DOP-C02 Incident and Event Response Practice Test 11 — 15 Questions

Question 1

An application running on Amazon ECS Fargate is experiencing intermittent HTTP 503 errors from the Application Load Balancer (ALB). The target group health checks are passing. Which configuration is MOST likely causing this issue?

Accepted Answer

The deregistration delay is set too short, causing connections to be closed before requests complete.. Option D is correct because a deregistration delay too short can cause the ALB to route traffic to a draining target, resulting in 503. Option A is wrong because health check interval being too short would cause flapping, not 503. Option B is wrong because slow start only affects new targets. Option C is wrong because circuit breaker doesn't cause 503s directly.

Answer

The ALB's slow start duration is too long, causing requests to be dropped.

Answer

The health check interval is set too low, causing targets to be marked unhealthy prematurely.

Answer

The ALB's circuit breaker is tripping due to high error rates.

Question 2

A DevOps team is designing an incident response plan for a critical microservices architecture. They need to automatically collect and analyze logs from all services during an incident. Which solution should they use?

Accepted Answer

Centralize logs in Amazon CloudWatch Logs and use CloudWatch Logs Insights for real-time querying.. Option B is correct because CloudWatch Logs Insights allows querying across log groups. Option A is wrong because S3 is storage, not real-time analysis. Option C is wrong because Kinesis Data Firehose is for streaming to destinations, not analysis. Option D is wrong because Systems Manager Run Command is for ad-hoc commands.

Answer

Stream logs to Amazon Kinesis Data Firehose and analyze with Amazon OpenSearch Service.

Answer

Store logs in Amazon S3 and use Amazon Athena to query them.

Answer

Use AWS Systems Manager Run Command to execute log collection scripts on each instance.

Question 3

During an incident, an engineer needs to quickly revoke access to a compromised IAM user. Which action should be taken FIRST?

Accepted Answer

Attach an AWS managed policy that explicitly denies all actions (e.g., AWSDenyAll).. Option B is correct because attaching a deny-all policy immediately blocks all actions. Option A is wrong because deleting the user may fail if there are dependencies. Option C is wrong because signing certificates are only for programmatic access, not console. Option D is wrong because rotating keys does not revoke existing sessions.

Answer

Delete the IAM user immediately.

Answer

Disable the user's signing certificates.

Answer

Rotate the user's access keys.

Question 4

A company uses AWS Config to track resource changes. They want to automatically remediate non-compliant security group rules that allow public SSH access. What is the MOST effective approach?

Accepted Answer

Create an AWS Config rule with an automatic remediation action using AWS Systems Manager Automation.. Option A is correct because AWS Config remediation with SSM Automation can automatically modify security group rules. Option B is wrong because AWS Config rules only evaluate, not remediate. Option C is wrong because CloudWatch Events cannot directly modify security groups. Option D is wrong because Service Catalog is for provisioning, not remediation.

Answer

Set up an AWS Config rule that triggers a Lambda function to remove the SSH rule.

Answer

Use Amazon CloudWatch Events to detect the change and invoke a Lambda function.

Answer

Use AWS Service Catalog to enforce security group templates.

Question 5

An application running on Amazon RDS for PostgreSQL is experiencing slow query performance. The DevOps team suspects a specific query is causing high CPU usage. Which tool should they use to identify the problematic query?

Accepted Answer

Amazon RDS Performance Insights. Option C is correct because Performance Insights provides a dashboard to identify top SQL queries. Option A is wrong because Enhanced Monitoring shows OS metrics, not queries. Option B is wrong because CloudWatch Logs might not capture query text. Option D is wrong because RDS Event Subscriptions are for instance events.

Answer

Amazon RDS Event Subscriptions

Answer

Amazon CloudWatch Logs with metric filters

Answer

Amazon RDS Enhanced Monitoring

Question 6

A company's incident response process requires that all changes to production resources are automatically paused when a P1 incident is declared. Which AWS service can be used to enforce this by preventing modifications to CloudFormation stacks?

Accepted Answer

AWS CloudFormation StackSets with a service control policy (SCP). Option B is correct because CloudFormation StackSets with a service control policy (SCP) can prevent stack updates. Option A is wrong because CloudTrail is logging. Option C is wrong because Config evaluates compliance, does not prevent changes. Option D is wrong because Systems Manager Change Manager requires manual approval, not automatic pause.

Answer

AWS Systems Manager Change Manager

Answer

AWS Config rules with remediation

Answer

AWS CloudTrail with Insights

Question 7

An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?

Accepted Answer

Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.. Option D is correct because an SCP can deny all actions from the root user and IAM users in the affected account. Option A is wrong because it only affects the root user. Option B is wrong because IAM policies cannot restrict root user. Option C is wrong because it only affects IAM users, not root.

Answer

Create a new IAM group with a deny-all policy and add all users to it.

Answer

Attach an IAM policy denying all actions to all IAM users in that account.

Answer

Apply an SCP that denies all actions to the root user only.

Question 8

A DevOps engineer is troubleshooting a Lambda function that is timing out. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Increase the function timeout in the Lambda configuration.. Option A is correct because increasing timeout may allow the function to complete. Option D is correct because CloudWatch Logs show execution details and errors. Option B is wrong because memory allocation doesn't directly affect timeout. Option C is wrong because VPC configuration is not directly related to timeout unless network issues. Option E is wrong because reserved concurrency affects scaling, not timeout.

Answer

Set reserved concurrency to 1 to isolate the function.

Answer

Check the VPC configuration for the Lambda function.

Answer

Increase the function memory allocation.

Question 9

A company is designing an incident response strategy for its Amazon EKS cluster. Which THREE steps should be taken to ensure rapid response to a compromised pod?

Accepted Answer

Delete the pod using kubectl delete pod.. Option A is correct because a network policy can isolate the pod. Option B is correct because executing commands helps gather forensics. Option C is correct because terminating the pod stops the compromise. Option D is wrong because deleting the namespace would affect other resources. Option E is wrong because scaling down the deployment might not be immediate enough.

Answer

Delete the entire namespace to ensure all resources are removed.

Answer

Scale down the deployment to 0 replicas.

Question 10

During an incident, a DevOps engineer needs to block traffic from a specific IP address that is attacking an Application Load Balancer. Which TWO actions can the engineer take to mitigate this?

Accepted Answer

Use AWS WAF to create an IP set rule that blocks the IP address.. Option B is correct because updating the security group of the ALB to deny the IP is effective. Option D is correct because AWS WAF can block IPs based on a rule. Option A is wrong because NACLs are for subnets, not ALBs directly. Option C is wrong because CloudFront is a CDN layer, not directly applicable. Option E is wrong because VPC Flow Logs are for monitoring, not blocking.

Answer

Configure Amazon CloudFront to block the IP address.

Answer

Modify the network ACL for the ALB's subnet to deny the IP address.

Answer

Enable VPC Flow Logs to capture traffic from the IP address.

Question 11

A DevOps engineer is troubleshooting an issue where an EC2 instance running a web application becomes unresponsive every few hours. CloudWatch logs show no application errors, but the instance's status checks are passing. The engineer suspects a memory leak. Which AWS service can be used to capture memory utilization metrics at a granular level to confirm the leak?

Accepted Answer

CloudWatch Agent. Option B is correct because CloudWatch Agent can collect memory metrics from EC2 instances and send them to CloudWatch. Option A is wrong because EC2 status checks only check system status, not memory. Option C is wrong because CloudTrail logs API calls, not performance metrics. Option D is wrong because Config records resource configuration changes, not metrics.

Answer

EC2 Status Checks

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance fails, and automatic failover does not occur within the expected 1-2 minutes. The DevOps team needs to quickly restore database availability. What should the team do first?

Accepted Answer

Reboot the DB instance with failover selected.. Option C is correct because forcing a failover by rebooting the DB instance with failover is the fastest way to trigger failover. Option A is wrong because restoring from snapshot takes longer. Option B is wrong because modifying the instance does not trigger failover. Option D is wrong because the standby is not accessible directly.

Answer

Restore the latest automated snapshot to a new DB instance.

Answer

Modify the DB instance to change the Multi-AZ setting to enable automatic failover.

Answer

Connect to the standby instance directly and promote it to primary.

Question 13

A DevOps engineer receives an alert that an EC2 instance's CPU utilization has been above 90% for the last 30 minutes. The engineer needs to investigate the root cause. Which AWS service should the engineer use to get OS-level process details and identify which process is consuming the CPU?

Accepted Answer

AWS Systems Manager Run Command. Option D is correct because Systems Manager Run Command can run scripts (e.g., 'top' or 'ps') on EC2 instances to get process-level details. Option A is wrong because CloudWatch metrics only show aggregated CPU utilization. Option B is wrong because CloudTrail logs API calls. Option C is wrong because Config records configuration changes.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 14

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The DevOps team needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which combination of services should be used?

Accepted Answer

CloudWatch Logs Insights and CloudWatch Dashboards. Option B is correct because CloudWatch Logs Insights can query logs and send results to CloudWatch Dashboards for real-time visualization. Option A is wrong because Athena is for querying data in S3, not real-time. Option C is wrong because Kinesis Data Analytics is for streaming data analytics but adds complexity. Option D is wrong because QuickSight is for BI, not real-time log monitoring.

Answer

Amazon Athena and Amazon QuickSight

Answer

Amazon Kinesis Data Analytics and Amazon Elasticsearch Service

Answer

Amazon S3 and Amazon QuickSight

Question 15

A DevOps team is configuring an Auto Scaling group for a web application behind an Application Load Balancer. The team wants to automatically replace instances that fail the health check. Which scaling policy should be used?

Accepted Answer

Default health check replacement. Option A is correct because the default health check replacement automatically replaces unhealthy instances. Option B is wrong because manual scaling does not automate replacement. Option C is wrong because target tracking policies adjust based on metrics, not health. Option D is wrong because step scaling policies adjust based on metric thresholds, not health.

Answer

Target tracking scaling policy

Answer

Step scaling policy

Answer

Manual scaling