DOP-C02 Incident and Event Response Practice Test 3 — 15 Questions

Question 1

A company is experiencing an ongoing security incident where an unauthorized user gained access to an AWS access key and is making API calls. The security team needs to immediately stop the unauthorized access and preserve evidence for investigation. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Enable CloudTrail logging to capture API calls for forensic analysis.. Option B is correct because enabling CloudTrail logging captures detailed API call records, including source IP, user agent, and request parameters, which are essential for forensic analysis and understanding the scope of the incident. CloudTrail logs provide immutable evidence that can be stored in S3 with versioning and MFA delete, ensuring the integrity of the investigation data.

Answer

Rotate the access key by creating a new key and updating the application.

Answer

Change the IAM policy attached to the user to deny all actions.

Answer

Contact AWS Support to have the key disabled.

Question 2

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.. The error indicates that the EC2 instance's IAM role 'EC2-AppRole' cannot authenticate to the RDS instance. IAM database authentication requires the EC2 instance to assume a database authentication token, which is generated by calling the RDS API with the 'EC2-AppRole' credentials. However, the RDS instance's resource-based policy only allows 'DatabaseAccessRole' to connect. For 'EC2-AppRole' to successfully authenticate, it must first assume 'DatabaseAccessRole' via a trust policy that permits the EC2 instance role to assume it. Without this trust relationship, the authentication token request fails, causing the error.

Answer

The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.

Answer

The security group for the EC2 instance does not allow outbound traffic to the RDS instance.

Answer

The EC2 instance does not have the correct IAM instance profile attached.

Question 3

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group (ASG) for web servers, and an Amazon RDS Multi-AZ DB instance. The ASG uses a launch template with Amazon Linux 2 and a user data script that installs the web application and connects to the RDS database using a static password stored in the user data. Recently, the security team discovered that the user data script is exposed in the EC2 console and could be viewed by anyone with EC2 describe-instances permissions. The team wants to remediate this immediately without causing downtime. The ASG is configured with a min size of 2, max size of 6, and desired capacity of 4. The application is currently under load. Which option describes the best course of action?

Accepted Answer

Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.. Option A is correct because it uses an instance refresh with a minimum healthy percentage of 100% to replace instances without downtime, while the new launch template version retrieves the password from AWS Secrets Manager, eliminating the static password exposure. This approach ensures that the security vulnerability is remediated immediately without disrupting the running application under load.

Answer

Immediately modify the user data on each running EC2 instance to remove the password, then update the launch template to reference AWS Secrets Manager.

Answer

Update the existing launch template to use AWS Secrets Manager for the database password. The ASG will automatically apply the change to existing instances.

Answer

Delete the existing launch template and create a new one with secrets from AWS Secrets Manager. Then terminate all running instances and let the ASG launch new ones.

Question 4

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. During a security incident, the security team needs to isolate a compromised instance for forensic analysis without affecting the application's availability. What is the MOST effective action to take?

Accepted Answer

Deregister the instance from the target group and stop the instance for forensic analysis.. Deregistering the instance from the target group removes it from the Application Load Balancer's routing, ensuring no new traffic is sent to it while existing connections drain (connection draining). Stopping the instance preserves its memory and disk state for forensic analysis without impacting application availability, as the remaining healthy instances continue to serve traffic.

Answer

Modify the security group of the instance to deny all inbound and outbound traffic.

Answer

Terminate the compromised instance immediately to prevent further damage.

Answer

Change the subnet route table to route traffic away from the compromised instance.

Question 5

A DevOps team is investigating a production incident where an Amazon RDS for MySQL database experienced a sudden spike in connections and CPU utilization. The team suspects a SQL injection attack. Which TWO actions should the team take to investigate and mitigate the incident?

Accepted Answer

Enable automated backups and ensure point-in-time recovery is configured.. Option B is correct because enabling automated backups and point-in-time recovery ensures that the database can be restored to a state before the suspected SQL injection attack, preserving data integrity and enabling forensic analysis. Option C is correct because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) to correlate with the spike, while audit logs capture actual SQL queries, which are essential for identifying malicious patterns and confirming the attack vector.

Answer

Delete the error logs to free up storage space.

Answer

Create a read replica to offload traffic from the primary instance.

Answer

Increase the DB instance size to handle the increased load.

Question 6

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.. The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed. This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Answer

The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.

Answer

The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.

Answer

The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.

Question 7

Drag and drop the steps to implement a blue/green deployment using AWS CodeDeploy.

Question 8

Drag and drop the steps to troubleshoot an AWS CloudTrail that is not logging API calls.

Question 9

Match each AWS compute or container service with its description.

Question 10

Match each AWS automation or configuration management tool to its description.

Question 11

A DevOps engineer notices that an EC2 instance running a critical web application has been terminated unexpectedly. The instance was part of an Auto Scaling group. Which step should the engineer take FIRST to investigate the root cause?

Accepted Answer

Review AWS CloudTrail logs for TerminateInstances API calls.. Option A is correct because the first step in incident response is to gather information. CloudTrail logs all API calls, including TerminateInstances, and can identify who or what terminated the instance. Option B is wrong because examining the application logs does not reveal the termination cause. Option C is wrong because scaling policies would not cause termination without CloudWatch. Option D is wrong because the termination reason is not available in the console without checking logs.

Answer

Look at the EC2 console's 'Termination Protection' setting.

Answer

Check the application logs on the instance's attached EBS volume (detached and attached to another instance).

Answer

Verify the Auto Scaling group's scaling policies and scheduled actions.

Question 12

A company uses AWS Lambda functions to process S3 events. After a recent deployment, some functions fail with timeout errors. The engineer needs to implement a solution that automatically captures and stores the function's input payload for all failed invocations without modifying the Lambda code. Which approach meets these requirements?

Accepted Answer

Use AWS Lambda Destinations with a failure destination pointing to an SQS queue.. Option D is correct because Lambda Destinations allow sending invocation records (including input payload) to SQS, SNS, Lambda, or EventBridge for failed events, without code changes. Option A is wrong because DLQs only capture messages for Lambda functions invoked asynchronously by SNS or SQS, not directly by S3 events. Option B is wrong because CloudWatch Logs does not capture payload by default; it only logs if the function writes to logs. Option C is wrong because CloudWatch Events (EventBridge) can capture Lambda invocations but not the payload without custom code.

Answer

Enable CloudWatch Logs Insights on the Lambda function's log group.

Answer

Use CloudWatch Events to capture Lambda invocation errors.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 13

A company uses Amazon RDS for MySQL as its database. The operations team notices that the database CPU utilization is consistently above 90% during peak hours, causing slow query responses. The team needs to quickly reduce CPU load without changing the application code. Which action should the team take?

Accepted Answer

Enable Performance Insights and analyze the top queries.. Option B is correct because enabling Performance Insights and analyzing queries helps identify inefficient queries that cause high CPU. Option A is wrong because read replicas do not reduce CPU on the primary instance. Option C is wrong because modifying DB parameters does not immediately reduce CPU. Option D is wrong because Multi-AZ is for high availability, not performance.

Answer

Enable Multi-AZ deployment.

Answer

Modify the DB parameter group to increase max_connections.

Answer

Add a read replica to offload read traffic.

Question 14

A company stores sensitive data in Amazon S3. A security audit reveals that several S3 buckets are publicly accessible. The DevOps engineer needs to implement a solution that automatically detects and alerts on any S3 bucket that becomes public. Which AWS service should the engineer use?

Accepted Answer

Amazon Macie. Option C is correct because Amazon Macie uses machine learning to discover, classify, and protect sensitive data, and it can alert on public buckets. Option A is wrong because AWS Trusted Advisor checks for public buckets but does not provide real-time alerts. Option B is wrong because S3 Block Public Access is a preventive control, not detective. Option D is wrong because AWS Config can track bucket policies but does not automatically alert on public access.

Answer

S3 Block Public Access

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 15

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent connection timeouts when calling an external API. The engineer needs to capture network traffic to diagnose the issue. Which solution is most appropriate?

Accepted Answer

Enable VPC Flow Logs on the ECS task's elastic network interface.. Option D is correct because VPC Flow Logs capture network traffic metadata at the ENI level, which can be analyzed to identify dropped packets or timeouts. Option A is wrong because AWS X-Ray traces requests but does not capture raw network packets. Option B is wrong because CloudWatch Logs does not capture network traffic. Option C is wrong because EC2 instances are not used with Fargate.

Answer

Enable detailed CloudWatch Logs for the ECS task.

Answer

Enable AWS X-Ray tracing on the ECS task.

Answer

Run tcpdump on the EC2 instance hosting the ECS task.