DOP-C02 Incident and Event Response Practice Test 5 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all accounts automatically forward their CloudWatch Logs to a central logging account. Which solution should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets to deploy a subscription filter and Lambda function in each account. AWS CloudFormation StackSets allows you to deploy infrastructure components across multiple accounts and regions in an AWS Organization. In this case, you can create a StackSet that includes a CloudWatch Logs subscription filter and a Lambda function to forward logs from each account to a central logging account. The subscription filter triggers the Lambda function to forward logs to a destination in the central account. This ensures all accounts automatically forward their CloudWatch Logs. Option A is incorrect because AWS Config aggregator aggregates configuration and compliance data, not logs. Option B is incorrect because AWS Service Catalog is used to create and manage IT service catalogs for approved products, not for log forwarding. Option D is incorrect because AWS Organizations does not have a native capability to forward logs; it manages policies and account structure.

Answer

Enable AWS Config aggregator in the central account

Answer

Use AWS Service Catalog to create a product for log forwarding

Answer

Configure AWS Organizations to automatically forward logs

Question 2

A critical application is deployed on Amazon EKS. The DevOps team notices that pods are failing with 'CrashLoopBackOff' status. The team needs to capture the application logs before the pod restarts to debug the issue. Which approach should the team use?

Accepted Answer

Configure a sidecar container to stream logs to Amazon CloudWatch Logs. Configuring a sidecar container to stream logs to Amazon CloudWatch Logs ensures that logs are persisted and available for debugging even if the pod crashes and restarts. This approach decouples log collection from the pod's lifecycle, allowing the DevOps team to analyze logs from the crash without needing to capture them in real-time. It aligns with the incident response best practice of centralized logging for ephemeral environments like EKS.

Answer

Use 'kubectl logs' command immediately after the crash

Answer

Store logs in a ConfigMap

Answer

Use 'kubectl exec' to access the container and check logs

Question 3

A DevOps engineer is troubleshooting an issue where an EC2 instance in a private subnet cannot reach the internet. The instance has a route to a NAT gateway. Which TWO of the following should the engineer check? (Choose TWO.)

Accepted Answer

The route table of the private subnet has a route to the NAT gateway. The private subnet's route table must have a route pointing to the NAT gateway for traffic to be forwarded to the internet. Option E is correct because the security group associated with the EC2 instance must allow outbound traffic (e.g., HTTPS) to reach the internet; otherwise, packets are dropped. Option A is incorrect because the NAT gateway must be in a public subnet, not the same private subnet as the instance. Option C is incorrect because the internet gateway is attached to the VPC, not to the subnet directly; private subnets use NAT to access the internet. Option D is incorrect because instances in private subnets do not require public IP addresses; they use the NAT gateway's public IP.

Answer

The NAT gateway is in the same subnet as the instance

Answer

The internet gateway is attached to the private subnet

Answer

The instance has a public IP address

Question 4

An IAM policy attached to a user is shown in the exhibit. The user reports that they are unable to delete an object in the 'example-bucket' bucket. What is the reason for this?

Accepted Answer

The explicit Deny statement overrides the Allow. An explicit Deny overrides any Allow. The Deny action s3:DeleteObject explicitly denies the delete, even though the Allow all s3 actions includes delete. Option A is wrong because the resource ARN matches. Option C is wrong because the policy allows all s3 actions, but the Deny blocks delete. Option D is wrong because the policy is valid.

Answer

The resource ARN does not match the bucket name

Answer

The user does not have permissions to perform s3:DeleteObject

Answer

The policy has a syntax error

Question 5

A DevOps engineer observes the CloudWatch alarm output shown in the exhibit. The alarm is in ALARM state for instance i-0abcd1234efgh5678. The engineer checks the EC2 console and sees that the instance's CPU utilization is currently 10%. What is the MOST likely explanation?

Accepted Answer

The alarm has not yet evaluated enough low datapoints to change state. The alarm is configured with EvaluationPeriods=1, meaning it requires only one high datapoint to trigger ALARM. The CPU spiked to 100% at 09:55, causing the alarm to enter ALARM state. Even though CPU utilization has since dropped to 10%, the alarm remains in ALARM until it evaluates a sufficient number of low datapoints to transition to OK. Since only one high datapoint was needed to trigger, only one low datapoint is needed to return to OK, but the alarm may not have evaluated the latest low datapoint yet, or the alarm's state transition period may not have elapsed. Option A is wrong because the metric exists and is being emitted. Option B is wrong because the threshold is set to 90%, which is appropriate. Option D is wrong because the CPUUtilization metric is being emitted, as evidenced by the spike.

Answer

The alarm is misconfigured with wrong metric

Answer

The threshold was set too low

Answer

The CPUUtilization metric is not being emitted

Question 6

The CloudFormation template in the exhibit deploys an S3 bucket with a bucket policy. After deployment, the DevOps team discovers that the bucket is publicly accessible. Which change should be made to prevent public access while allowing only authenticated users from a specific AWS account to read objects?

Accepted Answer

Change the Principal to the AWS account ID of the allowed account. Changing the Principal to a specific AWS account ID ensures that only that account's IAM users/roles can access the bucket, preventing public access. Option A is incorrect because AWS Organizations does not directly block public access at the bucket level; it can set service control policies but not a bucket policy. Option C is incorrect because using Principal "*" with a condition for aws:SourceIp still allows any user with that IP (including unauthenticated) to access, and it does not restrict to a specific AWS account. Option D is incorrect because setting BlockPublicAccess to true would block all public access, including the intended access from the specific account, which is not the goal.

Answer

Enable AWS Organizations to block public access

Answer

Change the Principal to "*" and add a condition for aws:SourceIp

Answer

Set the bucket's 'BlockPublicAccess' property to true

Question 7

A company's production RDS MySQL instance experienced a failover. The DevOps team needs to understand the root cause. Which set of logs should be reviewed first?

Accepted Answer

AWS CloudTrail logs. AWS CloudTrail logs capture API calls and events, including RDS failover events such as DBInstanceFailover or maintenance events. These logs provide a chronological record of who initiated the failover (e.g., a manual failover or an automatic failover due to a detected issue). Option A is incorrect because VPC Flow Logs record network traffic metadata, not database failover events. Option B is incorrect because RDS MySQL error logs contain database-level errors (e.g., connection errors, crash details) but not the failover trigger itself. Option D is incorrect because RDS slow query logs only list queries that exceed a time threshold, unrelated to failover causes. Therefore, CloudTrail is the first log set to review for understanding the root cause of a failover.

Answer

VPC Flow Logs

Answer

RDS MySQL error logs

Answer

RDS slow query logs

Question 8

An application running on an EC2 instance in a private subnet needs to access an S3 bucket. The instance has an IAM role with S3 access. However, the application is failing with timeout errors. The security group allows all outbound traffic, and the NACL allows outbound ephemeral ports. What is the most likely cause?

Accepted Answer

No VPC endpoint for S3. A VPC endpoint for S3 (Gateway or Interface) is needed for private subnet access to S3 without NAT. Without a VPC endpoint, the EC2 instance in a private subnet cannot reach S3, resulting in timeout errors. The security group and NACL settings are permissive, so they are not the issue. Option B is incorrect because the instance is in a private subnet; routing to an Internet Gateway is not necessary and would require a NAT device. Option C is incorrect because the IAM role has the necessary S3 permissions. Option D is incorrect because no HTTP proxy is required for S3 access.

Answer

Missing route in the route table to an Internet Gateway

Answer

IAM role does not have correct trust policy

Answer

Missing HTTP proxy configuration

Question 9

A DevOps engineer is troubleshooting an AWS Lambda function that is intermittently timing out. The function is configured with a 3-second timeout and 128 MB memory. The function processes messages from an SQS queue. What is the most cost-effective change to reduce timeouts?

Accepted Answer

Increase the function memory to 256 MB. Increasing the memory to 256 MB is the most cost-effective change because Lambda allocates CPU proportionally to memory, so doubling the memory from 128 MB to 256 MB also doubles the CPU performance. This reduces execution time, which can resolve timeouts without increasing the timeout duration, and since Lambda billing is based on compute time (GB-seconds), the total cost may stay the same or even decrease if the function finishes faster.

Answer

Increase the SQS batch size to 20

Answer

Increase the function timeout to 10 seconds

Answer

Set reserved concurrency to 10

Question 10

After deploying a new application version using AWS CodeDeploy, an EC2 instance fails the deployment. The deployment group is configured with an in-place deployment. The engineer sees the error 'ScriptMissing' in the CodeDeploy logs. What should the engineer check?

Accepted Answer

The file path defined in the appspec.yml for the lifecycle hook. The 'ScriptMissing' error in CodeDeploy indicates that the script file specified in the appspec.yml for a lifecycle event hook is not found at the expected path. The engineer should verify the file path defined in the appspec.yml to ensure it points to an existing executable script on the instance.

Answer

The deployment group's deployment configuration

Answer

The security group attached to the instance

Answer

The AMI used for the EC2 instance

Question 11

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team requires that log data be encrypted at rest using a customer-managed AWS KMS key. The logs are currently being delivered, but they are not encrypted. What is the most likely reason?

Accepted Answer

The KMS key policy does not allow the CloudWatch Logs service principal. For CloudWatch Logs to encrypt log data at rest with a customer-managed KMS key, the key policy must grant the CloudWatch Logs service principal the necessary permissions (kms:Encrypt, kms:Decrypt, etc.). If the key policy does not include this, CloudWatch Logs can still ingest the logs but cannot encrypt them, resulting in unencrypted logs. Option A is incorrect: the IAM role for the EC2 instance does not need kms:Encrypt permissions for server-side encryption; that is handled by the CloudWatch Logs service using the key policy. Option B is incorrect because encryption is configured at the log group level, not in the agent. Option C would cause delivery failures, not just lack of encryption.

Answer

The IAM role for the EC2 instance does not have kms:Encrypt permission

Answer

The CloudWatch Logs agent is not configured to encrypt logs

Answer

The KMS key is disabled

Question 12

A DevOps engineer receives a CloudWatch alarm that the 'StatusCheckFailed' metric for an EC2 instance is in ALARM state. The instance is part of an Auto Scaling group. What should the engineer do first to restore service?

Accepted Answer

Wait for Auto Scaling to replace the instance. The Auto Scaling group automatically replaces unhealthy instances based on EC2 status checks. Options A, C, and D are incorrect: Updating the launch configuration does not fix existing instances; manually terminating is unnecessary as Auto Scaling handles it; and rebooting may not resolve underlying issues.

Answer

Update the Auto Scaling group's launch configuration

Answer

Manually terminate the instance

Answer

Reboot the instance

Question 13

An application running on Amazon ECS Fargate is experiencing intermittent 'CannotPullContainerError' errors. The task definition references a Docker image in a private Amazon ECR repository. The task execution role has the 'AmazonECSTaskExecutionRolePolicy' policy attached. What is the most likely cause?

Accepted Answer

The Fargate task is in a private subnet without a NAT gateway or VPC endpoint. The 'CannotPullContainerError' occurs when the ECS task cannot retrieve the container image from ECR. Since the task execution role has the 'AmazonECSTaskExecutionRolePolicy' attached, which includes the necessary permissions (ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer), the issue is not permissions. The most likely cause is that the Fargate task is running in a private subnet that lacks a route to the internet (via NAT gateway) or a VPC endpoint for ECR. Without either, the task cannot reach the ECR API to pull the image. Option A is correct. Option B is wrong because the policy provides sufficient permissions. Option C is irrelevant; Auto Scaling does not affect image pulling. Option D is less likely because ECR repositories are typically in the same region, and cross-region pulls would still be possible with proper permissions and networking.

Answer

The task execution role does not have sufficient permissions

Answer

The ECS service is not configured with Auto Scaling

Answer

The ECR repository is not in the same region as the ECS cluster

Question 14

A company uses AWS CloudFormation to manage infrastructure. A recent stack update failed with the error 'UPDATE_ROLLBACK_FAILED'. The stack is now in a 'UPDATE_ROLLBACK_FAILED' state, and the engineer needs to fix the stack. What is the correct course of action?

Accepted Answer

Continue the rollback using the 'ContinueUpdateRollback' API. The 'ContinueUpdateRollback' API allows you to resume the rollback of a stack that is in a 'UPDATE_ROLLBACK_FAILED' state. This action attempts to roll back the remaining resources that failed during the initial rollback, potentially skipping resources that cannot be rolled back. Option A is incorrect because AWS Support cannot fix the stack state; you need to take action yourself. Option B is incorrect because deleting a stack in 'UPDATE_ROLLBACK_FAILED' state may not succeed; you first need to continue the rollback or fix the underlying issues. Option C is incorrect because you cannot submit a new stack update while the stack is in a failed rollback state; you must first resolve the rollback failure.

Answer

Contact AWS Support to fix the stack

Answer

Delete the stack and recreate it

Answer

Submit another stack update with the desired configuration

Question 15

A DevOps engineer is designing an incident response plan for a serverless application using AWS Lambda, API Gateway, and DynamoDB. Which TWO services should be used to monitor and alert on errors and latency?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (Option B) provides metrics, logs, and alarms for AWS Lambda, API Gateway, and DynamoDB. You can monitor error counts, latency, and other performance indicators, and set alarms for thresholds. AWS X-Ray (Option C) helps analyze and debug distributed applications, providing tracing and latency breakdowns for requests through API Gateway and Lambda, and interactions with DynamoDB. Options A, D, and E are incorrect: Amazon GuardDuty (A) is a threat detection service, not for application monitoring; AWS Config (D) is for configuration compliance and auditing; AWS CloudTrail (E) records API activity but does not provide real-time error or latency monitoring.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail