DOP-C02 Practice Exam 66 — 20 Questions

Question 1

A company runs a microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. The DevOps team wants to monitor the number of HTTP 5xx errors returned by each service. They configure the ALB to send access logs to an S3 bucket and enable CloudWatch Container Insights. However, the team cannot view 5xx errors per service. What should the team do to achieve this?

Accepted Answer

Enable ALB access logging and parse the logs to filter by target group, then correlate with the ECS service name.. Option B is correct. ALB access logs contain the target group, but not the service name. By using the target group, you can map to the service. Option A is incorrect because CloudWatch Logs Insights can query access logs, but the logs need to be in CloudWatch Logs, not S3. Option C is incorrect because Container Insights provides metrics per task, not per service. Option D is incorrect because adding a response header would not be visible in metrics.

Answer

Use CloudWatch Logs Insights to query the ALB access logs directly from S3.

Answer

Enable Container Insights and create a CloudWatch dashboard to view HTTP 5xx errors per ECS service.

Answer

Configure the ALB to add a custom header with the service name and use CloudWatch metrics.

Question 2

A DevOps engineer is designing a centralized logging solution for 10 AWS accounts. Logs must be stored in a central S3 bucket with encryption and access logging. Which THREE services/resources are required to meet these requirements?

Accepted Answer

AWS CloudTrail.. Option A, Option C, and Option E are correct. CloudTrail can deliver logs to a central S3 bucket. S3 server access logs record requests to the bucket. KMS encryption key encrypts the logs. Option B (CloudWatch Logs) is not required for storage. Option D (Config) is not required for logging.

Answer

AWS Config.

Answer

Amazon CloudWatch Logs.

Question 3

A DevOps engineer is setting up monitoring for an Amazon RDS for PostgreSQL instance. The engineer wants to track the number of active database connections over time to plan for scaling. Which approach should the engineer use?

Accepted Answer

Enable Enhanced Monitoring and view the 'DatabaseConnections' metric in CloudWatch.. Option B is correct. Enhanced Monitoring provides OS-level metrics including the number of database connections. Option A is incorrect because RDS event subscriptions are for events like failover, not metrics. Option C is incorrect because Performance Insights shows database load, not connection count. Option D is incorrect because CloudWatch Logs does not directly provide connection count metrics.

Answer

Configure CloudWatch Logs to monitor the PostgreSQL error log for connection entries.

Answer

Enable RDS event subscriptions to receive notifications about connection changes.

Answer

Use Performance Insights to view the number of active connections.

Question 4

A company is using Amazon CloudWatch Synthetics to monitor the availability of a web application. The canary runs every 5 minutes from multiple locations. Recently, the canary has been failing intermittently with HTTP 503 errors, but the application team reports that the application is healthy. Which step should the DevOps engineer take to identify the cause of the false positives?

Accepted Answer

Review the canary's CloudWatch Logs to check for network errors or timeouts.. Option C is correct because checking the canary's CloudWatch Logs might reveal that the failure is due to a network timeout or other client-side issue, not the application. Option A is wrong because increasing canary frequency would generate more data but not identify the cause. Option B is wrong because increasing timeout might mask the issue. Option D is wrong because adding more locations would not pinpoint the cause if the issue is client-side.

Answer

Increase the canary timeout setting to allow more time for the application to respond.

Answer

Add more canary locations to increase coverage.

Answer

Increase the canary run frequency to every 1 minute.

Question 5

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket for long-term storage and analysis. The logs include AWS CloudTrail, VPC Flow Logs, and Amazon RDS audit logs. Which solution is the MOST operationally efficient?

Accepted Answer

Configure each account to deliver logs directly to a central S3 bucket using a bucket policy that allows cross-account writes.. Option D is correct. Amazon S3 supports cross-account access via bucket policies, and enabling S3 server access logs is not required for this use case. Option A is incorrect because CloudWatch Logs subscription filters can stream to a cross-account S3 bucket, but Kinesis Data Firehose adds unnecessary complexity. Option B is incorrect because aggregating into a single CloudWatch Logs account and then exporting requires additional steps. Option C is incorrect because it requires manual configuration per account.

Answer

Configure each account to send logs to a central CloudWatch Logs account, then export to S3.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to the central bucket.

Question 6

A company runs a critical application on Amazon ECS with Fargate. The DevOps team wants to set up a metric to track the number of tasks running. Which TWO steps are required to achieve this? (Choose TWO.)

Accepted Answer

Create a CloudWatch alarm on the 'RunningTaskCount' metric.. Options A and D are correct. Container Insights must be enabled (A) to get task count metrics, and then a CloudWatch alarm can be created on the metric (D). Option B is incorrect because a service auto scaling target is not required for monitoring. Option C is incorrect because CloudWatch Logs subscription does not provide metrics. Option E is incorrect because CloudWatch agent is not needed for Fargate.

Answer

Install the CloudWatch agent on the task containers.

Answer

Configure a CloudWatch Logs subscription filter to count tasks.

Answer

Create a service auto scaling target for the ECS service.

Question 7

A company uses Amazon CloudWatch Logs to store application logs from EC2 instances. The security team requires that logs be retained for 5 years for compliance. Which action should be taken to meet this requirement cost-effectively?

Accepted Answer

Set a log retention policy of 5 years on the CloudWatch Logs log groups.. Option A is correct because CloudWatch Logs supports setting a retention policy of 5 years, which is cost-effective. Option B is wrong because exporting to S3 and using S3 Glacier Deep Archive is more expensive than simply setting a retention policy. Option C is wrong because AWS CloudTrail is for API activity logs, not application logs. Option D is wrong because disabling retention deletes logs, which fails compliance.

Answer

Export the logs to Amazon S3 and use S3 Glacier Deep Archive for long-term storage.

Answer

Disable log retention and let CloudWatch Logs keep the logs indefinitely.

Answer

Use AWS CloudTrail to store the logs for 5 years.

Question 8

A company is using Amazon CloudWatch to monitor a production environment. The DevOps team wants to receive notifications when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which TWO steps should the team take to achieve this? (Choose TWO.)

Accepted Answer

Configure an Amazon SNS topic and subscribe the team's email address to it, then set the alarm to send notifications to the SNS topic.. Option A (Create a CloudWatch alarm) and Option C (Configure an SNS topic) are correct. A CloudWatch alarm monitors the metric and triggers an action (e.g., SNS notification) when the condition is met. Option B (Create a CloudWatch dashboard) is for visualization, not notification. Option D (Enable detailed monitoring) is not required for this alarm; basic monitoring (5-minute) is sufficient for 5-minute evaluation periods. Option E (Create a CloudWatch Logs metric filter) is for logs, not EC2 metrics.

Answer

Enable detailed monitoring on the EC2 instance to get 1-minute metrics.

Answer

Create a CloudWatch Logs metric filter to count CPU utilization errors.

Answer

Create a CloudWatch dashboard to visualize CPU utilization.

Question 9

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The DevOps team wants to detect and alert on any IAM user who creates an access key and then uses it to make API calls within 24 hours, as this may indicate a compromised account. Which combination of actions should be taken to achieve this with minimal latency?

Accepted Answer

Enable S3 Event Notifications on the CloudTrail S3 bucket to invoke a Lambda function that processes new log files and checks for the pattern.. Option D is correct because CloudTrail delivers logs to S3 within about 15 minutes; using S3 Events to trigger a Lambda that analyzes the logs in near-real-time allows detection within the 24-hour window. Option A is wrong because CloudWatch Logs Insights queries are not real-time and require logs to be streamed to CloudWatch Logs, which adds latency. Option B is wrong because Athena is not real-time. Option C is wrong because EventBridge can detect API calls but cannot correlate the creation of a key with its subsequent use in a single rule; it would require complex pattern matching.

Answer

Use Amazon Athena to query CloudTrail logs in S3 every hour and send alerts for matches.

Answer

Create an Amazon EventBridge rule that matches CreateAccessKey and any subsequent API call from the same user within 24 hours.

Answer

Stream CloudTrail logs to CloudWatch Logs and create a metric filter to detect the pattern, then set an alarm.

Question 10

A company has a microservices architecture running on Amazon ECS with Fargate. The operations team uses Amazon CloudWatch Container Insights to monitor the cluster. They notice that one of the services is experiencing high memory utilization, causing occasional task failures. The team wants to set up proactive monitoring to receive alerts when memory utilization exceeds 80% for more than 5 minutes. They also want to automate the response by replacing the failing tasks. The team has already created a CloudWatch alarm on the MemoryUtilized metric. Which additional steps should the team take to achieve the desired proactive monitoring and automated response?

Accepted Answer

Configure the CloudWatch alarm to trigger an Auto Scaling action that increases the desired count of the service to replace failing tasks.. Option A is correct because a CloudWatch Alarm can trigger an Auto Scaling action to replace tasks. Option B is wrong because CloudWatch Events (now EventBridge) can trigger Lambda, but the alarm already exists; the action should be on the alarm. Option C is wrong because CloudWatch Logs Insights is for querying logs, not for automated response. Option D is wrong because CloudTrail is for auditing API calls, not for automation.

Answer

Use CloudWatch Logs Insights to run queries on the task logs to identify the cause of high memory.

Answer

Create a CloudWatch Events rule that triggers an AWS Lambda function to restart the tasks when the alarm state changes.

Answer

Enable AWS CloudTrail to log all ECS API calls to audit the task failures.

Question 11

Refer to the exhibit. A DevOps engineer checks the CloudWatch alarm configuration and state. The alarm is in ALARM state for CPUUtilization averaging 90% over 5 minutes, but no notification was received. What is the most likely reason?

Accepted Answer

The SNS topic does not have any confirmed subscriptions.. Option B is correct because the alarm actions are configured with an SNS topic ARN, but the topic might not have any subscriptions (e.g., email not confirmed). Option A is wrong because the alarm is in ALARM state, so data is available. Option C is wrong because the period is 300 seconds (5 minutes), which is valid. Option D is wrong because the instance is running (CPU data exists).

Answer

The EC2 instance is stopped.

Answer

The alarm period is set to 300 seconds, which is too long.

Answer

The alarm has insufficient data to evaluate.

Question 12

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that all logs be encrypted at rest using a customer-managed AWS KMS key. Which THREE steps are necessary to meet this requirement? (Choose THREE.)

Accepted Answer

Grant the IAM role used by the application to write logs permission to use the KMS key (kms:Encrypt, kms:Decrypt).. Options A, B, and C are correct. A KMS key must be created (A), the CloudWatch Logs log group must be associated with the key (B), and the IAM role that writes logs must have permission to use the key (C). Option D (enable server-side encryption with S3) is not applicable because logs are stored in CloudWatch Logs, not S3. Option E (enable encryption on the log stream) is not a supported action; encryption is set at the log group level.

Answer

Enable encryption on each log stream individually.

Answer

Enable server-side encryption on the Amazon S3 bucket where logs are exported.

Question 13

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked successfully, but it frequently times out after 15 seconds. The function's CloudWatch Logs show that the timeout occurs while the function is making an HTTP request to an external API. The function's reserved concurrency is set to 5, and the SQS queue has a visibility timeout of 30 seconds. Which change would MOST effectively reduce the number of timeouts?

Accepted Answer

Increase the Lambda function's timeout to 30 seconds.. Option B is correct because increasing the Lambda function timeout to 30 seconds gives the HTTP request more time to complete, reducing timeouts. Option A is wrong because increasing concurrency would not help if the issue is the timeout duration. Option C is wrong because decreasing batch size might reduce load but not address the timeout for individual invocations. Option D is wrong because increasing the visibility timeout could cause duplicate processing but does not fix the Lambda timeout.

Answer

Increase the SQS queue's visibility timeout to 60 seconds.

Answer

Decrease the SQS batch size to 1.

Answer

Increase the Lambda function's reserved concurrency to 10.

Question 14

A company runs a production web application on Amazon EC2 instances that are part of an Auto Scaling group. The instances are behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics and set up a CloudWatch dashboard to monitor the application. Recently, the team noticed that the CPU Utilization metric for the Auto Scaling group shows a spike every day at 2:00 PM, but the application performance remains normal. The team wants to investigate the cause of the CPU spike. What should the team do FIRST to identify the root cause?

Accepted Answer

Use CloudWatch Logs Insights to query the application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM.. Option A is correct because CloudWatch Logs Insights can query instance logs to identify processes causing high CPU. Option B is wrong because increasing instance size is not a first step for investigation. Option C is wrong because a cron job may be the cause, but the first step is to check logs. Option D is wrong because CloudTrail logs API calls, not CPU usage.

Answer

Enable AWS CloudTrail to log all API calls to the instances.

Answer

Disable any scheduled tasks on the instances to see if the spike stops.

Answer

Increase the instance size to provide more CPU capacity to handle the spike.

Question 15

A company runs a multi-region application on Amazon EC2 instances across us-east-1 and eu-west-1. The application uses an Amazon Aurora global database for writes in us-east-1 and reads in eu-west-1. The DevOps team wants to monitor the replication lag between the primary and secondary regions. They have set up a CloudWatch alarm on the AuroraReplicaLag metric in both regions. However, they notice that the alarm in eu-west-1 sometimes triggers false positives when the lag spikes briefly but then recovers. The team wants to reduce false alarms while still being alerted to sustained high lag that could impact read replicas. The team is already using a standard CloudWatch alarm with a period of 1 minute and evaluation periods of 1. What should the team change to reduce false positives?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if the lag is high for 3 consecutive minutes.. Option A is correct because increasing evaluation periods requires the lag to be high for a longer duration before triggering an alarm. Option B is wrong because reducing the period would cause more frequent data points, potentially increasing false alarms. Option C is wrong because increasing the threshold would only alert on higher lag, but false positives are due to brief spikes. Option D is wrong because a composite alarm combining multiple metrics is not needed; the issue is with the evaluation period.

Answer

Increase the alarm threshold to a higher value, such as 10 seconds.

Answer

Reduce the metric period to 30 seconds to get more granular data.

Answer

Create a composite alarm that triggers when both the AuroraReplicaLag and CPUUtilization metrics are high.

Question 16

A company's security policy requires that all EC2 instances must be launched with an IAM role that provides least privilege access. A DevOps engineer needs to enforce this across the organization. Which approach is MOST effective?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users. Using an IAM policy with a condition that denies instance launch unless a specific IAM role is attached. Option A is wrong because it only restricts instance profiles, not the launch. Option B is wrong because SCPs cannot enforce a specific role attachment. Option D is wrong because instance metadata service does not enforce roles.

Answer

Create an SCP that denies ec2:RunInstances if the specified IAM role is not the approved role

Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action unless an instance profile is attached

Answer

Use AWS Config to detect instances without the required role and terminate them via Lambda

Question 17

A DevOps engineer notices that an EC2 instance running a critical web application has been terminated unexpectedly. The instance was part of an Auto Scaling group. Which step should the engineer take FIRST to investigate the root cause?

Accepted Answer

Review AWS CloudTrail logs for TerminateInstances API calls.. Option A is correct because the first step in incident response is to gather information. CloudTrail logs all API calls, including TerminateInstances, and can identify who or what terminated the instance. Option B is wrong because examining the application logs does not reveal the termination cause. Option C is wrong because scaling policies would not cause termination without CloudWatch. Option D is wrong because the termination reason is not available in the console without checking logs.

Answer

Look at the EC2 console's 'Termination Protection' setting.

Answer

Check the application logs on the instance's attached EBS volume (detached and attached to another instance).

Answer

Verify the Auto Scaling group's scaling policies and scheduled actions.

Question 18

A company uses AWS Lambda functions to process S3 events. After a recent deployment, some functions fail with timeout errors. The engineer needs to implement a solution that automatically captures and stores the function's input payload for all failed invocations without modifying the Lambda code. Which approach meets these requirements?

Accepted Answer

Use AWS Lambda Destinations with a failure destination pointing to an SQS queue.. Option D is correct because Lambda Destinations allow sending invocation records (including input payload) to SQS, SNS, Lambda, or EventBridge for failed events, without code changes. Option A is wrong because DLQs only capture messages for Lambda functions invoked asynchronously by SNS or SQS, not directly by S3 events. Option B is wrong because CloudWatch Logs does not capture payload by default; it only logs if the function writes to logs. Option C is wrong because CloudWatch Events (EventBridge) can capture Lambda invocations but not the payload without custom code.

Answer

Enable CloudWatch Logs Insights on the Lambda function's log group.

Answer

Use CloudWatch Events to capture Lambda invocation errors.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 19

A company uses Amazon RDS for MySQL as its database. The operations team notices that the database CPU utilization is consistently above 90% during peak hours, causing slow query responses. The team needs to quickly reduce CPU load without changing the application code. Which action should the team take?

Accepted Answer

Enable Performance Insights and analyze the top queries.. Option B is correct because enabling Performance Insights and analyzing queries helps identify inefficient queries that cause high CPU. Option A is wrong because read replicas do not reduce CPU on the primary instance. Option C is wrong because modifying DB parameters does not immediately reduce CPU. Option D is wrong because Multi-AZ is for high availability, not performance.

Answer

Enable Multi-AZ deployment.

Answer

Modify the DB parameter group to increase max_connections.

Answer

Add a read replica to offload read traffic.

Question 20

A company stores sensitive data in Amazon S3. A security audit reveals that several S3 buckets are publicly accessible. The DevOps engineer needs to implement a solution that automatically detects and alerts on any S3 bucket that becomes public. Which AWS service should the engineer use?

Accepted Answer

Amazon Macie. Option C is correct because Amazon Macie uses machine learning to discover, classify, and protect sensitive data, and it can alert on public buckets. Option A is wrong because AWS Trusted Advisor checks for public buckets but does not provide real-time alerts. Option B is wrong because S3 Block Public Access is a preventive control, not detective. Option D is wrong because AWS Config can track bucket policies but does not automatically alert on public access.

Answer

S3 Block Public Access

Answer

AWS Trusted Advisor

Answer

AWS Config