DOP-C02 Incident and Event Response Practice Test 16 — 15 Questions

Question 1

A company uses AWS CodePipeline for CI/CD. During a production deployment, the pipeline fails at the 'Deploy' stage with an error: 'The deployment failed because the deployment group does not have enough capacity to handle the deployment.' The engineer checks the CodeDeploy deployment group and sees that it is configured with a minimum healthy hosts of 100% and a deployment configuration of 'CodeDeployDefault.OneAtATime'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deployment group has only one instance, and the minimum healthy hosts setting prevents the deployment.. With a minimum healthy hosts of 100% and a OneAtATime deployment configuration, CodeDeploy must keep all instances healthy during the deployment. If the deployment group contains only one instance, taking it out of service to deploy would drop healthy hosts below 100%, making the deployment impossible. This is the most likely cause of the capacity error.

Answer

The deployment configuration 'OneAtATime' is not compatible with the deployment group.

Answer

The target group health check is misconfigured, causing all instances to be unhealthy.

Answer

The CodeDeploy agent on the instances is not running.

Question 2

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the DevOps engineer notices that some users are being logged out and losing session data. The deployment uses a rolling update strategy. What is the MOST likely cause?

Accepted Answer

The session data is stored locally on the EC2 instance, not in a shared external store.. Sticky sessions on the ALB bind a user to a specific EC2 instance via a cookie (AWSALB). If session data is stored locally on that instance, terminating the instance during a rolling update destroys the session data, logging the user out. The correct fix is to externalize session state to a shared store like ElastiCache, DynamoDB, or a database so any instance can serve any user.

Answer

The Auto Scaling group is terminating instances before the new ones are fully ready.

Answer

The health check interval is too long, causing the ALB to route traffic to unhealthy instances.

Answer

The ALB sticky session cookie is not being generated correctly.

Question 3

A company runs a critical application on EC2 instances in an Auto Scaling group. The application must be highly available across multiple Availability Zones. Which TWO configurations are necessary to achieve this? (Choose TWO.)

Accepted Answer

Place an Application Load Balancer in front of the Auto Scaling group.. To achieve high availability across multiple Availability Zones (AZs), two key configurations are required. First, the Auto Scaling group must be configured to launch instances in multiple AZs (Option E). This ensures that if one AZ fails, the application can continue serving traffic from instances in other AZs. Second, an Application Load Balancer (ALB) should be placed in front of the Auto Scaling group (Option D). The ALB distributes incoming traffic across instances in all AZs where the Auto Scaling group has launched instances. It also performs health checks and automatically routes traffic away from unhealthy instances. Option A is incorrect because using a single AZ would create a single point of failure, undermining high availability. Option B is incorrect because Spot Instances can be terminated with little notice, which is unsuitable for a critical application requiring consistent availability. Option C is incorrect because a Classic Load Balancer lacks advanced features like path-based routing and native cross-zone load balancing, making the ALB a better choice for modern applications.

Answer

Use a single Availability Zone to reduce latency.

Answer

Use Spot Instances to reduce costs.

Answer

Use a Classic Load Balancer to distribute traffic.

Question 4

Refer to the exhibit. The DevOps engineer runs the commands and sees the output. What is the most likely issue with the instance?

Accepted Answer

The underlying hardware is having issues (system status check failed).. The SystemStatus is 'impaired', indicating a problem with the underlying physical host (system status check failed). The InstanceStatus is 'ok', so the OS is functioning normally. Option B is incorrect because the system status check shows impairment, so there is an issue. Option C is incorrect because the instance is running, not stopped. Option D is incorrect because the impairment is at the system level, not the OS level.

Answer

The instance is healthy and no issues exist.

Answer

The instance is stopped.

Answer

The instance has a failed status check due to OS-level issues.

Question 5

A DevOps engineer notices that an EC2 instance is unresponsive and the CloudWatch alarm 'StatusCheckFailed' is in ALARM state. The instance was launched in a private subnet with no public IP. Which action should the engineer take to diagnose the issue without creating a new instance?

Accepted Answer

Use EC2 Serial Console to connect to the instance.. EC2 Serial Console provides out-of-band access to the instance console, allowing troubleshooting of OS-level issues even when network connectivity is lost. Option A is wrong because modifying the security group to allow SSH from the engineer's IP does not help if the instance is unresponsive at the OS level. Option B is wrong because Systems Manager Session Manager requires the instance to have connectivity to the Systems Manager endpoint and the agent running. Option C is wrong because AWS Personal Health Dashboard provides service health notifications, not instance-level troubleshooting.

Answer

Modify the security group to allow SSH from the engineer's IP.

Answer

Use AWS Systems Manager Session Manager to start a session.

Answer

Check AWS Personal Health Dashboard for instance issues.

Question 6

A company uses Amazon RDS for MySQL and has enabled automated backups. The database administrator accidentally deleted a critical row from a table. The deletion occurred 15 minutes ago. What is the fastest way to recover the lost data?

Accepted Answer

Perform a Point-in-Time Restore to a time just before the deletion.. Amazon RDS automated backups enable Point-in-Time Restore (PITR), which uses continuous transaction log backups to restore the instance to any second within the retention window (up to 35 days). Since the deletion happened 15 minutes ago, performing a PITR to a time just before the deletion is the fastest and most precise recovery method. This restores to a new instance, from which the lost row can be extracted.

Answer

Use the RDS console to undo the last transaction.

Answer

Use the binary log to replay transactions before the deletion.

Answer

Create a manual snapshot of the current instance and restore it.

Question 7

A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?

Accepted Answer

Check ALB access logs for target response times.. A 504 error indicates the load balancer did not receive a response from the target within the idle timeout period. Checking ALB access logs for target response times is the first step to determine if the backend is slow or unresponsive. Option A is wrong because scaling policies affect the number of instances, not response times. Option B is wrong because health checks verify instance availability, but intermittent slow responses may not cause health check failures. Option C is wrong because security group rules would cause different errors (e.g., connection timeouts) rather than 504s.

Answer

Review the Auto Scaling group scaling policies.

Answer

Verify the target group health checks are passing.

Answer

Check security group rules for the ALB.

Question 8

A company experiences a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The DevOps team needs to identify the source IP address and user agent of the request. Which AWS service provides this information?

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs record detailed information about every request made to a bucket, including the requester's IP address, user agent, request time, and operation. This is the only AWS service in the list that captures the source IP and user agent for S3 object-level requests. CloudTrail records API management events but does not log data-plane GET/PUT requests by default.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 9

An Amazon RDS for PostgreSQL instance is running low on storage. The DevOps engineer needs to increase the allocated storage without downtime. Which action should be taken?

Accepted Answer

Modify the DB instance to increase the allocated storage.. Amazon RDS supports storage autoscaling and manual storage scaling by modifying the DB instance's allocated storage. Increasing allocated storage is an online operation that does not require downtime; RDS handles the underlying volume expansion transparently. This is the correct action to increase storage without downtime.

Answer

Modify the DB instance to a larger instance class.

Answer

Create a snapshot of the DB instance and restore it with larger storage.

Answer

Launch a new read replica with larger storage and promote it.

Question 10

A DevOps team is investigating a performance issue where an application's response time spiked during a deployment. The deployment used AWS CodeDeploy to update an Auto Scaling group. Which THREE actions should the team take to identify the root cause? (Choose THREE.)

Accepted Answer

Review the CodeDeploy deployment logs for errors.. CodeDeploy deployment logs contain detailed information about the deployment process, including any errors or failed steps that could impact performance. Option B is correct because application logs on the new EC2 instances can reveal errors, misconfigurations, or resource contention that may have caused the spike. Option E is correct because comparing CloudWatch metrics (e.g., CPU utilization, latency, request count) before and after the deployment helps pinpoint changes that correlate with the performance issue. Option C is wrong because reviewing the deployment group configuration—which defines how deployments occur (e.g., traffic routing, instance selection)—is unlikely to directly identify the root cause of a performance spike; it is more relevant for deployment strategy issues. Option D is wrong because AWS CloudTrail records API calls for auditing and security, not application performance; unauthorized API calls are unlikely to cause a transient performance spike during deployment.

Answer

Review the CodeDeploy deployment group configuration.

Answer

Check AWS CloudTrail for any unauthorized API calls during the deployment.

Question 11

A company uses AWS Systems Manager to manage a fleet of EC2 instances. During an incident, a DevOps engineer needs to execute a script on a specific instance to collect diagnostic data. The engineer does not have SSH key access. Which approach should the engineer use to execute the script?

Accepted Answer

Use AWS Systems Manager Run Command to execute the script.. AWS Systems Manager Run Command is the correct tool because it lets you execute scripts or commands on managed EC2 instances remotely without SSH, RDP, or any inbound ports open. The instance only needs the SSM Agent and an IAM instance profile with the right permissions, which satisfies the 'no SSH key access' constraint.

Answer

Use AWS OpsWorks to run the script as a Chef recipe.

Answer

Use EC2 Instance Connect to SSH into the instance and run the script.

Answer

Use AWS Systems Manager Session Manager to open a shell and run the script.

Question 12

A DevOps team is configuring CloudWatch alarms for their production environment. They want to receive notifications when the CPUUtilization metric of an EC2 instance exceeds 90% for three consecutive 5-minute periods. Which combination of settings should they use?

Accepted Answer

Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 3. To alarm when CPUUtilization exceeds 90% for three consecutive 5-minute periods, you need a period of 5 minutes, evaluation periods of 3, and datapoints to alarm of 3. This means CloudWatch evaluates the metric over three consecutive periods, and all three must breach the threshold to trigger the alarm. This configuration exactly matches the requirement.

Answer

Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 1

Answer

Period: 5 minutes; Evaluation periods: 1; Datapoints to alarm: 3

Answer

Period: 5 minutes; Evaluation periods: 5; Datapoints to alarm: 3

Question 13

During an incident, a DevOps engineer needs to quickly revoke access to a set of IAM users who are suspected to be compromised. The users have programmatic access keys and console passwords. The engineer wants to minimize the impact on non-compromised users. Which action should the engineer take FIRST?

Accepted Answer

Attach an IAM policy that explicitly denies all actions to the compromised users.. Attaching an explicit Deny policy to the compromised users immediately blocks all API and console actions for those principals while leaving other users untouched, and it is reversible once the incident is resolved. This is the fastest containment step that satisfies least-impact on non-compromised users. Deleting keys or users is more destructive and slower to reverse.

Answer

Delete the compromised IAM users.

Answer

Delete the access keys of the compromised users.

Answer

Change the IAM password policy to require strong passwords.

Question 14

A company uses AWS CloudTrail to log all API calls. During an incident investigation, a security engineer needs to identify who deleted an S3 bucket named 'critical-data' two days ago. Which approach will provide the necessary information?

Accepted Answer

Use AWS CloudTrail LookupEvents API to search for DeleteBucket events.. CloudTrail records management events such as DeleteBucket, and the LookupEvents API allows programmatic search of the last 90 days of event history by event name, so it can identify who deleted the bucket two days ago. This is the intended mechanism for API-level auditing. The other options either lack the event detail, cover only data-plane access, or require prior configuration that is not guaranteed.

Answer

Check the AWS Management Console activity history.

Answer

Review the S3 access logs for the bucket.

Answer

Search CloudWatch Logs for 'DeleteBucket' events.

Question 15

A company uses an Auto Scaling group with a dynamic scaling policy based on the average CPU utilization of the instances. During an incident, the DevOps team notices that the Auto Scaling group is not launching new instances quickly enough to handle a traffic spike. What is a possible cause for the slow scaling response?

Accepted Answer

The cooldown period is set too high.. A high cooldown period prevents the Auto Scaling group from launching additional instances immediately after a scaling activity, even if the CPU utilization remains high. During a traffic spike, if the cooldown is set too high, the group waits before responding to further scaling triggers, resulting in slow scale-out. Reducing the cooldown period allows the group to react more quickly to sustained high demand.

Answer

The health check grace period is set too low.

Answer

The minimum group size is set too low.

Answer

The launch template has a long warm-up time.