DOP-C02 Incident and Event Response Practice Test 11 — 15 Questions

Question 1

A Lambda function has the above IAM policy attached. The function is failing to write logs to CloudWatch Logs. What is the most likely reason?

Accepted Answer

The log group ARN in the resource does not match the Lambda function's log group.. The IAM policy specifies a Resource ARN that includes a specific log group pattern (e.g., arn:aws:logs:region:account-id:log-group:/aws/lambda/function-name:*). If the Lambda function is configured to write to a different log group (for example, if the function name differs from the one in the ARN), the logs:PutLogEvents action will be denied because the resource ARN does not match. Option A is incorrect because the policy does include the necessary logs:PutLogEvents action (assuming it's listed). Option B is incorrect because ec2:DescribeInstances is unrelated to writing logs to CloudWatch Logs. Option D is incorrect because there is no KMS key specified in the policy, so no KMS permission is needed.

Answer

The policy does not include the 'logs:PutLogEvents' action.

Answer

The policy does not allow 'ec2:DescribeInstances' on a specific resource.

Answer

The Lambda function does not have permission to use the KMS key for log encryption.

Question 2

The CloudWatch alarm 'HighCPU' has transitioned to ALARM state. What does the alarm history indicate about the metric that triggered it?

Accepted Answer

The metric value of 90.0 exceeded the threshold of 80.0.. The alarm history shows that a single datapoint with a value of 90.0 exceeded the threshold of 80.0, causing the alarm to transition to ALARM state. Option A is incorrect because the metric value (90.0) did not remain below the threshold. Option B is incorrect because the value was 90.0, not exactly 80.0. Option D is incorrect because the alarm history indicates that only one datapoint breached the threshold, not three consecutive datapoints.

Answer

The metric value remained below the threshold.

Answer

The metric value was exactly 80.0 at the time of the alarm.

Answer

The alarm was triggered after 3 consecutive datapoints breached the threshold.

Question 3

A company experiences an EC2 instance failure in an Auto Scaling group. The instance is terminated and replaced automatically. The DevOps engineer needs to troubleshoot why the instance failed. Which AWS service should the engineer use to view the instance's console output and screenshots before termination?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture EC2 instance console output if the CloudWatch agent is configured to send system logs. After termination, these logs persist in CloudWatch Logs, allowing troubleshooting. However, CloudWatch Logs does not capture screenshots. Option A (AWS CloudTrail) records API calls, not console output. Option C (AWS Systems Manager Session Manager) provides interactive shell access but does not retrieve console output or screenshots after termination. Option D (AWS Config) tracks configuration changes, not instance failures.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Session Manager

Answer

AWS Config

Question 4

A DevOps team is debugging a production incident where an Application Load Balancer (ALB) is returning 503 errors for some requests. The target group instances are healthy. What is the most likely cause?

Accepted Answer

The deregistration delay setting on the target group is too long. The deregistration delay setting controls how long the ALB continues to send requests to an instance that is being deregistered. If this delay is too long, the ALB may route traffic to an instance that has already stopped accepting connections, resulting in 503 errors even though the health checks pass. Option A is incorrect because a missing security group rule would prevent any traffic from reaching the ALB, causing connection timeouts rather than 503 errors. Option B is incorrect because the instance health checks are passing (as stated), so the health check path must be correct. Option D is incorrect because disabling cross-zone load balancing affects traffic distribution but does not cause 503 errors.

Answer

The security group for the ALB does not allow inbound traffic on port 443

Answer

Health checks are misconfigured to use an incorrect path

Answer

Cross-zone load balancing is disabled

Question 5

A company uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with the error 'The following resource(s) failed to create: [AWS::RDS::DBInstance]'. Which AWS service should the engineer use to view detailed error messages for the failed resource creation?

Accepted Answer

AWS CloudFormation console Events tab. The correct option is B: the CloudFormation console Events tab displays detailed error messages for each resource event, including creation failures. This is the most direct way to view error details for failed resource creation. Option A (AWS Config timeline) is used for configuration history and compliance, not for resource creation errors. Option C (AWS Service Catalog) manages product portfolios and provisioning, not stack troubleshooting. Option D (AWS CloudTrail event history) records API calls but does not surface CloudFormation-specific resource-level error messages.

Answer

AWS Config timeline

Answer

AWS Service Catalog

Answer

AWS CloudTrail event history

Question 6

A DevOps engineer receives a CloudWatch alarm for high CPU utilization on an EC2 instance. The engineer needs to investigate the cause. Which AWS service can provide a detailed analysis of the running processes and their resource consumption?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command can execute commands (e.g., 'top') on EC2 instances to gather process-level details. Option A (AWS Config) records configuration state, not OS-level metrics. Option B (AWS CloudTrail) records API activity, not OS-level metrics. Option D (Amazon Inspector) is for vulnerability assessment, not process analysis.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 7

A company uses Amazon S3 to store critical data. An incident occurs where an S3 bucket is accidentally deleted. The DevOps engineer needs to recover the bucket and its objects. What should the engineer do?

Accepted Answer

Recreate the bucket with the same name and restore objects from a previous backup. If the bucket was deleted, the only way to recover the data is to recreate the bucket (note: the bucket name may not be immediately available, but you can create a new bucket with a different name) and restore objects from a previous backup, assuming backups exist. Option B is incorrect because AWS Support cannot restore a deleted S3 bucket; versioning helps recover individual object versions but does not prevent bucket deletion. Option A is incorrect because CloudTrail logs API calls but cannot restore buckets. Option D is incorrect because the S3 console does not have an undo feature for bucket deletion.

Answer

Restore the bucket from AWS CloudTrail event history

Answer

Contact AWS Support to restore the bucket from a backup if versioning was enabled

Answer

Use the AWS S3 console to undo the deletion

Question 8

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. During an incident, the API returns 502 Bad Gateway errors. The Lambda function logs show no errors. What is the most likely cause?

Accepted Answer

The Lambda function is returning a response that exceeds the API Gateway payload size limit. When an API Gateway REST API returns 502 Bad Gateway errors but the Lambda function logs show no errors, the most likely cause is that the Lambda function is returning a response that exceeds the API Gateway payload size limit. API Gateway has a maximum payload size of 10 MB for REST APIs, and if the Lambda function returns a response larger than this, API Gateway will reject it and return a 502 error without the Lambda function itself throwing an exception or logging an error.

Answer

The Lambda function is throwing an unhandled exception

Answer

The API Gateway has reached its maximum concurrency limit

Answer

The Lambda function is timing out and API Gateway is not handling the timeout correctly

Question 9

A DevOps engineer is investigating a security incident where an EC2 instance was used to launch an outbound DDoS attack. Which AWS service can provide details about the source IP addresses and network traffic from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces, providing details about source IP addresses and network traffic. AWS CloudTrail records API calls, not network traffic. GuardDuty is a threat detection service but does not provide raw traffic logs. AWS Config records configuration changes.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

A company uses an AWS Elastic Load Balancer (ELB) to distribute traffic to EC2 instances. During an incident, some users report slow response times. The DevOps engineer suspects that one instance is unhealthy but the health check is not detecting it. What should the engineer do to improve health check accuracy?

Accepted Answer

Configure a health check that checks a specific application endpoint. Configuring a health check that checks a specific application endpoint (deep health check) ensures the health check reflects actual application responsiveness, not just instance-level metrics. Option A is incorrect because increasing the interval reduces the frequency of checks, potentially delaying detection of unhealthy instances. Option C is incorrect because decreasing the unhealthy threshold (e.g., to 2 consecutive failures) makes the instance more sensitive to transient issues, not necessarily improving accuracy. Option D is incorrect because checking the root document ('/') may succeed even if the application is failing, providing a false positive. Deep health checks targeting a critical application path improve accuracy by verifying end-to-end functionality.

Answer

Increase the health check interval to reduce load on instances

Answer

Decrease the health check unhealthy threshold to 2

Answer

Set the health check path to the root document ('/')

Question 11

Which TWO actions should a DevOps engineer take to ensure that an Amazon RDS for PostgreSQL database is automatically recovered in the event of a failure?

Accepted Answer

Enable automated backups with a retention period of at least 1 day. The correct actions are D and E. Enabling Multi-AZ deployment (E) provides automatic failover to a standby replica in a different Availability Zone, ensuring automatic recovery. Enabling automated backups with a retention period of at least 1 day (D) allows point-in-time recovery to any point within the retention period, which aids in recovery from failures like data corruption. Option A is incorrect because creating a read replica does not provide automatic failover; it is for read scaling. Option B is incorrect because manual snapshots require manual intervention and do not automate recovery. Option C is incorrect because cross-region replication is for disaster recovery, not automatic failover within the same region.

Answer

Create a read replica in a different Availability Zone

Answer

Take manual snapshots every hour

Answer

Configure cross-region replication to a secondary region

Question 12

A company experiences a security incident where an IAM user's access key is compromised. Which THREE steps should the DevOps engineer take immediately?

Accepted Answer

Review AWS CloudTrail logs for any unauthorized API calls. Options A, B, and E are correct. Reviewing CloudTrail logs (A) helps identify the scope of unauthorized actions. Rotating the access key (B) invalidates the compromised key. Revoking temporary security credentials (E) ensures any active sessions using the compromised key are terminated. Option C is incorrect because changing the password does not affect access keys. Option D is incorrect because deleting and recreating the user is more disruptive than necessary; rotating the key suffices.

Answer

Change the IAM user's password

Answer

Delete the IAM user and recreate it

Question 13

Which TWO metrics should a DevOps engineer monitor to detect an EC2 instance that is unresponsive due to resource exhaustion?

Accepted Answer

MemoryUtilization. Options B and D are correct. CPUUtilization and MemoryUtilization (if enabled) are key indicators of resource exhaustion. Option A is incorrect because StatusCheckFailed indicates instance health issues but not specifically resource exhaustion. Option C is incorrect because DiskReadOps alone does not indicate exhaustion. Option E is incorrect because NetworkIn alone is not a resource exhaustion metric.

Answer

StatusCheckFailed

Answer

DiskReadOps

Answer

NetworkIn

Question 14

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The engineer checks CloudWatch metrics and sees a CPU Utilization spike to 100% just before the instance became unresponsive. However, the instance status check passed. What should the engineer do NEXT to troubleshoot the issue?

Accepted Answer

Use the EC2 Serial Console to connect to the instance and diagnose the issue.. The instance is unresponsive but the status check passes, indicating an OS-level issue such as a kernel panic or high CPU hang. The EC2 Serial Console provides interactive, out-of-band access to diagnose and troubleshoot the instance without requiring network connectivity, allowing you to view kernel logs, check system load, and potentially recover the instance. Option B is wrong: terminating the instance without investigation may result in data loss and does not help identify the root cause. Option C is wrong: CloudWatch Logs are useful for reviewing historical application errors but are passive and may not provide real-time diagnostics for a hung instance. Option D is wrong: increasing the instance size could help if resource exhaustion were the cause, but the instance is already unresponsive; resizing requires a stop/start which may not resolve the underlying OS issue and could delay recovery.

Answer

Terminate the instance and launch a new one from the same AMI.

Answer

Review CloudWatch Logs for the instance to identify any application errors.

Answer

Increase the instance size and restart the instance.

Question 15

A company runs a multi-tier web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors during peak traffic. The Auto Scaling group is configured with a step scaling policy based on CPU utilization. CloudWatch metrics show that CPU utilization never exceeds 70%, but the ALB target group reports that some targets are unhealthy. What is the MOST likely cause?

Accepted Answer

The application health check endpoint is returning HTTP 5xx or timing out.. Health checks are failing, causing the ALB to stop sending traffic to those instances, which results in 503 errors. The CPU utilization might be low because the unhealthy instances are not receiving traffic. Option B is wrong because if the scaling policy were too aggressive, you'd see more instances and possibly lower CPU, not 503 errors. Option C is wrong because connection draining does not cause health check failures. Option D is wrong because the application itself is failing health checks, not the ALB configuration.

Answer

The ALB is misconfigured with an incorrect security group blocking traffic to the targets.

Answer

The ALB connection draining settings are too short, causing in-flight requests to fail.

Answer

The step scaling policy is too aggressive and is terminating instances prematurely.