DOP-C02 Incident and Event Response Practice Test 16 — 15 Questions

Question 1

A company runs a critical application on Amazon ECS with Fargate launch type. During an incident, the DevOps engineer notices that tasks are failing with 'CannotPullContainerError: API error (500)'. Which TWO steps should the engineer take to resolve this issue?

Accepted Answer

Ensure that the ECR repository policy allows the task execution role to pull images.. Options A and C are correct. A is correct because a missing or invalid task execution role can prevent ECS from pulling the image from ECR. C is correct because if the image is in a private ECR repository, the task execution role needs the ecr:GetDownloadUrlForLayer permission. Option B is wrong because the service role is for load balancer integration, not image pulling. Option D is wrong because Fargate does not support EBS. Option E is wrong because increasing task memory is unrelated to pulling images.

Answer

Attach an EBS volume to the Fargate task for caching.

Answer

Check that the ECS service role has the required permissions.

Answer

Increase the task memory to accommodate the image pull.

Question 2

A DevOps engineer notices that an Auto Scaling group is repeatedly launching and terminating instances. CloudWatch alarms show high CPU but the group's metrics are erratic. What is the most likely cause?

Accepted Answer

The health check grace period is too short and the health check type is ELB, but the load balancer health check is failing.. Option C is correct because incorrect health check configuration can cause the Auto Scaling group to continuously replace instances that are actually healthy, leading to the described behavior. Option A is wrong because insufficient AMI configuration would cause launch failures, not repeated cycling. Option B is wrong because load balancer health checks determine instance health; if they are not configured, instances are considered healthy. Option D is wrong because changing launch template user data would not cause cycling.

Answer

The Auto Scaling group is not associated with a load balancer.

Answer

The launch template user data is causing instances to fail during boot.

Answer

The AMI used in the launch template is not properly configured.

Question 3

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

Accepted Answer

Check if the instances have outbound internet connectivity to the SSM endpoints.. Option B is correct because checking if the instances have internet connectivity is essential for SSM Agent to communicate with the Systems Manager service. Option A is wrong because the state manager association is not directly related to connectivity. Option C is wrong because IAM roles are necessary for SSM, but the logs show no errors, so roles are likely correct. Option D is wrong because the SSM Agent logs show no errors, so agent is running.

Answer

Restart the SSM Agent on the affected instances.

Answer

Verify that the patch baseline is associated with the instances.

Answer

Review the IAM role attached to the instances for sufficient permissions.

Question 4

During a deployment, a new application version on an ECS service starts failing health checks. The previous version is still running. The deployment is a rolling update with a 200% percent start. Which ECS feature should the engineer use to automatically revert to the previous version?

Accepted Answer

ECS deployment circuit breaker. Option D is correct because a circuit breaker automatically detects deployment failures and rolls back. Option A is wrong because ECS service auto recovery is for underlying infrastructure. Option B is wrong because managed scaling adjusts desired count, not rollback. Option C is wrong because CloudWatch alarms can trigger rollback but are not automatic within ECS itself.

Answer

ECS service auto recovery

Answer

ECS managed scaling

Answer

CloudWatch alarm actions

Question 5

An application runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The engineer checks ALB metrics and sees 'SurgeQueueLength' increasing periodically. What is the most likely cause?

Accepted Answer

The application instances are not able to process requests quickly enough, causing the request queue to back up.. Option B is correct because a high SurgeQueueLength indicates that the ALB is receiving more requests than the instances can handle, and the queue is filling up, leading to 503 errors when the queue overflows. Option A is wrong because unhealthy hosts would cause errors but not necessarily an increasing queue. Option C is wrong because a misconfigured security group would block traffic entirely. Option D is wrong because an SSL certificate issue would cause TLS errors, not 503.

Answer

The target group health checks are failing, causing the ALB to route traffic to unhealthy instances.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB security group is blocking traffic from the clients.

Question 6

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with the error 'UPDATE_ROLLBACK_FAILED'. What should the engineer do to resolve this?

Accepted Answer

Use the 'ContinueUpdateRollback' operation to fix the resource that caused the failure.. Option B is correct because a rollback failure indicates that CloudFormation could not undo some changes. Continuing the rollback process or manually fixing the resource allows the stack to reach a consistent state. Option A is wrong because deleting the stack may cause data loss. Option C is wrong because ignoring may leave the stack in an inconsistent state. Option D is wrong because updating again may compound the issue.

Answer

Retry the stack update with the same parameters.

Answer

Delete the stack and recreate it.

Answer

Ignore the error and continue using the stack.

Question 7

A company uses RDS Multi-AZ with a read replica. During a failover test, the application experiences a 30-second write outage. The application uses a single DB endpoint. How can the outage be minimized?

Accepted Answer

Use RDS Proxy to handle database connections and failover.. Option C is correct because using the RDS proxy with connection pooling and failover handling reduces the outage window by automatically rerouting connections. Option A is wrong because Multi-AZ already provides a standby, but DNS propagation takes time. Option B is wrong because multiple write endpoints are not supported. Option D is wrong because increasing instance size does not reduce failover time.

Answer

Increase the instance class to improve failover performance.

Answer

Use a Route 53 weighted record with health checks to point to both instances.

Answer

Configure the application to use the read replica endpoint for writes.

Question 8

A Lambda function processes SQS messages but sometimes times out after 15 seconds. The function performs a database call that occasionally takes longer. What is the best way to handle this without losing messages?

Accepted Answer

Increase the Lambda timeout and increase the SQS visibility timeout, and add a dead-letter queue.. Option D is correct because increasing the visibility timeout allows the function more time to process, and using a DLQ ensures that messages that repeatedly fail are captured. Option A is wrong because decreasing visibility timeout would cause messages to reappear sooner. Option B is wrong because reducing reserved concurrency would cause throttling. Option C is wrong because splitting the batch does not address the timeout.

Answer

Decrease the SQS visibility timeout to retry faster.

Answer

Split the batch into smaller batches using partial batch response.

Answer

Reduce the Lambda reserved concurrency to limit invocations.

Question 9

A company uses CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed KMS key. What must be done to enable this?

Accepted Answer

Associate a customer-managed KMS key with the log group and update the key policy to allow CloudWatch Logs to use it.. Option D is correct because CloudWatch Logs supports encryption at rest using a customer-managed KMS key. To enable this, you must associate the KMS key with the log group via the CloudWatch Logs console or API, and you must update the key policy to grant CloudWatch Logs the necessary permissions (kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:DescribeKey). Without this key policy update, CloudWatch Logs cannot use the key to encrypt the log data at rest.

Answer

Enable encryption on the log group using the default AWS managed key.

Answer

Use a third-party encryption tool before sending logs to CloudWatch.

Answer

Create a new log group in a region where KMS is enabled.

Question 10

An organization uses AWS Config to track resource changes. They notice that a particular S3 bucket policy was deleted, but the Config rule 's3-bucket-policy-grantee-check' did not trigger a remediation. What is the most likely reason?

Accepted Answer

The bucket was deleted and recreated, and the configuration recorder did not capture the deletion event.. Option C is correct because AWS Config evaluates rules only when a configuration change occurs. If the bucket was deleted and recreated, the deletion of the policy may not have been recorded as a change if the bucket itself was recreated without a policy. Option A is wrong because Config supports bucket policies. Option B is wrong because evaluation frequency does not affect triggered evaluations. Option D is wrong because S3 bucket policy changes are supported.

Answer

The Config rule does not support S3 bucket policies.

Answer

The rule is set to evaluate resources only on a periodic basis.

Answer

The S3 bucket policy change is not supported by AWS Config.

Question 11

A company uses Amazon CloudFront with an S3 origin. Users in Europe report slow load times. The engineer needs to improve performance for European users. Which TWO actions should the engineer take?

Accepted Answer

Add additional price classes to the CloudFront distribution (e.g., Price Class 200).. Option A is correct because adding additional price class can include more edge locations in Europe. Option C is correct because using origin shield reduces load on the origin and improves performance. Option B is wrong because S3 Transfer Acceleration is for uploads, not CloudFront. Option D is wrong because enabling logging does not improve performance. Option E is wrong because enabling WAF does not improve performance.

Answer

Enable S3 Transfer Acceleration on the origin bucket.

Answer

Enable CloudFront access logs to identify slow requests.

Answer

Enable AWS WAF on the CloudFront distribution to block malicious traffic.

Question 12

A DevOps team is troubleshooting an application that occasionally throws 'Connection reset by peer' errors when connecting to an RDS MySQL instance. The errors are intermittent and seem to correlate with high traffic. Which TWO steps should the team take to diagnose the issue?

Accepted Answer

Check the RDS error log for messages about connection timeouts or aborted connections.. Option B is correct because RDS performance insights can show database load and identify if connections are being dropped. Option E is correct because checking the RDS error log can reveal connection-related errors. Option A is wrong because increasing max_connections may not help if the issue is resource contention. Option C is wrong because enabling Multi-AZ does not fix connection resets. Option D is wrong because security group changes are unlikely to be the cause of intermittent resets.

Answer

Increase the max_connections parameter in the DB parameter group.

Answer

Enable Multi-AZ deployment to provide a standby instance.

Answer

Review the security group rules to ensure the application can connect.

Question 13

A company uses AWS CodePipeline for CI/CD. A recent pipeline execution failed at the 'Deploy' stage with the error 'Action execution failed: Access Denied'. The pipeline uses an IAM service role. Which THREE checks should the engineer perform to resolve this?

Accepted Answer

Verify that the IAM service role has sufficient permissions to perform the deploy action on the target resource.. Option A is correct because the service role may lack permissions to the deployment target. Option C is correct because the artifact bucket needs permissions for the pipeline. Option D is correct because the IAM role trust policy must allow CodePipeline to assume it. Option B is wrong because CloudWatch Events are not required for pipeline execution. Option E is wrong because S3 events are not relevant to the deploy stage.

Answer

Check that CloudWatch Events rule is configured to trigger the pipeline.

Answer

Enable S3 event notifications to trigger the pipeline on code changes.

Question 14

A DevOps engineer applied the above S3 bucket policy to restrict access. Users report that they can download objects from the bucket only when using HTTPS from within the 10.0.0.0/8 network. However, users outside that network receive access denied errors even over HTTPS. What is wrong with the policy?

Accepted Answer

The Allow statement only allows requests from the specific IP range; requests from other IPs are implicitly denied even over HTTPS.. Option C is correct because the Deny statement with SecureTransport false only denies non-HTTPS requests; it does not explicitly allow HTTPS requests from outside the allowed IP range. The Allow statement only allows from the specific IP range, so requests from outside that range are implicitly denied. Option A is wrong because the policy already uses a Deny for non-HTTPS. Option B is wrong because the condition is fine. Option D is wrong because the Deny statement is not the issue; the lack of an Allow for HTTPS from other IPs is the issue.

Answer

The Deny statement blocks all requests over HTTPS because of the BoolIfExists condition.

Answer

The Allow statement should include a condition for SecureTransport.

Answer

The Deny statement should use a Condition for SourceIp instead of SecureTransport.

Question 15

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application is deployed across three Availability Zones. The DevOps team uses AWS CloudFormation to manage the infrastructure. During a recent deployment, a stack update failed, and the stack entered a ROLLBACK_IN_PROGRESS state. However, the rollback also failed, leaving the stack in UPDATE_ROLLBACK_FAILED state. The engineer needs to restore the application to a working state. The stack includes an Auto Scaling group, an ALB, security groups, and a DynamoDB table. The DynamoDB table is defined with deletion protection enabled. The engineer is considering the following actions: A) ContinueUpdateRollback to retry the rollback, fixing the resource that caused the failure. B) Delete the stack and recreate it from the last known good template. C) Use CloudFormation's 'SignalResource' to manually complete the rollback. D) Manually update the resources to match the previous template, then resume the rollback. Which action should the engineer take?

Accepted Answer

Use ContinueUpdateRollback to retry the rollback after fixing the resource that caused the failure.. Option A is correct because ContinueUpdateRollback is the designed method to resolve a rollback failure. The engineer can fix the underlying issue (e.g., DynamoDB deletion protection preventing table deletion) and then retry the rollback. Option B is wrong because deleting the stack would also delete the DynamoDB table (deletion protection may prevent deletion, causing further issues). Option C is wrong because SignalResource is for signaling creation of resources, not for rollback. Option D is wrong because manually updating resources is error-prone and not recommended; ContinueUpdateRollback automates the process.

Answer

Manually update the resources to match the previous template, then resume the rollback.

Answer

Use CloudFormation's 'SignalResource' to manually complete the rollback.

Answer

Delete the stack and recreate it from the last known good template.