DOP-C02 Incident and Event Response Practice Test 11 — 15 Questions

Question 1

A DevOps engineer observes the CloudWatch alarm output shown in the exhibit. The alarm is in ALARM state for instance i-0abcd1234efgh5678. The engineer checks the EC2 console and sees that the instance's CPU utilization is currently 10%. What is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The alarm has not yet evaluated enough low datapoints to change state. CloudWatch alarms evaluate metrics over a specified number of datapoints and periods. Even if the current CPU utilization is 10%, the alarm may still be in ALARM state because it has not yet evaluated enough consecutive low datapoints to transition to OK. The alarm state changes only after the configured number of evaluation periods and datapoints breach or recover from the threshold.

Answer

The alarm is misconfigured with wrong metric

Answer

The threshold was set too low

Answer

The CPUUtilization metric is not being emitted

Question 2

A DevOps engineer receives an alarm that an EC2 instance's CPU utilization has exceeded 90% for 5 minutes. The engineer needs to automatically recover the instance. Which AWS service should be used to configure automatic recovery?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can be configured to trigger an EC2 instance recovery action when a metric like CPU utilization exceeds a threshold (e.g., 90% for 5 minutes). The alarm sends a signal to the EC2 service, which automatically recovers the instance by stopping it and starting it on a new underlying host, preserving the instance ID, private IP, and Elastic IP. This is the native, built-in mechanism for automatic instance recovery without requiring additional compute or orchestration services.

Answer

AWS Lambda

Answer

AWS Systems Manager Automation

Answer

EC2 Auto Scaling

Question 3

An application running on an EC2 instance in a private subnet needs to access an S3 bucket. The instance has an IAM role with S3 access. However, the application is failing with timeout errors. The security group allows all outbound traffic, and the NACL allows outbound ephemeral ports. What is the most likely cause?

Accepted Answer

No VPC endpoint for S3. A VPC endpoint for S3 (Gateway or Interface) is needed for private subnet access to S3 without NAT. Without a VPC endpoint, the EC2 instance in a private subnet cannot reach S3, resulting in timeout errors. The security group and NACL settings are permissive, so they are not the issue. Option B is incorrect because the instance is in a private subnet; routing to an Internet Gateway is not necessary and would require a NAT device. Option C is incorrect because the IAM role has the necessary S3 permissions. Option D is incorrect because no HTTP proxy is required for S3 access.

Answer

Missing route in the route table to an Internet Gateway

Answer

IAM role does not have correct trust policy

Answer

Missing HTTP proxy configuration

Question 4

A DevOps engineer is troubleshooting an AWS Lambda function that is intermittently timing out. The function is configured with a 3-second timeout and 128 MB memory. The function processes messages from an SQS queue. What is the most cost-effective change to reduce timeouts?

Accepted Answer

Increase the function memory to 256 MB. Increasing the memory to 256 MB is the most cost-effective change because Lambda allocates CPU proportionally to memory, so doubling the memory from 128 MB to 256 MB also doubles the CPU performance. This reduces execution time, which can resolve timeouts without increasing the timeout duration, and since Lambda billing is based on compute time (GB-seconds), the total cost may stay the same or even decrease if the function finishes faster.

Answer

Increase the SQS batch size to 20

Answer

Increase the function timeout to 10 seconds

Answer

Set reserved concurrency to 10

Question 5

After deploying a new application version using AWS CodeDeploy, an EC2 instance fails the deployment. The deployment group is configured with an in-place deployment. The engineer sees the error 'ScriptMissing' in the CodeDeploy logs. What should the engineer check?

Accepted Answer

The file path defined in the appspec.yml for the lifecycle hook. The 'ScriptMissing' error in CodeDeploy indicates that a lifecycle hook script referenced in appspec.yml cannot be found at the specified path on the instance. The engineer should verify the file path defined for that hook in appspec.yml.

Answer

The deployment group's deployment configuration

Answer

The security group attached to the instance

Answer

The AMI used for the EC2 instance

Question 6

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team requires that log data be encrypted at rest using a customer-managed AWS KMS key. The logs are currently being delivered, but they are not encrypted. What is the most likely reason?

Accepted Answer

The KMS key policy does not allow the CloudWatch Logs service principal. For CloudWatch Logs to encrypt log data at rest with a customer-managed KMS key, the key policy must grant the CloudWatch Logs service principal the necessary permissions (kms:Encrypt, kms:Decrypt, etc.). If the key policy does not include this, CloudWatch Logs can still ingest the logs but cannot encrypt them, resulting in unencrypted logs. Option A is incorrect: the IAM role for the EC2 instance does not need kms:Encrypt permissions for server-side encryption; that is handled by the CloudWatch Logs service using the key policy. Option B is incorrect because encryption is configured at the log group level, not in the agent. Option C would cause delivery failures, not just lack of encryption.

Answer

The IAM role for the EC2 instance does not have kms:Encrypt permission

Answer

The CloudWatch Logs agent is not configured to encrypt logs

Answer

The KMS key is disabled

Question 7

A DevOps engineer receives a CloudWatch alarm that the 'StatusCheckFailed' metric for an EC2 instance is in ALARM state. The instance is part of an Auto Scaling group. What should the engineer do first to restore service?

Accepted Answer

Wait for Auto Scaling to replace the instance. The Auto Scaling group automatically replaces unhealthy instances based on EC2 status checks. Options A, C, and D are incorrect: Updating the launch configuration does not fix existing instances; manually terminating is unnecessary as Auto Scaling handles it; and rebooting may not resolve underlying issues.

Answer

Update the Auto Scaling group's launch configuration

Answer

Manually terminate the instance

Answer

Reboot the instance

Question 8

An application running on Amazon ECS Fargate is experiencing intermittent 'CannotPullContainerError' errors. The task definition references a Docker image in a private Amazon ECR repository. The task execution role has the 'AmazonECSTaskExecutionRolePolicy' policy attached. What is the most likely cause?

Accepted Answer

The Fargate task is in a private subnet without a NAT gateway or VPC endpoint. The 'CannotPullContainerError' occurs when the ECS task cannot retrieve the container image from ECR. Since the task execution role has the 'AmazonECSTaskExecutionRolePolicy' attached, which includes the necessary permissions (ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer), the issue is not permissions. The most likely cause is that the Fargate task is running in a private subnet that lacks a route to the internet (via NAT gateway) or a VPC endpoint for ECR. Without either, the task cannot reach the ECR API to pull the image. Option A is correct. Option B is wrong because the policy provides sufficient permissions. Option C is irrelevant; Auto Scaling does not affect image pulling. Option D is less likely because ECR repositories are typically in the same region, and cross-region pulls would still be possible with proper permissions and networking.

Answer

The task execution role does not have sufficient permissions

Answer

The ECS service is not configured with Auto Scaling

Answer

The ECR repository is not in the same region as the ECS cluster

Question 9

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The team wants to automate the response to an instance failure. Which THREE steps should be taken to ensure automatic recovery and notification?

Accepted Answer

Configure Auto Scaling to replace unhealthy instances. Configuring the Auto Scaling group to replace unhealthy instances ensures that when an instance fails health checks, Auto Scaling automatically terminates it and launches a new instance to maintain the desired capacity. This is the core mechanism for automated recovery in an Auto Scaling group, as it directly responds to instance failure without manual intervention.

Answer

Create a CloudWatch alarm to terminate the instance

Answer

Create a scaling policy based on CPU utilization

Question 10

A company's production EC2 instance running a web application becomes unresponsive. The operations team checks CloudWatch metrics and sees a CPU Utilization spike to 100% for the last 10 minutes. What is the MOST efficient first step to restore service?

Accepted Answer

Reboot the EC2 instance from the AWS Management Console or CLI. Rebooting the EC2 instance is the most efficient first step to restore service when the instance is unresponsive due to a CPU spike. A reboot can quickly resolve transient software issues or resource exhaustion without data loss. Option A (checking CloudWatch Logs) delays recovery—investigation should come after restoration. Option B (creating an AMI and launching a new instance) is time-consuming and unnecessary for initial recovery. Option D (terminating and launching a new instance) risks data loss and is more drastic than rebooting.

Answer

Check the instance's system logs in CloudWatch Logs to identify the root cause

Answer

Create an AMI of the instance and launch a new instance from that AMI

Answer

Terminate the instance and launch a new one from the latest AMI

Question 11

A DevOps engineer receives a CloudWatch alarm that an Auto Scaling group has been in an 'Insufficient data' state for 20 minutes. What does this indicate?

Accepted Answer

The alarm has not received enough metric data to evaluate. The 'Insufficient data' state in CloudWatch alarms indicates that the alarm has not received enough metric data points to determine whether the threshold has been breached. This can occur when the metric is not being published, the data collection period is too short, or the metric namespace is misconfigured. It does not directly indicate instance health, scaling needs, or agent installation status.

Answer

All instances in the Auto Scaling group are unhealthy

Answer

The Auto Scaling group needs to scale up

Answer

The CloudWatch agent is not installed on the instances

Question 12

A company uses AWS CloudTrail to log API calls. An IAM user's credentials are compromised, and the attacker launches multiple EC2 instances in regions that are not typically used. The security team wants to receive near-real-time notifications of any API calls from this user. What is the MOST effective solution?

Accepted Answer

Create a CloudTrail trail that delivers to CloudWatch Logs, then set up a CloudWatch Events rule to invoke a Lambda function that sends an SNS notification. The most effective solution for near-real-time notifications of specific API calls is to deliver CloudTrail logs to CloudWatch Logs and create a CloudWatch Events (now EventBridge) rule that triggers a Lambda function to send an SNS notification. This provides immediate alerting based on specific API calls, such as RunInstances, from a particular user.

Answer

Create an AWS Config rule that checks for EC2 instances in unauthorized regions

Answer

Configure CloudTrail to deliver logs to an S3 bucket and enable S3 event notifications to SQS

Answer

Use CloudWatch Logs Insights to query CloudTrail logs every 5 minutes and send results via email

Question 13

A company experiences an unexpected spike in network traffic to a web application hosted on EC2 instances behind an Application Load Balancer. The DevOps team needs to investigate the source IP addresses generating the traffic. Which AWS service should they use to capture the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information, including source and destination IPs, ports, and protocols, allowing investigation of source IPs. Option A (CloudWatch Logs) is wrong because it captures application logs, not network traffic. Option B (AWS Config) is wrong because it records resource configuration changes. Option C (CloudTrail) is wrong because it logs API calls, not network traffic.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 14

An organization uses AWS Systems Manager to manage its EC2 instances. After a security incident, the security team wants to ensure that all future API calls to Systems Manager are logged and monitored. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS CloudTrail for the Systems Manager service. Enabling CloudTrail for Systems Manager logs all API calls made to the Systems Manager service. Option A is incorrect because S3 server access logging only logs access to S3 buckets, not Systems Manager API calls. Option C is incorrect because the CloudWatch Logs agent captures instance logs, not API calls to Systems Manager. Option D is incorrect because AWS Config rules track configuration changes, not API calls. Therefore, CloudTrail is the most efficient way to log and monitor all future API calls to Systems Manager.

Answer

Enable S3 server access logging on the Systems Manager log bucket

Answer

Install the CloudWatch Logs agent on each instance to capture Systems Manager logs

Answer

Create an AWS Config rule to monitor Systems Manager usage

Question 15

A company runs a critical application on an Amazon RDS for MySQL DB instance. The application experiences intermittent connection timeouts. The DevOps team notices that the DB instance's CPU and memory metrics are normal. What should the team check NEXT to diagnose the issue?

Accepted Answer

Check the 'DatabaseConnections' CloudWatch metric to see if the connection count is near the max_connections limit. The most likely cause of intermittent connection timeouts when CPU and memory are normal is that the number of database connections has reached the max_connections limit. The 'DatabaseConnections' CloudWatch metric shows the current number of connections; if it's near the limit, new connections will be refused or time out. Checking this metric is the next logical step to diagnose the issue.

Answer

Enable Enhanced Monitoring to check OS-level metrics

Answer

Examine the slow query log to identify long-running queries

Answer

Verify that the DB instance's storage is not full