DOP-C02 Incident and Event Response Practice Test 12 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a Lambda function that processes S3 events. The function has been running successfully for months, but today it started timing out. The engineer checks CloudWatch Logs and sees 'Task timed out after 3.01 seconds' errors. The function is configured with a 3-second timeout. What should the engineer do to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The function is timing out at the configured limit of 3 seconds. Increasing the timeout to a higher value (e.g., 10 seconds) allows the function more time to complete its execution. Option A is incorrect because reserved concurrency controls how many concurrent executions are allowed, not the execution duration; it does not address timeout errors. Option B is incorrect because increasing memory allocation may improve performance but does not directly address the timeout; the function is still limited by the 3-second timeout. Option D is incorrect because a dead-letter queue (DLQ) is used to capture failed events for later processing, but it does not prevent timeouts; the function will still timeout before the DLQ can be utilized.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 2

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a sudden spike in connections, causing some application requests to fail with 'Too many connections' errors. The DevOps team needs to automate a response to this incident. What is the MOST effective solution?

Accepted Answer

Create a CloudWatch alarm on the DatabaseConnections metric to trigger a Lambda function that increases the max_connections parameter.. The issue is a spike in connections exceeding max_connections. By monitoring DatabaseConnections with a CloudWatch alarm, you can trigger a Lambda function to increase the max_connections parameter in the DB parameter group (applied immediately or pending reboot) to handle the spike. Option A is incorrect because Multi-AZ provides failover, not load distribution; it does not increase connection capacity. Option C is incorrect: RDS Proxy pools connections but does not change the max_connections limit; it would help prevent the issue but not respond to it. Option D is incorrect because Auto Scaling for RDS changes instance size, which does not directly increase max_connections; moreover, scaling takes time and is not an immediate response to a connection spike.

Answer

Enable Multi-AZ to distribute the load across two instances.

Answer

Use Amazon RDS Proxy to pool and share database connections.

Answer

Use an Auto Scaling policy to increase the RDS instance size.

Question 3

A company uses AWS CodePipeline for CI/CD. During a production deployment, the pipeline fails at the 'Deploy' stage with an error: 'The deployment failed because the deployment group does not have enough capacity to handle the deployment.' The engineer checks the CodeDeploy deployment group and sees that it is configured with a minimum healthy hosts of 100% and a deployment configuration of 'CodeDeployDefault.OneAtATime'. What is the MOST likely cause?

Accepted Answer

The deployment group has only one instance, and the minimum healthy hosts setting prevents the deployment.. The deployment group has only one instance. With a minimum healthy hosts of 100%, CodeDeploy requires that all hosts remain healthy during the deployment. The 'CodeDeployDefault.OneAtATime' configuration updates only one instance at a time, but if there is only one instance, taking it out of service to deploy violates the minimum healthy hosts requirement, causing the 'not enough capacity' error. Option A is incorrect because the deployment configuration is compatible; the issue is the lack of capacity. Option B is incorrect because the error message specifically mentions capacity, not health check failures. Option C is incorrect because a CodeDeploy agent issue would typically result in a different error, such as 'The overall deployment failed because too many individual instances failed deployment.'

Answer

The deployment configuration 'OneAtATime' is not compatible with the deployment group.

Answer

The target group health check is misconfigured, causing all instances to be unhealthy.

Answer

The CodeDeploy agent on the instances is not running.

Question 4

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer invalidated the CloudFront cache. What is the MOST likely reason?

Accepted Answer

The invalidation has not propagated to all edge locations.. CloudFront invalidations do not take effect immediately; they propagate to all edge locations over several minutes. Users may still receive cached content from an edge location that has not yet received the invalidation. Option A is incorrect because the origin is an S3 bucket, not an Application Load Balancer. Option C is incorrect because while the S3 bucket policy controls access, it does not cause CloudFront to serve stale content; invalidation forces CloudFront to fetch the updated object from S3 regardless of the bucket policy. Option D is incorrect because the default TTL setting is irrelevant when an explicit invalidation is performed; the invalidation overrides TTL and should clear the cache.

Answer

The origin is an Application Load Balancer that returns stale content.

Answer

The S3 bucket policy does not allow CloudFront to access the updated objects.

Answer

The CloudFront distribution has a default TTL of 86400 seconds set.

Question 5

A DevOps engineer is investigating a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The engineer needs to determine what actions the user performed and from which IP address. Which AWS service should be used to retrieve this information?

Accepted Answer

Amazon S3 server access logs.. Amazon S3 server access logs provide detailed records of all requests made to a bucket, including requester, IP address, action (e.g., GET, PUT), and timestamp. This is exactly what the engineer needs to identify the unauthorized user's actions and IP address. Option A is incorrect because AWS CloudTrail management events capture only bucket-level API calls (e.g., CreateBucket, DeleteBucket) and do not log object-level operations unless data events are explicitly enabled; even then, they may not include the full detail of server access logs. Option B is incorrect because Amazon Inspector is a vulnerability management service that assesses security exposures, not a logging service for S3 access. Option D is incorrect because Amazon CloudWatch Logs can store logs from various sources, but the S3 bucket itself does not automatically send logs to CloudWatch; the source of the logs would be S3 server access logs exported to CloudWatch Logs, but the service directly providing the information is S3 server access logs.

Answer

AWS CloudTrail management events.

Answer

Amazon Inspector findings.

Answer

Amazon CloudWatch Logs for the S3 bucket.

Question 6

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the DevOps engineer notices that some users are being logged out and losing session data. The deployment uses a rolling update strategy. What is the MOST likely cause?

Accepted Answer

The session data is stored locally on the EC2 instance, not in a shared external store.. During a rolling update, old instances are terminated and new instances are launched. Sticky sessions are tied to a specific instance; when that instance is terminated, the user's session is lost if it is not shared externally. Option A is wrong because the ALB configuration remains unchanged. Option B is wrong because health checks are not the direct cause. Option C is wrong because Auto Scaling is not involved unless explicitly configured.

Answer

The Auto Scaling group is terminating instances before the new ones are fully ready.

Answer

The health check interval is too long, causing the ALB to route traffic to unhealthy instances.

Answer

The ALB sticky session cookie is not being generated correctly.

Question 7

A company uses Amazon ECS with the Fargate launch type for a microservices application. The application experiences intermittent HTTP 5xx errors from the ALB. The DevOps team needs to diagnose the issue. Which TWO steps should be taken to gather diagnostic information? (Choose TWO.)

Accepted Answer

Enable Container Insights for the ECS cluster.. Container Insights provides metrics and logs for ECS clusters including Fargate tasks, helping diagnose resource-related issues causing 5xx errors. Option E is correct: Configuring the task definition to send application logs to CloudWatch Logs allows analysis of application-level errors. Option B is wrong because X-Ray traces HTTP requests but does not capture application logs or resource metrics. Option C is wrong because Fargate does not manage EC2 instances, so detailed monitoring is irrelevant. Option D is wrong because Session Manager cannot connect to Fargate tasks as they lack a persistent operating system shell.

Answer

Enable AWS X-Ray tracing on the ECS service.

Answer

Enable detailed monitoring on the underlying EC2 instances.

Answer

Use AWS Systems Manager Session Manager to connect to the running containers.

Question 8

A company runs a critical application on EC2 instances in an Auto Scaling group. The application must be highly available across multiple Availability Zones. Which TWO configurations are necessary to achieve this? (Choose TWO.)

Accepted Answer

Place an Application Load Balancer in front of the Auto Scaling group.. To achieve high availability across multiple Availability Zones (AZs), two key configurations are required. First, the Auto Scaling group must be configured to launch instances in multiple AZs (Option E). This ensures that if one AZ fails, the application can continue serving traffic from instances in other AZs. Second, an Application Load Balancer (ALB) should be placed in front of the Auto Scaling group (Option D). The ALB distributes incoming traffic across instances in all AZs where the Auto Scaling group has launched instances. It also performs health checks and automatically routes traffic away from unhealthy instances. Option A is incorrect because using a single AZ would create a single point of failure, undermining high availability. Option B is incorrect because Spot Instances can be terminated with little notice, which is unsuitable for a critical application requiring consistent availability. Option C is incorrect because a Classic Load Balancer lacks advanced features like path-based routing and native cross-zone load balancing, making the ALB a better choice for modern applications.

Answer

Use a single Availability Zone to reduce latency.

Answer

Use Spot Instances to reduce costs.

Answer

Use a Classic Load Balancer to distribute traffic.

Question 9

Refer to the exhibit. The DevOps engineer runs the commands and sees the output. What is the most likely issue with the instance?

Accepted Answer

The underlying hardware is having issues (system status check failed).. The SystemStatus is 'impaired', indicating a problem with the underlying physical host (system status check failed). The InstanceStatus is 'ok', so the OS is functioning normally. Option B is incorrect because the system status check shows impairment, so there is an issue. Option C is incorrect because the instance is running, not stopped. Option D is incorrect because the impairment is at the system level, not the OS level.

Answer

The instance is healthy and no issues exist.

Answer

The instance is stopped.

Answer

The instance has a failed status check due to OS-level issues.

Question 10

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to 'my-bucket' without specifying server-side encryption. What will happen?

Accepted Answer

The upload is denied because of the Deny statement.. The Deny statement explicitly denies any request that does not have server-side encryption set to AES256 (using StringNotEquals). Since the user's request does not specify encryption, the Deny condition is met, and the explicit Deny overrides any Allow. Therefore, the upload is denied. Option A is incorrect because the Allow statement's condition is not met (no encryption header), but the Deny is what ultimately denies the request. Options C and D are incorrect because the request is denied by the Deny statement.

Answer

The upload is denied because the Allow statement requires encryption.

Answer

The upload is allowed because the Allow statement grants permission.

Answer

The upload is allowed because no encryption header is specified.

Question 11

Refer to the exhibit. A DevOps engineer set up a CloudWatch alarm for a Lambda function. The alarm fires when the error count metric exceeds 10 in 5 minutes. The engineer receives an alarm notification, but when checking the Lambda logs, only 3 errors are found in that 5-minute window. What is the MOST likely reason for the discrepancy?

Accepted Answer

The metric filter is counting errors from other log groups or sources that use the same metric name.. The metric filter might be capturing errors from other log groups that share the same metric name (ErrorCount). If multiple Lambda functions or other services publish to the same metric, the alarm could be summing across all of them. Option A is wrong because CloudWatch Logs metric filters are near real-time. Option C is wrong because Lambda errors are counted correctly. Option D is wrong because the metric filter is correctly defined.

Answer

The metric filter is not processing logs in real time, causing a delay.

Answer

The metric filter pattern is incorrect and is matching non-error entries.

Answer

The Lambda function is generating more errors than shown in the logs.

Question 12

A DevOps engineer notices that an EC2 instance is unresponsive and the CloudWatch alarm 'StatusCheckFailed' is in ALARM state. The instance was launched in a private subnet with no public IP. Which action should the engineer take to diagnose the issue without creating a new instance?

Accepted Answer

Use EC2 Serial Console to connect to the instance.. EC2 Serial Console provides out-of-band access to the instance console, allowing troubleshooting of OS-level issues even when network connectivity is lost. Option A is wrong because modifying the security group to allow SSH from the engineer's IP does not help if the instance is unresponsive at the OS level. Option B is wrong because Systems Manager Session Manager requires the instance to have connectivity to the Systems Manager endpoint and the agent running. Option C is wrong because AWS Personal Health Dashboard provides service health notifications, not instance-level troubleshooting.

Answer

Modify the security group to allow SSH from the engineer's IP.

Answer

Use AWS Systems Manager Session Manager to start a session.

Answer

Check AWS Personal Health Dashboard for instance issues.

Question 13

A company uses AWS CloudFormation to manage infrastructure. After a failed stack update, the stack is in ROLLBACK_COMPLETE state. The DevOps team needs to identify the specific resource that caused the rollback and review the error message. Which approach provides the most efficient way to achieve this?

Accepted Answer

View the Events tab in the AWS CloudFormation console.. The CloudFormation console Events tab lists all stack events in chronological order, including the specific resource that caused the rollback and the associated error message. This is the most efficient way to quickly identify the resource and error without using CLI commands or parsing logs. Option A is incorrect: while describe-stack-events can retrieve the same information, the console is more efficient for a visual review. Option C is incorrect: CloudTrail logs the UpdateStack API call but does not provide a direct aggregated view of resource-specific errors. Option D is incorrect: describe-stack-resources only lists resources, not events or error details.

Answer

Run describe-stack-events and filter by status.

Answer

Check AWS CloudTrail for the UpdateStack API call.

Answer

Run describe-stack-resources to list all stack resources.

Question 14

A company uses Amazon RDS for MySQL and has enabled automated backups. The database administrator accidentally deleted a critical row from a table. The deletion occurred 15 minutes ago. What is the fastest way to recover the lost data?

Accepted Answer

Perform a Point-in-Time Restore to a time just before the deletion.. Point-in-Time Restore (PITR) is the fastest method to recover the deleted data. Since automated backups are enabled, RDS allows restoring to any point within the backup retention period, down to the second. By restoring to a time just before the deletion (approximately 15 minutes ago), the lost row is recovered without needing to manually apply binary logs or create a snapshot. Option B is incorrect because RDS does not provide an 'undo last transaction' feature. Option C is incorrect because although binary logs can be used to replay transactions, this process is manual, time-consuming, and not the fastest AWS-native approach. Option D is incorrect because creating a manual snapshot from the current instance would include the deletion, and restoring it would not recover the lost data.

Answer

Use the RDS console to undo the last transaction.

Answer

Use the binary log to replay transactions before the deletion.

Answer

Create a manual snapshot of the current instance and restore it.

Question 15

An application running on Amazon ECS Fargate is experiencing intermittent 503 errors. The task definition sets a soft limit of 512 CPU units and 1024 memory. The errors occur when traffic spikes. Which change is most likely to resolve the issue?

Accepted Answer

Increase the soft memory limit to 2048 MiB.. Increasing the soft memory limit provides more memory to the container, reducing the likelihood of out-of-memory errors causing 503s. Option A is wrong because increasing CPU units may help if the issue is CPU-bound, but memory is more likely the cause of 503 errors. Option B is wrong because increasing desired count helps with load distribution but not if each task is resource-constrained. Option C is wrong because changing to hard limit may cause the task to be killed if it exceeds memory.

Answer

Increase the soft CPU limit to 1024 units.

Answer

Change the soft memory limit to a hard limit.

Answer

Increase the desired task count in the service.