2, Lambda, and API Gateway. The logs must be stored in a central location for long-term retention and analyzed using SQL queries. Which TWO services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Correct options: B and E. Option B: CloudWatch Logs can collect logs from many AWS services. Option E: Exporting logs to S3 and using Athena allows SQL-based analysis. Option A is wrong because CloudTrail is for API logs, not all service logs. Option C is wrong because Kinesis Data Firehose is for real-time streaming, not for ad-hoc SQL queries. Option D is wrong because SQS is a message queue, not a log store.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Question 18

A company wants to monitor network traffic to and from its VPC for security analysis. It needs to capture IP traffic information, including accepted and rejected connection attempts, and store the data in S3 for long-term analysis. Which AWS service should be used?

Accepted Answer

Amazon VPC Flow Logs. Option B is correct because VPC Flow Logs capture network traffic metadata and can be published to S3. Option A is wrong because CloudWatch Logs is for application logs, not network flows. Option C is wrong because CloudTrail tracks API calls. Option D is wrong because GuardDuty is a threat detection service, not a log source.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 19

An e-commerce application runs on Amazon ECS with Fargate. The operations team notices that the application's latency increases during peak hours. The engineer needs to correlate high CPU usage with increased request latency to identify the root cause. Which approach should be used?

Accepted Answer

Enable Container Insights and ServiceLens to correlate metrics and traces. Option D is correct because CloudWatch Container Insights collects CPU metrics and ServiceLens integrates with X-Ray to trace requests, providing end-to-end visibility. Option A is wrong because CloudWatch Logs Insights alone does not correlate metrics and traces. Option B is wrong because Prometheus is a third-party tool. Option C is wrong because CloudWatch Synthetics only monitors endpoints, not internal metrics.

Answer

Use CloudWatch Logs Insights to query container logs

Answer

Configure CloudWatch Synthetics canaries to measure latency

Answer

Set up a Prometheus server on an EC2 instance to scrape container metrics

Question 20

A company wants to ensure that all changes to its Amazon S3 bucket policies are logged for auditing purposes. Which TWO AWS services should be enabled to capture these changes?

Accepted Answer

AWS Config. Options B and D are correct. AWS Config records resource configuration changes, including bucket policies. CloudTrail records API calls like PutBucketPolicy. Option A is wrong because CloudWatch is not for auditing. Option C is wrong because VPC Flow Logs capture network traffic. Option E is wrong because GuardDuty is for threat detection.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

VPC Flow Logs