DOP-C02 Incident and Event Response Practice Test 6 — 15 Questions

Question 1

A DevOps engineer is troubleshooting an issue where an EC2 instance in a private subnet cannot reach the internet. The instance has a route to a NAT gateway. Which TWO of the following should the engineer check? (Choose TWO.)

Accepted Answer

The route table of the private subnet has a route to the NAT gateway. Option A is correct because the route table must have a route to the NAT gateway. Option B is correct because the security group must allow outbound traffic (e.g., HTTPS). Option C is wrong because the internet gateway is attached to the VPC, not the subnet. Option D is wrong because public IP is not needed for instances in private subnet using NAT. Option E is wrong because the NAT gateway is in a public subnet, but the instance is in private; the instance does not have a public IP.

Answer

The NAT gateway is in the same subnet as the instance

Answer

The internet gateway is attached to the private subnet

Answer

The instance has a public IP address

Question 2

A company uses AWS Lambda with an Amazon DynamoDB trigger. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors. The DevOps team needs to mitigate the issue. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Increase the DynamoDB table's write capacity. Option B is correct because increasing DynamoDB write capacity reduces throttling. Option D is correct because reducing the batch size lowers the number of writes per invocation. Option A is wrong because Lambda concurrency is not the issue; DynamoDB is throttling. Option C is wrong because DynamoDB Streams is required for the trigger; disabling it stops the trigger. Option E is wrong because enabling DynamoDB Accelerator (DAX) is for reads, not writes.

Answer

Increase the Lambda function's reserved concurrency

Answer

Disable DynamoDB Streams on the table

Answer

Enable DynamoDB Accelerator (DAX) for the table

Question 3

A company uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is experiencing intermittent HTTP 503 errors. The DevOps team needs to diagnose the cause. Which THREE of the following should the team investigate? (Choose THREE.)

Accepted Answer

Auto Scaling group minimum capacity and scaling policy. Option A is correct because if the instances are unhealthy, the ALB returns 503. Option C is correct because insufficient instances cannot handle the load. Option E is correct because idle timeout can cause premature connection closure leading to 503. Option B is wrong because SSL certificate issues cause 502 or 400 errors. Option D is wrong because security group inbound rules affect access, but 503 is from ALB, not the client.

Answer

Security group inbound rules for the ALB

Answer

SSL certificate expiration on the ALB

Question 4

An IAM policy attached to a user is shown in the exhibit. The user reports that they are unable to delete an object in the 'example-bucket' bucket. What is the reason for this?

Accepted Answer

The explicit Deny statement overrides the Allow. Option B is correct because an explicit Deny overrides any Allow. The Deny action s3:DeleteObject explicitly denies the delete, even though the Allow all s3 actions includes delete. Option A is wrong because the resource ARN matches. Option C is wrong because the policy allows all s3 actions, but the Deny blocks delete. Option D is wrong because the policy is valid.

Answer

The resource ARN does not match the bucket name

Answer

The user does not have permissions to perform s3:DeleteObject

Answer

The policy has a syntax error

Question 5

A DevOps engineer observes the CloudWatch alarm output shown in the exhibit. The alarm is in ALARM state for instance i-0abcd1234efgh5678. The engineer checks the EC2 console and sees that the instance's CPU utilization is currently 10%. What is the MOST likely explanation?

Accepted Answer

The alarm has not yet evaluated enough low datapoints to change state. Option D is correct because the alarm evaluated only 1 datapoint (EvaluationPeriods=1) and the CPU spiked to 100% at 09:55, triggering the alarm. It has since dropped, but the alarm state persists until manually reset or until it transitions to OK after enough low datapoints. Option A is wrong because the metric exists. Option B is wrong because the threshold is 90%. Option C is wrong because the alarm is correctly configured.

Answer

The alarm is misconfigured with wrong metric

Answer

The threshold was set too low

Answer

The CPUUtilization metric is not being emitted

Question 6

The CloudFormation template in the exhibit deploys an S3 bucket with a bucket policy. After deployment, the DevOps team discovers that the bucket is publicly accessible. Which change should be made to prevent public access while allowing only authenticated users from a specific AWS account to read objects?

Accepted Answer

Change the Principal to the AWS account ID of the allowed account. Option C is correct because restricting the Principal to a specific AWS account prevents public access. Option A is wrong because public access is enabled by Principal "*". Option B is wrong because blocking public access at the account level is an alternative, but the question asks to change the template. Option D is wrong because blocking public access on the bucket is another approach, but the template change is required.

Answer

Enable AWS Organizations to block public access

Answer

Change the Principal to "*" and add a condition for aws:SourceIp

Answer

Set the bucket's 'BlockPublicAccess' property to true

Question 7

A DevOps engineer receives an alarm that an EC2 instance's CPU utilization has exceeded 90% for 5 minutes. The engineer needs to automatically recover the instance. Which AWS service should be used to configure automatic recovery?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can be configured to trigger an EC2 instance recovery action when a metric like CPU utilization exceeds a threshold (e.g., 90% for 5 minutes). The alarm sends a signal to the EC2 service, which automatically recovers the instance by stopping it and starting it on a new underlying host, preserving the instance ID, private IP, and Elastic IP. This is the native, built-in mechanism for automatic instance recovery without requiring additional compute or orchestration services.

Answer

AWS Lambda

Answer

AWS Systems Manager Automation

Answer

EC2 Auto Scaling

Question 8

A company's production RDS MySQL instance experienced a failover. The DevOps team needs to understand the root cause. Which set of logs should be reviewed first?

Accepted Answer

AWS CloudTrail logs. Option B is correct because RDS events (failover, maintenance) are logged in CloudTrail. Option A is wrong because slow query logs do not record failover events. Option C is wrong because error logs may show errors but not the failover trigger. Option D is wrong because VPC Flow Logs capture network traffic, not database events.

Answer

VPC Flow Logs

Answer

RDS MySQL error logs

Answer

RDS slow query logs

Question 9

An application running on an EC2 instance in a private subnet needs to access an S3 bucket. The instance has an IAM role with S3 access. However, the application is failing with timeout errors. The security group allows all outbound traffic, and the NACL allows outbound ephemeral ports. What is the most likely cause?

Accepted Answer

No VPC endpoint for S3. Option D is correct because a VPC endpoint for S3 (Gateway or Interface) is needed for private subnet access to S3 without NAT. Option A is wrong because the routing table is not typically an issue for S3 access via Internet Gateway. Option B is wrong because the IAM role is already configured. Option C is wrong because no proxy is required.

Answer

Missing route in the route table to an Internet Gateway

Answer

IAM role does not have correct trust policy

Answer

Missing HTTP proxy configuration

Question 10

A DevOps engineer is troubleshooting an AWS Lambda function that is intermittently timing out. The function is configured with a 3-second timeout and 128 MB memory. The function processes messages from an SQS queue. What is the most cost-effective change to reduce timeouts?

Accepted Answer

Increase the function memory to 256 MB. Increasing the memory to 256 MB is the most cost-effective change because Lambda allocates CPU proportionally to memory, so doubling the memory from 128 MB to 256 MB also doubles the CPU performance. This reduces execution time, which can resolve timeouts without increasing the timeout duration, and since Lambda billing is based on compute time (GB-seconds), the total cost may stay the same or even decrease if the function finishes faster.

Answer

Increase the SQS batch size to 20

Answer

Increase the function timeout to 10 seconds

Answer

Set reserved concurrency to 10

Question 11

After deploying a new application version using AWS CodeDeploy, an EC2 instance fails the deployment. The deployment group is configured with an in-place deployment. The engineer sees the error 'ScriptMissing' in the CodeDeploy logs. What should the engineer check?

Accepted Answer

The file path defined in the appspec.yml for the lifecycle hook. Option A is correct because the appspec.yml references lifecycle event hooks scripts; if the file is missing, 'ScriptMissing' error occurs. Option B is wrong because the AMI is not related to script files. Option C is wrong because the security group does not affect script execution. Option D is wrong because the deployment group configuration is not the cause.

Answer

The deployment group's deployment configuration

Answer

The security group attached to the instance

Answer

The AMI used for the EC2 instance

Question 12

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team requires that log data be encrypted at rest using a customer-managed AWS KMS key. The logs are currently being delivered, but they are not encrypted. What is the most likely reason?

Accepted Answer

The IAM role for the EC2 instance does not have kms:Encrypt permission. Option C is correct because the CloudWatch Logs role must have kms:Encrypt permission to use CMK. Option A is wrong because KMS key policies allow IAM policies but IAM policies must grant permissions. Option B is wrong because the CMK must be enabled, but that's not the typical issue. Option D is wrong because encryption is applied at log group level, not at the agent level.

Answer

The CloudWatch Logs agent is not configured to encrypt logs

Answer

The KMS key is disabled

Answer

The KMS key policy does not allow the CloudWatch Logs service principal

Question 13

A DevOps engineer receives a CloudWatch alarm that the 'StatusCheckFailed' metric for an EC2 instance is in ALARM state. The instance is part of an Auto Scaling group. What should the engineer do first to restore service?

Accepted Answer

Wait for Auto Scaling to replace the instance. Option B is correct because the instance status check failure indicates a system issue; if the instance is unhealthy, Auto Scaling will terminate and replace it. Option A is wrong because rebooting may not fix underlying issues. Option C is wrong because terminating manually is not needed; Auto Scaling handles it. Option D is wrong because changing the AMI is not immediate.

Answer

Update the Auto Scaling group's launch configuration

Answer

Manually terminate the instance

Answer

Reboot the instance

Question 14

An application running on Amazon ECS Fargate is experiencing intermittent 'CannotPullContainerError' errors. The task definition references a Docker image in a private Amazon ECR repository. The task execution role has the 'AmazonECSTaskExecutionRolePolicy' policy attached. What is the most likely cause?

Accepted Answer

The Fargate task is in a private subnet without a NAT gateway or VPC endpoint. Option C is correct because the task execution role needs permission to pull images; 'AmazonECSTaskExecutionRolePolicy' includes ecr:GetAuthorizationToken and ecr:BatchCheckLayerAvailability etc., so it should work. However, if the image is in a different account, the repository policy may not allow cross-account pulls. But among options, D is plausible. Actually, re-evaluate: The policy includes necessary permissions, so likely it's a networking issue. Option A is wrong because the policy does allow. Option B is wrong because ECR does not use VPC endpoints by default. Option C is correct if the subnet has no route to ECR. Option D is wrong because Auto Scaling does not affect image pulling.

Answer

The task execution role does not have sufficient permissions

Answer

The ECS service is not configured with Auto Scaling

Answer

The ECR repository is not in the same region as the ECS cluster

Question 15

A company uses AWS CloudFormation to manage infrastructure. A recent stack update failed with the error 'UPDATE_ROLLBACK_FAILED'. The stack is now in a 'UPDATE_ROLLBACK_FAILED' state, and the engineer needs to fix the stack. What is the correct course of action?

Accepted Answer

Continue the rollback using the 'ContinueUpdateRollback' API. Option A is correct because when a rollback fails, you can continue the rollback (which may skip resources that failed to roll back) or perform a stack operation to fix. Option B is wrong because deleting may not be possible if the stack is stuck. Option C is wrong because you cannot update a stack in rollback failed state without first continuing rollback. Option D is wrong because support can help but is not the direct action.

Answer

Contact AWS Support to fix the stack

Answer

Delete the stack and recreate it

Answer

Submit another stack update with the desired configuration