DOP-C02 Incident and Event Response Practice Test 6 — 15 Questions

Question 1

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The team wants to automate the response to an instance failure. Which THREE steps should be taken to ensure automatic recovery and notification?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Auto Scaling to replace unhealthy instances. Configuring the Auto Scaling group to replace unhealthy instances ensures that when an instance fails health checks, Auto Scaling automatically terminates it and launches a new instance to maintain the desired capacity. This is the core mechanism for automated recovery in an Auto Scaling group, as it directly responds to instance failure without manual intervention.

Answer

Create a CloudWatch alarm to terminate the instance

Answer

Create a scaling policy based on CPU utilization

Question 2

A company's production EC2 instance running a web application becomes unresponsive. The operations team checks CloudWatch metrics and sees a CPU Utilization spike to 100% for the last 10 minutes. What is the MOST efficient first step to restore service?

Accepted Answer

Reboot the EC2 instance from the AWS Management Console or CLI. Rebooting the EC2 instance is the most efficient first step to restore service when the instance is unresponsive due to a CPU spike. A reboot can quickly resolve transient software issues or resource exhaustion without data loss. Option A (checking CloudWatch Logs) delays recovery—investigation should come after restoration. Option B (creating an AMI and launching a new instance) is time-consuming and unnecessary for initial recovery. Option D (terminating and launching a new instance) risks data loss and is more drastic than rebooting.

Answer

Check the instance's system logs in CloudWatch Logs to identify the root cause

Answer

Create an AMI of the instance and launch a new instance from that AMI

Answer

Terminate the instance and launch a new one from the latest AMI

Question 3

A DevOps engineer receives a CloudWatch alarm that an Auto Scaling group has been in an 'Insufficient data' state for 20 minutes. What does this indicate?

Accepted Answer

The alarm has not received enough metric data to evaluate. The 'Insufficient data' state in CloudWatch alarms indicates that the alarm has not received enough metric data points to determine whether the threshold has been breached. This can occur when the metric is not being published, the data collection period is too short, or the metric namespace is misconfigured. It does not directly indicate instance health, scaling needs, or agent installation status.

Answer

All instances in the Auto Scaling group are unhealthy

Answer

The Auto Scaling group needs to scale up

Answer

The CloudWatch agent is not installed on the instances

Question 4

A company uses AWS CloudTrail to log API calls. An IAM user's credentials are compromised, and the attacker launches multiple EC2 instances in regions that are not typically used. The security team wants to receive near-real-time notifications of any API calls from this user. What is the MOST effective solution?

Accepted Answer

Create a CloudTrail trail that delivers to CloudWatch Logs, then set up a CloudWatch Events rule to invoke a Lambda function that sends an SNS notification. CloudTrail can deliver logs to CloudWatch Logs in near real-time. A CloudWatch Events (now Amazon EventBridge) rule can then match API calls from the compromised user and trigger a Lambda function to send an SNS notification. Option A is incorrect because AWS Config rules check configuration compliance, not real-time API calls. Option B is incorrect because S3 event notifications are not near-real-time and are typically for object-level events, not API call monitoring. Option D is incorrect because CloudWatch Logs Insights is for querying historical logs and requires manual intervention; it does not provide near-real-time notifications.

Answer

Create an AWS Config rule that checks for EC2 instances in unauthorized regions

Answer

Configure CloudTrail to deliver logs to an S3 bucket and enable S3 event notifications to SQS

Answer

Use CloudWatch Logs Insights to query CloudTrail logs every 5 minutes and send results via email

Question 5

A company experiences an unexpected spike in network traffic to a web application hosted on EC2 instances behind an Application Load Balancer. The DevOps team needs to investigate the source IP addresses generating the traffic. Which AWS service should they use to capture the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information, including source and destination IPs, ports, and protocols, allowing investigation of source IPs. Option A (CloudWatch Logs) is wrong because it captures application logs, not network traffic. Option B (AWS Config) is wrong because it records resource configuration changes. Option C (CloudTrail) is wrong because it logs API calls, not network traffic.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

An organization uses AWS Systems Manager to manage its EC2 instances. After a security incident, the security team wants to ensure that all future API calls to Systems Manager are logged and monitored. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS CloudTrail for the Systems Manager service. Enabling CloudTrail for Systems Manager logs all API calls made to the Systems Manager service. Option A is incorrect because S3 server access logging only logs access to S3 buckets, not Systems Manager API calls. Option C is incorrect because the CloudWatch Logs agent captures instance logs, not API calls to Systems Manager. Option D is incorrect because AWS Config rules track configuration changes, not API calls. Therefore, CloudTrail is the most efficient way to log and monitor all future API calls to Systems Manager.

Answer

Enable S3 server access logging on the Systems Manager log bucket

Answer

Install the CloudWatch Logs agent on each instance to capture Systems Manager logs

Answer

Create an AWS Config rule to monitor Systems Manager usage

Question 7

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The team wants to automate the response to an instance failure. Which THREE steps should be taken to ensure automatic recovery and notification?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the 'DatabaseConnections' CloudWatch metric to see if the connection count is near the max_connections limit. Intermittent connection timeouts with normal CPU and memory often indicate that the number of connections to the DB instance is exceeding the max_connections limit. The 'DatabaseConnections' CloudWatch metric directly shows the current connection count, making it the best next step to diagnose. Option A is wrong because Enhanced Monitoring provides OS-level metrics, not connection counts; Option B is wrong because slow query logs help identify query performance issues, not connection limits; Option C is wrong because storage capacity issues would typically result in different errors, not intermittent timeouts when CPU and memory are normal.

Answer

Enable Enhanced Monitoring to check OS-level metrics

Answer

Examine the slow query log to identify long-running queries

Answer

Verify that the DB instance's storage is not full

Question 8

A DevOps engineer receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. How should the engineer respond?

Accepted Answer

Verify the instance's system and instance status checks, then consider terminating the instance to allow the Auto Scaling group to launch a new one. When an EC2 instance fails status checks, the engineer should first verify the instance's system and instance status checks to understand the issue. If the instance is unhealthy and cannot be recovered, terminating it allows the Auto Scaling group to launch a replacement. Option A is wrong because immediately terminating without investigation may cause unnecessary disruption and could have been avoided. Option C is wrong because the Auto Scaling group does not automatically replace instances based solely on status check failure unless health checks are configured and the instance fails them. Option D is wrong because security group rules affect network traffic, not status checks; status checks are about the instance's health at the OS or hardware level.

Answer

Immediately terminate the instance to trigger a replacement

Answer

Do nothing, because the Auto Scaling group will automatically replace the instance

Answer

Check the security group rules to ensure they allow traffic

Question 9

A company uses Amazon CloudFront to distribute content globally. Users in some regions report slow load times. The DevOps team wants to identify the geographic regions where performance is worst. Which tool should they use?

Accepted Answer

CloudFront reports in the AWS Management Console. CloudFront reports in the AWS Management Console provide performance metrics (e.g., total requests, error rates, latency) broken down by geographic region, enabling the team to identify regions with worst performance. Option A is wrong: CloudWatch metrics for CloudFront are aggregated per distribution, not per region. Option B is wrong: CloudFront access logs in S3 record individual requests but do not aggregate performance by region. Option C is wrong: Amazon Route 53 latency records are used for DNS-based routing decisions, not for analyzing CloudFront performance.

Answer

Amazon CloudWatch Metrics for CloudFront

Answer

CloudFront access logs in S3

Answer

Amazon Route 53 latency records

Question 10

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences periodic spikes in response times. The CloudWatch metrics show high CPU and memory usage for the tasks during these spikes. What is the MOST effective approach to handle these spikes?

Accepted Answer

Configure target tracking scaling policies for the ECS service using CPU or memory utilization. Target tracking scaling policies for Amazon ECS services using CPU or memory utilization are the most effective approach because they dynamically adjust the number of tasks in response to real-time demand, automatically adding capacity during spikes and removing it when load subsides. This aligns with the AWS Well-Architected Framework's principle of elasticity, ensuring the application scales out precisely when high CPU/memory usage is detected, without manual intervention or over-provisioning.

Answer

Use a larger Fargate task size to handle the spikes

Answer

Increase the CPU and memory limits for the ECS task definition

Answer

Set up a scheduled scaling action to add tasks during peak hours

Question 11

A company uses AWS CloudFormation to manage infrastructure. An engineer notices that a stack update has failed, leaving the stack in a ROLLBACK_IN_PROGRESS state. Which TWO actions should the engineer take to investigate and resolve the issue?

Accepted Answer

View the stack events in the CloudFormation console to see the specific error message. When a CloudFormation stack update fails and enters ROLLBACK_IN_PROGRESS, the engineer should first view the stack events (option C) to identify the specific error message that caused the failure. This provides insight into what went wrong. Then, reviewing the change set (option E) helps understand the intended changes and diagnose the issue. Option A is incorrect because manually stopping the rollback is not a standard action and could leave resources in an inconsistent state. Option B is incorrect because re-launching the stack with the same template would likely repeat the same error without addressing the root cause. Option D is incorrect because deleting and re-launching the stack would lose existing resources and is an extreme measure not needed for investigation.

Answer

Manually stop the rollback and continue with the update

Answer

Re-launch the stack with the same template

Answer

Delete the stack and re-launch it

Question 12

A company runs a web application on EC2 instances behind an Application Load Balancer. The application is experiencing intermittent 503 errors. The DevOps team suspects that the target group's health check settings may be causing healthy instances to be marked as unhealthy. Which THREE configurations should the team review?

Accepted Answer

Health check interval. Options B, C, and D are correct. The health check interval, healthy threshold count, and health check path are all target group settings that determine if an instance is considered healthy. A misconfigured interval may cause premature failures, an incorrect threshold can mark instances unhealthy too quickly, and a wrong path may return non-2xx/3xx responses, leading to 503 errors. Stickiness (A) and cross-zone load balancing (E) do not affect health check decisions.

Answer

Stickiness setting

Answer

Cross-zone load balancing setting

Question 13

A company uses AWS CloudTrail to monitor API activity. The security team notices that an IAM user 'dev-user' deleted an S3 bucket. They need to quickly identify the source IP address of the delete request. Which CloudTrail feature should they use to find this information?

Accepted Answer

Search the CloudTrail event history for the delete event and review the sourceIPAddress field.. CloudTrail event history records include the `sourceIPAddress` field, which directly provides the IP address from which the `DeleteBucket` API call was made. Option A is incorrect because CloudTrail Lake can query events, but the IP address is in the `sourceIPAddress` field, not in `userIdentity`. Option B is incorrect because S3 server access logs capture requests to S3 objects, not bucket-level API calls like deletion; CloudTrail captures management events such as `DeleteBucket`. Option C is incorrect because CloudTrail Insights detects unusual activity patterns but does not provide the source IP for individual events.

Answer

Use CloudTrail Lake to query the event and extract the IP address from the userIdentity field.

Answer

Check S3 server access logs for the bucket deletion event.

Answer

Enable CloudTrail Insights to analyze unusual activity.

Question 14

A DevOps engineer receives a CloudWatch alarm that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance hosts a critical web application. What is the MOST appropriate immediate response to mitigate performance impact?

Accepted Answer

Place the instance into an Auto Scaling group with a scale-out policy based on CPU utilization.. Placing the instance into an Auto Scaling group with a scale-out policy based on CPU utilization allows the group to launch additional instances to handle the increased load, providing immediate mitigation without downtime. Rebooting (A) causes downtime and does not resolve the root cause. Creating a new AMI and launching a larger instance (C) or stopping and resizing (D) both involve significant downtime and are not immediate. Therefore, B is the best immediate response.

Answer

Reboot the EC2 instance to clear any temporary processes.

Answer

Create a new AMI from the instance and launch a new larger instance.

Answer

Stop the instance and change its type to a larger instance size.

Question 15

A company uses an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security team reports that a specific client IP address is sending malicious requests and must be blocked immediately. The ALB's security group only allows HTTP/HTTPS from 0.0.0.0/0. What is the FASTEST way to block traffic from this IP address without affecting other traffic?

Accepted Answer

Create an AWS WAF web ACL with an IP set deny rule and associate it with the ALB.. The fastest way to block traffic from a specific client IP without affecting other traffic is to use AWS WAF. Option A is correct: Create an AWS WAF web ACL with an IP set deny rule and associate it with the ALB. This immediately blocks the malicious IP at the application layer without altering network infrastructure. Option B is incorrect because ALB listener rules only affect routing decisions (e.g., forwarding to target groups), not packet dropping. Option C is incorrect because security groups only support allow rules; you cannot add a deny rule. You would have to update the security group to remove the allow from 0.0.0.0/0 and add allow for all except that IP, which is not a simple deny and could affect other traffic. Option D is incorrect because VPC route tables operate at the network layer and cannot filter by source IP; they only direct traffic based on destination. Also, modifying route tables would affect all traffic to the ALB's subnets, not just the specific IP.

Answer

Modify the ALB listener rules to drop requests from the client IP.

Answer

Update the ALB security group to add a deny rule for the client IP address.

Answer

Update the VPC route table to drop packets from the client IP.