DOP-C02 Incident and Event Response Practice Test 5 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team needs to receive real-time notifications when any IAM user in any account creates an access key. Which solution is the most operationally efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config rules with a CloudWatch Events rule to detect CreateAccessKey and publish to an SNS topic.. AWS Config supports multi-account, multi-region aggregation and can evaluate configuration changes against managed or custom rules. A custom Config rule can detect the CreateAccessKey API call (or the resulting IAM user configuration change) and, combined with an Amazon EventBridge (CloudWatch Events) rule, trigger an SNS notification in near real-time. This approach is operationally efficient because Config and EventBridge are native, serverless services that require no log parsing or custom query infrastructure, and they work across all accounts in an AWS Organization when centralized via a delegated administrator.

Answer

Enable CloudTrail in all accounts and send logs to a central S3 bucket, then use Amazon Athena to query.

Answer

Create an SCP that denies access key creation and monitor with CloudWatch.

Answer

Use AWS Trusted Advisor to check for exposed access keys.

Question 2

A company uses AWS CloudTrail to log API calls. The security team needs to be alerted when an IAM user performs a ConsoleLogin event from an IP address outside the corporate network. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Create a CloudWatch Events rule that matches ConsoleLogin and publishes to an SNS topic.. Option E is correct because CloudTrail must have management events enabled to record ConsoleLogin, which is an IAM management (control plane) event; without logging management events, no ConsoleLogin record is generated for detection. Option A is correct because an Amazon CloudWatch Events (EventBridge) rule can match the ConsoleLogin API call from CloudTrail and route it to an SNS topic, which then alerts the security team; the rule pattern can also filter on the source IP address to detect logins outside the corporate network. Option B is incorrect because AWS Config rules evaluate resource configuration compliance, not real-time API login events. Option C is incorrect because S3 event notifications only fire on object-level operations in the bucket, not on the semantic content of CloudTrail log entries. Option D is incorrect because CloudWatch Logs Insights is a query/analysis tool, not an alerting mechanism, and it does not by itself trigger notifications.

Answer

Create an AWS Config rule to detect ConsoleLogin.

Answer

Configure S3 event notifications on the CloudTrail bucket.

Answer

Use CloudWatch Logs Insights to query for ConsoleLogin events.

Question 3

A company uses Amazon CloudFront to distribute content globally. Users in certain geographic regions report slow load times. Which TWO configurations can improve performance for these users? (Choose TWO.)

Accepted Answer

Implement Lambda@Edge to optimize content delivery.. Option A is correct because Lambda@Edge runs functions at CloudFront edge locations, allowing you to customize and optimize content delivery (for example, rewriting requests, modifying headers, or serving optimized responses) closer to users in the slow regions, which reduces latency. Option D is correct because CloudFront performance depends on having edge locations near viewers; adding more edge locations (or using a broader set of points of presence) shortens the network distance and improves load times for users in those geographic regions. Option B is not correct because ElastiCache caches data for application/database tiers and does not sit in the CloudFront content-delivery path to accelerate global edge delivery. Option C is not correct because changing the origin to a Network Load Balancer only affects how CloudFront reaches the origin, not the edge-to-viewer latency that causes slow loads in specific regions. Option E is not correct because S3 Transfer Acceleration speeds up uploads to S3 (and some origin fetches) but does not improve CloudFront's delivery of cached content to end users in distant regions.

Answer

Use Amazon ElastiCache to cache content.

Answer

Switch the origin to a Network Load Balancer.

Answer

Enable S3 Transfer Acceleration on the origin bucket.

Question 4

A company uses an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances in an Auto Scaling group. During an incident, the DevOps team notices that the ALB is returning 503 errors. The instances are healthy according to the target group health checks. What is the MOST likely cause?

Accepted Answer

The ALB's surge queue is full, causing it to reject requests.. The ALB returns 503 Service Unavailable when it cannot route a request to a healthy target, and one specific cause is a full surge queue. The surge queue holds requests that arrive faster than the target group can accept them, especially when targets are slow to respond or connection limits are hit. Since the instances are healthy per health checks, the issue is not target health but the ALB's internal queuing capacity. A full surge queue means the ALB has no place to buffer incoming requests, so it rejects them with 503.

Answer

The ALB has no listeners configured.

Answer

The security group for the ALB is blocking traffic from the clients.

Answer

The ALB is throttling requests due to a surge.

Question 5

A DevOps engineer is troubleshooting an issue where an EC2 instance running Amazon Linux 2 is not receiving commands from AWS Systems Manager Run Command. The instance has the SSM Agent installed and is running. What should the engineer verify FIRST?

Accepted Answer

Check that the instance has an IAM role with the AmazonSSMManagedInstanceCore policy.. For SSM Run Command to reach an instance, the SSM Agent must authenticate to the SSM service using credentials from an instance profile. Without an IAM role carrying AmazonSSMManagedInstanceCore (or equivalent ssm:* permissions), the agent cannot register the instance as a managed node, so commands never arrive. Verifying the IAM role is the first and most common root cause.

Answer

Verify the instance has outbound internet access to the SSM endpoints.

Answer

Confirm the instance's clock is synchronized with NTP.

Answer

Ensure the SSM Agent is the latest version.

Question 6

A company runs a critical application on an Amazon RDS for MySQL DB instance. During a recent incident, the database became unresponsive. The DevOps team suspects that a long-running query is blocking other operations. Which metric should they monitor in Amazon CloudWatch to detect this type of issue?

Accepted Answer

ActiveTransactions (from Enhanced Monitoring). ActiveTransactions (from Enhanced Monitoring). This metric directly shows the number of active transactions, including long-running ones that can hold locks and cause blocking. Monitoring ActiveTransactions helps detect such issues. Option A (DatabaseConnections) indicates the number of connections but not whether they are actively blocking. Option C (ReadLatency) is a symptom of blocking but not a direct indicator. Option D (CPUUtilization) may be high for many reasons and does not specifically point to blocking.

Answer

DatabaseConnections

Answer

ReadLatency

Answer

CPUUtilization

Question 7

A DevOps engineer notices that an Auto Scaling group is repeatedly launching and terminating instances. CloudWatch alarms show high CPU but the group's metrics are erratic. What is the most likely cause?

Accepted Answer

The health check grace period is too short and the health check type is ELB, but the load balancer health check is failing.. Repeated launch-and-terminate cycling in an Auto Scaling group with erratic metrics most commonly indicates that instances are being marked unhealthy and replaced. When the health check type is ELB and the grace period is too short, instances that haven't finished booting or registering with the load balancer fail health checks, get terminated, and are relaunched — creating a loop.

Answer

The Auto Scaling group is not associated with a load balancer.

Answer

The launch template user data is causing instances to fail during boot.

Answer

The AMI used in the launch template is not properly configured.

Question 8

A company uses RDS Multi-AZ with a read replica. During a failover test, the application experiences a 30-second write outage. The application uses a single DB endpoint. How can the outage be minimized?

Accepted Answer

Use RDS Proxy to handle database connections and failover.. RDS Proxy maintains a warm connection pool and automatically routes new connections to the new primary after failover, masking the DNS change and reducing the outage from ~30 seconds to a few seconds. It also handles connection multiplexing and credential management via Secrets Manager. This directly addresses the single-endpoint write outage described.

Answer

Increase the instance class to improve failover performance.

Answer

Use a Route 53 weighted record with health checks to point to both instances.

Answer

Configure the application to use the read replica endpoint for writes.

Question 9

An organization uses AWS Config to track resource changes. They notice that a particular S3 bucket policy was deleted, but the Config rule 's3-bucket-policy-grantee-check' did not trigger a remediation. What is the most likely reason?

Accepted Answer

The bucket was deleted and recreated, and the configuration recorder did not capture the deletion event.. When an S3 bucket is deleted and recreated, AWS Config may not capture the deletion event if the configuration recorder is not properly configured or if the bucket is recreated before the recorder processes the deletion. This can cause the rule to not trigger on the policy change. Option A is incorrect because AWS Config does support S3 bucket policy checks. Option B is incorrect because the rule evaluates resources on configuration changes, not only periodically. Option C is incorrect because S3 bucket policy changes are supported by AWS Config.

Answer

The Config rule does not support S3 bucket policies.

Answer

The rule is set to evaluate resources only on a periodic basis.

Answer

The S3 bucket policy change is not supported by AWS Config.

Question 10

A company uses Amazon CloudFront with an S3 origin. Users in Europe report slow load times. The engineer needs to improve performance for European users. Which TWO actions should the engineer take?

Accepted Answer

Enable CloudFront Origin Shield in a European region.. CloudFront Price Class 100 already includes all European edge locations. Changing to Price Class 200 adds edge locations in other continents (e.g., Asia, South America) but does not improve performance for European users. Origin Shield in a European region is the appropriate action because it provides a caching layer close to European edge locations, reducing origin fetch latency and improving load times.

Answer

Add additional price classes to the CloudFront distribution (e.g., Price Class 200).

Answer

Enable S3 Transfer Acceleration on the origin bucket.

Answer

Enable CloudFront access logs to identify slow requests.

Answer

Enable AWS WAF on the CloudFront distribution to block malicious traffic.

Question 11

A DevOps engineer applied the above S3 bucket policy to restrict access. Users report that they can download objects from the bucket only when using HTTPS from within the 10.0.0.0/8 network. However, users outside that network receive access denied errors even over HTTPS. What is wrong with the policy?

Accepted Answer

The Allow statement only allows requests from the specific IP range; requests from other IPs are implicitly denied even over HTTPS.. The policy contains an Allow statement scoped to the 10.0.0.0/8 source IP range, so any request originating from outside that CIDR — even over HTTPS with SecureTransport satisfied — fails to match the Allow and is denied by S3's default implicit deny. HTTPS is not the problem; the source IP restriction is. To let external users in, the Allow statement's SourceIp condition must be broadened or removed.

Answer

The Deny statement blocks all requests over HTTPS because of the BoolIfExists condition.

Answer

The Allow statement should include a condition for SecureTransport.

Answer

The Deny statement should use a Condition for SourceIp instead of SecureTransport.

Question 12

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application is deployed across three Availability Zones. The DevOps team uses AWS CloudFormation to manage the infrastructure. During a recent deployment, a stack update failed, and the stack entered a ROLLBACK_IN_PROGRESS state. However, the rollback also failed, leaving the stack in UPDATE_ROLLBACK_FAILED state. The engineer needs to restore the application to a working state. The stack includes an Auto Scaling group, an ALB, security groups, and a DynamoDB table. The DynamoDB table is defined with deletion protection enabled. The engineer is considering the following actions: A) ContinueUpdateRollback to retry the rollback, fixing the resource that caused the failure. B) Delete the stack and recreate it from the last known good template. C) Use CloudFormation's 'SignalResource' to manually complete the rollback. D) Manually update the resources to match the previous template, then resume the rollback. Which action should the engineer take?

Accepted Answer

Use ContinueUpdateRollback to retry the rollback after fixing the resource that caused the failure.. ContinueUpdateRollback is the designed CloudFormation operation to retry a failed rollback after fixing the underlying issue, such as DynamoDB deletion protection preventing the table from being deleted during rollback. The engineer can modify the DynamoDB table to disable deletion protection or remove the protection policy, then use ContinueUpdateRollback to complete the rollback. Option A is incorrect because CloudFormation does not support manually updating resources and then resuming rollback; the stack is in a failed state and requires an automated retry. Option C is incorrect because SignalResource is used to signal the creation of resources during a stack operation, not to handle rollback failures. Option D is incorrect because deleting the stack would also attempt to delete the DynamoDB table; despite deletion protection, the deletion may be blocked, causing further failure, and it would also delete other resources, leading to data loss.

Answer

Manually update the resources to match the previous template, then resume the rollback.

Answer

Use CloudFormation's 'SignalResource' to manually complete the rollback.

Answer

Delete the stack and recreate it from the last known good template.

Question 13

A DevOps team uses AWS Systems Manager Incident Manager for incident response. They have an escalation plan that sends notifications to an SNS topic. However, during a recent incident, the on-call engineer did not receive the notification. The engineer's phone number and email are correct in the SSM Incident Manager contact settings. What is the MOST likely cause of the missed notification?

Accepted Answer

The SNS subscription for the engineer's contact was never confirmed.. SNS requires explicit subscription confirmation before delivering messages. If the engineer's email or SMS subscription was created but never confirmed (via the confirmation link or code), SNS silently drops all notifications to that endpoint. Since the contact details are correct in Incident Manager, the most likely cause is an unconfirmed subscription.

Answer

SSM Incident Manager requires a VPC endpoint for SNS, which is not configured.

Answer

The SNS topic's IAM policy does not allow Systems Manager to publish messages.

Answer

The SNS topic and the engineer's contact are in different AWS Regions.

Question 14

A company's DevOps team is designing an automated incident response workflow using AWS Systems Manager Incident Manager and AWS Lambda. The workflow should automatically acknowledge incidents and send notifications to the appropriate response team. Which TWO actions should the team take to achieve this?

Accepted Answer

Have the Lambda function publish a message to an SNS topic that the response team subscribes to.. Option E is correct because Incident Manager publishes incident lifecycle events to Amazon EventBridge, so an EventBridge rule matching those events (e.g., Incident Manager incident creation/update events) can trigger a Lambda function that performs the automated acknowledgment and notification logic. Option A is correct because the Lambda function can publish to an Amazon SNS topic, and the response team's subscriptions (email, SMS, Lambda, HTTPS, etc.) then deliver the notifications to the appropriate responders. Option B is incorrect because CloudWatch alarms integrate with Incident Manager through response plans/EventBridge, not by directly invoking a Lambda function for incident creation. Option C is incorrect because Incident Manager does not provide built-in 'Acknowledge' and 'Notify' actions that can simply be added to a response plan; acknowledgment and notification must be implemented via automation such as Lambda, SSM Automation runbooks, or EventBridge-triggered workflows. Option D is incorrect because Step Functions is not required to orchestrate this workflow; the Lambda function triggered by EventBridge can directly publish to SNS, making Step Functions unnecessary overhead.

Answer

Configure the CloudWatch alarm to directly invoke the Lambda function for incident creation.

Answer

Use Incident Manager's built-in 'Acknowledge' and 'Notify' actions in a response plan.

Answer

Use AWS Step Functions to orchestrate the Lambda function and SNS topic.

Question 15

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The DevOps engineer needs to investigate the failure. Which TWO actions should the engineer take?

Accepted Answer

Review the 'Stack Events' tab in the CloudFormation console to see the specific error messages.. Option B is correct because the Stack Events tab in the CloudFormation console lists every resource event with timestamps and status reasons, including the exact error message (e.g., 'Resource creation cancelled' or a specific AWS service failure) that caused the update to roll back, making it the primary diagnostic tool for a ROLLBACK_IN_PROGRESS state. Option D is correct because a failed update is often caused by an invalid template (syntax, unsupported property, wrong resource type) or incorrect parameter values (e.g., an invalid CIDR or instance type), so examining the template and parameters validates the input that CloudFormation attempted to apply. Option A is not the best action because CloudTrail records the UpdateStack API call metadata (who, when, request parameters) but not the granular resource-level failure reasons needed to diagnose the rollback. Option C is incorrect because rollback triggers only apply to stacks created with the --rollback-configuration option for CloudWatch alarm monitoring, which is unrelated to diagnosing why a resource failed during an update. Option E is incorrect because a Change Set only previews proposed changes before execution and does not provide error details about an update that has already failed and rolled back.

Answer

Review AWS CloudTrail logs for the 'UpdateStack' API call.

Answer

Check the 'Rollback triggers' configuration for the stack.

Answer

Create a Change Set to see the proposed changes before re-attempting the update.