DOP-C02 Incident and Event Response Practice Test 14 — 15 Questions

Question 1

A company has a serverless application using AWS Lambda functions and Amazon API Gateway. The application has been running fine, but recently users report that some requests are timing out with a 504 error. The Lambda function's timeout is set to 30 seconds, and API Gateway's integration timeout is 29 seconds. The CloudWatch logs for the Lambda function show that the function executes in under 5 seconds on average. What is the MOST likely cause of the 504 errors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda function is experiencing concurrency limits and requests are being throttled.. Even though the Lambda function runs in under 5 seconds, if it is throttled due to concurrency limits, the function may not be invoked until after API Gateway's 29-second integration timeout has passed. This causes API Gateway to return a 504 error. Option A is incorrect because excessive logging does not cause 504 errors; it may affect performance but not directly cause timeouts. Option B is incorrect because the Lambda timeout (30s) is actually higher than API Gateway's integration timeout (29s), so the function could complete before API Gateway times out. Option D is incorrect because cold starts typically add only a second or two, not enough to exceed the 29-second integration timeout when average execution is under 5 seconds.

Answer

The Lambda function is logging too much data, causing delays in log delivery.

Answer

API Gateway's timeout is set to less than the Lambda function's timeout.

Answer

The Lambda function's memory is too low, causing cold starts to take longer than the timeout.

Question 2

A DevOps engineer notices that an EC2 instance running a web application is unresponsive. CloudWatch alarms are not triggering. What is the FIRST step the engineer should take to diagnose the issue?

Accepted Answer

Review the EC2 instance system log and CloudWatch Logs for error messages.. When an EC2 instance is unresponsive but CloudWatch alarms are not triggering, the first diagnostic step is to check the instance system log (console output) and CloudWatch Logs for error messages. This approach follows the principle of gathering evidence before taking action, as the logs may reveal application crashes, kernel panics, or resource exhaustion that caused the unresponsiveness without breaching CloudWatch alarm thresholds.

Answer

Terminate the instance and launch a new one from the latest AMI.

Answer

Restart the EC2 instance immediately to restore service.

Answer

Create a new CloudWatch alarm with a lower threshold to get alerted quicker next time.

Question 3

A company uses AWS CloudTrail to monitor API activity. During an incident, they need to quickly identify any unauthorized IAM role assumption attempts. Which CloudTrail feature should be used to filter and alert on this specific event?

Accepted Answer

Enable CloudTrail Insights to detect anomalous AssumeRole events.. CloudTrail Insights automatically analyzes management events to detect unusual activity, such as spikes in AssumeRole calls, without requiring manual filter configuration. This feature uses machine learning to establish a baseline and then alerts on deviations, making it ideal for quickly identifying unauthorized role assumption attempts during an incident.

Answer

Configure VPC Flow Logs to capture traffic to the IAM endpoint.

Answer

Use S3 event notifications on the CloudTrail bucket for PutObject events.

Answer

Set up a CloudWatch Logs metric filter on the CloudTrail log group for 'AssumeRole' events.

Question 4

An application running on Amazon ECS Fargate is experiencing intermittent HTTP 503 errors from the Application Load Balancer (ALB). The target group health checks are passing. Which configuration is MOST likely causing this issue?

Accepted Answer

The deregistration delay is set too short, causing connections to be closed before requests complete.. The intermittent HTTP 503 errors from the ALB, despite health checks passing, indicate that the target (ECS Fargate task) is being deregistered while still processing active requests. A deregistration delay that is too short causes the ALB to close connections to the target before the application has finished responding, resulting in 503 errors for in-flight requests. The default deregistration delay is 300 seconds; setting it too low (e.g., 5 seconds) can cause this issue.

Answer

The ALB's slow start duration is too long, causing requests to be dropped.

Answer

The health check interval is set too low, causing targets to be marked unhealthy prematurely.

Answer

The ALB's circuit breaker is tripping due to high error rates.

Question 5

A DevOps team is designing an incident response plan for a critical microservices architecture. They need to automatically collect and analyze logs from all services during an incident. Which solution should they use?

Accepted Answer

Centralize logs in Amazon CloudWatch Logs and use CloudWatch Logs Insights for real-time querying.. Amazon CloudWatch Logs provides a centralized log management service that integrates natively with AWS services. During an incident, CloudWatch Logs Insights enables real-time, ad-hoc querying and analysis of logs from all microservices without needing to set up additional infrastructure, making it the most efficient solution for incident response.

Answer

Stream logs to Amazon Kinesis Data Firehose and analyze with Amazon OpenSearch Service.

Answer

Store logs in Amazon S3 and use Amazon Athena to query them.

Answer

Use AWS Systems Manager Run Command to execute log collection scripts on each instance.

Question 6

A company uses AWS Config to track resource changes. They want to automatically remediate non-compliant security group rules that allow public SSH access. What is the MOST effective approach?

Accepted Answer

Create an AWS Config rule with an automatic remediation action using AWS Systems Manager Automation.. AWS Config can directly associate an AWS Systems Manager Automation document as a remediation action for a non-compliant rule. This approach provides a fully managed, idempotent, and auditable remediation workflow without requiring custom Lambda code or external event orchestration. The automation document can be configured to automatically remove the SSH ingress rule (port 22) from the security group when the Config rule detects non-compliance.

Answer

Set up an AWS Config rule that triggers a Lambda function to remove the SSH rule.

Answer

Use Amazon CloudWatch Events to detect the change and invoke a Lambda function.

Answer

Use AWS Service Catalog to enforce security group templates.

Question 7

An application running on Amazon RDS for PostgreSQL is experiencing slow query performance. The DevOps team suspects a specific query is causing high CPU usage. Which tool should they use to identify the problematic query?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct tool because it provides a database performance tuning and monitoring feature that visualizes database load and lets you identify specific queries causing high CPU usage. It breaks down the database load by wait events, SQL statements, hosts, and users, making it straightforward to pinpoint the problematic query. This directly addresses the DevOps team's need to find the query responsible for high CPU consumption.

Answer

Amazon RDS Event Subscriptions

Answer

Amazon CloudWatch Logs with metric filters

Answer

Amazon RDS Enhanced Monitoring

Question 8

An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?

Accepted Answer

Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.. A service control policy (SCP) is a feature of AWS Organizations that allows you to centrally control permissions for all accounts in your organization. An SCP can be applied to the root of the organization, an OU, or a specific account. When an SCP that denies all actions is applied to an affected account, it restricts permissions for all principals, including the root user and IAM users in that account. This effectively isolates the compromised account by preventing any API calls. Option A is incorrect because creating a new IAM group with a deny-all policy and adding all users would affect only IAM users, not the root user. Option C is incorrect because an IAM policy attached to IAM users does not affect the root user. Option D is incorrect because applying an SCP that denies all actions only to the root user would leave IAM users unrestricted, failing to fully isolate the account.

Answer

Create a new IAM group with a deny-all policy and add all users to it.

Answer

Attach an IAM policy denying all actions to all IAM users in that account.

Answer

Apply an SCP that denies all actions to the root user only.

Question 9

A company is designing an incident response strategy for its Amazon EKS cluster. Which THREE steps should be taken to ensure rapid response to a compromised pod?

Accepted Answer

Delete the pod using kubectl delete pod.. Deleting the pod with `kubectl delete pod` immediately terminates the compromised container, stopping any malicious activity. This is a rapid containment step that removes the pod from the cluster without affecting the broader deployment or namespace, allowing the incident response team to investigate and remediate without unnecessary disruption.

Answer

Delete the entire namespace to ensure all resources are removed.

Answer

Scale down the deployment to 0 replicas.

Question 10

A DevOps engineer is troubleshooting an issue where an EC2 instance running a web application becomes unresponsive every few hours. CloudWatch logs show no application errors, but the instance's status checks are passing. The engineer suspects a memory leak. Which AWS service can be used to capture memory utilization metrics at a granular level to confirm the leak?

Accepted Answer

CloudWatch Agent. The CloudWatch Agent can be installed on EC2 instances to collect custom metrics such as memory usage and send them to CloudWatch, allowing granular monitoring. Option A is incorrect because EC2 Status Checks only verify system status (e.g., network reachability). Option B is incorrect because AWS Config tracks configuration changes, not performance metrics. Option C is incorrect because CloudTrail records API activity, not system metrics.

Answer

EC2 Status Checks

Answer

AWS Config

Answer

AWS CloudTrail

Question 11

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance fails, and automatic failover does not occur within the expected 1-2 minutes. The DevOps team needs to quickly restore database availability. What should the team do first?

Accepted Answer

Reboot the DB instance with failover selected.. When automatic failover does not occur within the expected 1-2 minutes, the fastest way to manually trigger a failover is to reboot the DB instance with the 'Reboot with Failover' option selected. This forces the RDS service to promote the standby replica to the new primary, restoring database availability without waiting for the automated health check to complete. Option D is correct because it directly initiates the failover process, leveraging the existing Multi-AZ setup.

Answer

Restore the latest automated snapshot to a new DB instance.

Answer

Modify the DB instance to change the Multi-AZ setting to enable automatic failover.

Answer

Connect to the standby instance directly and promote it to primary.

Question 12

A DevOps engineer receives an alert that an EC2 instance's CPU utilization has been above 90% for the last 30 minutes. The engineer needs to investigate the root cause. Which AWS service should the engineer use to get OS-level process details and identify which process is consuming the CPU?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run commands (e.g., 'top', 'ps') remotely on EC2 instances to obtain OS-level process details and identify which process is consuming CPU. Option A is wrong because AWS Config records configuration changes, not OS-level processes. Option B is wrong because AWS CloudTrail logs API calls, not system-level metrics. Option D is wrong because Amazon CloudWatch provides aggregated CPU utilization metrics but cannot provide process-level details.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 13

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The DevOps team needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which combination of services should be used?

Accepted Answer

CloudWatch Logs Insights and CloudWatch Dashboards. CloudWatch Logs Insights allows you to query log data in real time using a query language, and you can create a query that counts ERROR-level entries across multiple log groups. CloudWatch Dashboards can then visualize the results of that query as a widget, providing a real-time dashboard. This combination is native to CloudWatch and requires no additional services or data movement.

Answer

Amazon Athena and Amazon QuickSight

Answer

Amazon Kinesis Data Analytics and Amazon Elasticsearch Service

Answer

Amazon S3 and Amazon QuickSight

Question 14

A DevOps team is configuring an Auto Scaling group for a web application behind an Application Load Balancer. The team wants to automatically replace instances that fail the health check. Which scaling policy should be used?

Accepted Answer

Default health check replacement. The correct approach is not a scaling policy but the Auto Scaling group's built-in health check replacement functionality. When the Auto Scaling group is configured with ELB health checks, it automatically terminates and replaces instances that the Application Load Balancer marks unhealthy. No scaling policy is required for this behavior.

Answer

Target tracking scaling policy

Answer

Step scaling policy

Answer

Manual scaling

Question 15

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

Accepted Answer

Use the awslogs log driver in the task definition.. The awslogs log driver is the simplest native integration between Amazon ECS and CloudWatch Logs. By specifying the log driver in the task definition, the ECS container agent automatically captures stdout and stderr from the container and streams them to CloudWatch Logs without any additional agents or custom code.

Answer

Install the CloudWatch Agent in each container.

Answer

Configure AWS CloudTrail to capture logs.

Answer

Write logs to a file and use an S3 bucket with event notifications.