DOP-C02 Incident and Event Response Practice Test 2 — 15 Questions

Question 1

A DevOps engineer notices that an EC2 instance in an Auto Scaling group is repeatedly failing health checks and being terminated. The engineer needs to capture the root cause by collecting memory dumps and system logs before termination. What should the engineer do?

Accepted Answer

Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.. Option B is correct because EC2Rescue is specifically designed to collect memory dumps and system logs from EC2 instances, and by configuring it to run at startup and extending the Auto Scaling health check grace period, the engineer ensures diagnostics are captured before the instance is terminated for failing health checks. This approach directly addresses the need to gather root cause data from a failing instance that is about to be replaced.

Answer

Configure the CloudWatch Agent to collect memory and system logs and publish them to CloudWatch Logs.

Answer

Use AWS Systems Manager Run Command to execute a script on the instance that collects diagnostics before it is terminated.

Answer

Enable EC2 instance metadata service (IMDS) to capture diagnostic data that persists after termination.

Question 2

A company is using AWS CloudFormation to deploy infrastructure. An engineer needs to ensure that any changes to the production stack are reviewed and approved before they are applied. The engineer also wants to prevent unauthorized changes. Which solution should the engineer implement?

Accepted Answer

Use CloudFormation Change Sets and require manual approval to execute the change set.. CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact running resources before you apply them. By requiring manual approval to execute the change set, the engineer ensures that all modifications are reviewed and approved, preventing unauthorized changes. This directly meets the requirement for a review-and-approval workflow without introducing unnecessary complexity.

Answer

Use CloudFormation StackSets to manage the production stack across multiple accounts.

Answer

Use AWS Service Catalog to create a product for the stack and require approval for any portfolio changes.

Answer

Use AWS CodePipeline to deploy the stack and require manual approval at the deploy stage.

Question 3

A company has a legacy application running on an EC2 instance that is not part of an Auto Scaling group. The instance is experiencing a memory leak. The DevOps engineer needs to collect memory metrics to analyze the issue without modifying the application. What should the engineer do?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. The CloudWatch agent is required to collect custom metrics like memory utilization from an EC2 instance because the standard EC2 monitoring only captures hypervisor-level metrics (CPU, network, disk I/O). By installing and configuring the CloudWatch agent, the engineer can collect memory metrics without modifying the application code, directly addressing the memory leak analysis requirement.

Answer

Use the AWS Management Console to view memory metrics from the EC2 monitoring tab.

Answer

Use EC2Rescue to generate a memory dump and analyze it.

Answer

Enable CloudWatch detailed monitoring on the instance.

Question 4

A company uses AWS Lambda functions to process incoming events from Amazon S3. The operations team notices that some events are not being processed, and there is no error in the Lambda function logs. What is the most likely cause?

Accepted Answer

The Lambda function has reserved concurrency set to a low value, causing throttling.. When a Lambda function has reserved concurrency set to a low value, it limits the number of concurrent executions allowed for that function. If incoming S3 events exceed this limit, the Lambda service throttles the invocations, causing some events to be silently dropped without generating errors in the function logs because the function never actually runs. This matches the symptom of missing events with no error logs.

Answer

The S3 event notification is configured to send to an SNS topic that is not subscribed to the Lambda function.

Answer

The S3 bucket policy does not allow the Lambda function to be invoked.

Answer

The Lambda function has a timeout that is too short.

Question 5

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover due to an availability zone outage. After the failover, the application team reports that the database endpoint is not resolving to the new primary. What is the most likely reason?

Accepted Answer

The application is using a cached DNS resolution that points to the old primary.. Option D is correct because after an RDS Multi-AZ failover, the DNS CNAME record for the DB instance is updated to point to the new primary in the standby AZ. However, if the application or its DNS resolver has cached the previous DNS resolution, it will continue to use the old IP address, which is no longer reachable. This is a common issue that can be resolved by reducing the TTL on the DNS record or implementing retry logic with DNS re-resolution in the application.

Answer

The RDS CNAME record was not updated by AWS after the failover.

Answer

The application is using the read replica endpoint instead of the primary endpoint.

Answer

The application is using a Route 53 health check that failed and redirected traffic away from the endpoint.

Question 6

A DevOps engineer is investigating why an Amazon ECS service is not scaling out as expected. The service has a target tracking scaling policy based on average CPU utilization. The CloudWatch alarm shows that CPU utilization has exceeded the target for several minutes, but no scaling activity has occurred. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is still in effect from a previous scaling activity.. Option D is correct because target tracking scaling policies in Amazon ECS have a cooldown period (default 300 seconds) that prevents the policy from initiating additional scaling activities immediately after a previous scaling action. If a recent scaling activity occurred, the cooldown period would still be in effect, causing the policy to ignore the alarm even though CPU utilization has exceeded the target. This is the most likely reason no scaling activity is observed despite the alarm being triggered.

Answer

The ECS service is configured with a minimum healthy percent that prevents scaling out.

Answer

The ECS service does not have an IAM role that allows it to call CloudWatch.

Answer

The CloudWatch alarm is configured with a period that is too long.

Question 7

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which TWO steps should be taken to accomplish this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send a notification to an Amazon SNS topic.. Option B is correct because Amazon CloudWatch Events (now Events) can be configured to match specific API calls logged by CloudTrail, such as CreateAccessKey. When the rule triggers, it can invoke an SNS topic to send an alert, enabling real-time notification. This approach directly monitors the API activity without additional overhead.

Answer

Enable CloudTrail Insights to detect unusual activity in the account.

Answer

Create an AWS Config rule that checks for access key creation and sends an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query on the CloudTrail logs and set an alarm.

Question 8

A company is experiencing a DDoS attack on its application hosted on AWS. The application uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The security team needs to mitigate the attack with minimal latency impact on legitimate users. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Enable AWS Shield Advanced on the ALB.. AWS Shield Advanced provides enhanced DDoS mitigation for ALBs, including access to the DDoS Response Team (DRT) and financial protection against scaling costs. It operates at the network and transport layers with minimal latency, as it inspects traffic inline without introducing significant processing delay. This makes it a critical first line of defense for high-availability applications under attack.

Answer

Disable cross-zone load balancing on the ALB to limit the number of instances receiving traffic.

Answer

Configure the Auto Scaling group to scale based on the NetworkIn metric to handle the increased traffic.

Question 9

A security engineer reviews the CloudTrail log entry above and notices that a security group was modified to allow SSH access from anywhere. The engineer wants to ensure that such changes are automatically detected and remediated in the future. What should the engineer do?

Accepted Answer

Create an AWS Config rule that checks security group rules and triggers an AWS Systems Manager Automation document to revoke the ingress rule.. Option C is correct because AWS Config can continuously evaluate security group rules against a custom or managed rule (e.g., restricted-ssh) and, upon detecting a noncompliant rule allowing 0.0.0.0/0 on port 22, trigger an AWS Systems Manager Automation document that automatically revokes the offending ingress rule. This provides both detection and remediation without manual intervention, meeting the requirement for automated detection and remediation.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter that alerts on AuthorizeSecurityGroupIngress events with 0.0.0.0/0.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the source IP is 0.0.0.0/0.

Answer

Enable Amazon GuardDuty to detect and block such changes in real time.

Question 10

A DevOps engineer updates an ECS service via CloudFormation. The stack update fails with the message 'Resource update cancelled'. The engineer notices that the ECS service's desired count was temporarily reduced during the update. What is the most likely cause of the failure?

Accepted Answer

The ECS service's minimum healthy percent was set to 100, causing the desired count reduction to zero to be rejected.. The error 'Resource update cancelled' occurs because CloudFormation detected that the ECS service update was not progressing as expected. When the minimum healthy percent is set to 100, the deployment process cannot reduce the desired count to zero (or below the current running count) without violating the requirement that 100% of the tasks remain healthy. This causes the update to be cancelled as CloudFormation waits indefinitely for the deployment to complete, eventually timing out and rolling back.

Answer

The ECS service's target group had an unhealthy instance that prevented the deregistration.

Answer

The ECS service deployment circuit breaker was triggered due to a timeout.

Answer

The ECS service did not have the required IAM role to call ecs:UpdateService.

Question 11

A company runs a critical web application on AWS. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The Auto Scaling group uses a launch template that specifies an Amazon Linux 2 AMI. The application stores session state in an ElastiCache Redis cluster. Recently, the operations team received alerts that the application is returning 503 errors intermittently. Investigation shows that the ALB target group health checks are failing for some instances, but those instances are still in service. The CloudWatch logs from the instances show that the application is running, but the health check endpoint is timing out after 5 seconds. The health check is configured with a 5-second timeout, 10-second interval, and 2 consecutive successes required to mark healthy. The DevOps engineer suspects that the issue is due to high CPU utilization on the instances causing the health check to respond slowly. The engineer wants to implement a solution that prevents the ALB from routing traffic to instances that are experiencing high CPU, and also automatically scales out to handle the increased load. What should the engineer do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.. Option B is correct because it addresses both the immediate issue (high CPU causing health check timeouts) and the scaling requirement. Stopping the instance via a CloudWatch alarm removes it from the ALB target group, preventing traffic routing to unhealthy instances. The target tracking scaling policy based on CPU utilization automatically adds instances when CPU is high, ensuring capacity matches demand.

Answer

Configure the Auto Scaling group to use ELB health checks and set the health check grace period to 600 seconds.

Answer

Create a scheduled scaling action to add more instances during peak hours.

Answer

Increase the health check timeout to 10 seconds and the interval to 20 seconds to give instances more time to respond.

Question 12

A company uses AWS CloudTrail to audit API activity. During an incident investigation, they find that a user with the IAM policy 'AdministratorAccess' deleted an S3 bucket. The security team wants to know the source IP address and user agent used for the delete operation. Which action should the team take to obtain this information?

Accepted Answer

View the CloudTrail event history for the delete-bucket event.. CloudTrail event history captures all management events, including DeleteBucket, and records the source IP address and user agent for each API call. By viewing the event history for the specific delete-bucket event, the security team can directly retrieve the required metadata without needing additional log sources or configurations.

Answer

Check the S3 server access logs for the deleted bucket.

Answer

Use CloudWatch Logs to search for the event in the CloudTrail log group.

Answer

Query AWS Config to find the configuration item for the bucket deletion.

Question 13

A DevOps engineer is troubleshooting an Auto Scaling group (ASG) that is not launching instances as expected. The ASG is configured with a launch template that uses an Amazon Linux 2 AMI. The engineer checks the EC2 Auto Scaling console and sees that the group's desired capacity is set to 2, but only 1 instance is running. The last scaling activity shows 'Failed to launch instance. Error: Your quota allows for 0 more running instance(s).' What is the most likely cause?

Accepted Answer

The account has reached the EC2 instance limit for the selected instance type in the region.. The error message 'Your quota allows for 0 more running instance(s)' directly indicates that the AWS account has reached its EC2 instance limit for the specific instance type in the region. Auto Scaling groups cannot launch instances beyond the service quota, regardless of the desired capacity. This is a common issue when the default limit (e.g., 5 or 20 instances per instance family) has been exhausted.

Answer

The launch template has insufficient IAM permissions to create instances.

Answer

The VPC subnet does not have enough available IP addresses.

Answer

There is an instance that is not passing health checks, preventing new instances.

Question 14

A company runs a critical application on Amazon ECS with Fargate. The application is deployed across multiple Availability Zones and uses an Application Load Balancer (ALB) as the front-end. During a recent incident, users experienced intermittent connectivity failures. The DevOps team suspects that tasks are being stopped due to resource exhaustion. Which combination of metrics and actions should the team use to diagnose and prevent recurrence?

Accepted Answer

Monitor CPU and memory utilization metrics in CloudWatch; increase the task size (CPU and memory) in the task definition.. Option A is correct because CPU and memory utilization metrics in CloudWatch directly indicate resource exhaustion, which is the suspected cause of tasks being stopped. Increasing the task size (CPU and memory) in the task definition provides more resources per task, preventing the OOM killer or CPU throttling from stopping tasks, without changing the number of tasks or scaling logic.

Answer

Set up CloudWatch Logs for the application and check for out-of-memory errors; then increase the number of tasks.

Answer

Monitor NetworkPacketsIn and NetworkPacketsOut metrics in CloudWatch; increase the number of tasks.

Answer

Monitor the ALB error metrics (5xx count) and scale the ECS service based on request count.

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

Accepted Answer

Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.. AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Answer

Use IAM Access Analyzer to validate the roles against a policy template.

Answer

Run AWS Trusted Advisor and check the IAM report for roles with long session durations.

Answer

Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.