DOP-C02 Incident and Event Response Practice Test 14 — 15 Questions

Question 1

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the DevOps engineer notices that some users are being logged out and losing session data. The deployment uses a rolling update strategy. What is the MOST likely cause?

Accepted Answer

The session data is stored locally on the EC2 instance, not in a shared external store.. Option D is correct because during a rolling update, old instances are terminated and new instances are launched. Sticky sessions are tied to a specific instance; when that instance is terminated, the user's session is lost if it is not shared externally. Option A is wrong because the ALB configuration remains unchanged. Option B is wrong because health checks are not the direct cause. Option C is wrong because Auto Scaling is not involved unless explicitly configured.

Answer

The Auto Scaling group is terminating instances before the new ones are fully ready.

Answer

The health check interval is too long, causing the ALB to route traffic to unhealthy instances.

Answer

The ALB sticky session cookie is not being generated correctly.

Question 2

A company uses Amazon ECS with the Fargate launch type for a microservices application. The application experiences intermittent HTTP 5xx errors from the ALB. The DevOps team needs to diagnose the issue. Which TWO steps should be taken to gather diagnostic information? (Choose TWO.)

Accepted Answer

Enable Container Insights for the ECS cluster.. Options B and D are correct. Option B: ECS service logs (from the awslogs driver) contain application output that can reveal errors. Option D: CloudWatch Container Insights provides metrics and logs for Fargate tasks, including resource utilization that can cause timeouts. Option A is wrong because instance-level metrics are not available with Fargate (no EC2 instances). Option C is wrong because X-Ray traces HTTP requests but may not capture the root cause if the error is at the application level. Option E is wrong because Fargate does not support Systems Manager Session Manager for tasks.

Answer

Enable AWS X-Ray tracing on the ECS service.

Answer

Enable detailed monitoring on the underlying EC2 instances.

Answer

Use AWS Systems Manager Session Manager to connect to the running containers.

Question 3

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with the error: 'UPDATE_ROLLBACK_IN_PROGRESS'. The DevOps engineer needs to investigate the cause. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Review the CloudFormation console to identify which resource failed.. Options A, D, and E are correct. Option A: The CloudFormation console shows the specific resource that caused the failure. Option D: Stack events provide detailed status and error messages. Option E: The '--retain-resources' parameter can preserve resources that failed to delete during rollback. Option B is wrong because change sets are used to preview changes before execution, not to troubleshoot failures. Option C is wrong because DescribeStackResource returns specific resource details but not the overall failure cause; also, it's not a primary troubleshooting step.

Answer

Create a change set to see what changes were attempted.

Answer

Use the 'describe-stack-resource' AWS CLI command to get the resource status.

Question 4

A company runs a critical application on EC2 instances in an Auto Scaling group. The application must be highly available across multiple Availability Zones. Which TWO configurations are necessary to achieve this? (Choose TWO.)

Accepted Answer

Place an Application Load Balancer in front of the Auto Scaling group.. Options A and D are correct. Option A: Distributing instances across multiple AZs ensures that if one AZ fails, the application continues in other AZs. Option D: An Application Load Balancer (ALB) distributes traffic across instances in multiple AZs. Option B is wrong because a single AZ defeats high availability. Option C is wrong because a Classic Load Balancer is not recommended; ALB is better for cross-zone. Option E is wrong because spot instances can be terminated, reducing availability.

Answer

Use a single Availability Zone to reduce latency.

Answer

Use Spot Instances to reduce costs.

Answer

Use a Classic Load Balancer to distribute traffic.

Question 5

Refer to the exhibit. The DevOps engineer runs the commands and sees the output. What is the most likely issue with the instance?

Accepted Answer

The underlying hardware is having issues (system status check failed).. Option C is correct. The SystemStatus is 'impaired', meaning there is a problem with the underlying physical host (system status check). The instance status is 'ok', so the OS is fine. Option A is wrong because the instance is running. Option B is wrong because instance status is ok. Option D is wrong because there is a system impairment.

Answer

The instance is healthy and no issues exist.

Answer

The instance is stopped.

Answer

The instance has a failed status check due to OS-level issues.

Question 6

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to 'my-bucket' without specifying server-side encryption. What will happen?

Accepted Answer

The upload is denied because of the Deny statement.. Option A is correct. The Allow statement requires encryption AES256, but the request does not specify encryption, so the condition is not met. The Deny statement catches any request that does not have encryption set to AES256 (since it uses StringNotEquals). The explicit Deny overrides any Allow, so the request is denied. Option B is wrong because the Deny statement is more specific. Option C is wrong because the Allow statement has a condition that is not met. Option D is wrong because the request is not allowed.

Answer

The upload is denied because the Allow statement requires encryption.

Answer

The upload is allowed because the Allow statement grants permission.

Answer

The upload is allowed because no encryption header is specified.

Question 7

Refer to the exhibit. A DevOps engineer set up a CloudWatch alarm for a Lambda function. The alarm fires when the error count metric exceeds 10 in 5 minutes. The engineer receives an alarm notification, but when checking the Lambda logs, only 3 errors are found in that 5-minute window. What is the MOST likely reason for the discrepancy?

Accepted Answer

The metric filter is counting errors from other log groups or sources that use the same metric name.. Option B is correct. The metric filter might be capturing errors from other log groups that share the same metric name (ErrorCount). If multiple Lambda functions or other services publish to the same metric, the alarm could be summing across all of them. Option A is wrong because CloudWatch Logs metric filters are near real-time. Option C is wrong because Lambda errors are counted correctly. Option D is wrong because the metric filter is correctly defined.

Answer

The metric filter is not processing logs in real time, causing a delay.

Answer

The metric filter pattern is incorrect and is matching non-error entries.

Answer

The Lambda function is generating more errors than shown in the logs.

Question 8

A DevOps engineer notices that an EC2 instance is unresponsive and the CloudWatch alarm 'StatusCheckFailed' is in ALARM state. The instance was launched in a private subnet with no public IP. Which action should the engineer take to diagnose the issue without creating a new instance?

Accepted Answer

Use EC2 Serial Console to connect to the instance.. Option A is correct because EC2 Serial Console provides out-of-band access to the instance console, useful for troubleshooting OS-level issues even when network connectivity is lost. Option B is wrong because Systems Manager Session Manager requires the instance to have connectivity to the Systems Manager endpoint and the agent running. Option C is wrong because AWS Personal Health Dashboard provides service health notifications, not instance-level troubleshooting. Option D is wrong because modifying the security group to allow SSH on port 22 does not help if the instance is unresponsive at the OS level.

Answer

Modify the security group to allow SSH from the engineer's IP.

Answer

Use AWS Systems Manager Session Manager to start a session.

Answer

Check AWS Personal Health Dashboard for instance issues.

Question 9

A company uses AWS CloudFormation to manage infrastructure. After a failed stack update, the stack is in ROLLBACK_COMPLETE state. The DevOps team needs to identify the specific resource that caused the rollback and review the error message. Which approach provides the most efficient way to achieve this?

Accepted Answer

View the Events tab in the AWS CloudFormation console.. Option C is correct because the CloudFormation console Events tab lists all stack events, including the failure reason and resource that caused the rollback. Option A is wrong because describe-stack-resources shows resources but not error details. Option B is wrong because describe-stack-events includes the error message. Option D is wrong because CloudTrail logs API calls but does not directly show CloudFormation resource errors in an aggregated view.

Answer

Run describe-stack-events and filter by status.

Answer

Check AWS CloudTrail for the UpdateStack API call.

Answer

Run describe-stack-resources to list all stack resources.

Question 10

A company uses Amazon RDS for MySQL and has enabled automated backups. The database administrator accidentally deleted a critical row from a table. The deletion occurred 15 minutes ago. What is the fastest way to recover the lost data?

Accepted Answer

Perform a Point-in-Time Restore to a time just before the deletion.. Option C is correct because Point-in-Time Restore (PITR) allows restoring to any time within the backup retention period, down to the second. Option A is wrong because a manual snapshot from before the deletion would need to be created, which is slower. Option B is wrong because the binlog contains changes, but replaying requires manual effort and is not the fastest AWS-native method. Option D is wrong because RDS does not have a native 'undo' feature.

Answer

Use the RDS console to undo the last transaction.

Answer

Use the binary log to replay transactions before the deletion.

Answer

Create a manual snapshot of the current instance and restore it.

Question 11

An application running on Amazon ECS Fargate is experiencing intermittent 503 errors. The task definition sets a soft limit of 512 CPU units and 1024 memory. The errors occur when traffic spikes. Which change is most likely to resolve the issue?

Accepted Answer

Increase the soft memory limit to 2048 MiB.. Option D is correct because increasing the soft memory limit provides more memory to the container, reducing the likelihood of out-of-memory errors causing 503s. Option A is wrong because increasing CPU units may help if the issue is CPU-bound, but memory is more likely the cause of 503 errors. Option B is wrong because increasing desired count helps with load distribution but not if each task is resource-constrained. Option C is wrong because changing to hard limit may cause the task to be killed if it exceeds memory.

Answer

Increase the soft CPU limit to 1024 units.

Answer

Change the soft memory limit to a hard limit.

Answer

Increase the desired task count in the service.

Question 12

A DevOps engineer is troubleshooting an Amazon CloudWatch alarm that is not triggering as expected. The alarm monitors an SQS queue's ApproximateNumberOfMessagesVisible metric with a threshold of 100 for 1 evaluation period. The queue has had over 100 messages for the past 30 minutes, but the alarm remains in OK state. What is the most likely cause?

Accepted Answer

Messages are being consumed but not deleted, causing them to become invisible.. Option B is correct because if the SQS queue has no consumers, the messages are not visible after the visibility timeout expires; the metric ApproximateNumberOfMessagesVisible only counts messages that are available for retrieval, not those in flight. Option A is wrong because the alarm is configured to monitor a metric, so it should trigger. Option C is wrong because the alarm period is likely set appropriately. Option D is wrong because if the queue is not polled, messages remain in the queue but are visible.

Answer

The alarm period is set longer than 30 minutes.

Answer

The alarm is not configured to evaluate the metric correctly.

Answer

The SQS queue is not being polled.

Question 13

A company uses AWS Organizations with multiple accounts. The security team needs to receive real-time notifications when any IAM user in any account creates an access key. Which solution is the most operationally efficient?

Accepted Answer

Use AWS Config rules with a CloudWatch Events rule to detect CreateAccessKey and publish to an SNS topic.. Option A is correct because an AWS Config rule with a CloudWatch Events trigger can detect CreateAccessKey API calls and send notifications via SNS. Option B is wrong because CloudTrail is already logging events, but CloudWatch Events can directly capture API calls. Option C is wrong because SCPs cannot trigger notifications. Option D is wrong because Trusted Advisor does not monitor IAM access key creation in real-time.

Answer

Enable CloudTrail in all accounts and send logs to a central S3 bucket, then use Amazon Athena to query.

Answer

Create an SCP that denies access key creation and monitor with CloudWatch.

Answer

Use AWS Trusted Advisor to check for exposed access keys.

Question 14

A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?

Accepted Answer

Check ALB access logs for target response times.. Option A is correct because 504 errors indicate the load balancer is not receiving a response from the target within the idle timeout period. Checking the ALB access logs for target response times can confirm if the backend is slow. Option B is wrong because if the ELB is not healthy, the instances would be replaced, but the issue is intermittent. Option C is wrong because scaling policies affect capacity, not response times. Option D is wrong because security group rules would cause connection timeouts, not 504s.

Answer

Review the Auto Scaling group scaling policies.

Answer

Verify the target group health checks are passing.

Answer

Check security group rules for the ALB.

Question 15

A company experiences a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The DevOps team needs to identify the source IP address and user agent of the request. Which AWS service provides this information?

Accepted Answer

Amazon S3 server access logs. Option B is correct because S3 server access logs contain detailed information about each request, including source IP, user agent, and requester. Option A is wrong because CloudTrail logs S3 API calls but does not include user agent by default. Option C is wrong because CloudWatch Logs can store logs but does not generate them. Option D is wrong because VPC Flow Logs capture network traffic but not application-level details like user agent.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs