DOP-C02 Incident and Event Response Practice Test 4 — 15 Questions

Question 1

A DevOps team receives a CloudWatch alarm that an RDS DB instance's CPU utilization has exceeded 90% for 5 minutes. The application is experiencing latency. What is the best immediate step to mitigate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the RDS instance to a larger instance class.. When an RDS instance's CPU utilization exceeds 90% for 5 minutes and the application is experiencing latency, the immediate step is to scale up the instance to a larger class to provide more CPU capacity. This directly addresses the resource bottleneck without requiring time-consuming analysis or architectural changes, making it the fastest mitigation for an ongoing incident.

Answer

Analyze slow query logs and optimize queries.

Answer

Enable Multi-AZ deployment for failover.

Answer

Add a read replica to offload read traffic.

Question 2

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a patching window, some instances fail to apply patches. The engineer checks the SSM Agent logs and sees 'ERROR: Failed to download patch files from the source.' What is the most likely cause?

Accepted Answer

The security group or NACL is blocking outbound HTTPS traffic (port 443).. The error 'Failed to download patch files from the source' indicates that the SSM Agent on the instance cannot reach the patch source repositories (e.g., Windows Update, Amazon Linux repos, or custom patch sources). Systems Manager Patch Manager requires outbound HTTPS (port 443) connectivity to download patch metadata and binaries. If a security group or NACL blocks this traffic, the download fails, producing this exact error in the agent logs.

Answer

The IAM instance profile does not grant ssm:UpdateInstanceInformation.

Answer

The SSM Agent is outdated.

Answer

The patch baseline is configured incorrectly.

Question 3

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Question 4

A DevOps engineer is troubleshooting a Lambda function that times out after 3 seconds. The function makes an HTTP request to an external API. The function's timeout setting is 10 seconds. What is the most likely cause of the timeout?

Accepted Answer

The HTTP client's timeout is set to a low value.. The Lambda function times out after exactly 3 seconds, which is a common default HTTP client timeout (e.g., 3 seconds in the Node.js `http` module or Python `requests` library). Even though the Lambda function's configured timeout is 10 seconds, the HTTP client's internal timeout fires first, causing the function to fail before the Lambda timeout is reached. This is the most likely cause because the symptom matches a client-side timeout rather than a server-side or infrastructure issue.

Answer

The external API is throttling the request.

Answer

The Lambda function is not in a VPC.

Answer

The Lambda function's memory is insufficient.

Question 5

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in a specific region report slow load times. The DevOps team checks CloudFront metrics and sees a high error rate (5xx) for that region. The S3 bucket is healthy. What is the most likely cause?

Accepted Answer

The CloudFront origin shield is misconfigured.. A high 5xx error rate from CloudFront in a specific region, combined with a healthy S3 bucket, indicates that CloudFront is encountering issues communicating with the origin shield or the origin. The most likely cause is that the CloudFront origin shield is misconfigured. Origin shield acts as an additional caching layer between CloudFront edge locations and the origin. If misconfigured, such as incorrect region selection or network connectivity issues, it can cause 5xx errors (e.g., 502 Bad Gateway or 503 Service Unavailable) for requests that go through it. This can affect a specific region if the origin shield is in a different region or has issues. Other options: A (WAF blocking) would cause 403 errors, not 5xx; B (missing OAI) would cause 403 errors, which CloudFront returns as 403 to the viewer; C (TTL too short) would not cause error rates.

Answer

The AWS WAF web ACL is blocking requests from that region.

Answer

The S3 bucket policy does not grant access to the CloudFront origin access identity (OAI).

Answer

The CloudFront distribution's default TTL is too short.

Question 6

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the Auto Scaling group launches new instances, but users experience session loss. What is the most likely cause?

Accepted Answer

The target group's deregistration delay is too short.. Sticky sessions rely on the instance ID to route requests. During a deployment, Auto Scaling launches new instances and terminates old ones. The target group's deregistration delay controls how long the ALB waits before forcibly closing connections to deregistering instances. If this delay is too short, in-flight requests and sessions are abruptly terminated, causing users to lose their sessions. Options A, B, and D are incorrect: lifecycle hooks (A) are for custom actions, not directly related to session loss; stickiness duration (B) affects how long a session sticks to an instance but does not cause loss during deployment; and health check interval (D) affects availability but not session persistence.

Answer

The Auto Scaling group's lifecycle hooks are not configured.

Answer

The stickiness duration is set too low.

Answer

The target group's health check interval is too long.

Question 7

Which THREE steps should a DevOps engineer take to troubleshoot an EC2 instance that cannot be reached via SSH? (Choose three.)

Accepted Answer

Check the network ACL inbound rules for the subnet.. Network ACLs (NACLs) are stateless firewall rules applied at the subnet level. If the inbound rule for ephemeral ports or port 22 is not explicitly allowed, SSH traffic will be dropped even if the security group permits it. Checking NACL inbound rules is a fundamental step in troubleshooting connectivity issues.

Answer

Verify that the corporate firewall allows SSH to the instance.

Answer

Create an AMI from the instance and launch a new one.

Question 8

Which TWO metrics should be monitored in Amazon CloudWatch to detect a potential memory leak in an EC2 instance? (Choose two.)

Accepted Answer

MemoryUtilization (custom metric published via CloudWatch Agent).. MemoryUtilization is a custom metric that must be published via the CloudWatch Agent because EC2 does not expose memory metrics by default. Monitoring this metric over time can reveal a steady upward trend in memory usage that does not drop after processes complete, which is a classic symptom of a memory leak.

Answer

DiskReadOps

Answer

NetworkIn

Answer

CPUUtilization

Question 9

A DevOps engineer notices that an Amazon RDS for MySQL instance has failed over to a standby replica. The engineer needs to identify the root cause by examining metrics. Which AWS service should the engineer use to view the database load, replication lag, and failover events?

Accepted Answer

Amazon CloudWatch. Amazon RDS integrates with CloudWatch to monitor metrics like DatabaseConnections, ReplicaLag, and failover events. Option A is wrong because CloudTrail records API calls but not database-level metrics. Option C is wrong because VPC Flow Logs capture network traffic, not database metrics. Option D is wrong because Trusted Advisor provides best-practice checks, not real-time metrics.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Question 10

An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?

Accepted Answer

Enable VPC Flow Logs and query Amazon Athena. VPC Flow Logs capture all network traffic (accepted and rejected) and can be queried using Amazon Athena to identify denied requests. Option A is incorrect because AWS Config records resource configuration changes, not network traffic. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option C is incorrect because AWS Security Hub aggregates security findings from various services but does not log individual traffic flows. Therefore, enabling VPC Flow Logs and querying Athena is the appropriate approach to analyze security group traffic and identify denied requests.

Answer

Use AWS Config to review security group rules

Answer

Check AWS CloudTrail for security group modification events

Answer

Enable AWS Security Hub and review the security findings

Question 11

A company uses AWS Lambda functions to process events from Amazon SQS. Recently, the Lambda function has been throttled, causing messages to accumulate in the dead-letter queue (DLQ). The function’s reserved concurrency is set to 100, and the account’s regional concurrency limit is 1000. What is the MOST likely cause of the throttling?

Accepted Answer

The function’s concurrency is fully utilized due to long-running invocations. The most likely cause of throttling is that the function's reserved concurrency of 100 is fully utilized due to long-running invocations. When invocations take longer to complete, they occupy concurrency for an extended period, preventing new invocations from starting. This leads to messages accumulating in the DLQ. Option D is incorrect because reserved concurrency of 100 is well below the account limit of 1000, so that is not the cause. Option B is incorrect because cold starts cause latency but not throttling; they do not consume concurrency. Option C is incorrect because the queue type (standard vs. FIFO) does not directly cause throttling; Lambda can process from both.

Answer

The Lambda function has a cold start issue

Answer

The SQS queue is not configured as a FIFO queue

Answer

The reserved concurrency is set too high, exceeding the account limit

Question 12

A DevOps engineer receives an alert that an Amazon EC2 instance’s CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a step scaling policy based on average CPU. The engineer checks the CloudWatch alarm and sees that it is in the ALARM state. What should the engineer do to verify that the Auto Scaling group is scaling out properly?

Accepted Answer

Review the Auto Scaling group’s activity history in the EC2 console. Reviewing the Auto Scaling group's activity history in the EC2 console shows whether scaling actions were triggered and if new instances were launched. The CloudWatch alarm is in ALARM state (indicating high CPU), and the step scaling policy should scale out, so checking the activity history confirms the scaling action occurred. Option A is incorrect because the scaling policy is for scaling out on high CPU, not scaling in. Option B is incorrect because CloudWatch Logs show instance-level logs, not Auto Scaling actions. Option C is incorrect because the alarm is in ALARM state, not INSUFFICIENT_DATA.

Answer

Ensure the scaling policy is configured to scale in

Answer

Check the CloudWatch Logs for the instance

Answer

Verify that the CloudWatch alarm is in INSUFFICIENT_DATA state

Question 13

A company uses AWS CloudFormation to deploy infrastructure. During an incident, a stack update fails with a stack rollback. The engineer needs to prevent the stack from rolling back on future failures and instead retain the resources for debugging. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the '--disable-rollback' option when updating the stack. The `--disable-rollback` option (or `DisableRollback` in the CloudFormation template) instructs AWS CloudFormation to leave the stack in its current state (with the failed resources intact) instead of automatically rolling back to the last known good state. This allows engineers to retain the resources for debugging without the stack being torn down on failure.

Answer

Enable drift detection on the stack

Answer

Use AWS CloudFormation StackSets to deploy the stack

Answer

Create a change set before updating instead of direct update

Question 14

An application running on Amazon ECS with Fargate is experiencing increased latency. The DevOps team suspects that the task is running out of memory and swapping. Which set of CloudWatch metrics should the team examine to confirm this suspicion?

Accepted Answer

MemoryUtilized and MemoryReserved. MemoryUtilized and MemoryReserved are the CloudWatch metrics that directly track memory consumption and allocation for ECS tasks using Fargate. When a task runs out of memory, the Linux kernel’s OOM killer may terminate processes, but before that, swapping can occur if swap space is available, causing increased latency. These metrics allow the DevOps team to compare actual memory usage against the task’s memory reservation, confirming if memory pressure is the root cause of the latency.

Answer

NetworkIn and NetworkOut

Answer

CPUUtilization and CPUReservation

Answer

EphemeralStorageUtilized and EphemeralStorageReserved

Question 15

A DevOps engineer receives an alert that an Amazon S3 bucket has become publicly accessible. The engineer needs to identify who made the bucket public. Which AWS service should the engineer use to find the API call that changed the bucket policy?

Accepted Answer

AWS CloudTrail. CloudTrail records all S3 API calls, including bucket policy changes. Option A is wrong because CloudWatch monitors metrics. Option C is wrong because Config records configuration changes but not the identity. Option D is wrong because GuardDuty detects threats but doesn't log API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty