DOP-C02 Incident and Event Response Practice Test 4 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application is using the old master user credentials that were changed on the primary but not replicated to the standby. The most likely cause is that the application is using credentials that were changed on the primary but not replicated to the standby. In RDS Multi-AZ, changes made via the RDS console or API (e.g., modifying the master password) are automatically replicated, but direct SQL modifications (e.g., ALTER USER) are not. After failover, the standby becomes the new primary with the old credentials, causing 'Access denied for user' errors. Option A is incorrect because DNS CNAME propagation delays cause connection timeouts, not authentication failures. Option B is incorrect because storage configuration differences do not affect authentication. Option D is incorrect because the security group remains associated with the RDS instance and the application's IP address does not change during failover.

Answer

The DNS CNAME for the RDS endpoint has not propagated to the application's DNS resolver

Answer

The standby instance has a different storage configuration than the primary

Answer

The security group for the RDS instance does not allow inbound traffic from the application's new IP address

Question 2

Which TWO actions should a DevOps engineer take to ensure that an Amazon RDS for PostgreSQL database is automatically recovered in the event of a failure?

Accepted Answer

Enable automated backups with a retention period of at least 1 day. The correct actions are D and E. Enabling Multi-AZ deployment (E) provides automatic failover to a standby replica in a different Availability Zone, ensuring automatic recovery. Enabling automated backups with a retention period of at least 1 day (D) allows point-in-time recovery to any point within the retention period, which aids in recovery from failures like data corruption. Option A is incorrect because creating a read replica does not provide automatic failover; it is for read scaling. Option B is incorrect because manual snapshots require manual intervention and do not automate recovery. Option C is incorrect because cross-region replication is for disaster recovery, not automatic failover within the same region.

Answer

Create a read replica in a different Availability Zone

Answer

Take manual snapshots every hour

Answer

Configure cross-region replication to a secondary region

Question 3

Which TWO metrics should a DevOps engineer monitor to detect an EC2 instance that is unresponsive due to resource exhaustion?

Accepted Answer

MemoryUtilization. MemoryUtilization (B) is correct because memory exhaustion is a common cause of an unresponsive EC2 instance, and since the default CloudWatch agent does not collect memory metrics, monitoring MemoryUtilization via the CloudWatch agent is essential to detect RAM pressure that can trigger OOM kills or severe swapping. CPUUtilization (D) is correct because sustained near-100% CPU indicates resource exhaustion from runaway processes or overload, which directly causes an instance to become unresponsive to normal requests. StatusCheckFailed (A) only reports hypervisor-level or instance-level health checks and does not specifically indicate resource exhaustion such as high memory or CPU usage. DiskReadOps (C) measures disk read operation counts, which reflect I/O activity rather than exhaustion of a resource that would render the instance unresponsive. NetworkIn (E) tracks inbound network traffic volume, which is unrelated to detecting CPU or memory exhaustion on the instance.

Answer

StatusCheckFailed

Answer

DiskReadOps

Answer

NetworkIn

Question 4

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The engineer checks CloudWatch metrics and sees a CPU Utilization spike to 100% just before the instance became unresponsive. However, the instance status check passed. What should the engineer do NEXT to troubleshoot the issue?

Accepted Answer

Use the EC2 Serial Console to connect to the instance and diagnose the issue.. The EC2 Serial Console provides out-of-band access to the instance's serial port, allowing the engineer to interact with the bootloader, kernel, and system even when the network stack or SSH is unresponsive. Since the instance status check passed, the underlying hypervisor and network are likely functional, but the OS or application is hung due to CPU saturation. The serial console is the correct next step because it enables direct troubleshooting without relying on the instance's network connectivity, which may be impaired by the high CPU load.

Answer

Terminate the instance and launch a new one from the same AMI.

Answer

Review CloudWatch Logs for the instance to identify any application errors.

Answer

Increase the instance size and restart the instance.

Question 5

A company uses AWS CloudTrail to record API calls across multiple accounts and regions. The security team needs to be alerted immediately when an IAM user creates a new access key. Which combination of services should be used to achieve this with minimal latency?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic.. CloudTrail can stream logs to CloudWatch Logs, where a metric filter can be configured to match the 'CreateAccessKey' API call. This metric filter triggers a CloudWatch Alarm, which publishes to an SNS topic for immediate notification, providing minimal latency. Option B is incorrect because S3 event notifications on the CloudTrail bucket notify on object creation, but CloudTrail delivers log files in batches (e.g., every 5 minutes), causing delays beyond the required minimal latency. Option C is incorrect because while Amazon EventBridge can match CloudTrail events in near real-time, the question's intended solution (and the one that best fits 'minimal latency') is the metric filter + alarm pattern; however, EventBridge is a valid alternative, but the correct answer as per options is A. Option D is incorrect because polling the CloudTrail API every minute is inefficient, introduces latency, and does not provide real-time alerting.

Answer

Enable S3 event notifications on the CloudTrail S3 bucket to trigger a Lambda function.

Answer

Use Amazon EventBridge to match the CloudTrail event and invoke an AWS Lambda function that sends an email.

Answer

Configure a Lambda function to poll the CloudTrail API every minute and check for new access keys.

Question 6

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. The issue is a spike in connections exceeding max_connections. By monitoring DatabaseConnections with a CloudWatch alarm, you can trigger a Lambda function to increase the max_connections parameter in the DB parameter group (applied immediately or pending reboot) to handle the spike. Option A is incorrect because Multi-AZ provides failover, not load distribution; it does not increase connection capacity. Option C is incorrect: RDS Proxy pools connections but does not change the max_connections limit; it would help prevent the issue but not respond to it. Option D is incorrect because Auto Scaling for RDS changes instance size, which does not directly increase max_connections; moreover, scaling takes time and is not an immediate response to a connection spike.

Answer

Enable Multi-AZ to distribute the load across two instances.

Answer

Create a CloudWatch alarm on the DatabaseConnections metric to trigger a Lambda function that increases the max_connections parameter.

Answer

Use an Auto Scaling policy to increase the RDS instance size.

Question 7

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer invalidated the CloudFront cache. What is the MOST likely reason?

Accepted Answer

The invalidation has not propagated to all edge locations.. CloudFront invalidations are not instantaneous — they are propagated to all edge locations globally, and this propagation can take several minutes (sometimes up to 10-15 minutes) to complete across every Point of Presence. During that window, some users will still receive cached objects from edge locations that have not yet processed the invalidation. This is the most likely reason users see outdated content immediately after an invalidation request.

Answer

The origin is an Application Load Balancer that returns stale content.

Answer

The S3 bucket policy does not allow CloudFront to access the updated objects.

Answer

The CloudFront distribution has a default TTL of 86400 seconds set.

Question 8

A DevOps engineer is investigating a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The engineer needs to determine what actions the user performed and from which IP address. Which AWS service should be used to retrieve this information?

Accepted Answer

Amazon S3 server access logs.. Amazon S3 server access logs record detailed information about every request made to a bucket, including the requester's IP address, the action performed (GET, PUT, DELETE), the object accessed, and the timestamp. This is the only option that provides both the actions performed and the source IP for object-level access. CloudTrail management events do not capture S3 data-plane operations like GetObject.

Answer

AWS CloudTrail management events.

Answer

Amazon Inspector findings.

Answer

Amazon CloudWatch Logs for the S3 bucket.

Question 9

A company uses Amazon ECS with the Fargate launch type for a microservices application. The application experiences intermittent HTTP 5xx errors from the ALB. The DevOps team needs to diagnose the issue. Which TWO steps should be taken to gather diagnostic information? (Choose TWO.)

Accepted Answer

Enable Container Insights for the ECS cluster.. AWS Systems Manager Session Manager can reach Fargate containers via ECS Exec (aws ecs execute-command), which has been supported on Fargate platform version 1.4.0+ since 2021 -- it does not require an underlying EC2 instance. However, ECS Exec must be explicitly enabled per task (enableExecuteCommand) and provides only ad-hoc interactive access to a running container at a point in time; it does not retroactively capture or aggregate the application's historical stdout/stderr output the way the awslogs driver does, so it is not an efficient way to diagnose intermittent errors that may have already occurred. For systematically gathering diagnostic information about intermittent 5xx errors, CloudWatch Logs (via the task definition's log configuration) and Container Insights remain the correct choices.

Answer

Enable AWS X-Ray tracing on the ECS service.

Answer

Enable detailed monitoring on the underlying EC2 instances.

Answer

Use AWS Systems Manager Session Manager to connect to the running containers.

Question 10

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with the error: 'UPDATE_ROLLBACK_IN_PROGRESS'. The DevOps engineer needs to investigate the cause. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Review the CloudFormation console to identify which resource failed.. Option C is correct because the CloudFormation console shows the stack's resource list with per-resource status (for example UPDATE_FAILED or UPDATE_ROLLBACK_FAILED), making it the fastest way to pinpoint which resource caused the failed update. Option D is correct because when a stack is stuck in UPDATE_ROLLBACK_FAILED, the continue-update-rollback command with --retain-resources lets the engineer skip resources that failed to roll back (typically resources that were successfully updated or deleted out-of-band), allowing the rollback to complete. Option E is correct because stack events are the authoritative log of the update and rollback, containing the exact error messages (for example 'Resource is not in the state stackUpdateComplete') needed to diagnose the root cause. Option A is not appropriate because a change set previews proposed changes for a future update and cannot be created against a stack currently in UPDATE_ROLLBACK_IN_PROGRESS or UPDATE_ROLLBACK_FAILED. Option B is not appropriate because describe-stack-resource returns only the last known state of a single resource and does not provide the failure reason or the event history needed for investigation.

Answer

Create a change set to see what changes were attempted.

Answer

Use the 'describe-stack-resource' AWS CLI command to get the resource status.

Question 11

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to 'my-bucket' without specifying server-side encryption. What will happen?

Accepted Answer

The upload is denied because of the Deny statement.. The IAM policy contains an explicit Deny statement that matches the upload action when no server-side encryption header is present, and in AWS IAM an explicit Deny always overrides any Allow. Even though an Allow statement grants s3:PutObject, the Deny statement's condition (e.g., StringNotEquals on s3:x-amz-server-side-encryption) evaluates true for an unencrypted upload, so the request is denied. This is the intended enforcement pattern for mandatory encryption.

Answer

The upload is denied because the Allow statement requires encryption.

Answer

The upload is allowed because the Allow statement grants permission.

Answer

The upload is allowed because no encryption header is specified.

Question 12

Refer to the exhibit. A DevOps engineer set up a CloudWatch alarm for a Lambda function. The alarm fires when the error count metric exceeds 10 in 5 minutes. The engineer receives an alarm notification, but when checking the Lambda logs, only 3 errors are found in that 5-minute window. What is the MOST likely reason for the discrepancy?

Accepted Answer

The metric filter is counting errors from other log groups or sources that use the same metric name.. CloudWatch metric filters are scoped to a log group, but if multiple log groups publish to the same custom metric name (or the filter is applied to a log group receiving aggregated logs), the alarm aggregates all matching data points. The Lambda function's own logs show only 3 errors, but the metric may include errors from other sources sharing the metric name, inflating the count above 10.

Answer

The metric filter is not processing logs in real time, causing a delay.

Answer

The metric filter pattern is incorrect and is matching non-error entries.

Answer

The Lambda function is generating more errors than shown in the logs.

Question 13

A company uses AWS CloudFormation to manage infrastructure. After a failed stack update, the stack is in ROLLBACK_COMPLETE state. The DevOps team needs to identify the specific resource that caused the rollback and review the error message. Which approach provides the most efficient way to achieve this?

Accepted Answer

View the Events tab in the AWS CloudFormation console.. The CloudFormation console's Events tab provides a chronological, human-readable list of all stack events, including resource status changes and error messages. When a stack update fails and rolls back, the Events tab clearly shows which resource entered a failure state (e.g., UPDATE_FAILED or CREATE_FAILED) and includes the exact error reason returned by the underlying service. This is the most efficient way to pinpoint the problematic resource and its error message without additional filtering or API calls.

Answer

Run describe-stack-events and filter by status.

Answer

Check AWS CloudTrail for the UpdateStack API call.

Answer

Run describe-stack-resources to list all stack resources.

Question 14

An application running on Amazon ECS Fargate is experiencing intermittent 503 errors. The task definition sets a soft limit of 512 CPU units and 1024 memory. The errors occur when traffic spikes. Which change is most likely to resolve the issue?

Accepted Answer

Increase the soft memory limit to 2048 MiB.. Increase the task definition's memory allocation (the single hard memory value Fargate enforces) to 2048 MiB, adjusting the paired CPU value as needed (e.g. 1024 CPU units to support 2048 MiB). Fargate has no separate soft/reservation limit -- the memory value you set is both the reservation and the hard cap enforced by cgroups -- so raising this single value gives the task's working set more headroom and prevents the OOM kill that is producing the intermittent 503s under traffic spikes.

Answer

Increase the soft CPU limit to 1024 units.

Answer

Change the soft memory limit to a hard limit.

Answer

Increase the desired task count in the service.

Question 15

A DevOps engineer is troubleshooting an Amazon CloudWatch alarm that is not triggering as expected. The alarm monitors an SQS queue's ApproximateNumberOfMessagesVisible metric with a threshold of 100 for 1 evaluation period. The queue has had over 100 messages for the past 30 minutes, but the alarm remains in OK state. What is the most likely cause?

Accepted Answer

Messages are being consumed but not deleted, causing them to become invisible.. SQS's ApproximateNumberOfMessagesVisible counts only messages that are visible in the queue. When a consumer receives a message, it becomes invisible for the visibility timeout period, so if consumers receive messages but fail to delete them, the messages cycle between visible and invisible states. If enough messages are in-flight (invisible) at each evaluation, the visible count may never exceed 100 for a full evaluation period, keeping the alarm in OK state.

Answer

The alarm period is set longer than 30 minutes.

Answer

The alarm is not configured to evaluate the metric correctly.

Answer

The SQS queue is not being polled.