DOP-C02 Incident and Event Response — 15 Questions

Question 1

A company uses an Auto Scaling group with a dynamic scaling policy based on a custom CloudWatch metric. After a recent deployment, the metric spikes unexpectedly, causing the Auto Scaling group to launch several EC2 instances. The operations team wants to quickly determine whether the spike was caused by a real load increase or a deployment issue. What is the MOST efficient way to investigate this?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns or deployment markers that coincide with the metric spike.. Option B is correct because CloudWatch Logs Insights allows you to query application logs for error patterns or deployment markers (e.g., new version tags, exception stack traces) that coincide with the metric spike. This directly correlates the scaling event with application-level evidence, enabling rapid root-cause analysis without altering infrastructure or relying on indirect notifications.

Answer

Check the SNS topic that the scaling policy publishes to for notifications.

Answer

Use AWS CloudTrail to review API calls that modified the scaling policy.

Answer

Temporarily disable the scaling policy and manually increase the desired capacity to handle the load.

Question 2

A company runs a critical application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) in front. During a load test, the team notices a sudden increase in 5xx errors from the ALB, and some tasks become unhealthy. The task logs show occasional 'OutOfMemoryError' exceptions. The task definition currently has 512 CPU units and 1024 MiB memory. What should the team do to mitigate the issue while maintaining a cost-effective approach?

Accepted Answer

Increase the task definition memory to 2048 MiB while keeping CPU at 512 units.. Option B is correct because the application is experiencing OutOfMemoryError, indicating the current 1024 MiB memory allocation is insufficient. Increasing memory to 2048 MiB while keeping CPU at 512 units directly resolves the memory constraint without unnecessary CPU cost. ECS Fargate allows independent scaling of CPU and memory within valid combinations, and this change maintains a cost-effective approach by only increasing the resource that is actually constrained.

Answer

Increase the task definition CPU to 1024 units and memory to 2048 MiB.

Answer

Configure the ECS service to use a rolling update with a longer health check grace period.

Answer

Decrease the task definition memory to 512 MiB to force garbage collection more frequently.

Question 3

A DevOps engineer is investigating an incident where an EC2 instance became unreachable. The engineer checks the AWS Management Console and finds the instance is running, but the status check shows '2/2 checks passed' and the system log shows no errors. What should the engineer do NEXT to diagnose the connectivity issue?

Accepted Answer

Check the security group and network ACL rules to ensure inbound traffic is allowed.. Since the instance is running, status checks pass, and the system log shows no errors, the issue is not with the operating system or underlying hardware. The most likely cause is a network-layer restriction, such as security group or network ACL rules blocking inbound traffic. Checking these rules is the correct next step because they control traffic at the instance and subnet levels, respectively, and misconfigurations here are a common cause of unreachability despite healthy instance status.

Answer

Review the CloudWatch metrics for CPU utilization and network throughput.

Answer

Reboot the instance to reset the network interface.

Answer

Stop and start the instance to move it to new underlying hardware.

Question 4

A company has an AWS Lambda function that processes S3 events. The function is invoked multiple times for the same S3 object, causing duplicate processing. The engineer suspects the issue is related to retries from the S3 event notification or Lambda's built-in retry behavior. What is the MOST effective way to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store a record of processed S3 object keys and check for existence before processing.. Option B is correct because storing processed S3 object keys in a DynamoDB table and checking for existence before processing ensures idempotency at the application level. This approach directly handles duplicate invocations caused by S3 event retries or Lambda's built-in retry behavior, as the function can conditionally skip processing if the key already exists in DynamoDB. It provides a durable, consistent, and scalable mechanism to prevent duplicate processing regardless of how many times the function is invoked for the same object.

Answer

Modify the S3 bucket event notification configuration to use a prefix filter that excludes duplicate objects.

Answer

Set the Lambda function's ReservedConcurrency to 1 to prevent concurrent executions.

Answer

Use an Amazon SQS FIFO queue as the event source and enable content-based deduplication.

Question 5

An organization uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with 'UPDATE_ROLLBACK_FAILED' status. The engineer needs to bring the stack to a consistent state without losing data. What is the BEST approach?

Accepted Answer

Use the 'ContinueUpdateRollback' API to skip the resource that caused the failure.. The 'ContinueUpdateRollback' API is the best approach because it allows the stack to resume the rollback process, skipping the resource that caused the failure, and bringing the stack to a consistent 'UPDATE_ROLLBACK_COMPLETE' state without manual intervention or data loss. This API is specifically designed for the 'UPDATE_ROLLBACK_FAILED' status, enabling you to skip resources that cannot be rolled back (e.g., due to a non-reversible change) while preserving the rest of the stack's state.

Answer

Create a new stack from the same template and migrate resources.

Answer

Manually correct the resource configuration that caused the failure, then perform a stack update.

Answer

Delete the stack and then recreate it from the same template.

Question 6

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The application is using the database's DNS endpoint for the old primary, which is no longer the writer.. After an RDS Multi-AZ failover, the DNS endpoint for the DB instance remains the same but its underlying IP address changes to point to the new primary (formerly the standby). If the application caches the IP address of the old primary or uses a direct connection to the old writer endpoint, it will attempt to connect to a node that is no longer the writer. The correct practice is to always connect using the RDS instance endpoint (CNAME), which automatically resolves to the current writer, and to avoid caching the resolved IP address. Since the instance status is 'Available', the new primary is ready, so the issue is a stale connection target.

Answer

The security group for the RDS instance has changed during failover.

Answer

The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.

Answer

The database instance is still in the process of failover and is not yet accepting connections.

Question 7

A DevOps team observes that an Amazon CloudFront distribution is returning HTTP 504 errors for a small percentage of requests. The origin is an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The team has already checked the ALB's access logs and found that the ALB returns 200 OK for all requests. What should the team investigate NEXT?

Accepted Answer

Check the ALB's idle timeout settings and compare with CloudFront origin timeout.. The ALB returns 200 OK for all requests, so the origin itself is not failing. However, HTTP 504 errors from CloudFront typically indicate that the origin (ALB) is not responding within CloudFront's timeout window. The ALB's idle timeout (default 60 seconds) can cause the ALB to close idle connections, while CloudFront's origin timeout (default 30 seconds) is separate. If the ALB's idle timeout is shorter than the time CloudFront waits for a response, the ALB may close the connection before CloudFront receives the full response, leading to a 504. Option D directly addresses this mismatch.

Answer

Check the ALB target group health check settings and ensure instances are healthy.

Answer

Examine the request headers in CloudFront logs to identify unusual patterns.

Answer

Review the CloudFront cache hit ratio and optimize caching strategies.

Question 8

A company uses AWS Organizations with multiple accounts. The security team notices that an IAM user in the production account has been making changes to security group rules that are not compliant with the company's policy. The team wants to automatically revoke any non-compliant security group rules and notify the security team. What is the MOST efficient way to achieve this?

Accepted Answer

Use an AWS Config managed rule to detect non-compliant security group rules, and configure an automatic remediation action with AWS Systems Manager Automation.. Option D is correct because AWS Config managed rules can continuously evaluate security group rules against a desired policy (e.g., disallowing SSH from 0.0.0.0/0). When a non-compliant change is detected, AWS Config can trigger an automatic remediation action using an AWS Systems Manager Automation document that revokes the offending rule. This provides both detection and automated correction without manual intervention, making it the most efficient solution.

Answer

Create a CloudWatch alarm on the SecurityGroupEvent metric to notify the security team.

Answer

Apply a Service Control Policy (SCP) that denies changes to security groups in the production account.

Answer

Set up a CloudTrail trail that logs security group modifications and use Amazon Detective to analyze the changes.

Question 9

A company is experiencing a DDoS attack on their web application hosted on Amazon EC2 behind an Application Load Balancer (ALB). The attack is causing high CPU utilization on the instances. The security team needs to mitigate the attack with minimal disruption to legitimate users. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Configure AWS WAF rate-based rules to block excessive requests from specific IP addresses.. AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate, which directly mitigates DDoS attacks by limiting excessive traffic from specific sources. This approach minimizes disruption to legitimate users because it only blocks IPs that exceed the threshold, preserving access for normal traffic patterns.

Answer

Enable AWS Shield Advanced on the ALB for additional DDoS protection.

Answer

Scale up the EC2 instances by increasing their instance size.

Answer

Place an Amazon CloudFront distribution in front of the ALB to cache content.

Question 10

An e-commerce platform uses Amazon DynamoDB as its primary database. During a flash sale, the application experiences throttling errors. The operations team needs to implement a solution to handle sudden traffic spikes while keeping costs under control. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache read-intensive data.. Option C is correct because DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from milliseconds to microseconds, offloading read requests from the main DynamoDB table. During a flash sale, caching read-intensive data (e.g., product details) with DAX reduces the number of read capacity units consumed, helping to avoid throttling while keeping costs under control by not requiring a permanent increase in provisioned capacity.

Answer

Increase the read and write capacity units manually before the sale.

Answer

Switch from on-demand to provisioned capacity with auto scaling.

Answer

Enable DynamoDB Streams and replicate data to a read replica.

Question 11

A DevOps engineer is troubleshooting an Amazon RDS for PostgreSQL instance that is running out of storage. The engineer wants to resolve the issue without downtime. Which TWO actions can achieve this? (Choose two.)

Accepted Answer

Enable storage auto scaling on the DB instance.. Option B is correct because enabling storage auto scaling on an Amazon RDS for PostgreSQL instance allows the database to automatically increase its allocated storage when it detects that available storage is running low, preventing out-of-storage errors without requiring manual intervention or downtime. Option E is correct because modifying the DB instance to increase the allocated storage size is a dynamic operation that can be performed without downtime, as Amazon RDS supports online storage scaling for PostgreSQL instances, allowing the change to take effect while the database remains available.

Answer

Create a read replica and promote it to primary.

Answer

Delete old automated snapshots to free up storage.

Answer

Scale up the DB instance to a larger instance class.

Question 12

An application log excerpt shows repeated HTTP 500 errors for the /api/orders endpoint, with occasional successful health checks. The application runs on EC2 instances behind an ALB. What is the MOST likely cause of this pattern?

Accepted Answer

The backend service that the /api/orders endpoint depends on is unavailable or failing.. The pattern of repeated HTTP 500 errors for /api/orders with occasional successful health checks strongly indicates that the backend service dependency (e.g., a database, cache, or another microservice) is intermittently failing or unavailable. HTTP 500 errors are server-side errors, meaning the application code is running but cannot complete the request due to a downstream failure. Successful health checks confirm the EC2 instances themselves are healthy and in-service, ruling out instance-level or ALB misconfiguration issues.

Answer

The EC2 instances are running out of memory and the application is crashing.

Answer

The ALB is misconfigured and routing requests to the wrong target group.

Answer

The EC2 instances are not passing health checks and are being deregistered from the target group.

Question 13

An IAM policy is attached to a role used by an operations team. The team reports that they are unable to start or stop EC2 instances tagged with Environment=Production. Other instances can be described. What is the MOST likely reason for this failure?

Accepted Answer

The condition key ec2:ResourceTag/Environment is not valid for ec2:StartInstances and ec2:StopInstances.. Option A is correct because the `ec2:ResourceTag` condition key is not supported for the `ec2:StartInstances` and `ec2:StopInstances` actions in IAM policy evaluation. AWS documentation explicitly states that these actions do not support resource-level permissions based on tags; they only support the `ec2:ResourceTag` condition key for certain read-only or tagging actions. Therefore, the condition in the policy cannot be evaluated, causing the operations team to fail when attempting to start or stop Production-tagged instances.

Answer

The role does not have permission to describe instances, so the condition cannot be evaluated.

Answer

The policy's Resource element is set to '*' and must be restricted to specific instance ARNs.

Answer

The policy does not include the ec2:RebootInstances action.

Question 14

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes messages from an Amazon SQS queue. Recently, the processing time has increased, and the SQS queue depth is growing. The CloudWatch metrics show that the ECS service's CPU utilization is consistently around 70%, memory utilization is 80%, and the number of running tasks is at the maximum allowed (10). The service is configured with a target tracking scaling policy based on CPU utilization with a target value of 50%. However, the auto scaling does not seem to be adding tasks. The engineer checks the ECS service events and finds no scaling activity. What is the MOST likely reason the auto scaling is not working, and what action should be taken to resolve the issue?

Accepted Answer

The service has reached the maximum number of tasks defined in the auto scaling configuration; increase the maximum tasks.. The auto scaling is not adding tasks because the ECS service has already reached the maximum number of tasks defined in the auto scaling configuration (10). With CPU utilization at 70% and the target tracking policy set to 50%, the policy would normally trigger scale-out actions, but since the maximum task count is already hit, no scaling activity occurs. The engineer must increase the maximum tasks in the auto scaling configuration to allow further scale-out.

Answer

The scaling policy is not properly configured; recreate it with a lower target value.

Answer

The CloudWatch metric is not being emitted correctly; check the metric namespace.

Answer

The ECS service is using Fargate, which does not support target tracking scaling policies.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

Accepted Answer

Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.. Option D is correct because AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Answer

Use Amazon GuardDuty to automatically modify the security group membership of the instance.

Answer

Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.

Answer

Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.