DOP-C02 Incident and Event Response Practice Test 14 — 15 Questions

Question 1

A company uses an Auto Scaling group with a dynamic scaling policy based on the average CPU utilization of the instances. During an incident, the DevOps team notices that the Auto Scaling group is not launching new instances quickly enough to handle a traffic spike. What is a possible cause for the slow scaling response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cooldown period is set too high.. The cooldown period prevents the Auto Scaling group from launching or terminating instances after a scaling activity. If the cooldown is too long, it delays subsequent scaling actions. Option B is wrong because the health check grace period is for instance health checks after launch, not scaling speed. Option C is wrong because the minimum group size is irrelevant to scaling speed. Option D is wrong because the warm-up time for the launch template is not a real parameter.

Answer

The health check grace period is set too low.

Answer

The minimum group size is set too low.

Answer

The launch template has a long warm-up time.

Question 2

An application running on AWS Lambda is experiencing increased error rates. The DevOps engineer needs to quickly identify the root cause. Which AWS service should the engineer use to analyze the logs and errors?

Accepted Answer

AWS X-Ray. AWS X-Ray provides end-to-end tracing and can analyze logs and errors in Lambda functions, helping identify root causes of increased error rates. Option B is wrong because AWS Trusted Advisor offers best practice checks and recommendations, not real-time error analysis. Option C is wrong because AWS Config monitors resource configuration compliance, not application errors. Option D is wrong because AWS CloudTrail logs API calls, not application-level errors.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

A DevOps engineer is designing an incident response plan for a multi-region application. The application runs on EC2 instances behind an Application Load Balancer (ALB) and uses Amazon RDS for MySQL with Multi-AZ. Which TWO actions should the engineer include to ensure high availability and fast failover during a regional incident?

Accepted Answer

Set up an Amazon RDS read replica in a second region and promote it during failover.. Options A and E are correct. Amazon RDS read replicas can be created in a different region and promoted to a standalone primary instance during a regional incident, providing a disaster recovery solution. Amazon Route 53 with health checks can automatically fail over DNS traffic to a secondary region by routing to a healthy endpoint. Option B is incorrect because Auto Scaling groups are regional and cannot launch instances across multiple regions directly; you would need separate Auto Scaling groups per region. Option C is incorrect because an Application Load Balancer is regional and cannot span regions; you would need separate ALBs in each region and Route 53 to route traffic. Option D is incorrect because Multi-AZ RDS replicates synchronously within a single region only; for cross-region disaster recovery, you need a read replica or a separate Multi-AZ deployment in the other region, not Multi-AZ in a second region (Multi-AZ in a second region is not a standard feature; you would need a separate RDS instance).

Answer

Create an Auto Scaling group that can launch instances in multiple regions.

Answer

Deploy an Application Load Balancer that spans both regions.

Answer

Configure Amazon RDS Multi-AZ in a second region.

Question 4

A security team is investigating a potential data exfiltration from an S3 bucket. They need to identify which IAM user accessed a specific object and whether the access was from a known IP address. Which THREE AWS services or features should they use together to conduct this investigation?

Accepted Answer

AWS CloudTrail. Options C, D, and E are correct. C is correct because AWS CloudTrail logs S3 API calls including GetObject. D is correct because S3 server access logs provide detailed object-level access logs including requester, IP, and object key. E is correct because Amazon Athena can query both CloudTrail logs and S3 access logs efficiently. Option A is wrong because AWS Config records resource configuration, not data access. Option B is wrong because VPC Flow Logs capture network traffic but not S3 object-level access.

Answer

AWS Config

Answer

VPC Flow Logs

Question 5

A company runs a critical application on Amazon ECS with Fargate launch type. During an incident, the DevOps engineer notices that tasks are failing with 'CannotPullContainerError: API error (500)'. Which TWO steps should the engineer take to resolve this issue?

Accepted Answer

Ensure that the ECR repository policy allows the task execution role to pull images.. Options C and E are correct. When a Fargate task fails with 'CannotPullContainerError: API error (500)', it typically indicates an issue with pulling the container image from Amazon ECR. The task execution IAM role (E) must have the necessary permissions (ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, ecr:BatchCheckLayerAvailability) to pull images from ECR. Additionally, if the image resides in a private ECR repository, the repository policy (C) must allow the task execution role to perform those actions. Option A is wrong because Fargate does not support attaching EBS volumes; it stores image layers ephemerally. Option B is incorrect because the ECS service role is used for load balancer integration, not for pulling images. Option D is incorrect because increasing task memory does not fix image pull errors; memory affects running tasks, not the pull process.

Answer

Attach an EBS volume to the Fargate task for caching.

Answer

Check that the ECS service role has the required permissions.

Answer

Increase the task memory to accommodate the image pull.

Question 6

A DevOps engineer notices that an Auto Scaling group is repeatedly launching and terminating instances. CloudWatch alarms show high CPU but the group's metrics are erratic. What is the most likely cause?

Accepted Answer

The health check grace period is too short and the health check type is ELB, but the load balancer health check is failing.. If the health check grace period is too short and the health check type is ELB, instances may be marked unhealthy before they are fully ready, causing the Auto Scaling group to terminate and relaunch them. This leads to repeated cycling and erratic metrics. Option A is wrong because not associating with a load balancer means the Auto Scaling group uses EC2 health checks, which would not cause this specific behavior. Option B is wrong while user data failures could cause instance replacement, they typically cause launch failures, not high CPU and cycling. Option D is wrong because an improperly configured AMI would likely cause instances to fail at launch, not repeatedly cycle after being in service.

Answer

The Auto Scaling group is not associated with a load balancer.

Answer

The launch template user data is causing instances to fail during boot.

Answer

The AMI used in the launch template is not properly configured.

Question 7

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

Accepted Answer

Check if the instances have outbound internet connectivity to the SSM endpoints.. The SSM Agent requires outbound internet connectivity to the Systems Manager endpoints (or AWS PrivateLink if configured) to communicate with the service. If the patch window or a security group change blocks this connectivity, instances become unreachable despite the agent logs showing no errors. Option A is wrong because restarting the agent does not help if the issue is network connectivity. Option B is wrong because the patch baseline association defines which patches to apply, not connectivity. Option C is wrong because IAM permissions are likely correct since the agent logs show no errors; the issue is network-related, not permissions.

Answer

Restart the SSM Agent on the affected instances.

Answer

Verify that the patch baseline is associated with the instances.

Answer

Review the IAM role attached to the instances for sufficient permissions.

Question 8

During a deployment, a new application version on an ECS service starts failing health checks. The previous version is still running. The deployment is a rolling update with a 200% percent start. Which ECS feature should the engineer use to automatically revert to the previous version?

Accepted Answer

ECS deployment circuit breaker. (ECS deployment circuit breaker) is correct because it automatically detects failed deployments (e.g., health check failures) and triggers a rollback to the previous version. With a 200% percent start rolling update, the new version starts before the old is stopped; if health checks fail, the circuit breaker initiates a rollback. Option B (ECS service auto recovery) recovers from underlying infrastructure failures, not deployment failures. Option C (ECS managed scaling) adjusts desired count based on load, not deployment health. Option D (CloudWatch alarm actions) can trigger rollback events but is not an ECS built-in feature; it requires custom automation. Therefore, the correct ECS feature for automatic rollback is the deployment circuit breaker.

Answer

ECS service auto recovery

Answer

ECS managed scaling

Answer

CloudWatch alarm actions

Question 9

An application runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The engineer checks ALB metrics and sees 'SurgeQueueLength' increasing periodically. What is the most likely cause?

Accepted Answer

The application instances are not able to process requests quickly enough, causing the request queue to back up.. A high SurgeQueueLength indicates that the ALB is receiving more requests than the target instances can process, causing the request queue to back up. When the queue exceeds the limit (1024 requests), the ALB returns 503 errors. Option B is incorrect because health check failures typically cause the ALB to stop routing traffic to unhealthy instances, reducing the queue rather than increasing it. Option C is incorrect because an expired SSL certificate would cause TLS handshake failures, not 503 errors. Option D is incorrect because a misconfigured security group would block traffic entirely, resulting in connection timeouts or 503s, but it would not cause the SurgeQueueLength to increase.

Answer

The target group health checks are failing, causing the ALB to route traffic to unhealthy instances.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB security group is blocking traffic from the clients.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with the error 'UPDATE_ROLLBACK_FAILED'. What should the engineer do to resolve this?

Accepted Answer

Use the 'ContinueUpdateRollback' operation to fix the resource that caused the failure.. When a stack update fails with 'UPDATE_ROLLBACK_FAILED', CloudFormation could not automatically roll back the changes. Using the 'ContinueUpdateRollback' operation (option D) allows CloudFormation to skip the resource that caused the failure and continue the rollback, bringing the stack to a consistent state. Option A is wrong because retrying with the same parameters is likely to fail again. Option B is wrong because deleting the stack may cause data loss. Option C is wrong because ignoring the error leaves the stack in an inconsistent state.

Answer

Retry the stack update with the same parameters.

Answer

Delete the stack and recreate it.

Answer

Ignore the error and continue using the stack.

Question 11

A company uses RDS Multi-AZ with a read replica. During a failover test, the application experiences a 30-second write outage. The application uses a single DB endpoint. How can the outage be minimized?

Accepted Answer

Use RDS Proxy to handle database connections and failover.. RDS Proxy helps minimize write outages during failover by managing database connections efficiently. It maintains connection pools and automatically routes connections to the new primary after failover, reducing the outage window from seconds to sub-second. Option A (increasing instance class) does not affect failover time because failover duration is dominated by DNS propagation and database recovery, not instance size. Option C (Route 53 weighted record with health checks) is not suitable because Multi-AZ failover already handles DNS updates automatically, and using a weighted record with health checks would require additional complexity and still involve DNS propagation delays. Option D (using read replica endpoint for writes) is invalid because read replicas do not accept write operations; they are read-only.

Answer

Increase the instance class to improve failover performance.

Answer

Use a Route 53 weighted record with health checks to point to both instances.

Answer

Configure the application to use the read replica endpoint for writes.

Question 12

A Lambda function processes SQS messages but sometimes times out after 15 seconds. The function performs a database call that occasionally takes longer. What is the best way to handle this without losing messages?

Accepted Answer

Increase the Lambda timeout and increase the SQS visibility timeout, and add a dead-letter queue.. Increasing the Lambda timeout allows the function more time to complete the database call, increasing the SQS visibility timeout prevents messages from becoming visible before the function finishes, and adding a dead-letter queue captures messages that still fail after all retries. Option A is wrong because decreasing the visibility timeout would cause messages to reappear sooner, potentially leading to duplicate processing or loss. Option B is wrong because splitting the batch does not address the timeout issue; partial batch response is for handling partial failures within a batch, not for timeout extension. Option D is wrong because reducing reserved concurrency would limit the number of concurrent executions but does not prevent timeouts; it might cause more throttling.

Answer

Decrease the SQS visibility timeout to retry faster.

Answer

Split the batch into smaller batches using partial batch response.

Answer

Reduce the Lambda reserved concurrency to limit invocations.

Question 13

A company uses CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed KMS key. What must be done to enable this?

Accepted Answer

Associate a customer-managed KMS key with the log group and update the key policy to allow CloudWatch Logs to use it.. CloudWatch Logs supports encryption at rest using a customer-managed KMS key. To enable this, you must associate the KMS key with the log group via the CloudWatch Logs console or API, and you must update the key policy to grant CloudWatch Logs the necessary permissions (kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:DescribeKey). Without this key policy update, CloudWatch Logs cannot use the key to encrypt the log data at rest.

Answer

Enable encryption on the log group using the default AWS managed key.

Answer

Use a third-party encryption tool before sending logs to CloudWatch.

Answer

Create a new log group in a region where KMS is enabled.

Question 14

An organization uses AWS Config to track resource changes. They notice that a particular S3 bucket policy was deleted, but the Config rule 's3-bucket-policy-grantee-check' did not trigger a remediation. What is the most likely reason?

Accepted Answer

The bucket was deleted and recreated, and the configuration recorder did not capture the deletion event.. When an S3 bucket is deleted and recreated, AWS Config may not capture the deletion event if the configuration recorder is not properly configured or if the bucket is recreated before the recorder processes the deletion. This can cause the rule to not trigger on the policy change. Option A is incorrect because AWS Config does support S3 bucket policy checks. Option B is incorrect because the rule evaluates resources on configuration changes, not only periodically. Option C is incorrect because S3 bucket policy changes are supported by AWS Config.

Answer

The Config rule does not support S3 bucket policies.

Answer

The rule is set to evaluate resources only on a periodic basis.

Answer

The S3 bucket policy change is not supported by AWS Config.

Question 15

A company uses Amazon CloudFront with an S3 origin. Users in Europe report slow load times. The engineer needs to improve performance for European users. Which TWO actions should the engineer take?

Accepted Answer

Enable CloudFront Origin Shield in a European region.. CloudFront Price Class 100 already includes all European edge locations. Changing to Price Class 200 adds edge locations in other continents (e.g., Asia, South America) but does not improve performance for European users. Origin Shield in a European region is the appropriate action because it provides a caching layer close to European edge locations, reducing origin fetch latency and improving load times.

Answer

Add additional price classes to the CloudFront distribution (e.g., Price Class 200).

Answer

Enable S3 Transfer Acceleration on the origin bucket.

Answer

Enable CloudFront access logs to identify slow requests.

Answer

Enable AWS WAF on the CloudFront distribution to block malicious traffic.