DOP-C02 Incident and Event Response Practice Test 10 — 15 Questions

Question 1

Which TWO actions should be taken to ensure a highly available and resilient architecture for a critical web application on AWS? (Choose two.)

Accepted Answer

Use an Auto Scaling group to maintain a desired number of instances.. Correct: B and E. Option B ensures that the desired number of EC2 instances is maintained, providing automatic scaling and fault tolerance. Option E deploys the application across multiple Availability Zones, which protects against an AZ failure. Option A (CloudFront) enhances content delivery but does not directly ensure high availability of the web application. Option C (Multi-AZ RDS with read replicas) improves read performance and provides disaster recovery, but write availability depends on the primary instance. Option D (backups in a different region) is for disaster recovery, not for immediate availability.

Answer

Enable Amazon CloudFront with multiple origins.

Answer

Use a Multi-AZ RDS deployment with read replicas.

Answer

Store backups in a different AWS Region.

Question 2

Which THREE steps should a DevOps engineer take to troubleshoot an EC2 instance that cannot be reached via SSH? (Choose three.)

Accepted Answer

Check the network ACL inbound rules for the subnet.. Network ACLs (NACLs) are stateless firewall rules applied at the subnet level. If the inbound rule for ephemeral ports or port 22 is not explicitly allowed, SSH traffic will be dropped even if the security group permits it. Checking NACL inbound rules is a fundamental step in troubleshooting connectivity issues.

Answer

Verify that the corporate firewall allows SSH to the instance.

Answer

Create an AMI from the instance and launch a new one.

Question 3

Which TWO metrics should be monitored in Amazon CloudWatch to detect a potential memory leak in an EC2 instance? (Choose two.)

Accepted Answer

MemoryUtilization (custom metric published via CloudWatch Agent).. MemoryUtilization is a custom metric that must be published via the CloudWatch Agent because EC2 does not expose memory metrics by default. Monitoring this metric over time can reveal a steady upward trend in memory usage that does not drop after processes complete, which is a classic symptom of a memory leak.

Answer

DiskReadOps

Answer

NetworkIn

Answer

CPUUtilization

Question 4

A DevOps engineer notices that an Amazon RDS for MySQL instance has failed over to a standby replica. The engineer needs to identify the root cause by examining metrics. Which AWS service should the engineer use to view the database load, replication lag, and failover events?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides RDS metrics including DatabaseConnections, ReplicaLag, ReadIOPS, and failover-related events. CloudWatch alarms and the RDS console's monitoring graphs surface failover events and replication lag, making it the correct service for diagnosing an RDS failover root cause.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Question 5

An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?

Accepted Answer

Enable VPC Flow Logs and query Amazon Athena. VPC Flow Logs capture IP traffic metadata (source, destination, port, protocol, action) for ENIs, subnets, or VPCs, and publishing them to CloudWatch Logs or S3 lets you query with Amazon Athena to identify REJECT entries caused by security group or NACL rules. This is the standard AWS approach for diagnosing denied traffic at the network layer.

Answer

Use AWS Config to review security group rules

Answer

Check AWS CloudTrail for security group modification events

Answer

Enable AWS Security Hub and review the security findings

Question 6

A company uses AWS Lambda functions to process events from Amazon SQS. Recently, the Lambda function has been throttled, causing messages to accumulate in the dead-letter queue (DLQ). The function’s reserved concurrency is set to 100, and the account’s regional concurrency limit is 1000. What is the MOST likely cause of the throttling?

Accepted Answer

The function’s concurrency is fully utilized due to long-running invocations. The most likely cause of throttling is that the function's reserved concurrency of 100 is fully utilized due to long-running invocations. When invocations take longer to complete, they occupy concurrency for an extended period, preventing new invocations from starting. This leads to messages accumulating in the DLQ. Option D is incorrect because reserved concurrency of 100 is well below the account limit of 1000, so that is not the cause. Option B is incorrect because cold starts cause latency but not throttling; they do not consume concurrency. Option C is incorrect because the queue type (standard vs. FIFO) does not directly cause throttling; Lambda can process from both.

Answer

The Lambda function has a cold start issue

Answer

The SQS queue is not configured as a FIFO queue

Answer

The reserved concurrency is set too high, exceeding the account limit

Question 7

A DevOps engineer receives an alert that an Amazon EC2 instance’s CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a step scaling policy based on average CPU. The engineer checks the CloudWatch alarm and sees that it is in the ALARM state. What should the engineer do to verify that the Auto Scaling group is scaling out properly?

Accepted Answer

Review the Auto Scaling group’s activity history in the EC2 console. Reviewing the Auto Scaling group's activity history in the EC2 console shows whether scaling actions were triggered and if new instances were launched. The CloudWatch alarm is in ALARM state (indicating high CPU), and the step scaling policy should scale out, so checking the activity history confirms the scaling action occurred. Option A is incorrect because the scaling policy is for scaling out on high CPU, not scaling in. Option B is incorrect because CloudWatch Logs show instance-level logs, not Auto Scaling actions. Option C is incorrect because the alarm is in ALARM state, not INSUFFICIENT_DATA.

Answer

Ensure the scaling policy is configured to scale in

Answer

Check the CloudWatch Logs for the instance

Answer

Verify that the CloudWatch alarm is in INSUFFICIENT_DATA state

Question 8

A company uses AWS CloudFormation to deploy infrastructure. During an incident, a stack update fails with a stack rollback. The engineer needs to prevent the stack from rolling back on future failures and instead retain the resources for debugging. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the '--disable-rollback' option when updating the stack. The `--disable-rollback` option (or `DisableRollback` in the CloudFormation template) instructs AWS CloudFormation to leave the stack in its current state (with the failed resources intact) instead of automatically rolling back to the last known good state. This allows engineers to retain the resources for debugging without the stack being torn down on failure.

Answer

Enable drift detection on the stack

Answer

Use AWS CloudFormation StackSets to deploy the stack

Answer

Create a change set before updating instead of direct update

Question 9

An application running on Amazon ECS with Fargate is experiencing increased latency. The DevOps team suspects that the task is running out of memory and swapping. Which set of CloudWatch metrics should the team examine to confirm this suspicion?

Accepted Answer

MemoryUtilized and MemoryReserved. MemoryUtilized and MemoryReserved are the CloudWatch metrics that directly track memory consumption and allocation for ECS tasks using Fargate. When a task runs out of memory, the Linux kernel’s OOM killer may terminate processes, but before that, swapping can occur if swap space is available, causing increased latency. These metrics allow the DevOps team to compare actual memory usage against the task’s memory reservation, confirming if memory pressure is the root cause of the latency.

Answer

NetworkIn and NetworkOut

Answer

CPUUtilization and CPUReservation

Answer

EphemeralStorageUtilized and EphemeralStorageReserved

Question 10

A DevOps engineer receives an alert that an Amazon S3 bucket has become publicly accessible. The engineer needs to identify who made the bucket public. Which AWS service should the engineer use to find the API call that changed the bucket policy?

Accepted Answer

AWS CloudTrail. CloudTrail records all S3 API calls, including bucket policy changes. Option A is wrong because CloudWatch monitors metrics. Option C is wrong because Config records configuration changes but not the identity. Option D is wrong because GuardDuty detects threats but doesn't log API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all accounts automatically forward their CloudWatch Logs to a central logging account. Which solution should the team implement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a subscription filter and Lambda function in each account. AWS CloudFormation StackSets allows you to deploy infrastructure components across multiple accounts and regions in an AWS Organization. In this case, you can create a StackSet that includes a CloudWatch Logs subscription filter and a Lambda function to forward logs from each account to a central logging account. The subscription filter triggers the Lambda function to forward logs to a destination in the central account. This ensures all accounts automatically forward their CloudWatch Logs. Option A is incorrect because AWS Config aggregator aggregates configuration and compliance data, not logs. Option B is incorrect because AWS Service Catalog is used to create and manage IT service catalogs for approved products, not for log forwarding. Option D is incorrect because AWS Organizations does not have a native capability to forward logs; it manages policies and account structure.

Answer

Enable AWS Config aggregator in the central account

Answer

Use AWS Service Catalog to create a product for log forwarding

Answer

Configure AWS Organizations to automatically forward logs

Question 12

A critical application is deployed on Amazon EKS. The DevOps team notices that pods are failing with 'CrashLoopBackOff' status. The team needs to capture the application logs before the pod restarts to debug the issue. Which approach should the team use?

Accepted Answer

Configure a sidecar container to stream logs to Amazon CloudWatch Logs. Configuring a sidecar container to stream logs to Amazon CloudWatch Logs ensures that logs are persisted and available for debugging even if the pod crashes and restarts. This approach decouples log collection from the pod's lifecycle, allowing the DevOps team to analyze logs from the crash without needing to capture them in real-time. It aligns with the incident response best practice of centralized logging for ephemeral environments like EKS.

Answer

Use 'kubectl logs' command immediately after the crash

Answer

Store logs in a ConfigMap

Answer

Use 'kubectl exec' to access the container and check logs

Question 13

A DevOps engineer is troubleshooting an issue where an EC2 instance in a private subnet cannot reach the internet. The instance has a route to a NAT gateway. Which TWO of the following should the engineer check? (Choose TWO.)

Accepted Answer

The route table of the private subnet has a route to the NAT gateway. Option B is correct because the private subnet's route table must contain a specific route (typically 0.0.0.0/0) pointing to the NAT gateway; without this route, traffic from the instance will never be forwarded to the NAT gateway even if one exists. Option E is correct because security groups are stateful and must have an outbound rule permitting the traffic (e.g., HTTPS/443 or HTTP/80) to the internet; a restrictive outbound rule will silently drop the packets before they leave the instance. Option A is incorrect because a NAT gateway must reside in a public subnet, not the same private subnet as the instance, and it is associated via the route table rather than subnet co-location. Option C is incorrect because an internet gateway attaches to a VPC, not to a subnet, and private subnets should not have a direct route to an internet gateway. Option D is incorrect because instances in private subnets should not have public IP addresses; outbound internet access via a NAT gateway does not require the instance to have a public IP.

Answer

The NAT gateway is in the same subnet as the instance

Answer

The internet gateway is attached to the private subnet

Answer

The instance has a public IP address

Question 14

A company uses AWS Lambda with an Amazon DynamoDB trigger. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors. The DevOps team needs to mitigate the issue. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Increase the DynamoDB table's write capacity. To mitigate 'ProvisionedThroughputExceededException' errors when a Lambda function is triggered by DynamoDB Streams, two actions are effective. Option D: Increase the DynamoDB table's write capacity to handle the write demand from the stream processing. Option E: Reduce the batch size for the DynamoDB stream event source mapping to lower the number of writes per invocation, reducing the chance of exceeding throughput. Option A is wrong because Lambda reserved concurrency controls how many concurrent executions Lambda can run, but the issue is DynamoDB throttling, not Lambda capacity. Option B is wrong because disabling DynamoDB Streams would stop the trigger entirely, which is not a mitigation. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes, and does not affect write throughput.

Answer

Increase the Lambda function's reserved concurrency

Answer

Disable DynamoDB Streams on the table

Answer

Enable DynamoDB Accelerator (DAX) for the table

Question 15

An IAM policy attached to a user is shown in the exhibit. The user reports that they are unable to delete an object in the 'example-bucket' bucket. What is the reason for this?

Accepted Answer

The explicit Deny statement overrides the Allow. An explicit Deny overrides any Allow. The Deny action s3:DeleteObject explicitly denies the delete, even though the Allow all s3 actions includes delete. Option A is wrong because the resource ARN matches. Option C is wrong because the policy allows all s3 actions, but the Deny blocks delete. Option D is wrong because the policy is valid.

Answer

The resource ARN does not match the bucket name

Answer

The user does not have permissions to perform s3:DeleteObject

Answer

The policy has a syntax error