DOP-C02 Practice Exam 62 — 20 Questions

Question 1

A company is using AWS Lambda functions for data processing. The operations team needs to monitor the number of invocations, duration, and error counts for each function. They also want to set alarms when the error rate exceeds 5% in a 5-minute period. Which combination of AWS services should the team use to achieve this with minimal effort?

Accepted Answer

Use CloudWatch metrics published by Lambda and create a CloudWatch alarm on the ErrorCount metric with a math expression to calculate error rate.. Option B is correct because Lambda automatically publishes metrics to CloudWatch (invocations, duration, errors, etc.). CloudWatch Alarms can be set on the ErrorCount metric, and a math expression can calculate error rate. Option A is wrong because CloudTrail logs API calls, not function execution metrics. Option C is wrong because CloudWatch Logs Insights is for log analysis, but the metrics are already available. Option D is wrong because Lambda Insights is for detailed performance monitoring but is not necessary for basic metrics and alarms.

Answer

Use AWS CloudTrail to log Lambda invocations and configure CloudWatch alarms on the log events.

Answer

Enable Lambda Insights to collect detailed metrics and use CloudWatch dashboards to monitor error rates.

Answer

Stream Lambda logs to CloudWatch Logs and use CloudWatch Logs Insights to query error rates, then create alarms.

Question 2

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to monitor the CloudFormation stack events to detect when stack creation or updates fail, and automatically send notifications to a Slack channel. The team has set up an Amazon SNS topic that sends messages to a Slack webhook via a Lambda function. Which solution should the team implement to trigger the SNS topic when a CloudFormation stack fails?

Accepted Answer

Configure the CloudFormation stack to send events to an SNS topic by specifying the topic ARN in the stack's notification options.. Option D is correct because CloudFormation publishes stack events to an SNS topic when specified as a notification ARN in the stack. The team can create an SNS topic and subscribe the Slack webhook Lambda function to it, then specify that topic as the notification ARN when creating or updating the stack. This will send events directly to SNS. Option A is wrong because CloudFormation does not send events to EventBridge by default; you would need to create a rule. Option B is wrong because CloudTrail logs API calls, but you would need additional setup. Option C is wrong because CloudWatch Logs Insights is for querying logs, not real-time events.

Answer

Use CloudWatch Logs Insights to query CloudFormation logs and set up a scheduled query to send results to SNS.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and create a CloudWatch metric filter that detects failure messages, then trigger an alarm to SNS.

Answer

Create an Amazon EventBridge rule that matches CloudFormation API calls for CreateStack and UpdateStack with a status of CREATE_FAILED or UPDATE_FAILED, and set the target to the SNS topic.

Question 3

A company runs a critical e-commerce application on AWS. The application is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The instances store session data in an ElastiCache for Redis cluster. Recently, users have reported intermittent session timeouts during peak traffic hours. The operations team notices that CloudWatch alarms for the Redis cluster's CPUUtilization and Evictions metrics are frequently breaching thresholds. The team wants to resolve the issue without incurring unnecessary costs. Which solution should the team implement?

Accepted Answer

Enable auto scaling for the ElastiCache Redis cluster to add replicas or shards based on CPU and memory utilization.. Option B is correct because enabling auto scaling with a larger instance type or adding shards (clustering) directly addresses the resource contention causing evictions and high CPU. Option A is wrong because memory-optimized instances may not solve CPU issues; also, increasing memory without scaling CPU may not help. Option C is wrong because increasing tRANSIT_ENCRYPTION_ENABLED does not affect performance. Option D is wrong because Lambda integration adds complexity and latency without scaling the cache.

Answer

Configure a Lambda function to offload session data to Amazon DynamoDB and use DAX for caching.

Answer

Enable encryption in transit (TLS) for the Redis cluster to reduce overhead.

Answer

Migrate the Redis cluster to a memory-optimized instance type like r6g.large.

Question 4

An application running on Amazon EC2 instances sends custom metrics to CloudWatch. The team notices that some metrics are not appearing. What is the most likely cause?

Accepted Answer

The CloudWatch agent is not installed or configured on the EC2 instances.. Option A is correct because the CloudWatch agent must be installed and configured to send custom metrics. Option B is wrong because IAM permissions are required but the agent also needs to be installed. Option C is wrong because the agent needs to be running. Option D is wrong because the metric namespace is configured in the agent, not in CloudWatch.

Answer

The custom metric namespace is not pre-registered in CloudWatch.

Answer

The EC2 instances are in a private subnet without a NAT gateway.

Answer

The IAM role attached to the EC2 instance lacks permissions to publish metrics.

Question 5

A company uses Amazon CloudWatch to monitor its production environment. The DevOps team wants to receive an email notification whenever the average CPU utilization of any EC2 instance exceeds 90% for 5 consecutive minutes. Which steps should be taken to set up this notification?

Accepted Answer

Create a CloudWatch alarm on CPUUtilization with a threshold of 90% for 5 consecutive periods, and configure an SNS topic to send email. Option A is correct: create a CloudWatch alarm on the CPUUtilization metric with a threshold of 90% for 5 minutes, and configure an SNS topic to send email. Option B is wrong because CloudTrail is for API logging. Option C is wrong because CloudWatch Logs agent is for log collection. Option D is wrong because Config is for configuration auditing.

Answer

Install the CloudWatch Logs agent on each EC2 instance and configure a metric filter to trigger an SNS notification

Answer

Use AWS CloudTrail to monitor CPU utilization and send notifications via SNS

Answer

Use AWS Config to create a rule that triggers an SNS notification when CPU utilization exceeds 90%

Question 6

A DevOps engineer receives an alarm that an EC2 instance's StatusCheckFailed metric has been in ALARM state for 10 minutes. Which action should the engineer take first to investigate?

Accepted Answer

Review the instance's system log and application logs in CloudWatch Logs. Option C is correct because StatusCheckFailed indicates an instance issue; reviewing system logs in CloudWatch Logs can reveal the cause. Option A (restart) might resolve temporarily but does not diagnose. Option B (CloudTrail) logs API calls, not OS-level issues. Option D (Config) is for configuration compliance.

Answer

Use AWS Config to check the instance's configuration compliance

Answer

Check AWS CloudTrail for any API calls that modified the instance

Answer

Restart the EC2 instance to clear the alarm

Question 7

A DevOps engineer notices that a CloudWatch alarm for high CPU utilization on an EC2 instance is not triggering despite the CPU consistently above the threshold. The instance is in a VPC with a public subnet and has internet access. What is the most likely cause?

Accepted Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.. Option D is correct because CloudWatch requires the SSM Agent or the CloudWatch agent to send metrics; the standard EC2 metrics include CPU utilization, but if the instance is not sending detailed metrics, the alarm may not trigger if the threshold is based on a higher-resolution metric. However, the most common cause is that the CloudWatch agent is not installed or configured, or the IAM role lacks permissions. If the instance does not have the correct IAM role to publish custom metrics, CloudWatch alarms may not trigger. Option A is wrong because CloudWatch can collect metrics from instances without a public IP if they have a NAT gateway or VPC endpoint. Option B is wrong because CloudWatch alarms are evaluated based on metric data, not instance state. Option C is wrong because standard monitoring collects metrics every 5 minutes, which should be sufficient for high CPU, though detailed monitoring (1-minute) is recommended.

Answer

The EC2 instance does not have a public IP address.

Answer

The instance is using basic monitoring (5-minute intervals) which delays the alarm.

Answer

The CloudWatch alarm is in the 'INSUFFICIENT_DATA' state because the instance is stopped.

Question 8

A company is using Amazon RDS for MySQL and needs to monitor the number of slow queries. They have enabled slow query logs. How can they effectively monitor and alert on the number of slow queries per minute?

Accepted Answer

Publish slow query logs to CloudWatch Logs, create a metric filter, and set an alarm.. Option C is correct because you can publish slow query logs to CloudWatch Logs, create a metric filter to count occurrences, and set an alarm on that metric. Option A is wrong because RDS Events do not include slow query counts. Option B is wrong because Enhanced Monitoring does not include slow query logs. Option D is wrong because CloudTrail does not capture database queries.

Answer

Use RDS Events to send slow query metrics to CloudWatch.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Use AWS CloudTrail to monitor SQL queries.

Question 9

A DevOps engineer needs to monitor the health of a web application running on EC2 instances behind an Application Load Balancer (ALB). Which TWO metrics from ALB should be monitored to detect application errors? (Choose TWO.)

Accepted Answer

HTTPCode_Target_5XX_Count.. Option A is correct because HTTPCode_Target_5XX_Count indicates server errors. Option B is correct because TargetResponseTime can indicate performance issues leading to errors. Option C is wrong because RequestCount is total requests, not errors. Option D is wrong because HealthyHostCount is about host health, not application errors. Option E is wrong because HTTPCode_ELB_5XX_Count is for ALB itself, not targets.

Answer

RequestCount.

Answer

HTTPCode_ELB_5XX_Count.

Answer

HealthyHostCount.

Question 10

A company is running a critical application on Amazon ECS with Fargate launch type. The application writes logs to Amazon CloudWatch Logs. The DevOps team needs to set up an alert when the application generates more than 100 error logs in any 5-minute window. Which configuration should be used?

Accepted Answer

Create a CloudWatch Logs metric filter for 'ERROR' and a CloudWatch alarm on the resulting metric with a period of 5 minutes. Option D is correct because a CloudWatch Logs metric filter can parse logs for the word 'ERROR' and create a custom metric, and a CloudWatch alarm can be set on that metric. Option A is wrong because CloudWatch Logs Insights is for querying, not real-time alerting. Option B is wrong because EventBridge can't directly parse log contents. Option C is wrong because CloudTrail is for API calls.

Answer

Create a CloudWatch Logs Insights query that runs every 5 minutes and triggers an SNS notification

Answer

Create an Amazon EventBridge rule that matches CloudWatch Logs events for the word 'ERROR' and triggers an alarm

Answer

Enable AWS CloudTrail logging for the ECS task and create a metric filter on CloudTrail logs

Question 11

A company is using AWS CloudFormation to manage infrastructure. The DevOps team wants to receive notifications when CloudFormation stack creation fails. Which AWS service should be used to capture the stack failure event and send a notification?

Accepted Answer

Amazon EventBridge. Option B is correct because Amazon EventBridge can capture CloudFormation stack events (such as CREATE_FAILED) and route them to an SNS topic for notification. Option A is wrong because CloudWatch Logs stores logs but does not directly send notifications. Option C is wrong because CloudTrail records API calls but is not the most efficient for real-time notifications. Option D is wrong because SQS is a queue, not a notification service.

Answer

Amazon SQS

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 12

A DevOps team needs to monitor failed API calls in their AWS account. They want to receive notifications when specific IAM actions, such as DeleteBucket, fail. Which service should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge.. Option D is correct because CloudTrail logs API calls, and CloudWatch Events (now Amazon EventBridge) can be used to create rules that match specific API calls and trigger notifications. Option A is wrong because CloudWatch does not directly capture API calls. Option B is wrong because Config monitors resource configuration, not API calls. Option C is wrong because S3 access logs are for object-level operations.

Answer

AWS Config rules.

Answer

Amazon S3 server access logs.

Answer

CloudWatch Logs and metric filters.

Question 13

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search and analyze logs from multiple EC2 instances in real time. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

Amazon OpenSearch Service.. Option A is correct because CloudWatch Logs Insights allows real-time querying of log groups. Option C is correct because CloudWatch Logs can stream to Amazon OpenSearch Service for real-time search and analytics. Option B is wrong because Athena is for ad-hoc querying of S3 data, not real-time. Option D is wrong because Kinesis Data Analytics is for streaming data analysis, not directly for log search. Option E is wrong because QuickSight is for visualization, not real-time search.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Answer

Amazon Kinesis Data Analytics.

Question 14

A company is using AWS CloudFormation to deploy a microservices architecture. The operations team wants to receive real-time notifications when any stack operation fails. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Options A and E are correct. CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack events and trigger an SNS topic to send notifications. Option B is wrong because Lambda alone doesn't provide notifications. Option C is wrong because CloudTrail is for API auditing, not real-time notification. Option D is wrong because CloudWatch Logs doesn't trigger SNS directly for stack events.

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 15

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Use the CloudWatch Logs console or API to associate the KMS key with the log group. Options A and C are correct. To encrypt CloudWatch Logs with a customer-managed KMS key, you must first create the KMS key and then associate it with the log group using the CloudWatch Logs console or API. Option B is wrong because you cannot associate a key with a log stream directly; it's at the log group level. Option D is wrong because CloudWatch Logs does not support default encryption with a KMS key at the account level. Option E is wrong because the key policy must allow CloudWatch Logs to use the key, but the key policy is set on the key itself, not on the log group.

Answer

Enable default encryption for CloudWatch Logs in the AWS account settings

Answer

Update the log group's resource policy to reference the KMS key

Answer

Associate the KMS key with each log stream individually

Question 16

A company uses AWS CloudTrail to monitor API activity. The DevOps team needs to ensure that any deletion of an S3 bucket is detected in real time and triggers an automated response. Which combination of AWS services should be used to meet these requirements?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a CloudWatch Events rule matching the DeleteBucket event, and target a Lambda function.. Option B is correct because CloudTrail logs can be sent to CloudWatch Logs, which can trigger a CloudWatch Events rule (now Amazon EventBridge) to invoke a Lambda function for automated response. Option A is wrong because S3 does not natively trigger on bucket deletion. Option C is wrong because CloudWatch Logs alone cannot trigger a response without a subscription filter or metric alarm. Option D is wrong because CloudTrail does not directly invoke Lambda; it must go through CloudWatch Logs or EventBridge.

Answer

Use CloudWatch Logs to monitor the logs, and create a metric filter to trigger an alarm when the DeleteBucket event appears.

Answer

Configure S3 event notifications to send to an SQS queue, and poll the queue with a Lambda function.

Answer

Configure CloudTrail to deliver logs to an S3 bucket, and use S3 event notifications to invoke a Lambda function.

Question 17

An application running on Amazon EKS generates logs that need to be sent to CloudWatch Logs for central monitoring. The DevOps team deploys the CloudWatch agent as a DaemonSet in the cluster. However, logs from some pods are not appearing in CloudWatch. Which configuration issue is most likely causing this?

Accepted Answer

The IAM role associated with the worker nodes does not have the necessary permissions to write to CloudWatch Logs.. Option B is correct because the CloudWatch agent requires IAM permissions to put logs to CloudWatch Logs; if the node's IAM role lacks these permissions, logs will not be sent. Option A is wrong because the agent typically collects from the pod's log files, not stdout directly. Option C is wrong because a DaemonSet runs on all nodes by default. Option D is wrong because the agent can forward logs without a sidecar if it has access to the log files.

Answer

The pods are using the fluentd sidecar instead of the CloudWatch agent.

Answer

The CloudWatch agent is configured to collect logs from stdout, but the application writes logs to files.

Answer

The DaemonSet is not scheduled on all nodes due to taints and tolerations.

Question 18

A DevOps team uses AWS CloudFormation to deploy a web application. They want to receive notifications when a stack update fails. Which combination of services should they use?

Accepted Answer

Create a CloudWatch alarm on the CloudFormation stack event metric 'UPDATE_FAILED' and configure an SNS topic to send email notifications.. Option B is correct because you can create a CloudWatch alarm on the 'Stack Events' metric for 'UPDATE_FAILED' and send notifications via SNS. Option A is wrong because Lambda cannot directly receive CloudFormation events without a custom integration. Option C is wrong because EventBridge can capture CloudFormation events, but the question asks for notifications; the simplest approach is CloudWatch Alarm + SNS. Option D is wrong because S3 does not trigger on stack events by default.

Answer

Use AWS Config rules to monitor stack status and trigger an SNS notification.

Answer

Use Amazon EventBridge to capture CloudFormation events and invoke an AWS Lambda function that sends an email.

Answer

Enable S3 event notifications on the CloudFormation template bucket and subscribe an SNS topic.

Question 19

A company has a microservices architecture with 50 services running on Amazon ECS. The DevOps team wants to collect and analyze logs from all services centrally. They need to query logs across services and set up alerts for error patterns. Which solution is the most scalable and cost-effective?

Accepted Answer

Use the awslogs driver to send logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights for querying and metric filters for alerts. Option D is correct because sending logs to CloudWatch Logs and using Logs Insights provides centralized querying and alerting. Option A (S3 + Athena) is cheaper but has slower query times and no real-time alerting. Option B (Elasticsearch) is more complex and costly. Option C (CloudTrail) is for API logs.

Answer

Use AWS CloudTrail to capture all log events and store them in an S3 bucket for analysis

Answer

Deploy an Amazon Elasticsearch cluster and configure the ECS Fargate agent to send logs directly to Elasticsearch

Answer

Send logs to Amazon S3 and use Amazon Athena for querying, with scheduled queries for alerts

Question 20

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The DevOps team wants to monitor the end-to-end latency of API requests, including the time spent in API Gateway and Lambda. Which approach provides the most granular breakdown?

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. Option D is correct because AWS X-Ray provides tracing that shows the time spent in each component (API Gateway, Lambda, downstream calls) with detailed segments and subsegments. Option A is wrong because CloudWatch metrics give aggregate latency but no breakdown. Option B is wrong because Lambda Insights provides OS-level metrics, not request tracing. Option C is wrong because VPC Flow Logs capture network traffic, not application latency.

Answer

Enable Lambda Insights to get per-request latency breakdown.

Answer

Enable VPC Flow Logs to capture network round-trip times.

Answer

Use CloudWatch metrics for API Gateway and Lambda, then add them together.