DOP-C02 Practice Exam 64 — 20 Questions

Question 1

A company runs a microservices application on Amazon ECS with Fargate. The operations team notices that some services are experiencing intermittent high latency, but CPU and memory metrics appear normal. They need to identify the root cause. Which approach should they use?

Accepted Answer

Instrument the application with the AWS X-Ray SDK and use the X-Ray console to analyze traces.. Option D is correct because AWS X-Ray provides end-to-end tracing to pinpoint latency issues in distributed applications. Option A is wrong because CloudWatch Logs Insights alone does not trace requests across services. Option B is wrong because Prometheus metrics are aggregated and may not correlate individual requests. Option C is wrong because CloudWatch Synthetics canaries test endpoints but cannot trace internal service calls.

Answer

Enable detailed CloudWatch Logs and use CloudWatch Logs Insights to query logs for slow requests.

Answer

Use Amazon Managed Service for Prometheus to collect custom metrics and set up dashboards.

Answer

Set up CloudWatch Synthetics canaries to monitor the endpoints and measure response times.

Question 2

A company wants to monitor the number of messages that are published to an Amazon SNS topic. Which CloudWatch metric should be used?

Accepted Answer

NumberOfMessagesPublished. Option A is correct because SNS publishes the NumberOfMessagesPublished metric. Option B (NumberOfNotificationsDelivered) is for deliveries. Option C (PublishSize) is for message size. Option D (SMSMonthToDateSpentUSD) is for SMS costs.

Answer

SMSMonthToDateSpentUSD

Answer

PublishSize

Answer

NumberOfNotificationsDelivered

Question 3

A company uses Amazon RDS for MySQL and wants to monitor slow queries to optimize performance. Which actions should the DevOps engineer take to capture and analyze slow query logs? (Choose THREE.)

Accepted Answer

Enable the slow query log parameter in the RDS DB parameter group. Option A (enable slow query log) is necessary. Option B (publish to CloudWatch Logs) allows centralized access. Option D (use CloudWatch Logs Insights) enables analysis. Option C (RDS Performance Insights) is for performance but not slow queries specifically. Option E (CloudTrail) is not relevant.

Answer

Use AWS CloudTrail to capture SQL queries

Answer

Enable RDS Performance Insights

Question 4

A company is using AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that all CloudTrail logs are delivered to a central Amazon S3 bucket and that the logs are encrypted and cannot be deleted. Which THREE steps should the team take to meet these requirements? (Choose THREE.)

Accepted Answer

Enable default encryption (SSE-S3) on the central S3 bucket.. Options A, C, and D are correct. Enabling log file validation (A) ensures integrity. Enabling SSE-S3 encryption (C) encrypts logs at rest. Enabling S3 Object Lock (D) prevents deletion. Option B (enable log file integrity) is duplicate of A? Actually, CloudTrail log file validation provides integrity. Option E (enable MFA Delete) is not supported on S3 buckets for this purpose; Object Lock is used.

Answer

Enable MFA Delete on the central S3 bucket to require multi-factor authentication for deletions.

Answer

Enable CloudTrail log file integrity by using AWS KMS.

Question 5

A DevOps engineer is troubleshooting a performance issue with an Amazon RDS for MySQL database. The engineer suspects that slow queries are causing high CPU utilization. Which TWO actions can the engineer take to identify the slow queries?

Accepted Answer

Enable the slow query log and publish it to CloudWatch Logs.. Options A and C are correct. Option A: Enabling the slow query log and sending it to CloudWatch Logs allows analysis. Option C: Enabling Performance Insights provides a dashboard to view database load and identify slow queries. Option B is wrong because Enhanced Monitoring provides OS-level metrics, not query details. Option D is wrong because the RDS event subscription notifies about database events, not slow queries. Option E is wrong because CloudWatch database metrics include CPU, but not query text.

Answer

Create an RDS event subscription for 'low storage' events.

Answer

Monitor the 'CPUUtilization' metric in CloudWatch.

Answer

Enable Enhanced Monitoring to view process list and SQL queries.

Question 6

An application running on AWS Lambda is experiencing cold starts. The team wants to monitor the cold start duration. What should they do?

Accepted Answer

Monitor the 'InitDuration' metric in CloudWatch for the Lambda function.. Option C is correct because Lambda automatically publishes the 'InitDuration' metric for cold starts. Option A is wrong because CloudWatch Logs Insights can extract cold start info but is not the simplest method. Option B is wrong because X-Ray traces show cold starts but the metric is already available. Option D is wrong because custom metrics are not necessary.

Answer

Use CloudWatch Logs Insights to query log groups for 'REPORT' lines and calculate duration.

Answer

Publish a custom metric from the Lambda code that measures initialization time.

Answer

Enable AWS X-Ray and trace the Lambda invocation to see cold start duration.

Question 7

A company uses AWS Lambda for data processing. The operations team wants to be alerted when a function fails. Which TWO methods can they use?

Accepted Answer

Configure a dead-letter queue (DLQ) for the Lambda function and monitor the queue.. Option A is correct because CloudWatch alarms can monitor the 'Errors' metric. Option D is correct because Lambda can send failed invocation records to a dead-letter queue (DLQ), which can trigger alerts. Option B is wrong because CloudTrail logs API calls, not function execution. Option C is wrong because S3 event notifications are not triggered by Lambda errors. Option E is wrong because Config is for resource configuration, not runtime errors.

Answer

Configure S3 event notifications to trigger on Lambda errors.

Answer

Enable AWS CloudTrail to log Lambda invocations.

Answer

Use AWS Config to detect Lambda function failures.

Question 8

Refer to the exhibit. The IAM policy above is attached to an EC2 instance role. The CloudWatch agent on the instance is configured to send logs to the 'MyAppLogs' log group. However, logs are not appearing in CloudWatch. What is the most likely issue?

Accepted Answer

The policy does not allow the 'logs:PutLogEvents' action on the specific log stream resource.. Option C is correct because the policy only grants permissions for log streams under the log group (using the * wildcard for log streams), but it does not include permission to describe or interact with the log group itself. However, the real issue is that the resource ARN for PutLogEvents requires a log stream resource, not just the log group. The correct resource should be "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:log-stream:*" for PutLogEvents. Option A is wrong because the log group name matches. Option B is wrong because the region is correct. Option D is wrong because CloudWatch Logs agent does not require S3 permissions.

Answer

The instance role needs additional permissions to write to S3 for log delivery.

Answer

The log group name in the policy does not match the log group name configured in the agent.

Answer

The region in the policy ARN does not match the region where the log group is created.

Question 9

A company uses Amazon S3 to store sensitive data. The security team wants to be notified when an S3 bucket policy is modified. Which approach is most efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'PutBucketPolicy' API call and sends a notification to an SNS topic.. Option A is correct because CloudTrail logs S3 bucket policy changes, and EventBridge can filter those events to trigger an SNS notification. Option B is wrong because CloudWatch Logs Insights is a query tool, not real-time alerting. Option C is wrong because S3 event notifications are for object-level events, not bucket policy changes. Option D is wrong because Config can detect changes but is not the most efficient for real-time alerting.

Answer

Set up an AWS Config rule to detect changes to the bucket policy.

Answer

Configure S3 event notifications for 's3:PutBucketPolicy' on the bucket.

Answer

Enable S3 server access logs and use CloudWatch Logs Insights to run queries periodically.

Question 10

Refer to the exhibit. A DevOps engineer runs the AWS CLI command shown to retrieve the RequestCount metric for an ELB. The output shows datapoints with Sum values. What is the total number of requests received by the load balancer during the entire hour?

Accepted Answer

18600 requests. Option B is correct because the datapoints are at 5-minute intervals (period 300 seconds), and each datapoint's Sum represents the total requests in that 5-minute window. To get the total for the hour, we sum all datapoints: 1500+2000+...+1800 = 18600 (assuming the sum of the listed datapoints is 18600). The calculation shows that summing the 12 datapoints yields 18600. Option A, C, and D are incorrect because they do not correctly sum the datapoints.

Answer

1500 + 2000 = 3500 requests

Answer

36000 requests

Answer

Cannot be determined from the data

Question 11

A DevOps team wants to monitor the disk space utilization on their EC2 instances. What is the simplest way to achieve this?

Accepted Answer

Install the CloudWatch agent on the EC2 instances and configure the disk metric.. Option D is correct because the CloudWatch agent can collect disk metrics from EC2 instances. Option A is wrong because basic monitoring does not include disk metrics. Option B is wrong because detailed monitoring also does not include disk metrics. Option C is wrong because Systems Manager Inventory is for software inventory, not disk space.

Answer

Use AWS Systems Manager Inventory to collect disk space data.

Answer

Enable EC2 detailed monitoring in CloudWatch.

Answer

Use EC2 basic monitoring in CloudWatch.

Question 12

A DevOps team is using Amazon CloudWatch Synthetics canaries to monitor the availability of a web application. The canary is configured to run every 5 minutes. The team notices that the canary fails occasionally but the application is healthy. Which action will help identify if the failures are due to network issues between the canary and the application?

Accepted Answer

Configure the canary to run inside the same VPC as the application using a VPC endpoint. Option C is correct because CloudWatch Synthetics canaries support the use of VPC endpoints or placement within a VPC to run from the same network environment as the application, allowing canary failures due to network issues to be distinguished from application issues. Option A is wrong because X-Ray traces the application, not the canary. Option B is wrong because VPC Flow Logs capture network metadata but are not directly integrated with canaries. Option D is wrong because enabling detailed CloudWatch metrics on the ALB does not isolate canary network issues.

Answer

Enable VPC Flow Logs for the canary's VPC and analyze the logs for dropped packets

Answer

Enable AWS X-Ray tracing on the canary to trace the request path

Answer

Increase the canary's memory and timeout settings to reduce false positives

Question 13

A company uses AWS Organizations to manage multiple accounts. The DevOps team needs to monitor for any IAM user creation across all accounts in the organization. Which THREE steps should be taken to implement this centralized monitoring?

Accepted Answer

Create a CloudWatch Logs metric filter on the organization's CloudTrail log group for 'CreateUser' events.. Options A, C, and E are correct. Option A: Enabling CloudTrail in the management account with organization trail captures all account API activity. Option C: Creating a CloudWatch Logs metric filter for 'CreateUser' events in the management account's CloudTrail log group captures the event. Option E: Creating a CloudWatch alarm on the metric triggers a notification. Option B is wrong because an S3 bucket alone does not provide alerting. Option D is wrong because AWS Config does not monitor API calls like IAM user creation.

Answer

Configure an S3 bucket to receive CloudTrail logs from all accounts and enable S3 event notifications for object creation.

Answer

Use AWS Config rules to detect IAM user creation across accounts.

Question 14

A DevOps engineer needs to aggregate logs from multiple AWS accounts into a central account for analysis. Which service should they use?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters.. Option B is correct because CloudWatch Logs can send log data cross-account using subscription filters with Kinesis Data Streams or Firehose. Option A is wrong because S3 can store logs but does not provide real-time aggregation. Option C is wrong because CloudTrail is for API activity, not general logs. Option D is wrong because Config is for resource configuration.

Answer

AWS CloudTrail with organization trails.

Answer

AWS Config with aggregator.

Answer

Amazon S3 with cross-account bucket policies.

Question 15

A DevOps engineer is designing a centralized logging solution for a multi-account AWS environment. The solution must be cost-effective and provide real-time log analysis. Which THREE services should they consider?

Accepted Answer

Amazon OpenSearch Service (Elasticsearch). Option A is correct because CloudWatch Logs can collect logs from various sources. Option C is correct because Kinesis Data Firehose can stream logs to destinations like S3 or Elasticsearch. Option E is correct because Amazon OpenSearch Service can be used for log analysis. Option B is wrong because S3 is for storage, not real-time analysis. Option D is wrong because CloudTrail is for API logs only.

Answer

Amazon S3

Answer

AWS CloudTrail

Question 16

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The operations team notices that the error rate on the ALB is increasing, but the CPU utilization on the EC2 instances remains low. Which CloudWatch metric should be examined to determine if the errors are due to a lack of healthy targets?

Accepted Answer

HealthyHostCount. Option A is correct because HealthyHostCount indicates the number of healthy targets per Availability Zone. If it drops, the ALB may return errors. Option B (UnHealthyHostCount) shows unhealthy hosts but not the direct cause of errors. Option C (RequestCount) measures total requests. Option D (TargetResponseTime) measures latency.

Answer

UnHealthyHostCount

Answer

RequestCount

Answer

TargetResponseTime

Question 17

A DevOps engineer needs to monitor the memory utilization of an Amazon RDS for MySQL instance. Which AWS service should be used to collect and visualize this metric?

Accepted Answer

Enhanced Monitoring for RDS.. Option C is correct because Enhanced Monitoring for RDS provides memory metrics (among others) and sends them to CloudWatch Logs, which can be visualized with CloudWatch dashboards. Option A is wrong because RDS does not expose memory utilization by default in CloudWatch; Enhanced Monitoring is required. Option B is wrong because Trusted Advisor does not collect instance-level metrics. Option D is wrong because Systems Manager is not the primary tool for RDS monitoring.

Answer

CloudWatch default metrics for RDS.

Answer

AWS Systems Manager Inventory.

Answer

AWS Trusted Advisor.

Question 18

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search across multiple log groups and visualize trends. Which TWO services can be used together to achieve this?

Accepted Answer

CloudWatch Logs Insights.. Option A and Option C are correct. CloudWatch Logs Insights can query multiple log groups, and CloudWatch Dashboards can visualize the results. Option B (Athena) queries data in S3, not directly in CloudWatch Logs. Option D (Kibana) requires Elasticsearch Service, which adds complexity. Option E (QuickSight) can visualize but requires data in S3 or a database.

Answer

Amazon Elasticsearch Service with Kibana.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Question 19

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs show that some requests are timing out. The team needs to identify the source of the issue. Which TWO steps should they take?

Accepted Answer

Enable ALB access logs and analyze them.. Option A is correct because ALB access logs contain detailed request information. Option C is correct because CloudWatch metrics for ALB show request counts per target. Option B is wrong because CloudTrail logs API calls, not application requests. Option D is wrong because VPC Flow Logs show network traffic but not application-level details. Option E is wrong because WAF logs are for web ACLs, not general request tracing.

Answer

Enable VPC Flow Logs to capture network traffic.

Answer

Enable AWS WAF logs to inspect HTTP requests.

Answer

Enable AWS CloudTrail to log all API calls.

Question 20

A Lambda function is timing out. The log above shows a recent invocation. What is the most likely cause?

Accepted Answer

The function timeout is set too low.. Option B is correct because the function timed out at 3000 ms, which is the default timeout (3 seconds). The function needs a longer timeout or optimization. Option A is wrong because memory usage is only 64 MB out of 128 MB. Option C is wrong because there was only one invocation. Option D is wrong because the init duration is normal.

Answer

The function is running out of memory.

Answer

The function is being invoked too frequently.

Answer

The function is experiencing a cold start.