DOP-C02 Incident and Event Response Practice Test 15 — 15 Questions

Question 1

A DevOps team is troubleshooting an application that occasionally throws 'Connection reset by peer' errors when connecting to an RDS MySQL instance. The errors are intermittent and seem to correlate with high traffic. Which TWO steps should the team take to diagnose the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the RDS error log for messages about connection timeouts or aborted connections.. Checking the RDS error log can reveal messages about connection timeouts or aborted connections, which are typical causes of 'Connection reset by peer' errors. Option D is correct because Performance Insights provides detailed analysis of database load and can identify bottlenecks (e.g., high CPU, contention) that lead to dropped connections under high traffic. Option B is incorrect because increasing max_connections does not address the underlying resource or configuration issues causing the intermittent resets, and may worsen performance. Option C is incorrect because Multi-AZ provides failover redundancy but does not prevent connection resets from load or misconfiguration. Option E is incorrect because security group rules are static; if they were blocking connections, the error would be persistent, not intermittent.

Answer

Increase the max_connections parameter in the DB parameter group.

Answer

Enable Multi-AZ deployment to provide a standby instance.

Answer

Review the security group rules to ensure the application can connect.

Question 2

A company uses AWS CodePipeline for CI/CD. A recent pipeline execution failed at the 'Deploy' stage with the error 'Action execution failed: Access Denied'. The pipeline uses an IAM service role. Which THREE checks should the engineer perform to resolve this?

Accepted Answer

Verify that the IAM service role has sufficient permissions to perform the deploy action on the target resource.. The 'Access Denied' error at the Deploy stage indicates a permissions issue. The correct checks are: B) Verify that the IAM service role has sufficient permissions for the deploy action on the target resource, as the role must have the necessary IAM policies to perform deployments. C) Ensure the artifact store S3 bucket has a bucket policy that allows the pipeline role to access it, because the pipeline needs to read artifacts from the bucket. E) Confirm that the service role's trust policy allows CodePipeline to assume the role, since the trust policy must grant the `sts:AssumeRole` permission to the CodePipeline service. Option A is incorrect because CloudWatch Events rules trigger pipeline execution but are not related to the deploy stage's access denied error. Option D is incorrect because S3 event notifications trigger the pipeline on code changes, not resolve deployment failures.

Answer

Check that CloudWatch Events rule is configured to trigger the pipeline.

Answer

Enable S3 event notifications to trigger the pipeline on code changes.

Question 3

A DevOps engineer applied the above S3 bucket policy to restrict access. Users report that they can download objects from the bucket only when using HTTPS from within the 10.0.0.0/8 network. However, users outside that network receive access denied errors even over HTTPS. What is wrong with the policy?

Accepted Answer

The Allow statement only allows requests from the specific IP range; requests from other IPs are implicitly denied even over HTTPS.. The policy has an Allow statement that grants s3:GetObject only when the request comes from the 10.0.0.0/8 IP range and uses HTTPS (SecureTransport true). The Deny statement explicitly blocks non-HTTPS requests regardless of IP. However, requests from outside the 10.0.0.0/8 range over HTTPS are not explicitly denied; they are implicitly denied because the Allow statement does not cover them. Since IAM policy evaluation defaults to deny, and no other statement allows access for those requests, they are denied. Option A is incorrect because the Deny statement correctly blocks non-HTTPS. Option B is incorrect because the Allow statement already includes SecureTransport. Option C is incorrect because the Deny statement should not use SourceIp for this purpose; the Deny is for non-HTTPS, not IP filtering.

Answer

The Deny statement blocks all requests over HTTPS because of the BoolIfExists condition.

Answer

The Allow statement should include a condition for SecureTransport.

Answer

The Deny statement should use a Condition for SourceIp instead of SecureTransport.

Question 4

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application is deployed across three Availability Zones. The DevOps team uses AWS CloudFormation to manage the infrastructure. During a recent deployment, a stack update failed, and the stack entered a ROLLBACK_IN_PROGRESS state. However, the rollback also failed, leaving the stack in UPDATE_ROLLBACK_FAILED state. The engineer needs to restore the application to a working state. The stack includes an Auto Scaling group, an ALB, security groups, and a DynamoDB table. The DynamoDB table is defined with deletion protection enabled. The engineer is considering the following actions: A) ContinueUpdateRollback to retry the rollback, fixing the resource that caused the failure. B) Delete the stack and recreate it from the last known good template. C) Use CloudFormation's 'SignalResource' to manually complete the rollback. D) Manually update the resources to match the previous template, then resume the rollback. Which action should the engineer take?

Accepted Answer

Use ContinueUpdateRollback to retry the rollback after fixing the resource that caused the failure.. ContinueUpdateRollback is the designed CloudFormation operation to retry a failed rollback after fixing the underlying issue, such as DynamoDB deletion protection preventing the table from being deleted during rollback. The engineer can modify the DynamoDB table to disable deletion protection or remove the protection policy, then use ContinueUpdateRollback to complete the rollback. Option A is incorrect because CloudFormation does not support manually updating resources and then resuming rollback; the stack is in a failed state and requires an automated retry. Option C is incorrect because SignalResource is used to signal the creation of resources during a stack operation, not to handle rollback failures. Option D is incorrect because deleting the stack would also attempt to delete the DynamoDB table; despite deletion protection, the deletion may be blocked, causing further failure, and it would also delete other resources, leading to data loss.

Answer

Manually update the resources to match the previous template, then resume the rollback.

Answer

Use CloudFormation's 'SignalResource' to manually complete the rollback.

Answer

Delete the stack and recreate it from the last known good template.

Question 5

A company is using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is configured with a batch size of 10 and a maximum concurrency of 5. Recently, the function started experiencing high error rates and the SQS queue's ApproximateNumberOfMessagesVisible metric is increasing. The CloudWatch logs show that the function is timing out after 30 seconds. The function makes calls to an external API that sometimes takes more than 30 seconds to respond. The DevOps engineer needs to reduce the backlog and prevent message loss. The engineer is considering the following actions: A) Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds. B) Decrease the batch size to 1 to avoid processing multiple messages at once. C) Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions. D) Use a dead-letter queue to capture messages that fail processing after all retries. Which combination of actions should the engineer take?

Accepted Answer

Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds.. The correct action because increasing the Lambda function timeout to 60 seconds allows the function to wait longer for the external API, and increasing the SQS visibility timeout to 90 seconds prevents messages from becoming visible again before the function completes. This reduces unnecessary retries and helps clear the backlog. Option A (DLQ) is useful for capturing failed messages but does not address the timeout issue. Option B (decrease batch size) reduces throughput and worsens the backlog. Option D (increase concurrency) may lead to more timeouts if the function still cannot complete within the existing timeout.

Answer

Use a dead-letter queue to capture messages that fail processing after all retries.

Answer

Decrease the batch size to 1 to avoid processing multiple messages at once.

Answer

Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions.

Question 6

A DevOps engineer is responsible for monitoring a production environment that uses Amazon EC2 Auto Scaling. The engineer notices that the Auto Scaling group has been launching and terminating instances frequently over the past hour. The group uses a dynamic scaling policy based on average CPU utilization. The CloudWatch alarm that triggers scaling is set to a threshold of 70% CPU for scale-out and 30% for scale-in. The engineer checks the CloudWatch metrics and sees that CPU utilization is oscillating between 40% and 60%, never reaching the thresholds. The engineer suspects that the scaling policy is not working correctly. The engineer is considering the following actions: A) Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization. B) Increase the cooldown period for the scaling policy to 300 seconds. C) Disable the scale-in policy to prevent frequent terminations. D) Use a simple scaling policy instead of a dynamic scaling policy. Which action should the engineer take?

Accepted Answer

Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization.. A target tracking policy automatically adjusts the desired capacity to maintain a target utilization (e.g., 50%), which smooths out oscillations by continuously adapting to load rather than reacting to fixed thresholds. Option A is wrong because disabling scale-in could lead to over-provisioning and increased costs. Option C is wrong because simple scaling policies are more prone to causing oscillations due to step adjustments with cooldowns. Option D is wrong because increasing the cooldown period only delays scaling actions and does not address the root cause of oscillations; target tracking is more effective.

Answer

Disable the scale-in policy to prevent frequent terminations.

Answer

Use a simple scaling policy instead of a dynamic scaling policy.

Answer

Increase the cooldown period for the scaling policy to 300 seconds.

Question 7

A DevOps team uses AWS Systems Manager Incident Manager for incident response. They have an escalation plan that sends notifications to an SNS topic. However, during a recent incident, the on-call engineer did not receive the notification. The engineer's phone number and email are correct in the SSM Incident Manager contact settings. What is the MOST likely cause of the missed notification?

Accepted Answer

The SNS subscription for the engineer's contact was never confirmed.. The most likely cause is that the SNS subscription for the engineer's contact was never confirmed. SNS requires subscribers to confirm their subscription (via email or SMS) before messages are delivered. An unconfirmed subscription will not receive notifications, regardless of correct contact settings in SSM Incident Manager.

Answer

SSM Incident Manager requires a VPC endpoint for SNS, which is not configured.

Answer

The SNS topic's IAM policy does not allow Systems Manager to publish messages.

Answer

The SNS topic and the engineer's contact are in different AWS Regions.

Question 8

A company uses CloudWatch Synthetics canaries to monitor a critical API endpoint. Recently, a canary started failing with a '403 Forbidden' error. The DevOps engineer verifies that the canary's IAM role has the necessary permissions to invoke the API and that the API endpoint is publicly accessible. What should the engineer check NEXT?

Accepted Answer

Check if the API requires an API key or other authentication that the canary is not providing.. A 403 Forbidden error typically indicates that the API endpoint requires authentication (such as an API key) that the canary is not providing. Since the IAM role permissions and public accessibility are verified, the next logical step is to check if the API requires an API key or other authentication headers. Option A is wrong because CloudWatch Logs would show runtime errors, but the 403 is a response from the API, not a runtime error. Option B is wrong because increasing memory does not address authentication issues. Option D is wrong because the API endpoint is publicly accessible, so VPC configuration is irrelevant.

Answer

Review the canary's CloudWatch Logs for any runtime errors.

Answer

Increase the canary's memory to 512 MB to prevent timeout-related issues.

Answer

Verify that the canary is attached to the correct VPC and subnet.

Question 9

A company's DevOps team is designing an automated incident response workflow using AWS Systems Manager Incident Manager and AWS Lambda. The workflow should automatically acknowledge incidents and send notifications to the appropriate response team. Which TWO actions should the team take to achieve this?

Accepted Answer

Have the Lambda function publish a message to an SNS topic that the response team subscribes to.. The Lambda function can publish a message to an SNS topic, which sends notifications to the response team. Option E is correct because an Amazon EventBridge rule can match Incident Manager events (e.g., incident creation) and trigger the Lambda function to acknowledge the incident and initiate notifications. Option B is incorrect because CloudWatch alarms do not directly invoke Incident Manager; incidents are created through response plans or EventBridge. Option C is incorrect because Incident Manager's built-in 'Acknowledge' and 'Notify' actions are not independent actions; they are part of a response plan, and the question asks for actions to implement the workflow using Lambda. Option D is incorrect because AWS Step Functions is unnecessary overhead for this simple workflow; a direct integration between EventBridge, Lambda, and SNS suffices.

Answer

Configure the CloudWatch alarm to directly invoke the Lambda function for incident creation.

Answer

Use Incident Manager's built-in 'Acknowledge' and 'Notify' actions in a response plan.

Answer

Use AWS Step Functions to orchestrate the Lambda function and SNS topic.

Question 10

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a sudden spike in connections, causing the application to timeout. The DevOps engineer notices that the 'DatabaseConnections' metric is high, but the 'CPUUtilization' is low. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Check the 'max_connections' parameter in the DB parameter group and increase it if needed.. Checking the 'max_connections' parameter in the DB parameter group reveals whether the connection spike is hitting the configured limit. Increasing it temporarily can alleviate timeouts while investigating the root cause. Option D is correct because enabling the general_log and setting log_output to TABLE or FILE captures connection attempts, helping identify the source of connections (e.g., a surge from a specific application or an attack). Option E is correct because Performance Insights provides visibility into active sessions and top SQL, allowing the engineer to pinpoint which queries or connections are contributing to the spike. Option B is incorrect because adding a read replica offloads read traffic, not connections; the primary instance still handles all write connections. Option C is incorrect because scaling up the DB instance class primarily addresses CPU, memory, and I/O capacity, but does not directly increase the connection limit; it is better to first diagnose with logging and Performance Insights before resizing.

Answer

Add a read replica to offload read traffic.

Answer

Scale up the DB instance class to handle more connections.

Question 11

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The DevOps engineer needs to investigate the failure. Which TWO actions should the engineer take?

Accepted Answer

Review the 'Stack Events' tab in the CloudFormation console to see the specific error messages.. To investigate a CloudFormation stack update failure, the DevOps engineer should review the 'Stack Events' tab (Option B), which provides detailed error messages for each resource, helping identify the root cause. Additionally, examining the stack's 'Template' and 'Parameters' (Option D) can reveal misconfigurations that may have caused the failure. Option A is incorrect because CloudTrail logs record API calls but not the specific resource-level errors from the stack update. Option C is incorrect because 'Rollback triggers' are used to monitor stack status and initiate rollback, not to diagnose failures. Option E is incorrect because Change Sets are for previewing changes before execution, not for debugging a failed update.

Answer

Review AWS CloudTrail logs for the 'UpdateStack' API call.

Answer

Check the 'Rollback triggers' configuration for the stack.

Answer

Create a Change Set to see the proposed changes before re-attempting the update.

Question 12

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to route traffic to the ECS service. Recently, the DevOps team noticed that the ECS service is failing to deploy new tasks during a rolling update. The CloudWatch Logs for the ECS service show that new tasks are failing to start because they cannot pull the container image from Amazon ECR. The error message indicates 'AccessDenied' when attempting to pull the image. The task execution role has the necessary permissions, and the image URI is correct. The VPC has a VPC endpoint for ECR configured. The security group for the tasks allows outbound traffic to the VPC endpoint. What is the MOST likely cause of the access denied error?

Accepted Answer

The VPC endpoint for ECR does not have 'Private DNS names enabled' selected.. For ECS tasks using Fargate to pull images from ECR via a VPC endpoint, the private DNS names must be enabled on the endpoint. If not enabled, the task's DNS resolution of the ECR repository URL returns a public IP, which may be blocked by security groups or route tables, causing an 'AccessDenied' error despite correct IAM permissions. Option A is incorrect because 'ecr:GetAuthorizationToken' is needed for authentication, but the error occurs after authentication (the task execution role has permissions). Option B is irrelevant as the ALB security group does not affect image pulling. Option D is incorrect because the task role is for application-level permissions, not for pulling images; that is handled by the task execution role.

Answer

The task execution role does not have the 'ecr:GetAuthorizationToken' permission.

Answer

The security group for the ALB does not allow inbound traffic to the ECS tasks.

Answer

The task role does not have the 'ecr:BatchGetImage' permission.

Question 13

A company uses AWS CloudTrail to log API activity in their AWS account. The DevOps engineer needs to ensure that all management events are logged and that the logs are delivered to an S3 bucket in another account for centralized auditing. The engineer has already created an S3 bucket in the central auditing account and applied a bucket policy that grants the CloudTrail service permission to write logs. However, logs are not being delivered. The engineer verifies that the CloudTrail trail is configured to point to the correct S3 bucket name and that the bucket exists. What is the MOST likely reason the logs are not being delivered?

Accepted Answer

The S3 bucket policy in the central account does not include the 's3:PutObject' action for the CloudTrail service.. The S3 bucket policy must include the 's3:PutObject' action for the CloudTrail service principal. Without this action, even if the bucket policy grants write access generically, CloudTrail cannot put objects. Option B is incorrect because ACLs are not required; bucket policy is the standard mechanism for cross-account access. Option C is incorrect because VPC peering is not needed for S3 cross-account log delivery; it uses public internet or VPC endpoints. Option D is incorrect because CloudTrail trails can be created in one account and deliver logs to a bucket in another account; the trail does not need to be in the central auditing account.

Answer

The S3 bucket must have ACLs enabled to allow cross-account writes.

Answer

The source account does not have a VPC peering connection to the central auditing account.

Answer

The CloudTrail trail must be created in the central auditing account, not the source account.

Question 14

A company runs a production database on Amazon RDS for PostgreSQL. The DevOps team has set up a read replica to offload read traffic. Recently, the replica started experiencing replication lag that is increasing over time. The primary instance's CPU and memory utilization are normal. The network bandwidth between the primary and replica is not saturated. The team has already increased the replica's instance class, but the lag persists. The primary database is under heavy write load due to a batch job that runs hourly. What is the MOST likely cause of the increasing replication lag?

Accepted Answer

The batch job on the primary is using long-running transactions that are holding up WAL generation.. Long-running transactions on the primary hold up WAL generation. The replica must wait for the transaction to commit before applying changes, causing increasing replication lag. Increasing the replica's instance class does not address this root cause. Option A is incorrect because Multi-AZ does not reduce replication lag; it provides high availability. Option B is incorrect because max_standby_streaming_delay affects query cancellation on the replica, not the lag itself. Option D is incorrect because the replica size was already increased without improvement, so the bottleneck is on the primary, not the replica.

Answer

The primary database should be migrated to a Multi-AZ deployment instead of using a read replica.

Answer

The replica's 'max_standby_streaming_delay' parameter is set too low, causing the replica to cancel queries.

Answer

The replica's instance class is still too small for the write load from the primary.

Question 15

A company uses AWS Lambda functions that are triggered by S3 events (object creation). The Lambda function processes the file and stores results in DynamoDB. Recently, the function started timing out after 15 seconds, causing some files to not be processed. The average file size has increased significantly. The DevOps engineer increases the Lambda function's timeout to 30 seconds and the memory to 512 MB, but the function still times out for large files. The CloudWatch Logs show that the timeout occurs during the 'dynamodb.put_item' call for a large item. The DynamoDB table's write capacity is set to on-demand, and there are no throttling errors. What should the engineer do to resolve the timeout issue?

Accepted Answer

Modify the Lambda function to split the large item into multiple smaller items before writing to DynamoDB.. The DynamoDB put_item API call is timing out due to the item size exceeding the 400 KB limit. Splitting the large item into multiple smaller items reduces the payload per request, allowing the call to complete within the timeout. Option B is incorrect because adding an SQS queue does not address the root cause of the large item size; the downstream Lambda would still face the same timeout issue. Option C is incorrect because EFS is a file storage service and is not relevant to DynamoDB API timeouts. Option D is incorrect because increasing the timeout and memory does not resolve the DynamoDB API call timeout caused by exceeding the item size limit.

Answer

Configure the Lambda function to write to an SQS queue first, then have another Lambda process the queue.

Answer

Mount an EFS file system to the Lambda function and write the large item to a file instead of DynamoDB.

Answer

Increase the Lambda function's timeout to 5 minutes and memory to 1024 MB.