DOP-C02 Incident and Event Response Practice Test 15 — 15 Questions

Question 1

A DevOps engineer is troubleshooting an issue where an Amazon RDS instance's CPU utilization is consistently high. The engineer has enabled Performance Insights and sees that the top SQL query is a SELECT statement that scans many rows. What is the best course of action to reduce CPU utilization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add appropriate indexes to optimize the query.. Adding appropriate indexes to optimize the query is the best course of action because the high CPU utilization is caused by a SELECT statement that scans many rows. Indexes allow the database to locate rows efficiently without scanning the entire table, reducing CPU load and improving query performance. This directly addresses the root cause identified by Performance Insights.

Answer

Create a read replica to offload read traffic.

Answer

Increase the allocated storage to improve I/O.

Answer

Increase the DB instance size to handle the load.

Question 2

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer has updated the files in the S3 bucket. What should the engineer do to ensure users see the latest content?

Accepted Answer

Create an invalidation for the updated file paths.. Creating a CloudFront invalidation for the specific file paths forces the edge locations to fetch the updated content from the S3 origin immediately, ensuring users see the latest files. Option B is incorrect because changing the bucket policy to allow public access does not affect CloudFront's cache; it only controls direct access to the bucket. Option C is incorrect because reducing the TTL affects how long new content is cached but does not clear already-cached outdated content. Option D is incorrect because deleting and recreating the distribution is an overly disruptive solution; a simple invalidation suffices.

Answer

Change the S3 bucket policy to allow public access.

Answer

Reduce the TTL for the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 3

A DevOps team is investigating a security incident where an unauthorized user accessed an S3 bucket. The team needs to determine what actions were taken by the user. Which TWO AWS services should be used together to investigate? (Choose TWO.)

Accepted Answer

S3 server access logs. S3 server access logs (A) are correct because they record detailed, object-level requests made against a bucket, including the requester, bucket name, request time, action (such as REST.GET.OBJECT or REST.PUT.OBJECT), response status, and error code, which lets the team see exactly what operations the unauthorized user performed on the objects. AWS CloudTrail (D) is correct because it captures S3 data events (GetObject, PutObject, DeleteObject) and management events (such as PutBucketPolicy) as API activity with the identity of the caller, source IP address, and timestamp, providing the who-did-what audit trail needed to attribute the actions. Used together, CloudTrail identifies the principal and API calls while S3 server access logs provide the granular request-level detail for the bucket. Amazon CloudWatch metrics (B) only provides aggregate performance and usage statistics, not per-request identity or action detail, so it cannot show what the user did. AWS Config (C) tracks resource configuration changes and compliance over time, not individual object access actions. Amazon GuardDuty (E) is a threat-detection service that generates findings about suspicious activity but does not provide the raw request-level or API-level audit records required to reconstruct the user's actions.

Answer

Amazon CloudWatch metrics

Answer

AWS Config

Answer

Amazon GuardDuty

Question 4

A DevOps engineer needs to receive notifications when an EC2 instance's status check fails. Which TWO services should the engineer use? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Alarms (Option E) can monitor EC2 instance status checks (both system and instance checks) and trigger an action when the alarm state changes to ALARM. Amazon SNS (Option B) is the service that delivers the notification by publishing messages to subscribers (e.g., email, SMS, HTTP endpoints) when the CloudWatch alarm triggers. Together, they provide a complete monitoring and notification pipeline for status check failures.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS Config

Question 5

An EC2 instance shows as 'running' in the AWS console, but the system status check is 'impaired'. What is the most likely cause?

Accepted Answer

The underlying physical host has experienced a failure.. The system status check specifically monitors the underlying physical host and hypervisor-level networking. When it is impaired, it indicates a failure of the AWS infrastructure supporting the instance, such as a power loss, network connectivity issue, or hardware degradation on the physical server. Since the instance status check (which monitors the guest OS) is not mentioned, the most likely cause is a host-level failure.

Answer

The instance's security group rules are blocking traffic.

Answer

The EBS root volume is corrupted.

Answer

The instance's operating system is not responding.

Question 6

A DevOps team is debugging a production incident where an Application Load Balancer (ALB) is returning 503 errors for some requests. The target group instances are healthy. What is the most likely cause?

Accepted Answer

The deregistration delay setting on the target group is too long. The deregistration delay setting controls how long the ALB continues to send requests to an instance that is being deregistered. If this delay is too long, the ALB may route traffic to an instance that has already stopped accepting connections, resulting in 503 errors even though the health checks pass. Option A is incorrect because a missing security group rule would prevent any traffic from reaching the ALB, causing connection timeouts rather than 503 errors. Option B is incorrect because the instance health checks are passing (as stated), so the health check path must be correct. Option D is incorrect because disabling cross-zone load balancing affects traffic distribution but does not cause 503 errors.

Answer

The security group for the ALB does not allow inbound traffic on port 443

Answer

Health checks are misconfigured to use an incorrect path

Answer

Cross-zone load balancing is disabled

Question 7

A company uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with the error 'The following resource(s) failed to create: [AWS::RDS::DBInstance]'. Which AWS service should the engineer use to view detailed error messages for the failed resource creation?

Accepted Answer

AWS CloudFormation console Events tab. The CloudFormation console's Events tab shows the chronological sequence of stack events, including the specific status reason for each resource failure. When a resource like AWS::RDS::DBInstance fails to create, the Events tab displays the underlying error message returned by the RDS API (e.g., invalid parameter, insufficient privileges, or subnet issues). This is the fastest and most direct way to diagnose the failure.

Answer

AWS Config timeline

Answer

AWS Service Catalog

Answer

AWS CloudTrail event history

Question 8

A DevOps engineer receives a CloudWatch alarm for high CPU utilization on an EC2 instance. The engineer needs to investigate the cause. Which AWS service can provide a detailed analysis of the running processes and their resource consumption?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command lets you remotely execute commands on EC2 instances (via the SSM agent) without SSH or RDP, so you can run tools like top, ps, htop, or perf to inspect running processes and CPU/memory consumption in real time. This is the correct service for interactive, instance-level process investigation triggered by a CloudWatch CPU alarm.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 9

A company uses Amazon S3 to store critical data. An incident occurs where an S3 bucket is accidentally deleted. The DevOps engineer needs to recover the bucket and its objects. What should the engineer do?

Accepted Answer

Recreate the bucket with the same name and restore objects from a previous backup. S3 bucket names are globally unique and, once deleted, cannot be restored by AWS — the bucket and its configuration are gone. The correct recovery approach is to recreate the bucket with the same name (if the name is still available) and restore the objects from a backup or from versioned copies if versioning was enabled. This is the only viable path to recovery.

Answer

Restore the bucket from AWS CloudTrail event history

Answer

Contact AWS Support to restore the bucket from a backup if versioning was enabled

Answer

Use the AWS S3 console to undo the deletion

Question 10

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. During an incident, the API returns 502 Bad Gateway errors. The Lambda function logs show no errors. What is the most likely cause?

Accepted Answer

The Lambda function is returning a response that exceeds the API Gateway payload size limit. When an API Gateway REST API returns 502 Bad Gateway errors but the Lambda function logs show no errors, the most likely cause is that the Lambda function is returning a response that exceeds the API Gateway payload size limit. API Gateway has a maximum payload size of 10 MB for REST APIs, and if the Lambda function returns a response larger than this, API Gateway will reject it and return a 502 error without the Lambda function itself throwing an exception or logging an error.

Answer

The Lambda function is throwing an unhandled exception

Answer

The API Gateway has reached its maximum concurrency limit

Answer

The Lambda function is timing out and API Gateway is not handling the timeout correctly

Question 11

A DevOps engineer is investigating a security incident where an EC2 instance was used to launch an outbound DDoS attack. Which AWS service can provide details about the source IP addresses and network traffic from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC, including source and destination IP addresses, ports, protocol, and accept/reject status. For an EC2 instance launching an outbound DDoS attack, flow logs provide the source IPs and traffic patterns needed to identify the attack destinations and volume. This is the service designed for network-level traffic visibility.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 12

A company uses an AWS Elastic Load Balancer (ELB) to distribute traffic to EC2 instances. During an incident, some users report slow response times. The DevOps engineer suspects that one instance is unhealthy but the health check is not detecting it. What should the engineer do to improve health check accuracy?

Accepted Answer

Configure a health check that checks a specific application endpoint. A health check that targets a specific application endpoint (e.g., /health or /api/status) validates that the application is actually functioning, not just that the instance responds on a port. This catches unhealthy instances that still accept TCP connections but fail to serve requests, which is exactly the scenario described. The other options either weaken detection or do not improve accuracy.

Answer

Increase the health check interval to reduce load on instances

Answer

Decrease the health check unhealthy threshold to 2

Answer

Set the health check path to the root document ('/')

Question 13

A company experiences a security incident where an IAM user's access key is compromised. Which THREE steps should the DevOps engineer take immediately?

Accepted Answer

Review AWS CloudTrail logs for any unauthorized API calls. Option A is correct because AWS CloudTrail records all API activity in the account, so reviewing its logs lets the engineer identify unauthorized calls made with the compromised access key and assess the incident's scope. Option B is correct because rotating the access key—creating a new key pair and deleting the compromised key—immediately invalidates the leaked credential so it can no longer be used for API authentication. Option E is correct because if the compromised IAM user had assumed roles or obtained temporary credentials via STS, those session tokens remain valid until expiry, so they must be explicitly revoked (e.g., by attaching a deny-all policy or using AWSRevokeOlderSessions) to cut off the attacker's access. Option C does not belong because changing the IAM user's console password does not affect the compromised access key, which is used for programmatic API calls rather than console sign-in. Option D does not belong because deleting and recreating the IAM user is a disruptive, unnecessary step that would break existing permissions and resource associations; rotating the key and revoking sessions is sufficient to contain the incident.

Answer

Change the IAM user's password

Answer

Delete the IAM user and recreate it

Question 14

A company runs a multi-tier web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors during peak traffic. The Auto Scaling group is configured with a step scaling policy based on CPU utilization. CloudWatch metrics show that CPU utilization never exceeds 70%, but the ALB target group reports that some targets are unhealthy. What is the MOST likely cause?

Accepted Answer

The application health check endpoint is returning HTTP 5xx or timing out.. ALB target groups mark targets unhealthy when the configured health check fails — typically because the application endpoint returns 5xx or times out. Unhealthy targets are removed from rotation, and if too few healthy targets remain to serve peak traffic, the ALB returns 503 Service Unavailable. Since CPU never exceeds 70%, the ASG is not scaling out, confirming the bottleneck is health-check failures rather than capacity.

Answer

The ALB is misconfigured with an incorrect security group blocking traffic to the targets.

Answer

The ALB connection draining settings are too short, causing in-flight requests to fail.

Answer

The step scaling policy is too aggressive and is terminating instances prematurely.

Question 15

A DevOps engineer is troubleshooting a Lambda function that processes S3 events. The function has been running successfully for months, but today it started timing out. The engineer checks CloudWatch Logs and sees 'Task timed out after 3.01 seconds' errors. The function is configured with a 3-second timeout. What should the engineer do to resolve the issue?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The error 'Task timed out after 3.01 seconds' indicates the function is exceeding its configured 3-second timeout. Since the function has been running successfully for months and only recently started timing out, the workload has likely grown (larger S3 objects, downstream latency, or cold starts). Increasing the timeout to 10 seconds gives the function enough time to complete its processing, directly addressing the timeout error.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.