DOP-C02 Incident and Event Response Practice Test 12 — 15 Questions

Question 1

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

Accepted Answer

Use the awslogs log driver in the task definition.. Option B is correct because the awslogs log driver is built into ECS and automatically sends container logs to CloudWatch Logs. Option A is wrong because CloudWatch Agent inside container adds complexity. Option C is wrong because CloudTrail is for API calls. Option D is wrong because S3 is not real-time and requires additional setup.

Answer

Install the CloudWatch Agent in each container.

Answer

Configure AWS CloudTrail to capture logs.

Answer

Write logs to a file and use an S3 bucket with event notifications.

Question 2

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The DevOps team notices that messages are not being processed and are going to the dead-letter queue. The Lambda function code is correct. What is the most likely cause?

Accepted Answer

The Lambda function's execution role lacks the sqs:ReceiveMessage permission.. Option C is correct because if the Lambda function's execution role does not have permission to receive messages from SQS, it cannot process them, causing them to go to DLQ. Option A is wrong because SQS does not have a timeout that causes messages to go to DLQ; that's a Lambda function timeout. Option B is wrong because visibility timeout is set on the queue, not Lambda. Option D is wrong because DLQ is not used for Lambda errors; it's used for messages that cannot be processed.

Answer

The SQS queue's visibility timeout is too long.

Answer

The Lambda function timeout is too short.

Answer

The Lambda function's dead-letter queue is misconfigured.

Question 3

A DevOps engineer is troubleshooting an issue where an Amazon RDS instance's CPU utilization is consistently high. The engineer has enabled Performance Insights and sees that the top SQL query is a SELECT statement that scans many rows. What is the best course of action to reduce CPU utilization?

Accepted Answer

Add appropriate indexes to optimize the query.. Option D is correct because adding appropriate indexes can reduce the number of rows scanned, thus reducing CPU usage. Option A is wrong because increasing instance size is a temporary fix. Option B is wrong because read replicas are for read traffic, not for reducing CPU on the primary. Option C is wrong because increasing storage does not reduce CPU.

Answer

Create a read replica to offload read traffic.

Answer

Increase the allocated storage to improve I/O.

Answer

Increase the DB instance size to handle the load.

Question 4

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer has updated the files in the S3 bucket. What should the engineer do to ensure users see the latest content?

Accepted Answer

Create an invalidation for the updated file paths.. Option C is correct because creating a CloudFront invalidation removes cached objects from edge locations. Option A is wrong because TTL settings affect how long content is cached, but invalidation is immediate. Option B is wrong because invalidating the entire distribution is not necessary; a path-specific invalidation works. Option D is wrong because changing S3 bucket policy does not affect cache.

Answer

Change the S3 bucket policy to allow public access.

Answer

Reduce the TTL for the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 5

A DevOps team is investigating a security incident where an unauthorized user accessed an S3 bucket. The team needs to determine what actions were taken by the user. Which TWO AWS services should be used together to investigate? (Choose TWO.)

Accepted Answer

S3 server access logs. Option A and Option D are correct. CloudTrail logs all API calls to S3, including who made the call, from where, and what action was taken. S3 server access logs provide detailed records of requests made to the bucket, including object-level operations. Option B is wrong because Config records configuration changes, not access. Option C is wrong because GuardDuty detects threats but does not provide detailed logs of past actions. Option E is wrong because CloudWatch metrics provide performance data, not access details.

Answer

Amazon CloudWatch metrics

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

A company runs a critical application on Amazon ECS with Fargate launch type. The application is experiencing intermittent failures due to resource exhaustion. The DevOps team wants to implement automated responses to scale the service. Which THREE steps should the team take to achieve this? (Choose THREE.)

Accepted Answer

Create a CloudWatch alarm based on CPU or memory utilization.. Option A, Option D, and Option E are correct. Creating a CloudWatch alarm on a metric like CPU or memory triggers scaling. Application Auto Scaling adjusts the desired count of tasks based on the alarm. The service auto scaling configuration is necessary to define the min/max tasks and scaling policies. Option B is wrong because ECS Cluster Auto Scaling is for EC2 launch type, not Fargate. Option C is wrong because Lambda for scaling is unnecessary and not a best practice.

Answer

Create an AWS Lambda function to manually update the service.

Answer

Configure EC2 Auto Scaling group for the cluster.

Question 7

A DevOps engineer needs to receive notifications when an EC2 instance's status check fails. Which TWO services should the engineer use? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Alarms (Option E) can monitor EC2 instance status checks (both system and instance checks) and trigger an action when the alarm state changes to ALARM. Amazon SNS (Option B) is the service that delivers the notification by publishing messages to subscribers (e.g., email, SMS, HTTP endpoints) when the CloudWatch alarm triggers. Together, they provide a complete monitoring and notification pipeline for status check failures.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS Config

Question 8

An EC2 instance shows as 'running' in the AWS console, but the system status check is 'impaired'. What is the most likely cause?

Accepted Answer

The underlying physical host has experienced a failure.. Option B is correct because system status checks indicate problems with the underlying physical host, such as loss of network connectivity or power. Option A is wrong because instance status checks are for the OS, not system. Option C is wrong because EBS volume issues are instance status checks. Option D is wrong because security group rules affect network access but not system status checks.

Answer

The instance's security group rules are blocking traffic.

Answer

The EBS root volume is corrupted.

Answer

The instance's operating system is not responding.

Question 9

A Lambda function has the above IAM policy attached. The function is failing to write logs to CloudWatch Logs. What is the most likely reason?

Accepted Answer

The log group ARN in the resource does not match the Lambda function's log group.. Option B is correct because the Resource ARN in the policy specifies a specific log group name pattern, but if the function is configured to write to a different log group (e.g., /aws/lambda/other-function), access will be denied. Option A is wrong because the actions are correct for writing logs. Option C is wrong because the ec2:DescribeInstances permission is irrelevant to logging. Option D is wrong because there is no encryption key specified in the policy.

Answer

The policy does not include the 'logs:PutLogEvents' action.

Answer

The policy does not allow 'ec2:DescribeInstances' on a specific resource.

Answer

The Lambda function does not have permission to use the KMS key for log encryption.

Question 10

The CloudWatch alarm 'HighCPU' has transitioned to ALARM state. What does the alarm history indicate about the metric that triggered it?

Accepted Answer

The metric value of 90.0 exceeded the threshold of 80.0.. Option D is correct because the history shows that 1 datapoint with value 90.0 was greater than the threshold of 80.0. Option A is wrong because the datapoint is 90.0, not 80.0. Option B is wrong because it crossed the threshold. Option C is wrong because the alarm uses 1 datapoint, not 3.

Answer

The metric value remained below the threshold.

Answer

The metric value was exactly 80.0 at the time of the alarm.

Answer

The alarm was triggered after 3 consecutive datapoints breached the threshold.

Question 11

A company experiences an EC2 instance failure in an Auto Scaling group. The instance is terminated and replaced automatically. The DevOps engineer needs to troubleshoot why the instance failed. Which AWS service should the engineer use to view the instance's console output and screenshots before termination?

Accepted Answer

AWS Systems Manager Session Manager. Option B is correct because AWS Systems Manager Session Manager can be used to retrieve EC2 console output and screenshots. Option A (CloudWatch Logs) does not capture console output by default. Option C (CloudTrail) records API calls, not instance-level console output. Option D (Config) is for configuration compliance, not troubleshooting instance failures.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 12

A DevOps team is debugging a production incident where an Application Load Balancer (ALB) is returning 503 errors for some requests. The target group instances are healthy. What is the most likely cause?

Accepted Answer

The deregistration delay setting on the target group is too long. Option D is correct because a deregistration delay setting can cause the ALB to continue sending requests to instances that are being de-registered, leading to 503 errors if the instances are no longer accepting traffic. Option A is incorrect because healthy instances mean the health checks pass. Option B is incorrect because a missing security group rule would cause connection timeouts, not 503. Option C is incorrect because cross-zone load balancing does not cause 503 errors.

Answer

The security group for the ALB does not allow inbound traffic on port 443

Answer

Health checks are misconfigured to use an incorrect path

Answer

Cross-zone load balancing is disabled

Question 13

A company uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with the error 'The following resource(s) failed to create: [AWS::RDS::DBInstance]'. Which AWS service should the engineer use to view detailed error messages for the failed resource creation?

Accepted Answer

AWS CloudFormation console Events tab. Option A is correct because CloudFormation events provide detailed error messages for resource creation failures. Option B (CloudTrail) records API calls but not CloudFormation-specific resource errors. Option C (Config) is for configuration compliance. Option D (Service Catalog) is for product provisioning, not troubleshooting stack failures.

Answer

AWS Config timeline

Answer

AWS Service Catalog

Answer

AWS CloudTrail event history

Question 14

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?

Accepted Answer

The application is using the old master user credentials that were changed on the primary but not replicated to the standby. Option A is correct because after failover, the standby instance may have different credentials if not using the same secret. Option B is incorrect because DNS propagation does not cause access denied errors. Option C is incorrect because the security group is associated with the RDS instance, not the endpoint. Option D is incorrect because the standby instance has the same storage as the primary.

Answer

The DNS CNAME for the RDS endpoint has not propagated to the application's DNS resolver

Answer

The standby instance has a different storage configuration than the primary

Answer

The security group for the RDS instance does not allow inbound traffic from the application's new IP address

Question 15

A DevOps engineer receives a CloudWatch alarm for high CPU utilization on an EC2 instance. The engineer needs to investigate the cause. Which AWS service can provide a detailed analysis of the running processes and their resource consumption?

Accepted Answer

AWS Systems Manager Run Command. Option C is correct because AWS Systems Manager Run Command can execute commands (e.g., 'top') on EC2 instances to gather process-level details. Option A (CloudTrail) does not provide OS-level metrics. Option B (Config) records configuration state. Option D (Inspector) is for vulnerability assessment.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector