DOP-C02 Incident and Event Response Practice Test 4 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. A recent stack update failed, and the engineer needs to roll back to the previous stable state. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the 'Rollback' action in the CloudFormation console.. Option C is correct because CloudFormation provides a built-in 'Rollback' action that automatically reverts a stack to its last known stable state when a stack update fails. This rollback occurs by default on failure, but if the engineer needs to manually trigger it after a failed update, they can use the 'Rollback' action in the CloudFormation console or API (e.g., `aws cloudformation rollback-stack`). This ensures the infrastructure returns to the previous working configuration without manual intervention.

Answer

Use AWS CloudFormation Drift Detection.

Answer

Use AWS CloudFormation StackSets.

Answer

Create a Change Set and execute it.

Question 2

A company's DevOps team uses AWS CodePipeline to automate deployments. A recent pipeline execution failed at the 'Deploy' stage. The engineer needs to view the detailed logs for the failed action. Which AWS service or feature should the engineer use?

Accepted Answer

CloudWatch Logs. AWS CodePipeline integrates with Amazon CloudWatch Logs to capture and store detailed execution logs for each pipeline action, including the 'Deploy' stage. When a deployment action fails, the engineer can view the associated logs directly from the CodePipeline console or via the CloudWatch Logs console, which provides granular error messages, timestamps, and stack traces necessary for troubleshooting. This is the designated service for accessing action-level logs in CodePipeline.

Answer

S3 access logs

Answer

CodeBuild logs

Answer

CloudTrail

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 503 errors. The engineer suspects the ALB is returning these errors because the target instances are unhealthy. Which metric should the engineer monitor to confirm this suspicion?

Accepted Answer

HealthyHostCount. Option A is correct because the ALB publishes a metric 'HealthyHostCount' that shows the number of healthy targets. If this metric drops to zero, the ALB returns 503 errors. Option B is wrong because 'UnhealthyHostCount' is not a standard ALB metric. Option C is wrong because 'RequestCount' does not indicate health. Option D is wrong because 'TargetResponseTime' does not indicate health status.

Answer

RequestCount

Answer

UnhealthyHostCount

Answer

TargetResponseTime

Question 4

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to know who attempted to decrypt data using a specific KMS key and whether the attempt succeeded. Which AWS service should the team use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey, as events in the CloudTrail logs. By examining CloudTrail events for the specific KMS key ID, the security team can see who called the Decrypt API and whether the call succeeded (HTTP 200) or failed (e.g., AccessDenied). This provides the exact audit trail needed for incident response.

Answer

AWS Config

Answer

KMS key policies

Answer

CloudWatch Logs

Question 5

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Review the canary's CloudWatch Logs for error details.. Option A is correct because canary logs are stored in CloudWatch Logs and can be analyzed. Option D is correct because canaries run on Lambda, and Lambda execution logs may contain additional error details. Option B is wrong because CloudTrail does not log canary execution details. Option C is wrong because CloudWatch Metrics do not provide detailed error information. Option E is wrong because the canary code is not accessible for modification.

Answer

Modify the canary script to add more logging.

Answer

Examine CloudWatch metrics for the canary.

Answer

Check CloudTrail for CanaryRun API calls.

Question 6

A company has a multi-account AWS organization. The security team needs to detect and respond to security incidents across all accounts centrally. Which THREE services should the team use together? (Choose three.)

Accepted Answer

AWS Security Hub. Option A is correct because GuardDuty provides threat detection across accounts. Option B is correct because Security Hub aggregates findings from multiple services and accounts. Option D is correct because Detective analyzes and investigates security findings. Option C is wrong because Inspector is for vulnerability assessments, not incident response. Option E is wrong because Macie is for data classification, not incident response.

Answer

Amazon Inspector

Answer

Amazon Macie

Question 7

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that failed. Which TWO resources should the engineer examine to identify the cause of the failure? (Choose two.)

Accepted Answer

CloudWatch Logs for CodeDeploy. Option B is correct because AWS CodeDeploy emits detailed logs about deployment lifecycle events (e.g., BeforeInstall, ApplicationStop) to CloudWatch Logs. These logs contain error messages, script output, and status codes that directly indicate why a deployment step failed, such as a permission issue or a script syntax error. Examining CloudWatch Logs for CodeDeploy is the primary method to diagnose deployment failures.

Answer

EC2 instance system logs

Answer

S3 access logs

Answer

CloudTrail logs

Question 8

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. Option A is correct because the policy requires encryption, so the upload will fail with Access Denied. Option B is wrong because the condition requires encryption. Option C is wrong because SSE-S3 uses AES256, but the condition requires it to be set explicitly. Option D is wrong because the policy does not allow unencrypted uploads.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-S3 encryption.

Answer

The upload succeeds and is automatically encrypted with SSE-S3.

Question 9

Refer to the exhibit. A CloudWatch alarm is configured for an EC2 instance. The CPU utilization exceeds 80% for two consecutive minutes. What action will occur?

Accepted Answer

The instance will be recovered.. Option C is correct because the alarm action is 'ec2:recover', which initiates instance recovery. Option A is wrong because the action is recover, not reboot. Option B is wrong because the alarm does not stop the instance. Option D is wrong because the alarm evaluates every 60 seconds, not 2 minutes as a total period.

Answer

No action will be taken because the period is 60 seconds.

Answer

The instance will be rebooted.

Answer

The instance will be stopped.

Question 10

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The instance is part of an Auto Scaling group with a minimum size of 2. What is the quickest way to restore service with minimal data loss?

Accepted Answer

Terminate the instance and let the Auto Scaling group launch a new one.. Option C is correct because terminating the unresponsive instance triggers the Auto Scaling group to automatically launch a replacement instance, restoring service with minimal data loss. Since the Auto Scaling group has a minimum size of 2, it will immediately detect the terminated instance and launch a new one using the launch template or configuration, ensuring the desired capacity is maintained without manual intervention.

Answer

Stop and start the instance from the EC2 console.

Answer

Create a new AMI from the instance and launch a replacement manually.

Answer

Restore the instance from the most recent EBS snapshot.

Question 11

A company uses AWS CloudTrail to log API events. During an incident investigation, they need to identify who deleted an S3 bucket. Which CloudTrail feature should be used to retrieve the event details quickly?

Accepted Answer

CloudTrail Event history. CloudTrail Event history provides a view of the last 90 days of management events for each AWS region, allowing you to quickly search and filter by resource name (e.g., the S3 bucket name) and event name (e.g., DeleteBucket). This feature is designed for rapid retrieval of recent API activity without needing to query S3 or set up additional infrastructure, making it the fastest option for identifying who deleted an S3 bucket during an incident investigation.

Answer

CloudTrail log file integrity validation

Answer

CloudTrail Lake

Answer

CloudTrail Insights

Question 12

An application running on Amazon ECS (Fargate) experiences intermittent HTTP 503 errors. The application uses an Application Load Balancer. The ECS service has a desired count of 2. CPU and memory utilization are below 50%. What is the most likely cause?

Accepted Answer

The target group health check threshold is set too low.. Intermittent HTTP 503 errors from an Application Load Balancer (ALB) typically indicate that the target group health checks are failing, causing the ALB to stop routing traffic to the affected tasks. With a desired count of 2 and low CPU/memory utilization, the most likely cause is a health check threshold set too low (e.g., a low unhealthy threshold count), which makes the ALB prematurely mark tasks as unhealthy during transient issues, leading to no healthy targets and 503 responses. This aligns with the symptom of intermittent errors, as tasks may briefly fail a health check but recover quickly, yet the low threshold causes them to be deregistered.

Answer

The ECS service Auto Scaling is too aggressive.

Answer

The ALB listener rule is misconfigured.

Answer

The task definition has an incorrect memory hard limit.

Question 13

A DevOps team receives a CloudWatch alarm that an RDS DB instance's CPU utilization has exceeded 90% for 5 minutes. The application is experiencing latency. What is the best immediate step to mitigate the issue?

Accepted Answer

Modify the RDS instance to a larger instance class.. Option C is correct because when an RDS instance's CPU utilization exceeds 90% for 5 minutes and the application is experiencing latency, the immediate step is to scale up the instance to a larger class to provide more CPU capacity. This directly addresses the resource bottleneck without requiring time-consuming analysis or architectural changes, making it the fastest mitigation for an ongoing incident.

Answer

Analyze slow query logs and optimize queries.

Answer

Enable Multi-AZ deployment for failover.

Answer

Add a read replica to offload read traffic.

Question 14

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a patching window, some instances fail to apply patches. The engineer checks the SSM Agent logs and sees 'ERROR: Failed to download patch files from the source.' What is the most likely cause?

Accepted Answer

The security group or NACL is blocking outbound HTTPS traffic (port 443).. The error 'Failed to download patch files from the source' indicates that the SSM Agent on the instance cannot reach the patch source repositories (e.g., Windows Update, Amazon Linux repos, or custom patch sources). Systems Manager Patch Manager requires outbound HTTPS (port 443) connectivity to download patch metadata and binaries. If a security group or NACL blocks this traffic, the download fails, producing this exact error in the agent logs.

Answer

The IAM instance profile does not grant ssm:UpdateInstanceInformation.

Answer

The SSM Agent is outdated.

Answer

The patch baseline is configured incorrectly.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. The correct answer is D. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)