DOP-C02 Incident and Event Response — 15 Questions

Question 1

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application is using the database's DNS endpoint for the old primary, which is no longer the writer.. After an RDS Multi-AZ failover, the DNS endpoint for the DB instance remains the same but its underlying IP address changes to point to the new primary (formerly the standby). If the application caches the IP address of the old primary or uses a direct connection to the old writer endpoint, it will attempt to connect to a node that is no longer the writer. The correct practice is to always connect using the RDS instance endpoint (CNAME), which automatically resolves to the current writer, and to avoid caching the resolved IP address. Since the instance status is 'Available', the new primary is ready, so the issue is a stale connection target.

Answer

The security group for the RDS instance has changed during failover.

Answer

The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.

Answer

The database instance is still in the process of failover and is not yet accepting connections.

Question 2

An IAM policy is attached to a role used by an operations team. The team reports that they are unable to start or stop EC2 instances tagged with Environment=Production. Other instances can be described. What is the MOST likely reason for this failure?

Accepted Answer

The condition key ec2:ResourceTag/Environment is not valid for ec2:StartInstances and ec2:StopInstances.. The `ec2:ResourceTag` condition key is not supported for the `ec2:StartInstances` and `ec2:StopInstances` actions in IAM policy evaluation. AWS documentation explicitly states that these actions do not support resource-level permissions based on tags; they only support the `ec2:ResourceTag` condition key for certain read-only or tagging actions. Therefore, the condition in the policy cannot be evaluated, causing the operations team to fail when attempting to start or stop Production-tagged instances.

Answer

The role does not have permission to describe instances, so the condition cannot be evaluated.

Answer

The policy's Resource element is set to '*' and must be restricted to specific instance ARNs.

Answer

The policy does not include the ec2:RebootInstances action.

Question 3

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

Accepted Answer

Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.. AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Answer

Use Amazon GuardDuty to automatically modify the security group membership of the instance.

Answer

Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.

Answer

Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.

Question 4

A DevOps engineer notices that an EC2 instance in an Auto Scaling group is repeatedly failing health checks and being terminated. The engineer needs to capture the root cause by collecting memory dumps and system logs before termination. What should the engineer do?

Accepted Answer

Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.. EC2Rescue is specifically designed to collect memory dumps and system logs from EC2 instances, and by configuring it to run at startup and extending the Auto Scaling health check grace period, the engineer ensures diagnostics are captured before the instance is terminated for failing health checks. This approach directly addresses the need to gather root cause data from a failing instance that is about to be replaced.

Answer

Configure the CloudWatch Agent to collect memory and system logs and publish them to CloudWatch Logs.

Answer

Use AWS Systems Manager Run Command to execute a script on the instance that collects diagnostics before it is terminated.

Answer

Enable EC2 instance metadata service (IMDS) to capture diagnostic data that persists after termination.

Question 5

A company runs a critical web application on AWS. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The Auto Scaling group uses a launch template that specifies an Amazon Linux 2 AMI. The application stores session state in an ElastiCache Redis cluster. Recently, the operations team received alerts that the application is returning 503 errors intermittently. Investigation shows that the ALB target group health checks are failing for some instances, but those instances are still in service. The CloudWatch logs from the instances show that the application is running, but the health check endpoint is timing out after 5 seconds. The health check is configured with a 5-second timeout, 10-second interval, and 2 consecutive successes required to mark healthy. The DevOps engineer suspects that the issue is due to high CPU utilization on the instances causing the health check to respond slowly. The engineer wants to implement a solution that prevents the ALB from routing traffic to instances that are experiencing high CPU, and also automatically scales out to handle the increased load. What should the engineer do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.. It addresses both the immediate issue (high CPU causing health check timeouts) and the scaling requirement. Stopping the instance via a CloudWatch alarm removes it from the ALB target group, preventing traffic routing to unhealthy instances. The target tracking scaling policy based on CPU utilization automatically adds instances when CPU is high, ensuring capacity matches demand.

Answer

Configure the Auto Scaling group to use ELB health checks and set the health check grace period to 600 seconds.

Answer

Create a scheduled scaling action to add more instances during peak hours.

Answer

Increase the health check timeout to 10 seconds and the interval to 20 seconds to give instances more time to respond.

Question 6

A company is experiencing an ongoing security incident where an unauthorized user gained access to an AWS access key and is making API calls. The security team needs to immediately stop the unauthorized access and preserve evidence for investigation. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Enable CloudTrail logging to capture API calls for forensic analysis.. Enabling CloudTrail logging captures detailed API call records, including source IP, user agent, and request parameters, which are essential for forensic analysis and understanding the scope of the incident. Deleting the compromised access key immediately invalidates the credential, stopping all further unauthorized API calls. Together, these actions stop the attack and preserve evidence for investigation.

Answer

Rotate the access key by creating a new key and updating the application.

Answer

Change the IAM policy attached to the user to deny all actions.

Answer

Contact AWS Support to have the key disabled.

Question 7

A company uses AWS Lambda functions to process S3 events. After a recent deployment, some functions fail with timeout errors. The engineer needs to implement a solution that automatically captures and stores the function's input payload for all failed invocations without modifying the Lambda code. Which approach meets these requirements?

Accepted Answer

Use AWS Lambda Destinations with a failure destination pointing to an SQS queue.. A DLQ for an async Lambda invocation does receive the entire original failed event (including the S3 event payload) once retries are exhausted. It is a valid but legacy way to capture the payload; Lambda Destinations (option D) is the modern, AWS-recommended mechanism and additionally provides structured invocation records (request, response, error, and metadata), making it the better answer here, but not because DLQs 'don't capture payload' from S3 events.

Answer

Enable CloudWatch Logs Insights on the Lambda function's log group.

Answer

Use CloudWatch Events to capture Lambda invocation errors.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 8

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Review the canary's CloudWatch Logs for error details.. Option B is correct because CloudWatch Synthetics canaries write detailed execution logs, including error messages, stack traces, and step-level results, to CloudWatch Logs under log groups such as /aws/lambda/cwsyn--; reviewing these logs directly reveals the cause of intermittent ClientError responses. Option C is correct because each canary runs on an underlying Lambda function, and its Lambda logs (including the canary's own log output and any runtime errors) provide the granular diagnostic detail needed to pinpoint why the script is receiving client errors. Option A is not the best diagnostic action because modifying the script to add logging changes the canary rather than investigating the existing failure data, and the current logs already contain error details. Option D is not ideal because CloudWatch metrics for canaries (SuccessPercent, Failed, Duration) only show that failures occurred, not the root cause. Option E is incorrect because CloudTrail records CanaryRun API management calls for auditing, not the runtime error details of individual canary executions.

Answer

Modify the canary script to add more logging.

Answer

Examine CloudWatch metrics for the canary.

Answer

Check CloudTrail for CanaryRun API calls.

Question 9

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. The IAM policy likely includes a condition that denies the s3:PutObject action if the request does not include server-side encryption headers. Without encryption, the condition evaluates to false, and the explicit deny or lack of allow results in an Access Denied error.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-S3 encryption.

Answer

The upload succeeds and is automatically encrypted with SSE-S3.

Question 10

Refer to the exhibit. A CloudWatch alarm is configured for an EC2 instance. The CPU utilization exceeds 80% for two consecutive minutes. What action will occur?

Accepted Answer

The instance will be recovered.. Per AWS documentation, the EC2 'Recover' alarm action (arn:aws:automate:<region>:ec2:recover) can only be associated with an alarm that monitors the StatusCheckFailed_System metric -- it is not supported for CPUUtilization or other general performance metrics. The exhibit shows a CPUUtilization-based alarm with a recover action attached, which is an invalid/unsupported configuration in real AWS (the console and API reject creating or associating this action with a non-status-check metric). This question's exhibit and marked answer need to be corrected -- either change the exhibit's metric to StatusCheckFailed_System (making 'the instance will be recovered' correct), or change the alarm action to something valid for CPUUtilization (e.g., an Auto Scaling or SNS action) and adjust the correct answer accordingly.

Answer

No action will be taken because the period is 60 seconds.

Answer

The instance will be rebooted.

Answer

The instance will be stopped.

Question 11

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in a specific region report slow load times. The DevOps team checks CloudFront metrics and sees a high error rate (5xx) for that region. The S3 bucket is healthy. What is the most likely cause?

Accepted Answer

The CloudFront origin shield is misconfigured.. When a CloudFront distribution's OAI lacks S3 bucket permissions, S3 returns a 403 AccessDenied response, and CloudFront passes that through to the viewer as a 403 (a 4xx client error), not a 5xx server error. Because the reported symptom here is a high 5xx rate (not 4xx) concentrated in one region with a healthy S3 origin, an OAI/bucket-policy permissions problem does not fit -- a misconfiguration affecting only the regional edge/Origin Shield path to the origin is a better fit for a region-specific 5xx pattern.

Answer

The AWS WAF web ACL is blocking requests from that region.

Answer

The S3 bucket policy does not grant access to the CloudFront origin access identity (OAI).

Answer

The CloudFront distribution's default TTL is too short.

Question 12

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the Auto Scaling group launches new instances, but users experience session loss. What is the most likely cause?

Accepted Answer

The target group's deregistration delay is too short.. The most likely cause of session loss during deployment is that the target group's deregistration delay is too short. When an instance is deregistered (e.g., during scaling in or deployment), the ALB stops routing new requests to it but allows existing connections to complete within the deregistration delay. If this delay is too short, in-flight requests may be terminated, causing session loss for users with sticky sessions. The other options do not directly cause session loss during instance replacement.

Answer

The Auto Scaling group's lifecycle hooks are not configured.

Answer

The stickiness duration is set too low.

Answer

The target group's health check interval is too long.

Question 13

A company uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is experiencing intermittent HTTP 503 errors. The DevOps team needs to diagnose the cause. Which THREE of the following should the team investigate? (Choose THREE.)

Accepted Answer

Auto Scaling group minimum capacity and scaling policy. Option C is correct because if the Auto Scaling group's minimum capacity or scaling policies are misconfigured, the group may have too few healthy instances to serve traffic, causing the ALB to return HTTP 503 (Service Unavailable) when no targets are available. Option D is correct because the ALB idle timeout setting can cause 503 errors if it is shorter than the application's processing time, leading the ALB to close connections prematurely or mark targets unhealthy. Option E is correct because misconfigured health checks (wrong path, port, protocol, or thresholds) can mark healthy targets as unhealthy, leaving the target group with no available targets and resulting in 503 responses. Option A is not the primary cause of 503 errors; security group misconfigurations typically cause connection timeouts or 502/504 errors rather than 503. Option B is also not directly related to 503 errors; an expired SSL certificate on the ALB would cause TLS handshake failures or certificate warnings, not HTTP 503 responses.

Answer

Security group inbound rules for the ALB

Answer

SSL certificate expiration on the ALB

Question 14

The CloudFormation template in the exhibit deploys an S3 bucket with a bucket policy. After deployment, the DevOps team discovers that the bucket is publicly accessible. Which change should be made to prevent public access while allowing only authenticated users from a specific AWS account to read objects?

Accepted Answer

Change the Principal to the AWS account ID of the allowed account. The bucket policy in the exhibit likely uses a wildcard Principal (e.g., "Principal": "*") which grants access to everyone, including anonymous users, making the bucket publicly accessible. By changing the Principal to the specific AWS account ID (e.g., "arn:aws:iam::123456789012:root"), the policy only allows authenticated identities from that account to read objects. This satisfies the requirement of restricting access to a specific AWS account while eliminating public access.

Answer

Enable AWS Organizations to block public access

Answer

Change the Principal to "*" and add a condition for aws:SourceIp

Answer

Set the bucket's 'BlockPublicAccess' property to true

Question 15

A company's production RDS MySQL instance experienced a failover. The DevOps team needs to understand the root cause. Which set of logs should be reviewed first?

Accepted Answer

AWS CloudTrail logs. AWS CloudTrail logs capture API calls and events, including RDS failover events such as DBInstanceFailover or maintenance events. These logs provide a chronological record of who initiated the failover (e.g., a manual failover or an automatic failover due to a detected issue). Option A is incorrect because VPC Flow Logs record network traffic metadata, not database failover events. Option B is incorrect because RDS MySQL error logs contain database-level errors (e.g., connection errors, crash details) but not the failover trigger itself. Option D is incorrect because RDS slow query logs only list queries that exceed a time threshold, unrelated to failover causes. Therefore, CloudTrail is the first log set to review for understanding the root cause of a failover.

Answer

VPC Flow Logs

Answer

RDS MySQL error logs

Answer

RDS slow query logs