DOP-C02 Incident and Event Response Practice Test 13 — 15 Questions

Question 1

A DevOps engineer is troubleshooting an Amazon CloudWatch alarm that is not triggering as expected. The alarm monitors an SQS queue's ApproximateNumberOfMessagesVisible metric with a threshold of 100 for 1 evaluation period. The queue has had over 100 messages for the past 30 minutes, but the alarm remains in OK state. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Messages are being consumed but not deleted, causing them to become invisible.. The most likely cause is that messages are being consumed but not deleted, causing them to become invisible. The CloudWatch metric `ApproximateNumberOfMessagesVisible` only counts messages that are available for retrieval (not in flight). If consumers process messages but do not delete them, those messages enter the in-flight state for the duration of the visibility timeout and are not counted as visible. If messages are continuously consumed but never deleted, the visible count may remain below the threshold even though the total number of messages (including in-flight) exceeds 100. Option B is incorrect because the alarm evaluates the metric correctly; it's the metric behavior that causes the issue. Options A and C are incorrect based on the given information.

Answer

The alarm period is set longer than 30 minutes.

Answer

The alarm is not configured to evaluate the metric correctly.

Answer

The SQS queue is not being polled.

Question 2

A company uses AWS Organizations with multiple accounts. The security team needs to receive real-time notifications when any IAM user in any account creates an access key. Which solution is the most operationally efficient?

Accepted Answer

Use AWS Config rules with a CloudWatch Events rule to detect CreateAccessKey and publish to an SNS topic.. The most operationally efficient because AWS Config rules can evaluate resource configurations and, when paired with a CloudWatch Events rule, can detect the CreateAccessKey API call in real-time and publish a notification to an SNS topic. Option A is incorrect because while CloudTrail logs are useful for auditing, using Athena to query logs is not real-time and adds operational overhead. Option B is incorrect because SCPs can deny actions but do not provide notifications. Option C is incorrect because Trusted Advisor checks for exposed keys after creation, not in real-time.

Answer

Enable CloudTrail in all accounts and send logs to a central S3 bucket, then use Amazon Athena to query.

Answer

Create an SCP that denies access key creation and monitor with CloudWatch.

Answer

Use AWS Trusted Advisor to check for exposed access keys.

Question 3

A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?

Accepted Answer

Check ALB access logs for target response times.. A 504 error indicates the load balancer did not receive a response from the target within the idle timeout period. Checking ALB access logs for target response times is the first step to determine if the backend is slow or unresponsive. Option A is wrong because scaling policies affect the number of instances, not response times. Option B is wrong because health checks verify instance availability, but intermittent slow responses may not cause health check failures. Option C is wrong because security group rules would cause different errors (e.g., connection timeouts) rather than 504s.

Answer

Review the Auto Scaling group scaling policies.

Answer

Verify the target group health checks are passing.

Answer

Check security group rules for the ALB.

Question 4

A company experiences a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The DevOps team needs to identify the source IP address and user agent of the request. Which AWS service provides this information?

Accepted Answer

Amazon S3 server access logs. (Amazon S3 server access logs) is correct because they provide detailed records of each request made to an S3 bucket, including the source IP address and user agent. Option A (VPC Flow Logs) is incorrect because they capture IP traffic metadata (source/destination IP, ports, protocol) but do not include application-level details like the user agent. Option C (AWS CloudTrail) is incorrect because although CloudTrail logs S3 API calls and does include user agent and source IP, S3 server access logs are specifically designed to provide this information and are the recommended source for forensic analysis of S3 access. Option D (Amazon CloudWatch Logs) is incorrect because CloudWatch Logs is a service for storing, monitoring, and accessing log files; it does not generate logs itself but can be used to store and analyze logs from other sources.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 5

An Amazon RDS for PostgreSQL instance is running low on storage. The DevOps engineer needs to increase the allocated storage without downtime. Which action should be taken?

Accepted Answer

Modify the DB instance to increase the allocated storage.. RDS supports modifying storage settings without downtime; the change is applied during the next maintenance window or immediately if the 'Apply Immediately' option is selected. Option A is wrong because taking a snapshot and restoring would cause downtime. Option C is wrong because you cannot add storage to an existing instance in a different way; you must modify the DB instance. Option D is wrong because modifying the DB instance class does not increase storage.

Answer

Modify the DB instance to a larger instance class.

Answer

Create a snapshot of the DB instance and restore it with larger storage.

Answer

Launch a new read replica with larger storage and promote it.

Question 6

A company uses AWS CloudTrail to log API calls. The security team needs to be alerted when an IAM user performs a ConsoleLogin event from an IP address outside the corporate network. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Create a CloudWatch Events rule that matches ConsoleLogin and publishes to an SNS topic.. CloudTrail logs management events like ConsoleLogin, and a CloudWatch Events rule can match that event and trigger an SNS notification for alerting. Option E is correct because CloudTrail must be enabled to log management events (which is the default, but must be ensured). Option B is wrong because AWS Config rules evaluate resource configurations, not API calls like ConsoleLogin. Option C is wrong because S3 event notifications are for object creation in S3, not for CloudTrail log delivery events. Option D is wrong because CloudWatch Logs Insights is a query tool for analyzing logs, not for real-time alerting; alerting requires CloudWatch Events or metric filters with alarms.

Answer

Create an AWS Config rule to detect ConsoleLogin.

Answer

Configure S3 event notifications on the CloudTrail bucket.

Answer

Use CloudWatch Logs Insights to query for ConsoleLogin events.

Question 7

A DevOps team is investigating a performance issue where an application's response time spiked during a deployment. The deployment used AWS CodeDeploy to update an Auto Scaling group. Which THREE actions should the team take to identify the root cause? (Choose THREE.)

Accepted Answer

Review the CodeDeploy deployment logs for errors.. CodeDeploy deployment logs contain detailed information about the deployment process, including any errors or failed steps that could impact performance. Option B is correct because application logs on the new EC2 instances can reveal errors, misconfigurations, or resource contention that may have caused the spike. Option E is correct because comparing CloudWatch metrics (e.g., CPU utilization, latency, request count) before and after the deployment helps pinpoint changes that correlate with the performance issue. Option C is wrong because reviewing the deployment group configuration—which defines how deployments occur (e.g., traffic routing, instance selection)—is unlikely to directly identify the root cause of a performance spike; it is more relevant for deployment strategy issues. Option D is wrong because AWS CloudTrail records API calls for auditing and security, not application performance; unauthorized API calls are unlikely to cause a transient performance spike during deployment.

Answer

Review the CodeDeploy deployment group configuration.

Answer

Check AWS CloudTrail for any unauthorized API calls during the deployment.

Question 8

A company uses Amazon CloudFront to distribute content globally. Users in certain geographic regions report slow load times. Which TWO configurations can improve performance for these users? (Choose TWO.)

Accepted Answer

Implement Lambda@Edge to optimize content delivery.. Lambda@Edge runs code at CloudFront edge locations, enabling custom processing like URL rewriting or content adaptation based on user location, which can optimize delivery. Option D is correct because selecting a CloudFront price class that includes additional edge locations (e.g., Price Class All) reduces the physical distance to users, improving load times. Option B is incorrect because ElastiCache is a database cache and does not directly enhance CloudFront distribution speed. Option C is incorrect because a Network Load Balancer operates at Layer 4 and does not cache or accelerate content. Option E is incorrect because S3 Transfer Acceleration accelerates uploads to S3, not content delivery to end users.

Answer

Use Amazon ElastiCache to cache content.

Answer

Switch the origin to a Network Load Balancer.

Answer

Enable S3 Transfer Acceleration on the origin bucket.

Question 9

A company uses AWS Systems Manager to manage a fleet of EC2 instances. During an incident, a DevOps engineer needs to execute a script on a specific instance to collect diagnostic data. The engineer does not have SSH key access. Which approach should the engineer use to execute the script?

Accepted Answer

Use AWS Systems Manager Run Command to execute the script.. AWS Systems Manager Run Command can execute scripts on EC2 instances without requiring SSH or RDP access, using the SSM Agent. Option B is wrong because AWS OpsWorks requires an agent and is typically used for Chef/Puppet. Option C is wrong because EC2 Instance Connect requires SSH key and port 22. Option D is wrong because SSM Session Manager is for interactive sessions, not script execution triggered as a command.

Answer

Use AWS OpsWorks to run the script as a Chef recipe.

Answer

Use EC2 Instance Connect to SSH into the instance and run the script.

Answer

Use AWS Systems Manager Session Manager to open a shell and run the script.

Question 10

A DevOps team is configuring CloudWatch alarms for their production environment. They want to receive notifications when the CPUUtilization metric of an EC2 instance exceeds 90% for three consecutive 5-minute periods. Which combination of settings should they use?

Accepted Answer

Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 3. The evaluation period must be set to 3, and the datapoints to alarm must be 3 to require three consecutive periods. Option B is wrong because datapoints to alarm set to 1 would trigger on any single high reading. Option C is wrong because evaluation period 1 with datapoints 3 is impossible. Option D is wrong because evaluation period 5 with datapoints 3 would require 3 out of 5, not necessarily consecutive.

Answer

Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 1

Answer

Period: 5 minutes; Evaluation periods: 1; Datapoints to alarm: 3

Answer

Period: 5 minutes; Evaluation periods: 5; Datapoints to alarm: 3

Question 11

During an incident, a DevOps engineer needs to quickly revoke access to a set of IAM users who are suspected to be compromised. The users have programmatic access keys and console passwords. The engineer wants to minimize the impact on non-compromised users. Which action should the engineer take FIRST?

Accepted Answer

Attach an IAM policy that explicitly denies all actions to the compromised users.. The correct first action because attaching an IAM policy that explicitly denies all actions quickly revokes both programmatic and console access for the compromised users without deleting their credentials, preserving them for investigation and minimizing impact on non-compromised users. Deleting access keys (Option C) would only revoke programmatic access, not console access. Deleting users (Option A) is irreversible and loses audit trails. Changing the password policy (Option D) affects all users, not just the compromised ones.

Answer

Delete the compromised IAM users.

Answer

Delete the access keys of the compromised users.

Answer

Change the IAM password policy to require strong passwords.

Question 12

A company uses an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances in an Auto Scaling group. During an incident, the DevOps team notices that the ALB is returning 503 errors. The instances are healthy according to the target group health checks. What is the MOST likely cause?

Accepted Answer

The ALB's surge queue is full, causing it to reject requests.. 503 errors from an ALB typically indicate that the target group has no healthy instances, or all instances are marked unhealthy. However, the question says instances are healthy according to health checks, so the issue might be that the ALB itself is at capacity (e.g., surge queue full). The most common cause when health checks are passing but 503s persist is that the ALB's connection surge queue is full, often due to too many connections or slow targets. Option A is wrong because an ALB with no listeners would return 502 or 504, not 503. Option B is wrong because security group rules usually cause timeouts, not 503. Option C is wrong because 503 is not a typical throttling response; throttling returns 429.

Answer

The ALB has no listeners configured.

Answer

The security group for the ALB is blocking traffic from the clients.

Answer

The ALB is throttling requests due to a surge.

Question 13

A DevOps engineer is troubleshooting an issue where an EC2 instance running Amazon Linux 2 is not receiving commands from AWS Systems Manager Run Command. The instance has the SSM Agent installed and is running. What should the engineer verify FIRST?

Accepted Answer

Check that the instance has an IAM role with the AmazonSSMManagedInstanceCore policy.. The SSM Agent requires an IAM role with the AmazonSSMManagedInstanceCore policy to authenticate and communicate with the Systems Manager API. Without this role, the agent cannot send or receive commands, even if it is installed and running. While outbound internet access, NTP sync, and agent version are valid considerations, the first and most fundamental check should be the IAM role, as it is a prerequisite for all SSM operations. Option A is incorrect because the agent can communicate via VPC endpoints without outbound internet. Option B is incorrect because time synchronization is important but not the primary cause of the issue. Option C is incorrect because the agent being the latest version is not the first thing to verify; the IAM role is the most common missing configuration.

Answer

Verify the instance has outbound internet access to the SSM endpoints.

Answer

Confirm the instance's clock is synchronized with NTP.

Answer

Ensure the SSM Agent is the latest version.

Question 14

A company uses AWS CloudTrail to log all API calls. During an incident investigation, a security engineer needs to identify who deleted an S3 bucket named 'critical-data' two days ago. Which approach will provide the necessary information?

Accepted Answer

Use AWS CloudTrail LookupEvents API to search for DeleteBucket events.. AWS CloudTrail records all API calls made within the account, including DeleteBucket events. The LookupEvents API allows you to search for events by event name, resource name, and time range, making it straightforward to identify who deleted the 'critical-data' bucket two days ago. Option B is incorrect because the AWS Management Console activity history only displays console sign-in events, not specific API calls like DeleteBucket. Option C is incorrect because S3 access logs record object-level access (e.g., GetObject, PutObject) and not bucket-level operations such as bucket deletion. Option D is incorrect because CloudWatch Logs does not store CloudTrail events by default; CloudTrail must be configured to stream events to CloudWatch Logs. Even if streaming is enabled, searching for 'DeleteBucket' logs in CloudWatch Logs is less direct than using the LookupEvents API, which is specifically designed for searching CloudTrail events.

Answer

Check the AWS Management Console activity history.

Answer

Review the S3 access logs for the bucket.

Answer

Search CloudWatch Logs for 'DeleteBucket' events.

Question 15

A company runs a critical application on an Amazon RDS for MySQL DB instance. During a recent incident, the database became unresponsive. The DevOps team suspects that a long-running query is blocking other operations. Which metric should they monitor in Amazon CloudWatch to detect this type of issue?

Accepted Answer

ActiveTransactions (from Enhanced Monitoring). ActiveTransactions (from Enhanced Monitoring). This metric directly shows the number of active transactions, including long-running ones that can hold locks and cause blocking. Monitoring ActiveTransactions helps detect such issues. Option A (DatabaseConnections) indicates the number of connections but not whether they are actively blocking. Option C (ReadLatency) is a symptom of blocking but not a direct indicator. Option D (CPUUtilization) may be high for many reasons and does not specifically point to blocking.

Answer

DatabaseConnections

Answer

ReadLatency

Answer

CPUUtilization