DOP-C02 Incident and Event Response Practice Test 3 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a multi-tier web application. During an incident, the stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The operations team needs to investigate the root cause quickly without losing the stack's current state. What is the MOST efficient approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the ContinueUpdateRollback API with the ResourcesToSkip parameter.. The ContinueUpdateRollback API with the ResourcesToSkip parameter allows you to skip resources that caused the failure and continue the rollback, preserving the stack's state without losing resources that were successfully updated. Option A is incorrect because creating a change set does not help when a stack update is already in rollback; it shows intended changes but cannot skip resources during rollback. Option B is incorrect because deleting and recreating the stack would lose the current state and is not efficient for investigation. Option C is incorrect because manually fixing resources is risky and may not address the root cause; the stack is already in rollback, and the ContinueUpdateRollback API is the proper approach.

Answer

Create a change set and execute it to see the changes.

Answer

Delete the stack and recreate it using the same template.

Answer

Manually fix the resources and then retry the stack update.

Question 2

A company configures AWS CloudTrail to deliver logs to S3 bucket 'my-app-logs'. However, no log files appear. The DevOps engineer runs the above command and sees the bucket policy. What is the issue?

Accepted Answer

The service principal in the bucket policy is incorrect; it should be 'cloudtrail.amazonaws.com'.. CloudTrail delivers log files to an S3 bucket by assuming a service-linked role and putting objects under the bucket owner's account, so the bucket policy must grant s3:PutObject and s3:GetBucketAcl to the correct service principal. The correct principal for CloudTrail is 'cloudtrail.amazonaws.com'. If the policy specifies any other principal (e.g., a typo or a different service), CloudTrail's PutObject calls are denied and no log files appear.

Answer

The bucket policy requires bucket-owner-full-control ACL, but CloudTrail does not support ACLs.

Answer

The bucket policy does not allow the s3:PutObject action.

Answer

The bucket does not exist; the policy retrieval failed silently.

Question 3

A company is experiencing intermittent connectivity issues between an EC2 instance and an RDS database. The EC2 instance is in a public subnet, and the RDS instance is in a private subnet. The security group for the RDS instance allows inbound traffic from the EC2 instance's security group. The network ACLs are default (all traffic allowed). Which THREE steps should the engineer take to troubleshoot the connectivity issue? (Choose THREE.)

Accepted Answer

Enable VPC Flow Logs for the subnets involved and analyze logs for dropped packets.. Option A is correct because VPC Flow Logs capture IP traffic going to and from network interfaces in the subnets, and analyzing them for REJECT entries reveals whether security groups or network ACLs are dropping packets, which is essential for intermittent connectivity issues. Option B is correct because network ACLs are stateless and must explicitly allow both inbound and outbound traffic on the database port (e.g., 3306 for MySQL) and ephemeral ports; even though the question states they are default (all traffic allowed), verifying them confirms no custom rules were inadvertently applied. Option C is correct because the RDS security group must allow inbound traffic on the database port from the EC2 instance's security group; confirming this rule exists and references the correct security group ID ensures the source is authorized. Option D is not among the correct answers because DNS resolution failures typically cause consistent, not intermittent, connectivity problems, and the scenario already implies the endpoint is reachable. Option E is not correct because security groups in AWS only contain allow rules and do not support deny rules, so checking for deny rules is technically invalid.

Answer

Verify that the EC2 instance can resolve the RDS endpoint via DNS.

Answer

Check the RDS security group for any deny rules that might block the EC2 instance.

Question 4

An IAM policy attached to a DevOps engineer's role is shown above. The engineer is trying to restart a stopped EC2 instance in the us-east-1 region but receives an 'AccessDenied' error. The instance ID is i-0abcd1234efgh5678. What is the MOST likely reason?

Accepted Answer

The policy does not allow ec2:StartInstances on the specific instance ARN.. Based on the exhibit's actual JSON policy (Allow ec2:DescribeInstances/StartInstances/StopInstances on Resource "*"; Deny ec2:TerminateInstances on the region-scoped instance ARN), a StartInstances call on any instance in us-east-1 should succeed under this policy alone -- there is no statement in the exhibit that would produce AccessDenied for a Start action. This question needs rewriting: either change the exhibit's Allow Resource to scope it away from this instance ARN (matching option B's intended answer), or change the stem/options to reflect a scenario the shown policy actually supports (e.g., ask about why TerminateInstances is denied).

Answer

The policy does not include a condition key that limits the allow to a specific region.

Answer

The Deny statement overrides the Allow statement for the instance.

Answer

The policy's Deny statement is applied to all EC2 actions.

Question 5

A DevOps team uses AWS Systems Manager Incident Manager to manage incidents. They have configured a response plan that sends notifications to an SNS topic, which triggers an AWS Lambda function to post messages to a Slack channel. Recently, the Slack notifications have stopped working. The CloudWatch logs for the Lambda function show no invocations when an incident is created. The SNS topic has a subscription to the Lambda function, and the Lambda function's resource policy allows invocation from SNS. What is the MOST likely cause?

Accepted Answer

The response plan is not configured to send notifications to the correct SNS topic ARN.. If the Lambda function's CloudWatch logs show zero invocations when an incident is created, the break is upstream of Lambda: the SNS topic is never receiving a publish, or the response plan is publishing to a different topic than the one subscribed to Lambda. The most likely cause is that the response plan's notification target ARN does not match the SNS topic that has the Lambda subscription, so Incident Manager publishes elsewhere. Verifying the response plan's SNS topic ARN against the subscribed topic is the first diagnostic step.

Answer

The Lambda function has a reserved concurrency of 0.

Answer

The Lambda function's execution role does not have permission to post to Slack.

Answer

The SNS topic's access policy does not allow the Incident Manager to publish to it.

Question 6

A company uses AWS CloudFormation to deploy a multi-tier web application. During an incident, the stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The operations team needs to investigate the root cause quickly without losing the stack's current state. What is the MOST efficient approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudTrail to view the CreateStack or UpdateStack API calls and the associated error messages.. When a CloudFormation stack update fails with an 'Internal failure' reason, the stack events in the console may not provide sufficient detail. AWS CloudTrail records the API calls (e.g., UpdateStack) and can include error messages returned by the service, which often contain more specific information about the failure. This is the best way to get detailed error information beyond the generic console events.

Answer

Check the CloudFormation template for syntax errors using cfn-lint.

Answer

Manually re-run the stack update in a test environment.

Answer

Review the stack events in the CloudFormation console for more details.

Question 7

During an incident, an engineer needs to quickly revoke access to a compromised IAM user. Which action should be taken FIRST?

Accepted Answer

Attach an AWS managed policy that explicitly denies all actions (e.g., AWSDenyAll).. Attaching an explicit deny-all policy (such as AWSDenyAll) immediately blocks all actions for the compromised IAM user, including any in-flight API calls, without deleting the user and losing audit trail. This is the fastest, reversible containment step.

Answer

Delete the IAM user immediately.

Answer

Disable the user's signing certificates.

Answer

Rotate the user's access keys.

Question 8

A company's incident response process requires that all changes to production resources are automatically paused when a P1 incident is declared. Which AWS service can be used to enforce this by preventing modifications to CloudFormation stacks?

Accepted Answer

AWS CloudFormation StackSets with a service control policy (SCP). CloudFormation StackSets combined with a service control policy (SCP) can enforce that production stack modifications are denied during a P1 incident. SCPs apply at the AWS Organizations level and can deny CloudFormation mutating actions (e.g., UpdateStack, DeleteStack) across accounts, while StackSets manage the stacks consistently.

Answer

AWS Systems Manager Change Manager

Answer

AWS Config rules with remediation

Answer

AWS CloudTrail with Insights

Question 9

A DevOps engineer is troubleshooting a Lambda function that is timing out. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Increase the function timeout in the Lambda configuration.. Option B is correct because increasing the function timeout in the Lambda configuration directly addresses the symptom: if the function's work legitimately exceeds the current timeout value, raising it (up to the 15-minute maximum) allows the invocation to complete and confirms whether the timeout is the root cause. Option E is correct because reviewing the function's CloudWatch Logs (the log group /aws/lambda/<function-name>) reveals timeout errors such as 'Task timed out after X seconds', stack traces, and where execution stalled, which is the primary diagnostic evidence for a timing-out Lambda. Option A is not appropriate because setting reserved concurrency to 1 only throttles invocations and does not help diagnose why a single invocation times out. Option C is not the best diagnostic step here because VPC misconfiguration typically causes connection timeouts to resources like RDS or ENIs, but the question asks for general timeout diagnosis and the logs would reveal that pattern first. Option D is not a diagnostic action; increasing memory also increases CPU proportionally and may speed execution, but it is a remediation attempt rather than a troubleshooting step to identify the cause.

Answer

Set reserved concurrency to 1 to isolate the function.

Answer

Check the VPC configuration for the Lambda function.

Answer

Increase the function memory allocation.

Question 10

During an incident, a DevOps engineer needs to block traffic from a specific IP address that is attacking an Application Load Balancer. Which TWO actions can the engineer take to mitigate this?

Accepted Answer

Modify the network ACL for the ALB's subnet to deny the IP address.. Option B is correct because a network ACL is a stateless, subnet-level firewall that supports explicit deny rules, so adding a DENY rule for the attacker's IP on the ALB subnet's inbound ACL immediately drops that traffic before it reaches the load balancer. Option C is correct because AWS WAF can be attached directly to an Application Load Balancer and an IP set rule with a Block action filters requests by source IP at the application layer, which is the native, targeted way to block a specific attacking address. Option A is not appropriate because CloudFront sits in front of the ALB only if it is already configured as the origin, and blocking there would not protect the ALB endpoint directly. Option D is wrong because VPC Flow Logs only capture and record metadata about traffic; they do not block anything. Option E is wrong because security groups are allow-only and cannot express a deny rule, so you cannot use one to deny a specific IP.

Answer

Configure Amazon CloudFront to block the IP address.

Answer

Enable VPC Flow Logs to capture traffic from the IP address.

Answer

Update the ALB security group to deny inbound traffic from the IP address.

Question 11

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The DevOps team notices that messages are not being processed and are going to the dead-letter queue. The Lambda function code is correct. What is the most likely cause?

Accepted Answer

The Lambda function timeout is too short.. A Lambda function timeout causes the invocation to fail without deleting the SQS message. The message becomes visible again once its visibility timeout expires, and the SQS event source mapping's poller receives it again -- each such receipt increments the message's ApproximateReceiveCount. This retry-and-timeout cycle repeats until ApproximateReceiveCount exceeds the redrive policy's maxReceiveCount, at which point SQS automatically moves the message to the configured dead-letter queue. This matches the observed symptom (correct function code, messages ending up in the DLQ) because the failure is happening after each successful receipt, not preventing receipt in the first place -- which is exactly the distinction the exam_trap/common_trap_note are testing.

Answer

The Lambda function's execution role lacks the sqs:ReceiveMessage permission.

Answer

The SQS queue's visibility timeout is too long.

Answer

The Lambda function's dead-letter queue is misconfigured.

Question 12

A company runs a critical application on Amazon ECS with Fargate launch type. The application is experiencing intermittent failures due to resource exhaustion. The DevOps team wants to implement automated responses to scale the service. Which THREE steps should the team take to achieve this? (Choose THREE.)

Accepted Answer

Create a CloudWatch alarm based on CPU or memory utilization.. Option B is correct because Amazon ECS service auto scaling is driven by CloudWatch metrics, so the team must create a CloudWatch alarm on CPU or memory utilization (e.g., ECSServiceAverageCPUUtilization or ECSServiceAverageMemoryUtilization) to trigger scaling actions. Option D is correct because Application Auto Scaling is the service that registers the ECS service as a scalable target and defines the target-tracking or step scaling policy that adjusts the desired count. Option E is correct because the ECS service itself must be configured for auto scaling so its desired task count can be dynamically adjusted in response to the alarm. Option A is not appropriate because a Lambda function manually updating the service is not an automated scaling mechanism and adds unnecessary custom logic. Option C is incorrect because EC2 Auto Scaling groups apply to EC2 launch types, not Fargate, which has no EC2 instances to scale.

Answer

Create an AWS Lambda function to manually update the service.

Answer

Configure EC2 Auto Scaling group for the cluster.

Question 13

A Lambda function has the above IAM policy attached. The function is failing to write logs to CloudWatch Logs. What is the most likely reason?

Accepted Answer

The log group ARN in the resource does not match the Lambda function's log group.. Question needs a genuinely broken exhibit (e.g., ARN referencing a different function name than one stated in the stem, or a missing CreateLogGroup permission) for any option to be verifiably correct.

Answer

The policy does not include the 'logs:PutLogEvents' action.

Answer

The policy does not allow 'ec2:DescribeInstances' on a specific resource.

Answer

The Lambda function does not have permission to use the KMS key for log encryption.

Question 14

The CloudWatch alarm 'HighCPU' has transitioned to ALARM state. What does the alarm history indicate about the metric that triggered it?

Accepted Answer

The metric value of 90.0 exceeded the threshold of 80.0.. When a CloudWatch alarm transitions to ALARM state, the alarm history records that the metric value breached the configured threshold — in this case, 90.0 exceeded the threshold of 80.0. The alarm history shows the state transition and the data points that caused it.

Answer

The metric value remained below the threshold.

Answer

The metric value was exactly 80.0 at the time of the alarm.

Answer

The alarm was triggered after 3 consecutive datapoints breached the threshold.

Question 15

A company experiences an EC2 instance failure in an Auto Scaling group. The instance is terminated and replaced automatically. The DevOps engineer needs to troubleshoot why the instance failed. Which AWS service should the engineer use to view the instance's console output and screenshots before termination?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture EC2 instance console output if the CloudWatch agent is configured to send system logs. After termination, these logs persist in CloudWatch Logs, allowing troubleshooting. However, CloudWatch Logs does not capture screenshots. Option A (AWS CloudTrail) records API calls, not console output. Option C (AWS Systems Manager Session Manager) provides interactive shell access but does not retrieve console output or screenshots after termination. Option D (AWS Config) tracks configuration changes, not instance failures.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Session Manager

Answer

AWS Config