DOP-C02 Incident and Event Response Practice Test 5 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a Lambda function that times out after 3 seconds. The function makes an HTTP request to an external API. The function's timeout setting is 10 seconds. What is the most likely cause of the timeout?

Accepted Answer

The HTTP client's timeout is set to a low value.. The Lambda function times out after exactly 3 seconds, which is a common default HTTP client timeout (e.g., 3 seconds in the Node.js `http` module or Python `requests` library). Even though the Lambda function's configured timeout is 10 seconds, the HTTP client's internal timeout fires first, causing the function to fail before the Lambda timeout is reached. This is the most likely cause because the symptom matches a client-side timeout rather than a server-side or infrastructure issue.

Answer

The external API is throttling the request.

Answer

The Lambda function is not in a VPC.

Answer

The Lambda function's memory is insufficient.

Question 2

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in a specific region report slow load times. The DevOps team checks CloudFront metrics and sees a high error rate (5xx) for that region. The S3 bucket is healthy. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant access to the CloudFront origin access identity (OAI).. A high 5xx error rate from CloudFront combined with a healthy S3 bucket strongly indicates that CloudFront cannot fetch objects from the origin. If the S3 bucket policy does not grant access to the CloudFront origin access identity (OAI), CloudFront receives an access denied (403) response from S3, which CloudFront translates into a 5xx error for the user. This is the most common cause of regional 5xx errors when the origin is otherwise healthy.

Answer

The AWS WAF web ACL is blocking requests from that region.

Answer

The CloudFront distribution's default TTL is too short.

Answer

The CloudFront origin shield is misconfigured.

Question 3

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the Auto Scaling group launches new instances, but users experience session loss. What is the most likely cause?

Accepted Answer

The target group's deregistration delay is too short.. The correct answer is D. Sticky sessions are tied to the instance ID. If the ALB target group's deregistration delay is too short, the ALB may route traffic to a new instance before the session is migrated. Session stickiness duration would affect how long sessions persist on the same instance, but not cause loss during deployments. Lifecycle hooks are for custom actions. Health check thresholds affect availability.

Answer

The Auto Scaling group's lifecycle hooks are not configured.

Answer

The stickiness duration is set too low.

Answer

The target group's health check interval is too long.

Question 4

Which TWO actions should be taken to ensure a highly available and resilient architecture for a critical web application on AWS? (Choose two.)

Accepted Answer

Use an Auto Scaling group to maintain a desired number of instances.. Correct: A and D. Deploying across multiple Availability Zones provides resilience against AZ failures. Using an Auto Scaling group ensures capacity is maintained. Option B provides read scalability but not write availability. Option C is for disaster recovery, not immediate availability. Option E is for performance, not availability.

Answer

Enable Amazon CloudFront with multiple origins.

Answer

Use a Multi-AZ RDS deployment with read replicas.

Answer

Store backups in a different AWS Region.

Question 5

Which THREE steps should a DevOps engineer take to troubleshoot an EC2 instance that cannot be reached via SSH? (Choose three.)

Accepted Answer

Check the network ACL inbound rules for the subnet.. Option A is correct because network ACLs (NACLs) are stateless firewall rules applied at the subnet level. If the inbound rule for ephemeral ports or port 22 is not explicitly allowed, SSH traffic will be dropped even if the security group permits it. Checking NACL inbound rules is a fundamental step in troubleshooting connectivity issues.

Answer

Verify that the corporate firewall allows SSH to the instance.

Answer

Create an AMI from the instance and launch a new one.

Question 6

Which TWO metrics should be monitored in Amazon CloudWatch to detect a potential memory leak in an EC2 instance? (Choose two.)

Accepted Answer

MemoryUtilization (custom metric published via CloudWatch Agent).. MemoryUtilization is a custom metric that must be published via the CloudWatch Agent because EC2 does not expose memory metrics by default. Monitoring this metric over time can reveal a steady upward trend in memory usage that does not drop after processes complete, which is a classic symptom of a memory leak.

Answer

DiskReadOps

Answer

NetworkIn

Answer

CPUUtilization

Question 7

A DevOps engineer notices that an Amazon RDS for MySQL instance has failed over to a standby replica. The engineer needs to identify the root cause by examining metrics. Which AWS service should the engineer use to view the database load, replication lag, and failover events?

Accepted Answer

Amazon CloudWatch. Option B is correct because Amazon RDS integrates with CloudWatch to monitor metrics like DatabaseConnections, ReplicaLag, and failover events. Option A is wrong because CloudTrail records API calls but not database-level metrics. Option C is wrong because VPC Flow Logs capture network traffic, not database metrics. Option D is wrong because Trusted Advisor provides best-practice checks, not real-time metrics.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Question 8

An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?

Accepted Answer

Enable VPC Flow Logs and query Amazon Athena. Option C is correct because VPC Flow Logs can capture all traffic (accepted and rejected) and be analyzed to find denied connections. Option A is wrong because Security Hub aggregates security findings but does not log traffic. Option B is wrong because CloudTrail logs API calls, not network traffic. Option D is wrong because Config records resource configurations, not traffic.

Answer

Use AWS Config to review security group rules

Answer

Check AWS CloudTrail for security group modification events

Answer

Enable AWS Security Hub and review the security findings

Question 9

A company uses AWS Lambda functions to process events from Amazon SQS. Recently, the Lambda function has been throttled, causing messages to accumulate in the dead-letter queue (DLQ). The function’s reserved concurrency is set to 100, and the account’s regional concurrency limit is 1000. What is the MOST likely cause of the throttling?

Accepted Answer

The function’s concurrency is fully utilized due to long-running invocations. Option D is correct because if the function’s reserved concurrency is 100 and the account-level limit is 1000, throttling could be due to the function exhausting its own concurrency if it has long-running invocations. Option A is wrong because 100 reserved is not above the account limit. Option B is wrong because SQS standard queue does not require FIFO. Option C is wrong because cold starts cause latency but not throttling.

Answer

The Lambda function has a cold start issue

Answer

The SQS queue is not configured as a FIFO queue

Answer

The reserved concurrency is set too high, exceeding the account limit

Question 10

A DevOps engineer receives an alert that an Amazon EC2 instance’s CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a step scaling policy based on average CPU. The engineer checks the CloudWatch alarm and sees that it is in the ALARM state. What should the engineer do to verify that the Auto Scaling group is scaling out properly?

Accepted Answer

Review the Auto Scaling group’s activity history in the EC2 console. Option A is correct because checking the Auto Scaling activity history will show if scaling actions were triggered. Option B is wrong because CloudWatch logs show instance logs, not scaling actions. Option C is wrong because the alarm state indicates it’s triggered. Option D is wrong because the scaling policy is for scale-out on high CPU.

Answer

Ensure the scaling policy is configured to scale in

Answer

Check the CloudWatch Logs for the instance

Answer

Verify that the CloudWatch alarm is in INSUFFICIENT_DATA state

Question 11

A company uses AWS CloudFormation to deploy infrastructure. During an incident, a stack update fails with a stack rollback. The engineer needs to prevent the stack from rolling back on future failures and instead retain the resources for debugging. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the '--disable-rollback' option when updating the stack. The `--disable-rollback` option (or `DisableRollback` in the CloudFormation template) instructs AWS CloudFormation to leave the stack in its current state (with the failed resources intact) instead of automatically rolling back to the last known good state. This allows engineers to retain the resources for debugging without the stack being torn down on failure.

Answer

Enable drift detection on the stack

Answer

Use AWS CloudFormation StackSets to deploy the stack

Answer

Create a change set before updating instead of direct update

Question 12

An application running on Amazon ECS with Fargate is experiencing increased latency. The DevOps team suspects that the task is running out of memory and swapping. Which set of CloudWatch metrics should the team examine to confirm this suspicion?

Accepted Answer

MemoryUtilized and MemoryReserved. Option B is correct because MemoryUtilized and MemoryReserved are the CloudWatch metrics that directly track memory consumption and allocation for ECS tasks using Fargate. When a task runs out of memory, the Linux kernel’s OOM killer may terminate processes, but before that, swapping can occur if swap space is available, causing increased latency. These metrics allow the DevOps team to compare actual memory usage against the task’s memory reservation, confirming if memory pressure is the root cause of the latency.

Answer

NetworkIn and NetworkOut

Answer

CPUUtilization and CPUReservation

Answer

EphemeralStorageUtilized and EphemeralStorageReserved

Question 13

A DevOps engineer receives an alert that an Amazon S3 bucket has become publicly accessible. The engineer needs to identify who made the bucket public. Which AWS service should the engineer use to find the API call that changed the bucket policy?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail records all S3 API calls, including bucket policy changes. Option A is wrong because CloudWatch monitors metrics. Option C is wrong because Config records configuration changes but not the identity. Option D is wrong because GuardDuty detects threats but doesn't log API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all accounts automatically forward their CloudWatch Logs to a central logging account. Which solution should the team implement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a subscription filter and Lambda function in each account. Option A is correct because a CloudFormation StackSet can deploy log forwarding resources across all accounts in the organization. Option B is wrong because Organizations does not forward logs on its own. Option C is wrong because Service Catalog is for provisioning products. Option D is wrong because Config aggregates configuration data, not logs.

Answer

Enable AWS Config aggregator in the central account

Answer

Use AWS Service Catalog to create a product for log forwarding

Answer

Configure AWS Organizations to automatically forward logs

Question 15

A critical application is deployed on Amazon EKS. The DevOps team notices that pods are failing with 'CrashLoopBackOff' status. The team needs to capture the application logs before the pod restarts to debug the issue. Which approach should the team use?

Accepted Answer

Configure a sidecar container to stream logs to Amazon CloudWatch Logs. Option B is correct because configuring a sidecar container to stream logs to Amazon CloudWatch Logs ensures that logs are persisted and available for debugging even if the pod crashes and restarts. This approach decouples log collection from the pod's lifecycle, allowing the DevOps team to analyze logs from the crash without needing to capture them in real-time. It aligns with the incident response best practice of centralized logging for ephemeral environments like EKS.

Answer

Use 'kubectl logs' command immediately after the crash

Answer

Store logs in a ConfigMap

Answer

Use 'kubectl exec' to access the container and check logs