DOP-C02 Incident and Event Response Practice Test 17 — 15 Questions

Question 1

An application running on AWS Lambda is experiencing increased error rates. The DevOps engineer needs to quickly identify the root cause. Which AWS service should the engineer use to analyze the logs and errors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS X-Ray. AWS X-Ray is designed for distributed tracing and root-cause analysis of application errors, including Lambda functions. It captures traces, errors, and latency data across services, making it the right tool to quickly identify where failures originate in a Lambda-based application.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

A DevOps engineer is designing an incident response plan for a multi-region application. The application runs on EC2 instances behind an Application Load Balancer (ALB) and uses Amazon RDS for MySQL with Multi-AZ. Which TWO actions should the engineer include to ensure high availability and fast failover during a regional incident?

Accepted Answer

Set up an Amazon RDS read replica in a second region and promote it during failover.. Options A and E are correct. Amazon RDS read replicas can be created in a different region and promoted to a standalone primary instance during a regional incident, providing a disaster recovery solution. Amazon Route 53 with health checks can automatically fail over DNS traffic to a secondary region by routing to a healthy endpoint. Option B is incorrect because Auto Scaling groups are regional and cannot launch instances across multiple regions directly; you would need separate Auto Scaling groups per region. Option C is incorrect because an Application Load Balancer is regional and cannot span regions; you would need separate ALBs in each region and Route 53 to route traffic. Option D is incorrect because Multi-AZ RDS replicates synchronously within a single region only; for cross-region disaster recovery, you need a read replica or a separate Multi-AZ deployment in the other region, not Multi-AZ in a second region (Multi-AZ in a second region is not a standard feature; you would need a separate RDS instance).

Answer

Create an Auto Scaling group that can launch instances in multiple regions.

Answer

Deploy an Application Load Balancer that spans both regions.

Answer

Configure Amazon RDS Multi-AZ in a second region.

Question 3

A security team is investigating a potential data exfiltration from an S3 bucket. They need to identify which IAM user accessed a specific object and whether the access was from a known IP address. Which THREE AWS services or features should they use together to conduct this investigation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (C) is correct because it records S3 data-plane API calls such as GetObject, including the IAM identity (user or role) that made the request, the source IP address, and the timestamp, which directly answers who accessed the object and from where. S3 server access logs (D) are correct because they provide detailed, object-level records for every request against the bucket, including the requester, source IP, request URI, and HTTP status, giving a second authoritative source for the specific object access. Amazon Athena (E) is correct because it lets the team query CloudTrail logs and S3 access logs stored in S3 using standard SQL, so they can efficiently correlate the IAM user, object key, and source IP across large log datasets. AWS Config (A) is not appropriate because it tracks resource configuration changes and compliance, not individual object access events or source IPs. VPC Flow Logs (B) capture IP traffic metadata at the ENI/subnet level and do not identify IAM users or S3 object-level requests, so they cannot answer who accessed the object.

Answer

AWS Config

Answer

VPC Flow Logs

Question 4

A company runs a critical application on Amazon ECS with Fargate launch type. During an incident, the DevOps engineer notices that tasks are failing with 'CannotPullContainerError: API error (500)'. Which TWO steps should the engineer take to resolve this issue?

Accepted Answer

Ensure that the ECR repository policy allows the task execution role to pull images.. Options C and E are correct. When a Fargate task fails with 'CannotPullContainerError: API error (500)', it typically indicates an issue with pulling the container image from Amazon ECR. The task execution IAM role (E) must have the necessary permissions (ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, ecr:BatchCheckLayerAvailability) to pull images from ECR. Additionally, if the image resides in a private ECR repository, the repository policy (C) must allow the task execution role to perform those actions. Option A is wrong because Fargate does not support attaching EBS volumes; it stores image layers ephemerally. Option B is incorrect because the ECS service role is used for load balancer integration, not for pulling images. Option D is incorrect because increasing task memory does not fix image pull errors; memory affects running tasks, not the pull process.

Answer

Attach an EBS volume to the Fargate task for caching.

Answer

Check that the ECS service role has the required permissions.

Answer

Increase the task memory to accommodate the image pull.

Question 5

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

Accepted Answer

Check if the instances have outbound internet connectivity to the SSM endpoints.. The SSM Agent requires outbound internet connectivity to the Systems Manager endpoints (or AWS PrivateLink if configured) to communicate with the service. If the patch window or a security group change blocks this connectivity, instances become unreachable despite the agent logs showing no errors. Option A is wrong because restarting the agent does not help if the issue is network connectivity. Option B is wrong because the patch baseline association defines which patches to apply, not connectivity. Option C is wrong because IAM permissions are likely correct since the agent logs show no errors; the issue is network-related, not permissions.

Answer

Restart the SSM Agent on the affected instances.

Answer

Verify that the patch baseline is associated with the instances.

Answer

Review the IAM role attached to the instances for sufficient permissions.

Question 6

During a deployment, a new application version on an ECS service starts failing health checks. The previous version is still running. The deployment is a rolling update with a 200% percent start. Which ECS feature should the engineer use to automatically revert to the previous version?

Accepted Answer

ECS deployment circuit breaker. (ECS deployment circuit breaker) is correct because it automatically detects failed deployments (e.g., health check failures) and triggers a rollback to the previous version. With a 200% percent start rolling update, the new version starts before the old is stopped; if health checks fail, the circuit breaker initiates a rollback. Option B (ECS service auto recovery) recovers from underlying infrastructure failures, not deployment failures. Option C (ECS managed scaling) adjusts desired count based on load, not deployment health. Option D (CloudWatch alarm actions) can trigger rollback events but is not an ECS built-in feature; it requires custom automation. Therefore, the correct ECS feature for automatic rollback is the deployment circuit breaker.

Answer

ECS service auto recovery

Answer

ECS managed scaling

Answer

CloudWatch alarm actions

Question 7

An application runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The engineer checks ALB metrics and sees 'SurgeQueueLength' increasing periodically. What is the most likely cause?

Accepted Answer

The application instances are not able to process requests quickly enough, causing the request queue to back up.. A high SurgeQueueLength indicates that the ALB is receiving more requests than the target instances can process, causing the request queue to back up. When the queue exceeds the limit (1024 requests), the ALB returns 503 errors. Option B is incorrect because health check failures typically cause the ALB to stop routing traffic to unhealthy instances, reducing the queue rather than increasing it. Option C is incorrect because an expired SSL certificate would cause TLS handshake failures, not 503 errors. Option D is incorrect because a misconfigured security group would block traffic entirely, resulting in connection timeouts or 503s, but it would not cause the SurgeQueueLength to increase.

Answer

The target group health checks are failing, causing the ALB to route traffic to unhealthy instances.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB security group is blocking traffic from the clients.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with the error 'UPDATE_ROLLBACK_FAILED'. What should the engineer do to resolve this?

Accepted Answer

Use the 'ContinueUpdateRollback' operation to fix the resource that caused the failure.. When a CloudFormation stack update fails and rollback also fails, the stack enters UPDATE_ROLLBACK_FAILED, a terminal state where CloudFormation cannot automatically recover. The ContinueUpdateRollback API operation tells CloudFormation to resume rolling back the stack, optionally skipping specific resources that are stuck, so the engineer can manually fix the problematic resource and then complete the rollback. This is the documented recovery path for this state.

Answer

Retry the stack update with the same parameters.

Answer

Delete the stack and recreate it.

Answer

Ignore the error and continue using the stack.

Question 9

A Lambda function processes SQS messages but sometimes times out after 15 seconds. The function performs a database call that occasionally takes longer. What is the best way to handle this without losing messages?

Accepted Answer

Increase the Lambda timeout and increase the SQS visibility timeout, and add a dead-letter queue.. The root cause is that the Lambda timeout (15s) is shorter than the occasional database call, and the SQS visibility timeout is likely too short to cover the retry window. Increasing the Lambda timeout gives the function room to finish, increasing the SQS visibility timeout prevents other consumers from picking up the message while it is still being processed, and a dead-letter queue captures messages that repeatedly fail so they are not lost. This combination preserves at-least-once delivery and prevents message loss.

Answer

Decrease the SQS visibility timeout to retry faster.

Answer

Split the batch into smaller batches using partial batch response.

Answer

Reduce the Lambda reserved concurrency to limit invocations.

Question 10

A company uses CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed KMS key. What must be done to enable this?

Accepted Answer

Associate a customer-managed KMS key with the log group and update the key policy to allow CloudWatch Logs to use it.. CloudWatch Logs supports encryption at rest using a customer-managed KMS key. To enable this, you must associate the KMS key with the log group via the CloudWatch Logs console or API, and you must update the key policy to grant CloudWatch Logs the necessary permissions (kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:DescribeKey). Without this key policy update, CloudWatch Logs cannot use the key to encrypt the log data at rest.

Answer

Enable encryption on the log group using the default AWS managed key.

Answer

Use a third-party encryption tool before sending logs to CloudWatch.

Answer

Create a new log group in a region where KMS is enabled.

Question 11

A DevOps team is troubleshooting an application that occasionally throws 'Connection reset by peer' errors when connecting to an RDS MySQL instance. The errors are intermittent and seem to correlate with high traffic. Which TWO steps should the team take to diagnose the issue?

Accepted Answer

Check the RDS error log for messages about connection timeouts or aborted connections.. Option A is correct because the RDS error log records server-side events such as 'Aborted connection' and connection timeout messages that directly explain why the server is resetting client connections under load. Option D is correct because Performance Insights captures database load (DBLoad) broken down by wait events and top SQL, letting the team pinpoint the bottleneck causing intermittent resets during high traffic. Option B is not a diagnostic step and blindly raising max_connections may not address the root cause. Option C is a high-availability configuration change, not a troubleshooting action, and Multi-AZ does not resolve connection resets. Option E is unlikely to be the cause since security group misconfiguration would produce consistent connection failures, not intermittent resets correlated with traffic.

Answer

Increase the max_connections parameter in the DB parameter group.

Answer

Enable Multi-AZ deployment to provide a standby instance.

Answer

Review the security group rules to ensure the application can connect.

Question 12

A company uses AWS CodePipeline for CI/CD. A recent pipeline execution failed at the 'Deploy' stage with the error 'Action execution failed: Access Denied'. The pipeline uses an IAM service role. Which THREE checks should the engineer perform to resolve this?

Accepted Answer

Verify that the IAM service role has sufficient permissions to perform the deploy action on the target resource.. The 'Access Denied' error at the Deploy stage indicates a permissions issue. The correct checks are: B) Verify that the IAM service role has sufficient permissions for the deploy action on the target resource, as the role must have the necessary IAM policies to perform deployments. C) Ensure the artifact store S3 bucket has a bucket policy that allows the pipeline role to access it, because the pipeline needs to read artifacts from the bucket. E) Confirm that the service role's trust policy allows CodePipeline to assume the role, since the trust policy must grant the `sts:AssumeRole` permission to the CodePipeline service. Option A is incorrect because CloudWatch Events rules trigger pipeline execution but are not related to the deploy stage's access denied error. Option D is incorrect because S3 event notifications trigger the pipeline on code changes, not resolve deployment failures.

Answer

Check that CloudWatch Events rule is configured to trigger the pipeline.

Answer

Enable S3 event notifications to trigger the pipeline on code changes.

Question 13

A company is using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is configured with a batch size of 10 and a maximum concurrency of 5. Recently, the function started experiencing high error rates and the SQS queue's ApproximateNumberOfMessagesVisible metric is increasing. The CloudWatch logs show that the function is timing out after 30 seconds. The function makes calls to an external API that sometimes takes more than 30 seconds to respond. The DevOps engineer needs to reduce the backlog and prevent message loss. The engineer is considering the following actions: A) Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds. B) Decrease the batch size to 1 to avoid processing multiple messages at once. C) Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions. D) Use a dead-letter queue to capture messages that fail processing after all retries. Which combination of actions should the engineer take?

Accepted Answer

Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds.. The correct action because increasing the Lambda function timeout to 60 seconds allows the function to wait longer for the external API, and increasing the SQS visibility timeout to 90 seconds prevents messages from becoming visible again before the function completes. This reduces unnecessary retries and helps clear the backlog. Option A (DLQ) is useful for capturing failed messages but does not address the timeout issue. Option B (decrease batch size) reduces throughput and worsens the backlog. Option D (increase concurrency) may lead to more timeouts if the function still cannot complete within the existing timeout.

Answer

Use a dead-letter queue to capture messages that fail processing after all retries.

Answer

Decrease the batch size to 1 to avoid processing multiple messages at once.

Answer

Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions.

Question 14

A DevOps engineer is responsible for monitoring a production environment that uses Amazon EC2 Auto Scaling. The engineer notices that the Auto Scaling group has been launching and terminating instances frequently over the past hour. The group uses a dynamic scaling policy based on average CPU utilization. The CloudWatch alarm that triggers scaling is set to a threshold of 70% CPU for scale-out and 30% for scale-in. The engineer checks the CloudWatch metrics and sees that CPU utilization is oscillating between 40% and 60%, never reaching the thresholds. The engineer suspects that the scaling policy is not working correctly. The engineer is considering the following actions: A) Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization. B) Increase the cooldown period for the scaling policy to 300 seconds. C) Disable the scale-in policy to prevent frequent terminations. D) Use a simple scaling policy instead of a dynamic scaling policy. Which action should the engineer take?

Accepted Answer

Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization.. A target tracking policy automatically adjusts the desired capacity to maintain a target utilization (e.g., 50%), which smooths out oscillations by continuously adapting to load rather than reacting to fixed thresholds. Option A is wrong because disabling scale-in could lead to over-provisioning and increased costs. Option C is wrong because simple scaling policies are more prone to causing oscillations due to step adjustments with cooldowns. Option D is wrong because increasing the cooldown period only delays scaling actions and does not address the root cause of oscillations; target tracking is more effective.

Answer

Disable the scale-in policy to prevent frequent terminations.

Answer

Use a simple scaling policy instead of a dynamic scaling policy.

Answer

Increase the cooldown period for the scaling policy to 300 seconds.

Question 15

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. Users report intermittent 503 errors. CloudWatch metrics show that the ALB's 'RequestCount' is normal, but 'HTTPCode_ELB_5XX_Count' spikes. The 'TargetResponseTime' metric shows occasional high latency. Which troubleshooting step should the DevOps engineer take FIRST?

Accepted Answer

Enable and analyze the ALB access logs stored in S3, filtering for 503 errors and correlating with target response times.. ALB access logs capture detailed per-request information including target IP, response time, and the specific error (e.g., 503 due to target connection errors or target timeouts). Analyzing these logs filtered for 503s and correlated with TargetResponseTime reveals whether the errors originate from unhealthy targets, connection limits, or slow responses, making it the correct first diagnostic step.

Answer

Increase the desired capacity of the Auto Scaling group to handle more requests.

Answer

Disable connection draining on the target group to prevent slow-draining instances from causing errors.

Answer

Review AWS CloudTrail logs for any recent configuration changes to the ALB.