DOP-C02 Incident and Event Response Practice Test 10 — 15 Questions

Question 1

An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.. A service control policy (SCP) is a feature of AWS Organizations that allows you to centrally control permissions for all accounts in your organization. An SCP can be applied to the root of the organization, an OU, or a specific account. When an SCP that denies all actions is applied to an affected account, it restricts permissions for all principals, including the root user and IAM users in that account. This effectively isolates the compromised account by preventing any API calls. Option A is incorrect because creating a new IAM group with a deny-all policy and adding all users would affect only IAM users, not the root user. Option C is incorrect because an IAM policy attached to IAM users does not affect the root user. Option D is incorrect because applying an SCP that denies all actions only to the root user would leave IAM users unrestricted, failing to fully isolate the account.

Answer

Create a new IAM group with a deny-all policy and add all users to it.

Answer

Attach an IAM policy denying all actions to all IAM users in that account.

Answer

Apply an SCP that denies all actions to the root user only.

Question 2

A DevOps engineer is troubleshooting a Lambda function that is timing out. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Increase the function timeout in the Lambda configuration.. Increasing the function timeout allows more time for the function to complete before timing out. Option E is correct because reviewing CloudWatch Logs helps identify timeout errors and execution details. Option A is wrong because setting reserved concurrency to 1 isolates the function but does not diagnose timeout issues. Option C is wrong because VPC configuration can cause network delays but is not a direct diagnostic step for timeout. Option D is wrong because increasing memory allocation may improve performance but does not directly resolve timeouts.

Answer

Set reserved concurrency to 1 to isolate the function.

Answer

Check the VPC configuration for the Lambda function.

Answer

Increase the function memory allocation.

Question 3

A company is designing an incident response strategy for its Amazon EKS cluster. Which THREE steps should be taken to ensure rapid response to a compromised pod?

Accepted Answer

Delete the pod using kubectl delete pod.. Deleting the pod with `kubectl delete pod` immediately terminates the compromised container, stopping any malicious activity. This is a rapid containment step that removes the pod from the cluster without affecting the broader deployment or namespace, allowing the incident response team to investigate and remediate without unnecessary disruption.

Answer

Delete the entire namespace to ensure all resources are removed.

Answer

Scale down the deployment to 0 replicas.

Question 4

During an incident, a DevOps engineer needs to block traffic from a specific IP address that is attacking an Application Load Balancer. Which TWO actions can the engineer take to mitigate this?

Accepted Answer

Use AWS WAF to create an IP set rule that blocks the IP address.. AWS WAF (option C) can be integrated with an Application Load Balancer to create a web access control list (web ACL) that includes an IP set rule. This rule can explicitly block traffic from a specific source IP address at the application layer (Layer 7), which is the appropriate layer for an ALB. This allows the engineer to mitigate the attack without modifying network-level components.

Answer

Configure Amazon CloudFront to block the IP address.

Answer

Modify the network ACL for the ALB's subnet to deny the IP address.

Answer

Enable VPC Flow Logs to capture traffic from the IP address.

Question 5

A DevOps engineer is troubleshooting an issue where an EC2 instance running a web application becomes unresponsive every few hours. CloudWatch logs show no application errors, but the instance's status checks are passing. The engineer suspects a memory leak. Which AWS service can be used to capture memory utilization metrics at a granular level to confirm the leak?

Accepted Answer

CloudWatch Agent. The CloudWatch Agent can be installed on EC2 instances to collect custom metrics such as memory usage and send them to CloudWatch, allowing granular monitoring. Option A is incorrect because EC2 Status Checks only verify system status (e.g., network reachability). Option B is incorrect because AWS Config tracks configuration changes, not performance metrics. Option C is incorrect because CloudTrail records API activity, not system metrics.

Answer

EC2 Status Checks

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

A DevOps engineer receives an alert that an EC2 instance's CPU utilization has been above 90% for the last 30 minutes. The engineer needs to investigate the root cause. Which AWS service should the engineer use to get OS-level process details and identify which process is consuming the CPU?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run commands (e.g., 'top', 'ps') remotely on EC2 instances to obtain OS-level process details and identify which process is consuming CPU. Option A is wrong because AWS Config records configuration changes, not OS-level processes. Option B is wrong because AWS CloudTrail logs API calls, not system-level metrics. Option D is wrong because Amazon CloudWatch provides aggregated CPU utilization metrics but cannot provide process-level details.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 7

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The DevOps team needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which combination of services should be used?

Accepted Answer

CloudWatch Logs Insights and CloudWatch Dashboards. CloudWatch Logs Insights allows real-time querying of CloudWatch Logs, and CloudWatch Dashboards can display the results as a real-time dashboard showing the count of ERROR-level log entries across all instances. Option A is incorrect because Amazon Athena is designed for querying data stored in S3, not real-time log streams. Option B is incorrect because while Kinesis Data Analytics and Elasticsearch Service could be used, they add unnecessary complexity and cost compared to the native CloudWatch integration. Option C is incorrect because Amazon S3 and QuickSight are not suitable for real-time monitoring; QuickSight is for business intelligence and batch analytics.

Answer

Amazon Athena and Amazon QuickSight

Answer

Amazon Kinesis Data Analytics and Amazon Elasticsearch Service

Answer

Amazon S3 and Amazon QuickSight

Question 8

A DevOps team is configuring an Auto Scaling group for a web application behind an Application Load Balancer. The team wants to automatically replace instances that fail the health check. Which scaling policy should be used?

Accepted Answer

Default health check replacement. The correct approach is not a scaling policy but the Auto Scaling group's built-in health check replacement functionality. When the Auto Scaling group is configured with ELB health checks, it automatically terminates and replaces instances that the Application Load Balancer marks unhealthy. No scaling policy is required for this behavior.

Answer

Target tracking scaling policy

Answer

Step scaling policy

Answer

Manual scaling

Question 9

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The DevOps team notices that messages are not being processed and are going to the dead-letter queue. The Lambda function code is correct. What is the most likely cause?

Accepted Answer

The Lambda function timeout is too short.. For Lambda to process SQS messages, its execution role needs permissions for ReceiveMessage, DeleteMessage, and GetQueueAttributes. If it lacks ReceiveMessage, Lambda cannot poll the queue and messages are never consumed, so they remain in the queue and do not go to the DLQ (since the receive count does not increase). If the Lambda function times out, it does not delete the message; the message becomes visible again, is retried, and after exceeding the maxReceiveCount, it is moved to the DLQ. Since the function code is correct, a too-short timeout can cause repeated failures and eventual DLQ redirection. Option B is incorrect because a longer visibility timeout only delays retries. Option D is incorrect because a misconfigured DLQ would prevent messages from going there.

Answer

The Lambda function's execution role lacks the sqs:ReceiveMessage permission.

Answer

The SQS queue's visibility timeout is too long.

Answer

The Lambda function's dead-letter queue is misconfigured.

Question 10

A DevOps engineer is troubleshooting an issue where an Amazon RDS instance's CPU utilization is consistently high. The engineer has enabled Performance Insights and sees that the top SQL query is a SELECT statement that scans many rows. What is the best course of action to reduce CPU utilization?

Accepted Answer

Add appropriate indexes to optimize the query.. Adding appropriate indexes can reduce the number of rows scanned by the SELECT query, directly reducing CPU utilization. Option A is incorrect: creating a read replica offloads read traffic from the primary instance, but the problematic query would still run on whichever instance it is executed. If the query is still executed on the primary, the CPU remains high. Additionally, the issue is a specific query scanning many rows, not general read load. Option B is incorrect: increasing allocated storage improves I/O performance but does not reduce CPU usage caused by scanning many rows. Option C is incorrect: increasing the DB instance size provides more CPU capacity, but it does not address the root cause of inefficient querying; optimizing the query is a more cost-effective and sustainable solution.

Answer

Create a read replica to offload read traffic.

Answer

Increase the allocated storage to improve I/O.

Answer

Increase the DB instance size to handle the load.

Question 11

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer has updated the files in the S3 bucket. What should the engineer do to ensure users see the latest content?

Accepted Answer

Create an invalidation for the updated file paths.. Creating a CloudFront invalidation for the specific file paths forces the edge locations to fetch the updated content from the S3 origin immediately, ensuring users see the latest files. Option B is incorrect because changing the bucket policy to allow public access does not affect CloudFront's cache; it only controls direct access to the bucket. Option C is incorrect because reducing the TTL affects how long new content is cached but does not clear already-cached outdated content. Option D is incorrect because deleting and recreating the distribution is an overly disruptive solution; a simple invalidation suffices.

Answer

Change the S3 bucket policy to allow public access.

Answer

Reduce the TTL for the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 12

A DevOps team is investigating a security incident where an unauthorized user accessed an S3 bucket. The team needs to determine what actions were taken by the user. Which TWO AWS services should be used together to investigate? (Choose TWO.)

Accepted Answer

S3 server access logs. (S3 server access logs) and Option D (AWS CloudTrail) are correct. S3 server access logs provide detailed records of requests made to the bucket, including object-level operations. AWS CloudTrail logs all API calls to S3, including who made the call, from where, and what action was taken. Option B (Amazon CloudWatch metrics) is incorrect because CloudWatch metrics provide performance and monitoring data, not detailed access logs. Option C (AWS Config) is incorrect because Config records configuration changes and compliance, not access history. Option E (Amazon GuardDuty) is incorrect because GuardDuty is a threat detection service that identifies suspicious activity but does not provide detailed logs of past actions.

Answer

Amazon CloudWatch metrics

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

A company runs a critical application on Amazon ECS with Fargate launch type. The application is experiencing intermittent failures due to resource exhaustion. The DevOps team wants to implement automated responses to scale the service. Which THREE steps should the team take to achieve this? (Choose THREE.)

Accepted Answer

Create a CloudWatch alarm based on CPU or memory utilization.. The correct steps are B, D, and E. Option B: Create a CloudWatch alarm based on CPU or memory utilization to detect resource exhaustion. Option D: Use Application Auto Scaling to define a scaling policy that adjusts the task count. Option E: Configure the ECS service to use auto scaling by specifying minimum and maximum tasks and linking the scaling policy. Option A is incorrect because manually updating the service via Lambda is not an automated response. Option C is incorrect because EC2 Auto Scaling is used for EC2 launch type, not Fargate.

Answer

Create an AWS Lambda function to manually update the service.

Answer

Configure EC2 Auto Scaling group for the cluster.

Question 14

A DevOps engineer needs to receive notifications when an EC2 instance's status check fails. Which TWO services should the engineer use? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Alarms (Option E) can monitor EC2 instance status checks (both system and instance checks) and trigger an action when the alarm state changes to ALARM. Amazon SNS (Option B) is the service that delivers the notification by publishing messages to subscribers (e.g., email, SMS, HTTP endpoints) when the CloudWatch alarm triggers. Together, they provide a complete monitoring and notification pipeline for status check failures.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

An EC2 instance shows as 'running' in the AWS console, but the system status check is 'impaired'. What is the most likely cause?

Accepted Answer

The underlying physical host has experienced a failure.. System status checks indicate problems with the underlying physical host, such as loss of network connectivity, power loss, or hardware failure. Option A is incorrect because security group rules affect network traffic but do not impact system status checks. Option B is incorrect because a corrupted EBS root volume would be detected by instance status checks, not system status checks. Option C is incorrect because the operating system not responding would be reflected in instance status checks, which monitor OS-level issues.

Answer

The instance's security group rules are blocking traffic.

Answer

The EBS root volume is corrupted.

Answer

The instance's operating system is not responding.