DOP-C02 Incident and Event Response Practice Test 3 — 15 Questions

Question 1

Drag and drop the steps to implement a blue/green deployment using AWS CodeDeploy.

Accepted Answer

Create application -> Create deployment group with blue/green settings -> Deploy -> Validate deployment -> Reroute traffic. First create the application and deployment group, then configure blue/green settings, then deploy, then validate, then reroute traffic.

Answer

Create application -> Deploy -> Create deployment group -> Validate -> Reroute traffic

Answer

Create deployment group -> Create application -> Deploy -> Validate -> Reroute traffic

Answer

Create application -> Create deployment group -> Configure blue/green settings -> Validate -> Deploy -> Reroute traffic

Question 2

Drag and drop the steps to troubleshoot an AWS CloudTrail that is not logging API calls.

Accepted Answer

Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Check IAM role, then Test CloudTrail logging. First verify CloudTrail is enabled, then check bucket policy, then check integrity, then check IAM role, then test.

Answer

Check bucket policy, then Check IAM role, then Verify CloudTrail is enabled, then Check log file integrity, then Test CloudTrail logging

Answer

Verify CloudTrail is enabled, then Check log file integrity, then Check bucket policy, then Check IAM role, then Test CloudTrail logging

Answer

Check IAM role, then Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Test CloudTrail logging

Question 3

Match each AWS compute or container service with its description.

Accepted Answer

EC2: Virtual servers in the cloud. Correct matches: EC2 for virtual servers, ECS for Docker containers, EKS for Kubernetes, Lambda for serverless computing. Common confusions include mistaking EC2 as serverless or mixing up ECS and EKS.

Answer

EC2: Serverless compute service

Answer

ECS: Managed Kubernetes service

Question 4

A DevOps engineer notices that an EC2 instance running a critical web application has been terminated unexpectedly. The instance was part of an Auto Scaling group. Which step should the engineer take FIRST to investigate the root cause?

Accepted Answer

Review AWS CloudTrail logs for TerminateInstances API calls.. The first step in incident response is to gather information. CloudTrail logs all API calls, including TerminateInstances, and can identify who or what terminated the instance. Option B is wrong because examining the application logs does not reveal the termination cause. Option C is wrong because scaling policies would not cause termination without CloudWatch. Option D is wrong because the termination reason is not available in the console without checking logs.

Answer

Look at the EC2 console's 'Termination Protection' setting.

Answer

Check the application logs on the instance's attached EBS volume (detached and attached to another instance).

Answer

Verify the Auto Scaling group's scaling policies and scheduled actions.

Question 5

A company uses AWS Lambda functions to process S3 events. After a recent deployment, some functions fail with timeout errors. The engineer needs to implement a solution that automatically captures and stores the function's input payload for all failed invocations without modifying the Lambda code. Which approach meets these requirements?

Accepted Answer

Use AWS Lambda Destinations with a failure destination pointing to an SQS queue.. AWS Lambda Destinations allow sending invocation records (including input payload) to SQS, SNS, Lambda, or EventBridge for failed events, without code changes. Option A is wrong because CloudWatch Logs Insights is a query tool for log groups; it does not automatically capture payloads for failed invocations. Option B is wrong because CloudWatch Events (now Amazon EventBridge) can capture invocation errors but does not include the input payload by default. Option C is wrong because a dead-letter queue (DLQ) for asynchronous invocations only captures the message, not the event payload, and it requires the function to be invoked asynchronously, which is not the case for S3 event invocations (they are synchronous). Therefore, only Lambda Destinations meet the requirement of capturing the payload without code changes.

Answer

Enable CloudWatch Logs Insights on the Lambda function's log group.

Answer

Use CloudWatch Events to capture Lambda invocation errors.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 6

A company uses Amazon RDS for MySQL as its database. The operations team notices that the database CPU utilization is consistently above 90% during peak hours, causing slow query responses. The team needs to quickly reduce CPU load without changing the application code. Which action should the team take?

Accepted Answer

Enable Performance Insights and analyze the top queries.. Enabling Performance Insights allows the team to identify the specific queries that are consuming CPU resources. By analyzing these top queries, the team can take targeted actions such as optimizing queries or adding indexes to reduce CPU load without changing application code. Option A is incorrect because Multi-AZ deployment provides high availability and failover support but does not reduce CPU utilization. Option B is incorrect because increasing max_connections allows more concurrent connections, which can actually increase CPU load rather than reduce it. Option C is incorrect because adding a read replica offloads read traffic but does not reduce CPU load on the primary instance, and typically requires application changes to route read queries to the replica.

Answer

Enable Multi-AZ deployment.

Answer

Modify the DB parameter group to increase max_connections.

Answer

Add a read replica to offload read traffic.

Question 7

A company stores sensitive data in Amazon S3. A security audit reveals that several S3 buckets are publicly accessible. The DevOps engineer needs to implement a solution that automatically detects and alerts on any S3 bucket that becomes public. Which AWS service should the engineer use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover, classify, and protect sensitive data, and it can automatically detect and alert on S3 buckets that become publicly accessible. Option B is incorrect because S3 Block Public Access is a preventive control, not detective. Option C is incorrect because AWS Trusted Advisor can check for public buckets but does not provide real-time alerts. Option D is incorrect because AWS Config can track bucket policies but does not automatically alert on public access.

Answer

S3 Block Public Access

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 8

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent connection timeouts when calling an external API. The engineer needs to capture network traffic to diagnose the issue. Which solution is most appropriate?

Accepted Answer

Enable VPC Flow Logs on the ECS task's elastic network interface.. VPC Flow Logs capture network traffic metadata at the elastic network interface (ENI) level, which can be analyzed to identify dropped packets, timeouts, and other connectivity issues. For ECS tasks with Fargate, each task gets its own ENI, so enabling VPC Flow Logs on that ENI provides network-level diagnostics without needing to run commands inside the container. Option A is wrong because CloudWatch Logs captures application logs, not network packets. Option C is wrong because AWS X-Ray traces requests and provides latency information but does not capture raw network traffic. Option D is wrong because Fargate does not use underlying EC2 instances that the user can access; thus, running tcpdump is not possible.

Answer

Enable detailed CloudWatch Logs for the ECS task.

Answer

Enable AWS X-Ray tracing on the ECS task.

Answer

Run tcpdump on the EC2 instance hosting the ECS task.

Question 9

A company uses AWS CloudFormation to deploy infrastructure. A recent stack update failed, and the engineer needs to roll back to the previous stable state. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the 'Rollback' action in the CloudFormation console.. CloudFormation provides a built-in 'Rollback' action that automatically reverts a stack to its last known stable state when a stack update fails. This rollback occurs by default on failure, but if the engineer needs to manually trigger it after a failed update, they can use the 'Rollback' action in the CloudFormation console or API (e.g., `aws cloudformation rollback-stack`). This ensures the infrastructure returns to the previous working configuration without manual intervention.

Answer

Use AWS CloudFormation Drift Detection.

Answer

Use AWS CloudFormation StackSets.

Answer

Create a Change Set and execute it.

Question 10

A company's DevOps team uses AWS CodePipeline to automate deployments. A recent pipeline execution failed at the 'Deploy' stage. The engineer needs to view the detailed logs for the failed action. Which AWS service or feature should the engineer use?

Accepted Answer

CloudWatch Logs. AWS CodePipeline integrates with Amazon CloudWatch Logs to capture and store detailed execution logs for each pipeline action, including the 'Deploy' stage. When a deployment action fails, the engineer can view the associated logs directly from the CodePipeline console or via the CloudWatch Logs console, which provides granular error messages, timestamps, and stack traces necessary for troubleshooting. This is the designated service for accessing action-level logs in CodePipeline.

Answer

S3 access logs

Answer

CodeBuild logs

Answer

CloudTrail

Question 11

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to know who attempted to decrypt data using a specific KMS key and whether the attempt succeeded. Which AWS service should the team use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey, as events in the CloudTrail logs. By examining CloudTrail events for the specific KMS key ID, the security team can see who called the Decrypt API and whether the call succeeded (HTTP 200) or failed (e.g., AccessDenied). This provides the exact audit trail needed for incident response.

Answer

AWS Config

Answer

KMS key policies

Answer

CloudWatch Logs

Question 12

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that failed. Which TWO resources should the engineer examine to identify the cause of the failure? (Choose two.)

Accepted Answer

CloudWatch Logs for CodeDeploy. AWS CodeDeploy emits detailed logs about deployment lifecycle events (e.g., BeforeInstall, ApplicationStop) to CloudWatch Logs. These logs contain error messages, script output, and status codes that directly indicate why a deployment step failed, such as a permission issue or a script syntax error. Examining CloudWatch Logs for CodeDeploy is the primary method to diagnose deployment failures.

Answer

EC2 instance system logs

Answer

S3 access logs

Answer

CloudTrail logs

Question 13

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The instance is part of an Auto Scaling group with a minimum size of 2. What is the quickest way to restore service with minimal data loss?

Accepted Answer

Terminate the instance and let the Auto Scaling group launch a new one.. Terminating the unresponsive instance triggers the Auto Scaling group to automatically launch a replacement instance, restoring service with minimal data loss. Since the Auto Scaling group has a minimum size of 2, it will immediately detect the terminated instance and launch a new one using the launch template or configuration, ensuring the desired capacity is maintained without manual intervention.

Answer

Stop and start the instance from the EC2 console.

Answer

Create a new AMI from the instance and launch a replacement manually.

Answer

Restore the instance from the most recent EBS snapshot.

Question 14

A company uses AWS CloudTrail to log API events. During an incident investigation, they need to identify who deleted an S3 bucket. Which CloudTrail feature should be used to retrieve the event details quickly?

Accepted Answer

CloudTrail Event history. CloudTrail Event history provides a view of the last 90 days of management events for each AWS region, allowing you to quickly search and filter by resource name (e.g., the S3 bucket name) and event name (e.g., DeleteBucket). This feature is designed for rapid retrieval of recent API activity without needing to query S3 or set up additional infrastructure, making it the fastest option for identifying who deleted an S3 bucket during an incident investigation.

Answer

CloudTrail log file integrity validation

Answer

CloudTrail Lake

Answer

CloudTrail Insights

Question 15

An application running on Amazon ECS (Fargate) experiences intermittent HTTP 503 errors. The application uses an Application Load Balancer. The ECS service has a desired count of 2. CPU and memory utilization are below 50%. What is the most likely cause?

Accepted Answer

The target group health check threshold is set too low.. Intermittent HTTP 503 errors from an Application Load Balancer (ALB) typically indicate that the target group health checks are failing, causing the ALB to stop routing traffic to the affected tasks. With a desired count of 2 and low CPU/memory utilization, the most likely cause is a health check threshold set too low (e.g., a low unhealthy threshold count), which makes the ALB prematurely mark tasks as unhealthy during transient issues, leading to no healthy targets and 503 responses. This aligns with the symptom of intermittent errors, as tasks may briefly fail a health check but recover quickly, yet the low threshold causes them to be deregistered.

Answer

The ECS service Auto Scaling is too aggressive.

Answer

The ALB listener rule is misconfigured.

Answer

The task definition has an incorrect memory hard limit.