DOP-C02 Incident and Event Response Practice Test 2 — 15 Questions

Question 1

A DevOps engineer is investigating why an Amazon ECS service is not scaling out as expected. The service has a target tracking scaling policy based on average CPU utilization. The CloudWatch alarm shows that CPU utilization has exceeded the target for several minutes, but no scaling activity has occurred. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scaling policy has a cooldown period that is still in effect from a previous scaling activity.. Target tracking scaling policies in Amazon ECS have a cooldown period (default 300 seconds) that prevents the policy from initiating additional scaling activities immediately after a previous scaling action. If a recent scaling activity occurred, the cooldown period would still be in effect, causing the policy to ignore the alarm even though CPU utilization has exceeded the target. This is the most likely reason no scaling activity is observed despite the alarm being triggered.

Answer

The ECS service is configured with a minimum healthy percent that prevents scaling out.

Answer

The ECS service does not have an IAM role that allows it to call CloudWatch.

Answer

The CloudWatch alarm is configured with a period that is too long.

Question 2

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which TWO steps should be taken to accomplish this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send a notification to an Amazon SNS topic.. Amazon CloudWatch Events (now Events) can be configured to match specific API calls logged by CloudTrail, such as CreateAccessKey. When the rule triggers, it can invoke an SNS topic to send an alert, enabling real-time notification. This approach directly monitors the API activity without additional overhead.

Answer

Enable CloudTrail Insights to detect unusual activity in the account.

Answer

Create an AWS Config rule that checks for access key creation and sends an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query on the CloudTrail logs and set an alarm.

Question 3

A company is experiencing a DDoS attack on its application hosted on AWS. The application uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The security team needs to mitigate the attack with minimal latency impact on legitimate users. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Enable AWS Shield Advanced on the ALB.. AWS Shield Advanced provides enhanced DDoS mitigation for ALBs, including access to the DDoS Response Team (DRT) and financial protection against scaling costs. It operates at the network and transport layers with minimal latency, as it inspects traffic inline without introducing significant processing delay. This makes it a critical first line of defense for high-availability applications under attack.

Answer

Disable cross-zone load balancing on the ALB to limit the number of instances receiving traffic.

Answer

Configure the Auto Scaling group to scale based on the NetworkIn metric to handle the increased traffic.

Question 4

A security engineer reviews the CloudTrail log entry above and notices that a security group was modified to allow SSH access from anywhere. The engineer wants to ensure that such changes are automatically detected and remediated in the future. What should the engineer do?

Accepted Answer

Create an AWS Config rule that checks security group rules and triggers an AWS Systems Manager Automation document to revoke the ingress rule.. AWS Config can continuously evaluate security group rules against a custom or managed rule (e.g., restricted-ssh) and, upon detecting a noncompliant rule allowing 0.0.0.0/0 on port 22, trigger an AWS Systems Manager Automation document that automatically revokes the offending ingress rule. This provides both detection and remediation without manual intervention, meeting the requirement for automated detection and remediation.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter that alerts on AuthorizeSecurityGroupIngress events with 0.0.0.0/0.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the source IP is 0.0.0.0/0.

Answer

Enable Amazon GuardDuty to detect and block such changes in real time.

Question 5

A DevOps engineer updates an ECS service via CloudFormation. The stack update fails with the message 'Resource update cancelled'. The engineer notices that the ECS service's desired count was temporarily reduced during the update. What is the most likely cause of the failure?

Accepted Answer

The ECS service's minimum healthy percent was set to 100, causing the desired count reduction to zero to be rejected.. The error 'Resource update cancelled' occurs because CloudFormation detected that the ECS service update was not progressing as expected. When the minimum healthy percent is set to 100, the deployment process cannot reduce the desired count to zero (or below the current running count) without violating the requirement that 100% of the tasks remain healthy. This causes the update to be cancelled as CloudFormation waits indefinitely for the deployment to complete, eventually timing out and rolling back.

Answer

The ECS service's target group had an unhealthy instance that prevented the deregistration.

Answer

The ECS service deployment circuit breaker was triggered due to a timeout.

Answer

The ECS service did not have the required IAM role to call ecs:UpdateService.

Question 6

A company uses AWS CloudTrail to audit API activity. During an incident investigation, they find that a user with the IAM policy 'AdministratorAccess' deleted an S3 bucket. The security team wants to know the source IP address and user agent used for the delete operation. Which action should the team take to obtain this information?

Accepted Answer

View the CloudTrail event history for the delete-bucket event.. CloudTrail event history captures all management events, including DeleteBucket, and records the source IP address and user agent for each API call. By viewing the event history for the specific delete-bucket event, the security team can directly retrieve the required metadata without needing additional log sources or configurations. Option B is incorrect because S3 server access logs log object-level operations, not management events like bucket deletion. Option C is not the most direct method; CloudWatch Logs can be used if CloudTrail is configured to send events to a log group, but the simplest way is from CloudTrail event history directly. Option D is incorrect because AWS Config tracks resource configuration changes, not API call details like source IP.

Answer

Check the S3 server access logs for the deleted bucket.

Answer

Use CloudWatch Logs to search for the event in the CloudTrail log group.

Answer

Query AWS Config to find the configuration item for the bucket deletion.

Question 7

A DevOps engineer is troubleshooting an Auto Scaling group (ASG) that is not launching instances as expected. The ASG is configured with a launch template that uses an Amazon Linux 2 AMI. The engineer checks the EC2 Auto Scaling console and sees that the group's desired capacity is set to 2, but only 1 instance is running. The last scaling activity shows 'Failed to launch instance. Error: Your quota allows for 0 more running instance(s).' What is the most likely cause?

Accepted Answer

The account has reached the EC2 instance limit for the selected instance type in the region.. The error message 'Your quota allows for 0 more running instance(s)' directly indicates that the AWS account has reached its EC2 instance limit for the specific instance type in the region. Auto Scaling groups cannot launch instances beyond the service quota, regardless of the desired capacity. This is a common issue when the default limit (e.g., 5 or 20 instances per instance family) has been exhausted.

Answer

The launch template has insufficient IAM permissions to create instances.

Answer

The VPC subnet does not have enough available IP addresses.

Answer

There is an instance that is not passing health checks, preventing new instances.

Question 8

A company runs a critical application on Amazon ECS with Fargate. The application is deployed across multiple Availability Zones and uses an Application Load Balancer (ALB) as the front-end. During a recent incident, users experienced intermittent connectivity failures. The DevOps team suspects that tasks are being stopped due to resource exhaustion. Which combination of metrics and actions should the team use to diagnose and prevent recurrence?

Accepted Answer

Monitor CPU and memory utilization metrics in CloudWatch; increase the task size (CPU and memory) in the task definition.. CPU and memory utilization metrics in CloudWatch directly indicate resource exhaustion, which is the suspected cause of tasks being stopped. Increasing the task size (CPU and memory) in the task definition provides more resources per task, preventing the OOM killer or CPU throttling from stopping tasks, without changing the number of tasks or scaling logic.

Answer

Set up CloudWatch Logs for the application and check for out-of-memory errors; then increase the number of tasks.

Answer

Monitor NetworkPacketsIn and NetworkPacketsOut metrics in CloudWatch; increase the number of tasks.

Answer

Monitor the ALB error metrics (5xx count) and scale the ECS service based on request count.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

Accepted Answer

Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.. AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Answer

Use IAM Access Analyzer to validate the roles against a policy template.

Answer

Run AWS Trusted Advisor and check the IAM report for roles with long session durations.

Answer

Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.

Question 10

A company is experiencing an ongoing security incident where an unauthorized user gained access to an AWS access key and is making API calls. The security team needs to immediately stop the unauthorized access and preserve evidence for investigation. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Enable CloudTrail logging to capture API calls for forensic analysis.. Enabling CloudTrail logging captures detailed API call records, including source IP, user agent, and request parameters, which are essential for forensic analysis and understanding the scope of the incident. CloudTrail logs provide immutable evidence that can be stored in S3 with versioning and MFA delete, ensuring the integrity of the investigation data.

Answer

Rotate the access key by creating a new key and updating the application.

Answer

Change the IAM policy attached to the user to deny all actions.

Answer

Contact AWS Support to have the key disabled.

Question 11

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.. The error indicates that the EC2 instance's IAM role 'EC2-AppRole' cannot authenticate to the RDS instance. IAM database authentication requires the EC2 instance to assume a database authentication token, which is generated by calling the RDS API with the 'EC2-AppRole' credentials. However, the RDS instance's resource-based policy only allows 'DatabaseAccessRole' to connect. For 'EC2-AppRole' to successfully authenticate, it must first assume 'DatabaseAccessRole' via a trust policy that permits the EC2 instance role to assume it. Without this trust relationship, the authentication token request fails, causing the error.

Answer

The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.

Answer

The security group for the EC2 instance does not allow outbound traffic to the RDS instance.

Answer

The EC2 instance does not have the correct IAM instance profile attached.

Question 12

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group (ASG) for web servers, and an Amazon RDS Multi-AZ DB instance. The ASG uses a launch template with Amazon Linux 2 and a user data script that installs the web application and connects to the RDS database using a static password stored in the user data. Recently, the security team discovered that the user data script is exposed in the EC2 console and could be viewed by anyone with EC2 describe-instances permissions. The team wants to remediate this immediately without causing downtime. The ASG is configured with a min size of 2, max size of 6, and desired capacity of 4. The application is currently under load. Which option describes the best course of action?

Accepted Answer

Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.. It uses an instance refresh with a minimum healthy percentage of 100% to replace instances without downtime, while the new launch template version retrieves the password from AWS Secrets Manager, eliminating the static password exposure. This approach ensures that the security vulnerability is remediated immediately without disrupting the running application under load.

Answer

Immediately modify the user data on each running EC2 instance to remove the password, then update the launch template to reference AWS Secrets Manager.

Answer

Update the existing launch template to use AWS Secrets Manager for the database password. The ASG will automatically apply the change to existing instances.

Answer

Delete the existing launch template and create a new one with secrets from AWS Secrets Manager. Then terminate all running instances and let the ASG launch new ones.

Question 13

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. During a security incident, the security team needs to isolate a compromised instance for forensic analysis without affecting the application's availability. What is the MOST effective action to take?

Accepted Answer

Deregister the instance from the target group and stop the instance for forensic analysis.. Deregistering the instance from the target group removes it from the Application Load Balancer's routing, ensuring no new traffic is sent to it while existing connections drain (connection draining). Stopping the instance preserves its memory and disk state for forensic analysis without impacting application availability, as the remaining healthy instances continue to serve traffic.

Answer

Modify the security group of the instance to deny all inbound and outbound traffic.

Answer

Terminate the compromised instance immediately to prevent further damage.

Answer

Change the subnet route table to route traffic away from the compromised instance.

Question 14

A DevOps team is investigating a production incident where an Amazon RDS for MySQL database experienced a sudden spike in connections and CPU utilization. The team suspects a SQL injection attack. Which TWO actions should the team take to investigate and mitigate the incident?

Accepted Answer

Enable automated backups and ensure point-in-time recovery is configured.. Enabling automated backups and point-in-time recovery ensures that the database can be restored to a state before the suspected SQL injection attack, preserving data integrity and enabling forensic analysis. Option C is correct because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) to correlate with the spike, while audit logs capture actual SQL queries, which are essential for identifying malicious patterns and confirming the attack vector.

Answer

Delete the error logs to free up storage space.

Answer

Create a read replica to offload traffic from the primary instance.

Answer

Increase the DB instance size to handle the increased load.

Question 15

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.. The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed. This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Answer

The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.

Answer

The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.

Answer

The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.