DOP-C02 Incident and Event Response Practice Test 13 — 15 Questions

Question 1

A company uses Amazon S3 to store critical data. An incident occurs where an S3 bucket is accidentally deleted. The DevOps engineer needs to recover the bucket and its objects. What should the engineer do?

Accepted Answer

Contact AWS Support to restore the bucket from a backup if versioning was enabled. Option B is correct because S3 bucket names are unique and cannot be recreated immediately; however, objects can be recovered if versioning and MFA delete were enabled. Option A is incorrect because buckets cannot be restored from CloudTrail. Option C is incorrect because only the bucket owner can delete a bucket, but deletion cannot be undone. Option D is incorrect because buckets are not recovered automatically.

Answer

Restore the bucket from AWS CloudTrail event history

Answer

Recreate the bucket with the same name and restore objects from a previous backup

Answer

Use the AWS S3 console to undo the deletion

Question 2

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. During an incident, the API returns 502 Bad Gateway errors. The Lambda function logs show no errors. What is the most likely cause?

Accepted Answer

The Lambda function is returning a response that exceeds the API Gateway payload size limit. When an API Gateway REST API returns 502 Bad Gateway errors but the Lambda function logs show no errors, the most likely cause is that the Lambda function is returning a response that exceeds the API Gateway payload size limit. API Gateway has a maximum payload size of 10 MB for REST APIs, and if the Lambda function returns a response larger than this, API Gateway will reject it and return a 502 error without the Lambda function itself throwing an exception or logging an error.

Answer

The Lambda function is throwing an unhandled exception

Answer

The API Gateway has reached its maximum concurrency limit

Answer

The Lambda function is timing out and API Gateway is not handling the timeout correctly

Question 3

A DevOps engineer is investigating a security incident where an EC2 instance was used to launch an outbound DDoS attack. Which AWS service can provide details about the source IP addresses and network traffic from the instance?

Accepted Answer

VPC Flow Logs. Option B is correct because VPC Flow Logs capture IP traffic information for network interfaces. Option A (CloudTrail) records API calls, not network traffic. Option C (GuardDuty) is a threat detection service but does not provide raw traffic logs. Option D (Config) records configuration changes.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A company uses an AWS Elastic Load Balancer (ELB) to distribute traffic to EC2 instances. During an incident, some users report slow response times. The DevOps engineer suspects that one instance is unhealthy but the health check is not detecting it. What should the engineer do to improve health check accuracy?

Accepted Answer

Configure a health check that checks a specific application endpoint. Option C is correct because a deep health check (checking an application-specific endpoint) ensures the instance is truly healthy. Option A is incorrect because increasing the interval makes checks less frequent. Option B is incorrect because decreasing the threshold makes it easier to mark unhealthy. Option D is incorrect because the health check path should be specific to the application.

Answer

Increase the health check interval to reduce load on instances

Answer

Decrease the health check unhealthy threshold to 2

Answer

Set the health check path to the root document ('/')

Question 5

Which TWO actions should a DevOps engineer take to ensure that an Amazon RDS for PostgreSQL database is automatically recovered in the event of a failure?

Accepted Answer

Enable automated backups with a retention period of at least 1 day. Options A and D are correct. Multi-AZ deployment provides automatic failover, and automated backups with point-in-time recovery allow restoring to a specific time. Option B is incorrect because manual snapshots require manual intervention. Option C is incorrect because read replicas are for read scaling, not automatic failover. Option E is incorrect because cross-region replication is for disaster recovery, not automatic recovery.

Answer

Create a read replica in a different Availability Zone

Answer

Take manual snapshots every hour

Answer

Configure cross-region replication to a secondary region

Question 6

A company experiences a security incident where an IAM user's access key is compromised. Which THREE steps should the DevOps engineer take immediately?

Accepted Answer

Review AWS CloudTrail logs for any unauthorized API calls. Options A, C, and D are correct. Rotating the access key invalidates the old key. Revoking temporary credentials ensures no active sessions. Reviewing CloudTrail logs helps assess the impact. Option B is incorrect because deleting the user is too drastic and not necessary. Option E is incorrect because changing the password does not affect access keys.

Answer

Change the IAM user's password

Answer

Delete the IAM user and recreate it

Question 7

Which TWO metrics should a DevOps engineer monitor to detect an EC2 instance that is unresponsive due to resource exhaustion?

Accepted Answer

MemoryUtilization. Options B and D are correct. CPUUtilization and MemoryUtilization (if enabled) are key indicators of resource exhaustion. Option A is incorrect because DiskReadOps alone does not indicate exhaustion. Option C is incorrect because NetworkIn alone is not a resource exhaustion metric. Option E is incorrect because StatusCheckFailed indicates instance health issues but not specifically resource exhaustion.

Answer

StatusCheckFailed

Answer

DiskReadOps

Answer

NetworkIn

Question 8

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The engineer checks CloudWatch metrics and sees a CPU Utilization spike to 100% just before the instance became unresponsive. However, the instance status check passed. What should the engineer do NEXT to troubleshoot the issue?

Accepted Answer

Use the EC2 Serial Console to connect to the instance and diagnose the issue.. Option D is correct because the instance is unresponsive but status check passes, indicating an OS-level issue. The serial console can be used to troubleshoot kernel hangs or high load. Option A is wrong because increasing instance size only helps if resource exhaustion is the root cause, but the instance is already unresponsive. Option B is wrong because the status check passed, so replacing the instance without investigation may lose data. Option C is wrong because CloudWatch Logs are helpful but do not give interactive access to a hung instance.

Answer

Terminate the instance and launch a new one from the same AMI.

Answer

Review CloudWatch Logs for the instance to identify any application errors.

Answer

Increase the instance size and restart the instance.

Question 9

A company uses AWS CloudTrail to record API calls across multiple accounts and regions. The security team needs to be alerted immediately when an IAM user creates a new access key. Which combination of services should be used to achieve this with minimal latency?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic.. Option B is correct because CloudTrail delivers events to CloudWatch Logs, and a metric filter on 'CreateAccessKey' can trigger a CloudWatch Alarm to send an SNS notification. Option A is wrong because CloudWatch Events (now Amazon EventBridge) can directly match CloudTrail events, but the question asks for minimal latency and a common pattern. Option C is wrong because S3 event notifications are not designed for real-time alerting on API calls. Option D is wrong because Lambda polling CloudTrail is inefficient and introduces latency.

Answer

Enable S3 event notifications on the CloudTrail S3 bucket to trigger a Lambda function.

Answer

Use Amazon EventBridge to match the CloudTrail event and invoke an AWS Lambda function that sends an email.

Answer

Configure a Lambda function to poll the CloudTrail API every minute and check for new access keys.

Question 10

A company runs a multi-tier web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors during peak traffic. The Auto Scaling group is configured with a step scaling policy based on CPU utilization. CloudWatch metrics show that CPU utilization never exceeds 70%, but the ALB target group reports that some targets are unhealthy. What is the MOST likely cause?

Accepted Answer

The application health check endpoint is returning HTTP 5xx or timing out.. Option A is correct because health checks are failing, causing the ALB to stop sending traffic to those instances, which results in 503 errors. The CPU utilization might be low because the unhealthy instances are not receiving traffic. Option B is wrong because if the scaling policy were too aggressive, you'd see more instances and possibly lower CPU, not 503 errors. Option C is wrong because connection draining does not cause health check failures. Option D is wrong because the application itself is failing health checks, not the ALB configuration.

Answer

The ALB is misconfigured with an incorrect security group blocking traffic to the targets.

Answer

The ALB connection draining settings are too short, causing in-flight requests to fail.

Answer

The step scaling policy is too aggressive and is terminating instances prematurely.

Question 11

A DevOps engineer is troubleshooting a Lambda function that processes S3 events. The function has been running successfully for months, but today it started timing out. The engineer checks CloudWatch Logs and sees 'Task timed out after 3.01 seconds' errors. The function is configured with a 3-second timeout. What should the engineer do to resolve the issue?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. Option C is correct because the function is timing out at the configured limit. Increasing the timeout to a higher value (e.g., 10 seconds) gives the function more time to complete. Option A is wrong because increasing memory may improve performance but does not directly address the timeout. Option B is wrong because the function already has a DLQ; the issue is the function timing out. Option D is wrong because the function is timing out, not provisioning limits.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 12

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a sudden spike in connections, causing some application requests to fail with 'Too many connections' errors. The DevOps team needs to automate a response to this incident. What is the MOST effective solution?

Accepted Answer

Create a CloudWatch alarm on the DatabaseConnections metric to trigger a Lambda function that increases the max_connections parameter.. Option D is correct because the issue is a connection spike that exceeds the max_connections parameter. Using a CloudWatch alarm on 'DatabaseConnections' to invoke a Lambda function that modifies the DB parameter group (requires reboot or apply immediately) can increase the limit. Option A is wrong because scaling storage does not increase max_connections. Option B is wrong because Multi-AZ is for high availability, not scaling connections. Option C is wrong because RDS Proxy manages connection pooling but does not change the max_connections limit; it would have been a preventive measure.

Answer

Enable Multi-AZ to distribute the load across two instances.

Answer

Use Amazon RDS Proxy to pool and share database connections.

Answer

Use an Auto Scaling policy to increase the RDS instance size.

Question 13

A company uses AWS CodePipeline for CI/CD. During a production deployment, the pipeline fails at the 'Deploy' stage with an error: 'The deployment failed because the deployment group does not have enough capacity to handle the deployment.' The engineer checks the CodeDeploy deployment group and sees that it is configured with a minimum healthy hosts of 100% and a deployment configuration of 'CodeDeployDefault.OneAtATime'. What is the MOST likely cause?

Accepted Answer

The deployment group has only one instance, and the minimum healthy hosts setting prevents the deployment.. Option B is correct because with a minimum healthy hosts of 100%, CodeDeploy requires that all hosts remain healthy during deployment. The OneAtATime configuration updates only one host at a time, but if the deployment group has only one instance, taking it out of service violates the minimum healthy hosts. Option A is wrong because the error is about capacity, not target group health. Option C is wrong because CodeDeploy agent issues would cause a different error. Option D is wrong because the deployment configuration is correct for rolling updates.

Answer

The deployment configuration 'OneAtATime' is not compatible with the deployment group.

Answer

The target group health check is misconfigured, causing all instances to be unhealthy.

Answer

The CodeDeploy agent on the instances is not running.

Question 14

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer invalidated the CloudFront cache. What is the MOST likely reason?

Accepted Answer

The invalidation has not propagated to all edge locations.. Option B is correct because by default, CloudFront does not invalidate objects in edge locations immediately; invalidation requests can take minutes to complete. Also, users may be hitting a different edge location that still has cached content. Option A is wrong because S3 bucket policies do not affect cache. Option C is wrong because TTL settings affect how long content is cached, but invalidation should override that. Option D is wrong because the origin is S3, not an ALB.

Answer

The origin is an Application Load Balancer that returns stale content.

Answer

The S3 bucket policy does not allow CloudFront to access the updated objects.

Answer

The CloudFront distribution has a default TTL of 86400 seconds set.

Question 15

A DevOps engineer is investigating a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The engineer needs to determine what actions the user performed and from which IP address. Which AWS service should be used to retrieve this information?

Accepted Answer

Amazon S3 server access logs.. Option A is correct because S3 server access logs provide detailed records of requests made to a bucket, including requester, IP address, and action. Option B is wrong because CloudTrail logs API calls made by users or roles, but for S3 object-level operations, it must be specifically enabled for data events. Option C is wrong because CloudWatch Logs can store logs but are not the source of S3 access logs. Option D is wrong because Amazon Inspector is for vulnerability assessments, not logging.

Answer

AWS CloudTrail management events.

Answer

Amazon Inspector findings.

Answer

Amazon CloudWatch Logs for the S3 bucket.