DOP-C02 Incident and Event Response Practice Test 12 — 15 Questions

Question 1

A company uses Amazon CloudFront to distribute content globally. Users in some regions report slow load times. The DevOps team wants to identify the geographic regions where performance is worst. Which tool should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudFront reports in the AWS Management Console. CloudFront reports in the AWS Management Console provide performance metrics (e.g., total requests, error rates, latency) broken down by geographic region, enabling the team to identify regions with worst performance. Option A is wrong: CloudWatch metrics for CloudFront are aggregated per distribution, not per region. Option B is wrong: CloudFront access logs in S3 record individual requests but do not aggregate performance by region. Option C is wrong: Amazon Route 53 latency records are used for DNS-based routing decisions, not for analyzing CloudFront performance.

Answer

Amazon CloudWatch Metrics for CloudFront

Answer

CloudFront access logs in S3

Answer

Amazon Route 53 latency records

Question 2

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences periodic spikes in response times. The CloudWatch metrics show high CPU and memory usage for the tasks during these spikes. What is the MOST effective approach to handle these spikes?

Accepted Answer

Configure target tracking scaling policies for the ECS service using CPU or memory utilization. Target tracking scaling policies for Amazon ECS services using CPU or memory utilization are the most effective approach because they dynamically adjust the number of tasks in response to real-time demand, automatically adding capacity during spikes and removing it when load subsides. This aligns with the AWS Well-Architected Framework's principle of elasticity, ensuring the application scales out precisely when high CPU/memory usage is detected, without manual intervention or over-provisioning.

Answer

Use a larger Fargate task size to handle the spikes

Answer

Increase the CPU and memory limits for the ECS task definition

Answer

Set up a scheduled scaling action to add tasks during peak hours

Question 3

A company uses AWS CloudTrail to monitor API activity. The security team notices that an IAM user 'dev-user' deleted an S3 bucket. They need to quickly identify the source IP address of the delete request. Which CloudTrail feature should they use to find this information?

Accepted Answer

Search the CloudTrail event history for the delete event and review the sourceIPAddress field.. CloudTrail Event History retains 90 days of management events and each event record includes a sourceIPAddress field that captures the IP address from which the API call was made. Searching Event History for the DeleteBucket event and inspecting sourceIPAddress is the fastest way to identify the source IP without additional setup.

Answer

Use CloudTrail Lake to query the event and extract the IP address from the userIdentity field.

Answer

Check S3 server access logs for the bucket deletion event.

Answer

Enable CloudTrail Insights to analyze unusual activity.

Question 4

A company uses an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security team reports that a specific client IP address is sending malicious requests and must be blocked immediately. The ALB's security group only allows HTTP/HTTPS from 0.0.0.0/0. What is the FASTEST way to block traffic from this IP address without affecting other traffic?

Accepted Answer

Create an AWS WAF web ACL with an IP set deny rule and associate it with the ALB.. AWS WAF with an IP set deny rule associated to the ALB is the fastest and most surgical way to block a specific client IP. WAF evaluates requests at the ALB before they reach targets, and an IP match condition with a block action takes effect within seconds without touching security groups or routing. This blocks only the offending IP while all other traffic continues normally.

Answer

Modify the ALB listener rules to drop requests from the client IP.

Answer

Update the ALB security group to add a deny rule for the client IP address.

Answer

Update the VPC route table to drop packets from the client IP.

Question 5

A company's production environment uses an Amazon ElastiCache Redis cluster for session caching. The operations team reports that the cache hit ratio has dropped significantly, causing increased load on the backend database. What is the MOST likely cause?

Accepted Answer

The cache is under memory pressure and evicting keys to make room.. A drop in cache hit ratio with increased backend load is most commonly caused by memory pressure leading to eviction of keys. When ElastiCache Redis reaches maxmemory, it evicts keys according to the eviction policy (e.g., LRU), causing more cache misses and higher database load.

Answer

The cluster was resized from a single node to a cluster mode.

Answer

The encryption in transit was enabled, adding latency.

Answer

There is a network partition between the application and the cache.

Question 6

A company uses AWS CodePipeline for CI/CD. A recent deployment to an Amazon ECS service failed because the new task definition referenced an ECR image that does not exist. The pipeline uses a source stage (CodeCommit), build stage (CodeBuild), and deploy stage (ECS). The engineer wants to catch such errors earlier. What should the engineer add to the pipeline?

Accepted Answer

Add a test stage that runs a script to verify the image exists in ECR.. Adding a test stage that runs a script to verify the image exists in ECR will catch the error earlier in the pipeline, before the deploy stage. This test stage can use AWS CLI or SDK to check if the image tag exists in the ECR repository, and fail the pipeline if it does not. This prevents the deployment from proceeding with a non-existent image.

Answer

Add an invoke action that calls a Lambda function to check the image.

Answer

Add a manual approval step before the deploy stage.

Answer

Add a second build stage that re-builds the image.

Question 7

A DevOps engineer is investigating a security incident where an EC2 instance was compromised. The engineer needs to collect forensic data without losing volatile information. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Create a snapshot of the attached EBS volumes.. Option C is correct because creating an EBS snapshot captures a point-in-time, crash-consistent copy of the attached volumes, preserving disk-based forensic evidence (file system, logs, malware artifacts) without altering the running instance. Option D is correct because volatile data such as RAM contents, running processes, network connections, and encryption keys exist only in memory and are lost once the instance is stopped or terminated, so a memory dump must be collected first. Option A is wrong because detaching EBS volumes from a running instance is not supported and would disrupt the live system before volatile data is captured. Option B is wrong because instance metadata contains only configuration data (instance ID, AMI, IAM role, user data) and provides no forensic value for the compromise. Option E is wrong because terminating the instance destroys both volatile memory and the instance store, and may also delete EBS volumes depending on the DeleteOnTermination setting, irreversibly destroying evidence.

Answer

Detach the EBS volumes and attach them to a forensic instance.

Answer

Retrieve the instance metadata from the console.

Answer

Terminate the instance immediately to prevent further access.

Question 8

A company uses Amazon CloudWatch for monitoring. The operations team wants to receive an alert when an EC2 instance's status check fails for 2 consecutive minutes. Which THREE resources should the team configure? (Choose three.)

Accepted Answer

CloudWatch alarm. To alert when an EC2 instance's status check fails for 2 consecutive minutes, you need to create a CloudWatch alarm on the StatusCheckFailed metric (options C and D). The alarm needs to send notifications via an SNS topic (option E). Option A (CloudWatch Events rule) is not used for metric-based alerts; CloudWatch Events triggers on events or schedules, not metric thresholds. Option B (CloudWatch Logs) is for log data, not metrics.

Answer

CloudWatch Events rule

Answer

CloudWatch Logs

Question 9

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. CloudWatch alarms for CPU utilization and memory usage did not trigger. The engineer checks the system logs and finds an 'Out of memory: Kill process' error. What is the MOST likely cause of the missed alarms?

Accepted Answer

The CloudWatch agent is not installed or configured to collect memory metrics.. The 'Out of memory: Kill process' error indicates the OS OOM killer terminated a process due to memory exhaustion, but the CloudWatch memory alarm did not fire because the default CloudWatch metrics for EC2 do not include memory utilization. Memory metrics are only available if the CloudWatch agent is installed and configured to collect them via the mem_used_percent metric. Therefore, the most likely cause is that the agent was not installed or not configured for memory metrics.

Answer

The instance is using instance store volumes instead of EBS, which prevents metric collection.

Answer

The CloudWatch metrics retention period is set to 1 day, so old alarms were deleted.

Answer

The EC2 instance's root EBS volume is encrypted, blocking CloudWatch agent logs.

Question 10

A company runs a production database on Amazon RDS for MySQL. The database experiences a sudden spike in connections, causing the application to time out. The DevOps team needs to diagnose the issue quickly. Which combination of actions should be taken? (Choose two.)

Accepted Answer

Check CloudWatch metrics for DatabaseConnections and CPUUtilization.. Option A is correct because Amazon CloudWatch publishes RDS metrics such as DatabaseConnections (the current number of client sessions) and CPUUtilization, which directly reveal whether the timeout is caused by connection saturation or CPU exhaustion on the instance. Option E is correct because Performance Insights, once enabled, provides a database load view broken down by wait events and top SQL statements, letting the team pinpoint which queries or sessions are consuming resources during the spike. Option B is not appropriate as a diagnostic step because scaling up is a remediation action taken after the root cause is identified, and it may not resolve connection-limit or query-level problems. Option C is wrong because VPC Flow Logs capture IP-level network traffic metadata, not database session counts or query behavior, so they cannot explain an RDS connection spike. Option D is wrong because the RDS console does not provide a per-user active connection breakdown; that level of session detail requires querying performance_schema or using Performance Insights.

Answer

Immediately scale up the RDS instance to handle the load.

Answer

Analyze VPC Flow Logs to identify the source IPs of connections.

Answer

Use the RDS console to view the number of active connections per user.

Question 11

A Lambda function 'my-function' is invoked multiple times, but no logs appear in CloudWatch. The DevOps engineer runs the above CLI command and sees that the log group exists but 'storedBytes' is 0. What is the MOST likely cause?

Accepted Answer

The Lambda execution role lacks permissions to create log streams and put log events.. If the CloudWatch log group exists but storedBytes is 0, the Lambda function is executing but its execution role lacks the IAM permissions required to create log streams and put log events (logs:CreateLogStream, logs:PutLogEvents). Lambda creates the log group automatically on first invocation, but writing log events requires explicit permissions — without them, invocations succeed silently with no logs. This is the classic 'Lambda runs but no logs' scenario.

Answer

The Lambda function is invoked too frequently, causing CloudWatch to throttle log ingestion.

Answer

The log group's retention policy of 7 days deletes logs immediately after creation.

Answer

The Lambda function does not have a log group; the one shown belongs to another resource.

Question 12

A company uses AWS Elastic Beanstalk for its web application. After a deployment, the environment health changes to 'Severe' and the application becomes unresponsive. The DevOps team needs to quickly revert to the previous working version. What is the FASTEST way to achieve this?

Accepted Answer

Use the Elastic Beanstalk console to deploy the previous application version.. Deploying the previous application version through the Elastic Beanstalk console is the fastest rollback because Beanstalk retains prior application versions and can redeploy one directly to the same environment, restoring the working state without rebuilding infrastructure. This is the standard, quickest recovery path.

Answer

Swap environment URLs with a different environment that runs the previous version.

Answer

Terminate the environment and create a new one with the previous version.

Answer

Redeploy the same application version to the environment.

Question 13

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 14

A DevOps team uses AWS CodePipeline to deploy a web application. The pipeline has a manual approval step. During an incident, the deployment is stuck at the approval step because the approver is on leave. The team needs to unblock the pipeline quickly. What is the BEST action to take?

Accepted Answer

Use the CodePipeline console to approve the action directly as a different user.. In AWS CodePipeline, a manual approval action can be approved by any IAM user with the appropriate permissions, not just the designated approver. Using the console to approve as a different user is the quickest way to unblock the pipeline without modifying the pipeline structure. This action is immediate and preserves the pipeline's integrity.

Answer

Update the pipeline definition to remove the manual approval step temporarily.

Answer

Disable the transition to the approval stage and manually run the remaining stages.

Answer

Retry the action in the approval stage from the CodePipeline console.

Question 15

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The target group health checks are failing. The DevOps engineer checks the instance logs and finds that the application is running but taking longer than 30 seconds to respond. What is the MOST likely cause?

Accepted Answer

The health check timeout is set too low, causing the ALB to mark instances unhealthy.. The most likely cause of intermittent 503 errors and failing health checks is that the health check timeout is set too low. The application takes longer than 30 seconds to respond, but if the health check timeout is set to a value less than the application response time, the ALB will mark the instance as unhealthy, leading to 503 errors. Adjusting the health check timeout to accommodate the application's response time would resolve the issue.

Answer

The Auto Scaling group's scaling policy is too aggressive, causing frequent instance replacements.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The EC2 instances are running out of memory and the application is crashing.