DOP-C02 Incident and Event Response Practice Test 13 — 15 Questions

Question 1

An EC2 instance is in 'running' state according to the CLI output, but the application hosted on it is unreachable. The DevOps engineer checks the security group and finds it allows inbound HTTP traffic from 0.0.0.0/0. The instance has a public IP. What is the MOST likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance's OS firewall (e.g., iptables) is blocking the traffic.. The instance is running, has a public IP, and the security group allows inbound HTTP from 0.0.0.0/0. Since the security group is correctly configured, the most likely cause is a host-level firewall (e.g., iptables, Windows Firewall) blocking the traffic. Security groups operate at the hypervisor level and do not override OS-level firewalls; thus, even with permissive security group rules, the OS can still drop packets. This is a common misconfiguration when instances are launched with restrictive default OS firewall rules.

Answer

The network ACL is blocking inbound HTTP traffic.

Answer

The instance does not have a public IP address assigned.

Answer

The security group is attached to the instance but does not allow inbound HTTP.

Question 2

A company uses AWS Systems Manager Patch Manager to patch its EC2 instances. After a patch window, some instances report a 'Failed' status. The DevOps engineer needs to investigate the cause. Which actions should be taken? (Choose three.)

Accepted Answer

Check the S3 bucket where Patch Manager logs are stored for detailed error messages.. Option A is correct because Patch Manager stores detailed patch execution logs, including error messages for failed patching operations, in an S3 bucket (configured as the patch log destination), which is the primary place to inspect granular failure reasons. Option B is correct because the Patch Manager dashboard in Systems Manager shows per-instance and per-patch compliance status, letting the engineer identify exactly which patches failed and on which instances. Option D is correct because patching is executed by the SSM Agent via RunCommand; if the agent is stopped, outdated, or unable to communicate with the Systems Manager endpoints, the patch operation will fail, so verifying the agent is running and current is a key troubleshooting step. Option C is not the right focus because CloudTrail records the RunCommand API calls for auditing and API-level errors, but it does not contain the patch-level failure details needed to diagnose why a patch failed. Option E is not appropriate because AWS Config tracks resource configuration changes and compliance rules, not the execution details or error messages of Patch Manager patch jobs.

Answer

Review CloudTrail logs for the RunCommand API calls.

Answer

Use AWS Config to check the configuration history of the instances.

Question 3

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 4

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error 'The overall deployment failed because too many individual instances failed deployment'. The team checks the instance logs and finds that the 'BeforeInstall' lifecycle event script returned a non-zero exit code. What is the BEST approach to resolve this?

Accepted Answer

Fix the script error in the revision and redeploy.. The deployment failed because the BeforeInstall lifecycle event script returned a non-zero exit code, which CodeDeploy interprets as a failure. The root cause is a bug or misconfiguration in the script itself. The best approach is to fix the script in the application revision and redeploy, ensuring the script exits with 0 on success. This addresses the underlying issue rather than bypassing it.

Answer

Set the 'ignoreScriptFailure' option to true in the AppSpec file and redeploy.

Answer

Manually run the script on an instance and then resume the deployment.

Answer

Change the deployment configuration to 'AllAtOnce' to speed up deployment.

Question 5

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application generates logs that are sent to CloudWatch Logs using the CloudWatch agent. Recently, the operations team noticed that some instances are missing logs for certain periods. The CloudWatch agent is configured to batch log events and send them every 5 seconds. The instances have high CPU utilization (90%+) during the missing periods. The DevOps engineer suspects that the agent is being throttled or failing. Which of the following is the MOST likely cause and the BEST course of action?

Accepted Answer

The CloudWatch agent is being starved of CPU resources, causing it to drop logs. Increase the CPU credits or instance size.. When CPU utilization is sustained at 90%+, the CloudWatch agent competes for CPU and can be starved, causing it to drop or delay log batches. The agent buffers events in memory and on disk; under CPU starvation, the buffer may overflow or the agent may fail to flush within the 5-second interval. Increasing CPU credits (for burstable instances) or moving to a larger instance size gives the agent the resources it needs.

Answer

The network bandwidth is saturated, causing log delivery to fail. Increase instance network performance.

Answer

The CloudWatch Logs retention policy is set to 1 day, so older logs are deleted. Increase retention.

Answer

The instances are running out of disk space, preventing log buffering. Add more EBS volume space.

Question 6

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a large backlog of messages, and the Lambda function is processing them slowly. The DevOps team wants to increase throughput without making changes to the Lambda code. The team decides to increase the reserved concurrency to 10. However, after the change, the Lambda function starts to experience throttling errors (RateExceeded). The team also notices that other Lambda functions in the same account are also being throttled. What is the MOST likely cause?

Accepted Answer

The account's Lambda concurrency limit has been reached due to the increased reserved concurrency.. Lambda concurrency is governed by an account-level limit (default 1,000) shared across all functions in a region. Reserved concurrency carves out a guaranteed slice for a function and subtracts from the unreserved pool available to other functions. Raising the reserved concurrency from 5 to 10 consumes more of the account pool, and if the account is already near its limit, other functions get throttled with RateExceeded errors.

Answer

The SQS queue's polling interval is too high, causing Lambda to poll infrequently.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The SQS queue's visibility timeout is too short, causing messages to be processed multiple times.

Question 7

A company hosts a static website on Amazon S3 with CloudFront as the CDN. Users report that they see an old version of the website even after the DevOps team updated the S3 objects. The team verified that the new objects are in the S3 bucket and are publicly accessible. The CloudFront distribution has a default TTL of 24 hours. To immediately serve the new content to users, the team needs to invalidate the CloudFront cache. Which of the following is the CORRECT approach to achieve this with minimal impact?

Accepted Answer

Create a CloudFront invalidation request for the path '/*'.. A CloudFront invalidation for the path '/*' tells all edge locations to stop serving cached objects matching that pattern and fetch fresh copies from the S3 origin on the next request. This is the standard, immediate way to purge stale content without changing the distribution configuration or object keys. It has minimal impact because it only affects cached objects and does not require re-uploading or renaming anything.

Answer

Change the CloudFront origin path to point to a new S3 bucket.

Answer

Update the CloudFront distribution's default TTL to 0 and wait for the changes to propagate.

Answer

Delete the S3 objects and re-upload them with different names.

Question 8

A DevOps engineer receives a CloudWatch alarm indicating that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance is part of an Auto Scaling group behind an Application Load Balancer. What is the MOST efficient initial step to troubleshoot the high CPU usage?

Accepted Answer

Review the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization.. Reviewing the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization is the most efficient initial step to diagnose high CPU usage. CPU credit balance is critical for burstable performance instances (e.g., T2/T3), as a depleted credit balance directly causes sustained high CPU utilization. Network utilization metrics can reveal if the high CPU is driven by excessive traffic or a DDoS-like pattern, allowing targeted remediation without unnecessary scaling or configuration changes.

Answer

Modify the Auto Scaling group to use a larger instance type.

Answer

Check the ALB's HTTP 5xx error rate metric for the target group.

Answer

Immediately increase the desired capacity of the Auto Scaling group.

Question 9

An organization uses AWS Systems Manager Incident Manager for incident response. They have created a response plan with an engagement plan that pages the on-call engineer via SMS. The engineer acknowledges the incident but then does not take any further action. What is the BEST way to automate escalation?

Accepted Answer

Configure an escalation plan in the response plan that pages a secondary contact after a specified timeout.. Systems Manager Incident Manager supports escalation plans with timeouts and multiple engagement levels. Option A is wrong because manual re-paging does not provide automated escalation and requires human intervention. Option B is wrong because CloudWatch Events can trigger actions but is not the built-in escalation mechanism within Incident Manager; that capability is provided by escalation plans. Option C is wrong because while a Lambda function could be used, it is not the best or simplest approach; Incident Manager natively supports escalation plans.

Answer

Manually re-page the on-call engineer with a higher urgency.

Answer

Use Amazon CloudWatch Events to trigger a second SMS if the incident is not resolved within a time frame.

Answer

Create an AWS Lambda function that checks the incident status and pages the next responder if no action is taken.

Question 10

A company's production environment consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances run a web application that stores session data in an ElastiCache Redis cluster. The company has enabled detailed CloudWatch metrics and set up a dashboard. The operations team notices that the average CPU utilization across the Auto Scaling group spikes to 95% every 15 minutes, coinciding with a high number of Redis connections. What is the MOST likely cause?

Accepted Answer

The ALB has session stickiness enabled, causing traffic to be routed to the same instances.. ALB session stickiness (sticky sessions) causes the load balancer to route requests from the same client to the same EC2 instance. When a large number of clients connect simultaneously (e.g., due to a periodic batch job), they may all be routed to the same few instances, causing CPU spikes on those instances. The high number of Redis connections corresponds to the sessions being stored in Redis. This explains the 15-minute periodic spikes. Option A is incorrect because Memcached is not used; the question states ElastiCache Redis. Option B is incorrect because the scaling policy is based on CPU utilization, not memory. Option D is incorrect because the cluster size doesn't cause periodic spikes; it would cause consistent high utilization.

Answer

The application is using Memcached instead of Redis, causing increased load.

Answer

The Auto Scaling group's scaling policy is based on memory utilization instead of CPU.

Answer

The ElastiCache cluster is not large enough to handle the number of requests.

Question 11

A DevOps engineer is setting up an incident response system for a critical application. The engineer needs to ensure that notifications are sent to the appropriate team when specific CloudWatch alarms trigger. Which TWO services can be used to trigger notifications based on CloudWatch alarms? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is correct because CloudWatch alarm actions natively support publishing to an SNS topic, which then fans out notifications via email, SMS, or HTTP/S endpoints to the appropriate team. AWS Chatbot is correct because it integrates with SNS topics and CloudWatch alarms to deliver formatted notifications directly into team chat channels such as Slack or Amazon Chime. AWS Systems Manager is not a notification service; it handles operational tasks like patching and automation, not alarm-driven alerts. Amazon SQS is a message queue that can receive alarm actions but does not itself send notifications to people. AWS Lambda can be invoked by an alarm but is a compute service that must be coded to send notifications, so it is not a notification service by itself.

Answer

AWS Systems Manager

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Question 12

A company uses AWS CloudTrail to log API calls in a multi-account environment. The security team wants to be alerted immediately when an IAM user or role performs a specific sensitive action (e.g., DeleteTrail, DeleteDBInstance). Which TWO services can be used together to achieve near real-time alerting? (Choose TWO.)

Accepted Answer

CloudWatch Logs metric filters and alarms. CloudTrail logs can be delivered to CloudWatch Logs, where metric filters can be created to match specific API actions (e.g., DeleteTrail, DeleteDBInstance) and trigger CloudWatch alarms for near real-time notification. Option B is correct because CloudTrail integration with CloudWatch Logs is the prerequisite step that enables the log delivery required for metric filters and alarms. Option C is incorrect: CloudTrail with Amazon S3 event notifications is not near real-time; S3 event notifications can have delays and are not designed for immediate alerting on specific API calls. Option D is incorrect: Amazon Athena is an interactive query service for ad-hoc analysis, not for real-time alerting. Option E is incorrect: AWS Config is used for resource configuration compliance and change tracking, not for real-time alerting on API calls.

Answer

CloudTrail with Amazon S3 event notifications

Answer

Amazon Athena and CloudWatch dashboards

Answer

AWS Config and AWS Lambda

Question 13

A company runs a critical web application on AWS. The application is deployed on EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group across multiple Availability Zones. The company uses Amazon Route 53 for DNS with a failover routing policy. Recently, the operations team noticed that during a regional outage, the failover did not trigger as expected, and users experienced downtime. The health checks in Route 53 are configured to check the ALB endpoint. The ALB's health checks are configured to check the instances. What is the MOST likely reason the failover did not work?

Accepted Answer

The ALB remained healthy during the regional outage, so Route 53 did not fail over.. Route 53 health checks are configured to check the ALB endpoint. During a regional outage, if the ALB itself remains healthy (e.g., the outage only affected the instances but not the ALB), the health check passes, so Route 53 does not trigger failover. This leads to users experiencing downtime because the instances behind the ALB are unhealthy, but Route 53 still directs traffic to the primary region. Option B is incorrect because failover with Route 53 is automatic when a health check fails; no manual intervention is required. Option C is incorrect because Route 53 health checks do not need to check instance IPs; checking the ALB is sufficient for failover as long as the ALB's health reflects instance health, but in this case it doesn't. Option D is incorrect because Route 53 can failover to a different region when the primary endpoint becomes unhealthy, but the condition for failover (health check failure) was not met.

Answer

The failover routing policy requires manual intervention to switch traffic.

Answer

Route 53 health checks were not configured for the instance IP addresses.

Answer

Route 53 cannot failover to a different region when the primary endpoint is still reachable.

Question 14

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The application experiences increased latency during peak hours. The DevOps engineer investigates and notices that the Read Replicas are not being utilized effectively. The application is configured to use the primary database endpoint. The engineer wants to offload read traffic to the Read Replicas without changing the application code. What is the BEST solution?

Accepted Answer

Configure Amazon RDS Proxy in front of the database and enable read/write splitting.. Amazon RDS Proxy with read/write splitting allows the application to offload read traffic to Read Replicas without code changes. It automatically directs read queries to Read Replicas and write queries to the primary, using a single endpoint. Option A (increasing instance size) does not leverage Read Replicas. Option B (modifying application) requires code changes. Option C (Multi-AZ cluster with read-only endpoint) is invalid because Multi-AZ clusters use a writer and reader endpoint, but the question requires no code changes, and the existing configuration uses a primary endpoint; also, creating a new cluster may not be the simplest solution compared to RDS Proxy.

Answer

Increase the instance size of the primary database to handle the load.

Answer

Modify the application to use separate endpoints for read and write operations.

Answer

Create a new Multi-AZ cluster with a read-only endpoint.

Question 15

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is behind an Application Load Balancer (ALB). The operations team notices that the ALB's 5xx error rate increases periodically. The ECS service is configured with a target tracking scaling policy based on CPU utilization. The CloudWatch logs from the application show no errors. The health check on the ALB is configured to hit the /health endpoint. What is the MOST likely cause of the 5xx errors?

Accepted Answer

The health check endpoint is returning a 503 status due to a dependency failure.. The ALB periodically reports 5xx errors because the health check endpoint /health is returning a 503 status code, likely due to a transient dependency failure. When the health check fails, the ALB considers the target unhealthy and returns a 503 (or 502) to clients. The application code itself logs no errors because the failure occurs in a downstream dependency that the health check probes, not in the main application logic. Option A is incorrect because ECS with Fargate does not expose underlying host patching; the ALB would not detect such patching as 5xx errors. Option C is incorrect because a target tracking CPU scaling policy, even if slow, would not cause 5xx errors—it would affect performance but not directly trigger health check failures. Option D is incorrect because the application logs show no errors, ruling out unlogged exceptions as the source.

Answer

The ECS tasks are running on an underlying host that is being patched.

Answer

The target tracking scaling policy is not responding quickly enough to traffic spikes.

Answer

The application is throwing exceptions that are not logged.