DOP-C02 Practice Exam 61 — 20 Questions

Question 1

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with timeout errors. The DevOps team needs to troubleshoot the root cause. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Increase the canary timeout configuration to allow more time for the endpoint to respond.. Options B, C, and D are correct. B: Checking VPC Flow Logs helps identify network issues. C: Checking canary logs provides details about the failure. D: Increasing canary timeout may resolve if the timeout is too low. A is wrong because canaries run in Lambda and do not use EC2. E is wrong because CloudTrail does not capture canary execution details.

Answer

Use AWS CloudTrail to review Canary API calls.

Answer

Check the EC2 instance CPU utilization in the VPC where the canaries run.

Question 2

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance is unable to send logs to CloudWatch Logs. The log group 'MyAppLogs' exists in the same account and region. What is the most likely reason for the failure?

Accepted Answer

The policy is missing permissions to create log streams.. Option B is correct because the policy only allows PutLogEvents, but the instance needs permissions for CreateLogStream and DescribeLogStreams as well. Option A is wrong because the log group exists. Option C is wrong because the resource ARN includes log-stream wildcard, which is correct. Option D is wrong because the policy explicitly allows the action.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The log group does not exist in the specified region.

Answer

The policy does not allow the logs:PutLogEvents action.

Question 3

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an Auto Scaling policy to add more EC2 instances when the queue depth exceeds a threshold. Which CloudWatch metric should the alarm use?

Accepted Answer

ApproximateNumberOfMessagesVisible. Option A is correct because ApproximateNumberOfMessagesVisible indicates the number of messages available for retrieval. Option B is wrong because NumberOfMessagesSent is a count of sent messages. Option C is wrong because ApproximateNumberOfMessagesNotVisible is for messages in flight. Option D is wrong because SentMessageSize is the size of messages.

Answer

NumberOfMessagesSent

Answer

ApproximateNumberOfMessagesNotVisible

Answer

SentMessageSize

Question 4

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that any changes to CloudTrail configuration (such as disabling the trail or modifying the log file validation) are immediately detected and trigger an automated response. Which solution should the DevOps engineer implement?

Accepted Answer

Create an Amazon EventBridge rule that matches CloudTrail API calls like StopLogging or UpdateTrail and triggers an SNS topic.. Option D is correct because CloudTrail itself logs changes to its configuration, so a CloudWatch Events (now Amazon EventBridge) rule can be created to match API calls that modify CloudTrail (e.g., StopLogging, UpdateTrail) and trigger an SNS notification or Lambda for automated response. Option A is wrong because Config rules can detect configuration drift but are not real-time. Option B is wrong because GuardDuty focuses on security threats, not CloudTrail configuration changes. Option C is wrong because Trusted Advisor does not monitor CloudTrail changes.

Answer

Enable Amazon GuardDuty and configure it to monitor CloudTrail logs for suspicious activity.

Answer

Use AWS Config rules with remediation actions to detect and revert changes to CloudTrail.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration and send alerts via email.

Question 5

A company runs a critical e-commerce application on AWS. The architecture includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server, and an Amazon RDS MySQL Multi-AZ database. The DevOps team has implemented CloudWatch dashboards to monitor key metrics. Recently, customers have reported that the website becomes unresponsive for a few minutes during peak traffic hours. The team reviews the CloudWatch metrics and observes that during the incidents, the ALB's 'TargetResponseTime' metric spikes, and the RDS 'ReadLatency' and 'WriteLatency' metrics also spike. However, the EC2 CPU utilization and memory usage remain normal. The ALB health check shows 'Healthy' for all targets. The team needs to identify the root cause. Which course of action should the team take?

Accepted Answer

Enable Performance Insights on the RDS instance to analyze database performance and identify slow queries.. Option C is correct because the symptoms point to database contention (spikes in read/write latency) while the application servers are healthy. Enabling Performance Insights on RDS will help identify the specific queries causing the latency, such as slow queries or locks. Option A is wrong because adding more EC2 instances doesn't address the database bottleneck. Option B is wrong because the issue is not related to ALB configuration. Option D is wrong because scaling the ALB is not the issue.

Answer

Configure the ALB to add a second listener and distribute traffic across multiple target groups.

Answer

Review the ALB access logs to identify if there are any unusual request patterns causing the latency.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances to handle the load.

Question 6

A company runs a microservices architecture on Amazon EKS. The DevOps team wants to monitor application performance and detect anomalies in request latency. They need to collect metrics, logs, and traces from all services. Which THREE AWS services should the team use together to implement a complete observability solution? (Choose three.)

Accepted Answer

AWS X-Ray. Options A, B, and D are correct. CloudWatch Container Insights provides metrics and logs for EKS (Option A). AWS X-Ray provides distributed tracing (Option B). CloudWatch ServiceLens integrates CloudWatch metrics/logs and X-Ray traces into a single view (Option D). Option C (Prometheus) is not a native AWS service; Amazon Managed Service for Prometheus would be the AWS service, but the question asks for AWS services. Option E (CloudTrail) is for API activity, not application performance.

Answer

AWS CloudTrail

Answer

Amazon Managed Service for Prometheus

Question 7

Refer to the exhibit. A DevOps engineer runs the AWS CLI command to get the average TargetResponseTime for an ALB over a 1-hour period. The output shows only three datapoints. What is the most likely reason?

Accepted Answer

The ALB did not receive any requests during most of the 5-minute periods.. Option C is correct because the period is 300 seconds (5 minutes), so there should be 12 datapoints in an hour. However, the output shows only 3, which suggests that data is missing for most intervals, likely because the ALB did not receive any requests during those periods (the metric is only emitted when there are requests). Option A is wrong because the metric is available. Option B is wrong because the command includes the TargetGroup dimension. Option D is wrong because the period is set to 300.

Answer

The metric TargetResponseTime is not available for Application Load Balancers.

Answer

The command is missing the 'Statistics' parameter with 'Average'.

Answer

The period of 300 seconds is too large; a smaller period should be used.

Question 8

A DevOps engineer executes the above CloudWatch Logs Insights query. What will the output contain?

Accepted Answer

The count of ERROR messages per 5-minute interval for the most recent 20 intervals. Option C is correct because the query filters for 'ERROR' messages, counts them in 5-minute bins, and returns the 20 most recent bins sorted by timestamp descending. Option A is wrong because it returns error messages, not all messages. Option B is wrong because it counts, not lists individual messages. Option D is wrong because it bins by 5 minutes, not 1 minute.

Answer

The count of ERROR messages per 1-minute interval for the most recent 20 intervals

Answer

The total count of ERROR messages in the log group

Answer

A list of the 20 most recent log entries that contain the word 'ERROR'

Question 9

A company is using Amazon CloudWatch to monitor its production environment. The operations team receives alerts for the same underlying issue from multiple alarms, causing alert fatigue. The team wants to reduce noise and consolidate alerts into actionable notifications. Which TWO steps should the team take? (Choose two.)

Accepted Answer

Configure the CloudWatch alarms to publish to an SNS topic, and use SNS subscription filter policies to route only critical notifications.. Options A and D are correct. CloudWatch Alarm composite alarms can combine multiple alarms into a single alarm with OR/AND logic (Option A). CloudWatch can publish to an SNS topic, and you can filter messages to reduce noise (Option D). Option B (CloudWatch Logs Insights) is for querying logs, not for alert consolidation. Option C (CloudWatch Evidently) is for feature flags. Option E (Config rules) is for compliance, not alerting.

Answer

Use CloudWatch Evidently to run experiments and filter out false alarms.

Answer

Use CloudWatch Logs Insights to query logs and create alarms based on the query results.

Answer

Use AWS Config rules to automatically suppress alarms that are not compliant.

Question 10

A company is running a production web application on Auto Scaling EC2 instances behind an ALB. They have enabled detailed CloudWatch metrics on the EC2 instances and enabled CloudTrail. Recently, users reported intermittent 503 errors. The operations team reviews CloudWatch dashboards but sees no spike in CPU or memory. What is the MOST likely cause of the 503 errors?

Accepted Answer

The target group has an insufficient number of healthy instances due to health check failures. Option D is correct because ALB 503 errors often indicate that the target group health checks are failing due to insufficient healthy instances, which may not cause CPU/memory spikes. Option A is wrong because CloudTrail logs API calls, not HTTP responses. Option B is wrong because if detailed monitoring were disabled, metrics would be missing, but the question says they are enabled. Option C is wrong because a misconfigured security group would cause connection timeouts, not 503 errors.

Answer

Insufficient CloudTrail logging trail configuration

Answer

Detailed monitoring is disabled for the EC2 instances

Answer

The security group for the ALB is misconfigured

Question 11

A company is deploying a new microservice on AWS Lambda. The DevOps team needs to monitor the function for errors and performance issues. Which TWO steps should the team take to set up effective monitoring?

Accepted Answer

Enable active tracing with AWS X-Ray to trace requests through the function. Option A is correct because Lambda automatically sends logs to CloudWatch Logs. Option C is correct because enabling AWS X-Ray traces requests and provides performance insights. Option B is wrong because CloudWatch Agent is not needed for Lambda. Option D is wrong because VPC Flow Logs are for network traffic. Option E is wrong because AWS Config is for configuration management.

Answer

Enable VPC Flow Logs to monitor network traffic to the function

Answer

Enable AWS Config rules to evaluate the function configuration

Answer

Install the CloudWatch Agent on the Lambda execution environment

Question 12

A company has a critical application running on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing intermittent latency spikes. The DevOps team has enabled detailed monitoring on the EC2 instances and is using CloudWatch metrics. They notice that CPU utilization and network traffic are normal during the spikes. Which additional diagnostic step should the team take to identify the root cause?

Accepted Answer

Instrument the application with AWS X-Ray to trace requests and identify bottlenecks.. Option B is correct because X-Ray can trace requests end-to-end and identify which component is causing latency, even if CPU and network are normal. Option A is wrong because Synthetics monitors external endpoints, not internal application behavior. Option C is wrong because Container Insights is for containerized environments. Option D is wrong because Trusted Advisor is not a diagnostic tool.

Answer

Use CloudWatch Container Insights to monitor the performance of the EC2 instances.

Answer

Enable CloudWatch Synthetics to create canaries that monitor the application endpoints.

Answer

Run an AWS Trusted Advisor check to identify performance-related recommendations.

Question 13

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances run a custom Java application that uses an RDS for MySQL database and an ElastiCache Redis cluster for session caching. The DevOps team has set up CloudWatch alarms for CPU utilization, memory, and database connections. Recently, customers have been reporting slow page load times and occasional timeouts. The team notices that during peak hours, the ALB's TargetResponseTime metric spikes, and the number of healthy hosts in the target group fluctuates. The CPU and memory metrics on the EC2 instances remain within normal ranges. The database CPU is also normal. The team suspects the issue is related to the application's session management. Which course of action should the DevOps team take to identify the root cause?

Accepted Answer

Monitor ElastiCache metrics such as CPUUtilization, CacheHits, and Evictions to determine if the Redis cluster is overloaded. Option C is correct because the symptoms (increased latency, fluctuating healthy hosts) and the role of ElastiCache in session caching suggest that Redis performance may be degrading. Monitoring ElastiCache metrics like CPUUtilization, cache hits/misses, and evictions can confirm if Redis is the bottleneck. Option A is wrong because scaling the ALB does not address session management issues. Option B is wrong because database connection pooling is not indicated; database CPU is normal. Option D is wrong because CloudWatch Agent on EC2 would not capture Redis metrics.

Answer

Enable RDS Performance Insights and look for slow queries or connection storms

Answer

Install the CloudWatch Agent on the EC2 instances to collect additional application-level metrics

Answer

Increase the number of ALB targets and adjust the target group health check interval

Question 14

A DevOps engineer is setting up monitoring for an Amazon S3 bucket that stores sensitive data. The engineer needs to be notified whenever an object in the bucket is accessed by a user or application, including read and write operations. Which AWS service should the engineer use to capture these events and trigger notifications?

Accepted Answer

Configure S3 event notifications to send events to an SNS topic for object-level operations.. Option C is correct because Amazon S3 can be configured to send event notifications to SNS, SQS, or Lambda for object-level operations (e.g., PutObject, GetObject). This is the most direct way. Option A is wrong because CloudTrail logs API calls but does not trigger real-time notifications. Option B is wrong because CloudWatch Metrics track bucket metrics but not per-object access. Option D is wrong because Config records changes but does not provide real-time access notifications.

Answer

Enable AWS CloudTrail data events for the S3 bucket and configure CloudWatch alarms on the log group.

Answer

Use AWS Config to record S3 resource changes and trigger an SNS notification.

Answer

Use Amazon CloudWatch metrics for the S3 bucket and set an alarm on the NumberOfObjects metric.

Question 15

A DevOps engineer is troubleshooting a production issue where an Application Load Balancer (ALB) is returning 503 errors. The ALB targets are EC2 instances in an Auto Scaling group behind the ALB. The engineer checks the ALB access logs in Amazon S3 and finds that the ALB is healthy. However, the 503 errors persist. Which configuration should the engineer check next?

Accepted Answer

Check the security groups for the EC2 instances to ensure they allow traffic from the ALB on the listener port.. Option C is correct because 503 errors are often caused by the ALB being unable to establish a connection to the targets due to security groups blocking traffic. Checking the target group's health check settings and the security groups for the EC2 instances is the logical next step. Option A is wrong because the ALB is healthy per the logs. Option B is wrong because the issue is not about SSL certificates. Option D is wrong because AWS Shield Advanced is a DDoS protection service, not relevant to 503 errors.

Answer

Enable AWS Shield Advanced to protect the ALB from DDoS attacks.

Answer

Verify that the SSL certificate associated with the ALB is not expired.

Answer

Check the ALB's target group health check settings and verify that the health check path is correct.

Question 16

A company uses Amazon CloudWatch Logs to store application logs. They have a requirement to retain logs for 90 days for operational analysis and then archive them to Amazon S3 for compliance purposes for an additional 5 years. Which of the following steps are necessary to meet this requirement? (Select TWO.)

Accepted Answer

Set the CloudWatch Logs retention policy on the log group to 90 days.. Option D is correct because you can set a retention policy on the log group to expire logs after 90 days (e.g., 90 days). Option E is correct because to archive logs to S3, you can use CloudWatch Logs export task to S3 (manual or automated). Option A is wrong because CloudWatch Logs does not have a lifecycle policy directly to S3; export is needed. Option B is wrong because S3 lifecycle transitions are for objects already in S3, not for logs in CloudWatch. Option C is wrong because CloudWatch does not automatically archive; you must export.

Answer

Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.

Answer

Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.

Answer

Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.

Question 17

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team wants to set up real-time monitoring for specific error patterns and trigger remediation actions. Which TWO services can process the log events in real time and invoke an AWS Lambda function for remediation? (Choose two.)

Accepted Answer

Stream log events to Amazon Kinesis Data Streams and configure a Lambda function to process the stream.. Option A and Option C are correct. CloudWatch Logs can stream to Lambda via subscription filters (Option A) and also to Kinesis Data Streams which can then be processed by Lambda (Option C). Option B is wrong because EventBridge does not directly subscribe to log streams; it can receive events from other sources but not directly from CloudWatch Logs in real time. Option D (SQS) would require a Lambda to poll, but real-time streaming is not native. Option E (SNS) is for push notifications, but cannot directly receive log events from CloudWatch Logs without a subscription filter.

Answer

Create an Amazon EventBridge rule that matches on CloudWatch Logs log group events.

Answer

Configure the log group to send log events to an Amazon SQS queue, and have the Lambda function poll the queue.

Answer

Publish log events to an Amazon SNS topic and subscribe the Lambda function.

Question 18

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team wants to collect custom application metrics (e.g., request latency per service) and visualize them in CloudWatch dashboards. The team also needs to set CloudWatch alarms based on these metrics. Which solution requires the LEAST amount of code changes and operational overhead?

Accepted Answer

Use the CloudWatch Embedded Metric Format to emit custom metrics as JSON log entries.. Option A is correct because the CloudWatch Embedded Metric Format allows applications to emit metrics as structured JSON logs, which CloudWatch automatically extracts into metrics and logs. This requires minimal code changes (just log format). Option B is wrong because publishing to CloudWatch via PutMetricData requires the AWS SDK and more code changes. Option C is wrong because CloudWatch Agent on Fargate is not supported (requires EC2). Option D is wrong because using a sidecar container for StatsD adds complexity and overhead.

Answer

Deploy a StatsD daemon as a sidecar container and configure the application to send metrics to StatsD, then forward to CloudWatch.

Answer

Modify the application code to use the AWS SDK to call PutMetricData API directly.

Answer

Install the CloudWatch Agent on each Fargate task as a sidecar container to collect custom metrics.

Question 19

Refer to the exhibit. A DevOps engineer runs the above CloudWatch Logs Insights query on a log group containing application logs. The query returns an empty result set. The engineer knows that the application logs contain ERROR entries. Which of the following is the most likely cause?

Accepted Answer

The filter pattern is case-sensitive and the log entries use lowercase 'error'.. Option B is correct because the query uses 'like /ERROR/' which is case-sensitive. If the logs contain 'error' in lowercase, the filter will not match. Option A is wrong because the timestamp field is present. Option C is wrong because the stats function is valid. Option D is wrong because the limit is fine.

Answer

The stats function cannot be used with the filter command.

Answer

The log group does not have any log streams.

Answer

The limit of 20 results is too low and the query times out.

Question 20

A DevOps team is designing a centralized logging solution for multiple AWS accounts. The team needs to collect logs from EC2 instances, Lambda functions, and VPC Flow Logs, and store them in a central account for analysis. The solution must be cost-effective and support near real-time log aggregation. Which THREE steps should the team take? (Choose three.)

Accepted Answer

Deliver logs from the central account's CloudWatch Logs to Amazon Kinesis Data Firehose, which writes to Amazon S3.. Options B, C, and D are correct. CloudWatch cross-account subscription allows sending logs from source accounts to a central account (Option B). Kinesis Data Firehose can buffer and deliver logs to S3 at low cost (Option C). Athena can query logs in S3 efficiently (Option D). Option A (direct delivery to S3) does not support near real-time aggregation; VPC Flow Logs can be delivered to S3, but not Lambda directly. Option E (OpenSearch) is more expensive and not necessary for cost-effective storage and analysis.

Answer

Configure VPC Flow Logs to deliver to a Lambda function in each account, which forwards logs to the central account.

Answer

Use Amazon OpenSearch Service to index and search the logs in near real time.