DOP-C02 Incident and Event Response Practice Test 6 — 15 Questions

Question 1

A company uses AWS CloudTrail to log API activity in their AWS account. The DevOps engineer needs to ensure that all management events are logged and that the logs are delivered to an S3 bucket in another account for centralized auditing. The engineer has already created an S3 bucket in the central auditing account and applied a bucket policy that grants the CloudTrail service permission to write logs. However, logs are not being delivered. The engineer verifies that the CloudTrail trail is configured to point to the correct S3 bucket name and that the bucket exists. What is the MOST likely reason the logs are not being delivered?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket policy in the central account does not include the 's3:PutObject' action for the CloudTrail service.. The S3 bucket policy must include the 's3:PutObject' action for the CloudTrail service principal. Without this action, even if the bucket policy grants write access generically, CloudTrail cannot put objects. Option B is incorrect because ACLs are not required; bucket policy is the standard mechanism for cross-account access. Option C is incorrect because VPC peering is not needed for S3 cross-account log delivery; it uses public internet or VPC endpoints. Option D is incorrect because CloudTrail trails can be created in one account and deliver logs to a bucket in another account; the trail does not need to be in the central auditing account.

Answer

The S3 bucket must have ACLs enabled to allow cross-account writes.

Answer

The source account does not have a VPC peering connection to the central auditing account.

Answer

The CloudTrail trail must be created in the central auditing account, not the source account.

Question 2

A company runs a production database on Amazon RDS for PostgreSQL. The DevOps team has set up a read replica to offload read traffic. Recently, the replica started experiencing replication lag that is increasing over time. The primary instance's CPU and memory utilization are normal. The network bandwidth between the primary and replica is not saturated. The team has already increased the replica's instance class, but the lag persists. The primary database is under heavy write load due to a batch job that runs hourly. What is the MOST likely cause of the increasing replication lag?

Accepted Answer

The batch job on the primary is using long-running transactions that are holding up WAL generation.. Long-running transactions on the primary (such as those from an hourly batch job) prevent PostgreSQL from advancing the WAL flush/apply position that the replica depends on. Even though the primary's CPU/memory are normal and network is fine, the replica cannot apply WAL records until the corresponding transaction commits, so lag grows monotonically. This is a classic PostgreSQL streaming replication behavior tied to transaction visibility, not resource sizing.

Answer

The primary database should be migrated to a Multi-AZ deployment instead of using a read replica.

Answer

The replica's 'max_standby_streaming_delay' parameter is set too low, causing the replica to cancel queries.

Answer

The replica's instance class is still too small for the write load from the primary.

Question 3

A company uses AWS Lambda functions that are triggered by S3 events (object creation). The Lambda function processes the file and stores results in DynamoDB. Recently, the function started timing out after 15 seconds, causing some files to not be processed. The average file size has increased significantly. The DevOps engineer increases the Lambda function's timeout to 30 seconds and the memory to 512 MB, but the function still times out for large files. The CloudWatch Logs show that the timeout occurs during the 'dynamodb.put_item' call for a large item. The DynamoDB table's write capacity is set to on-demand, and there are no throttling errors. What should the engineer do to resolve the timeout issue?

Accepted Answer

Modify the Lambda function to split the large item into multiple smaller items before writing to DynamoDB.. The DynamoDB put_item API call is timing out due to the item size exceeding the 400 KB limit. Splitting the large item into multiple smaller items reduces the payload per request, allowing the call to complete within the timeout. Option B is incorrect because adding an SQS queue does not address the root cause of the large item size; the downstream Lambda would still face the same timeout issue. Option C is incorrect because EFS is a file storage service and is not relevant to DynamoDB API timeouts. Option D is incorrect because increasing the timeout and memory does not resolve the DynamoDB API call timeout caused by exceeding the item size limit.

Answer

Configure the Lambda function to write to an SQS queue first, then have another Lambda process the queue.

Answer

Mount an EFS file system to the Lambda function and write the large item to a file instead of DynamoDB.

Answer

Increase the Lambda function's timeout to 5 minutes and memory to 1024 MB.

Question 4

A company runs a critical application on Amazon ECS with the Fargate launch type. During an incident, the DevOps engineer notices that tasks are failing to start with the error 'ResourceInitializationError: unable to pull secrets or registry auth'. The tasks use secrets from AWS Secrets Manager and images from Amazon ECR. The engineer needs to identify the root cause of the task failures. Which action should the engineer take FIRST to diagnose the issue?

Accepted Answer

Inspect the task's stopped reason in the ECS console and check the Amazon ECS agent logs for detailed error messages.. The ResourceInitializationError occurs when ECS tasks cannot initialize due to issues like missing IAM permissions for Secrets Manager or ECR, or network problems. The stopped reason and ECS agent logs contain the specific error details, making them the most direct diagnostic source. Other actions, such as checking CloudTrail or security groups, might be relevant later but do not provide immediate insight into the failure reason.

Answer

Verify that the VPC security group attached to the Fargate task allows outbound traffic to the internet.

Answer

Restart the ECS service to force new tasks to launch and see if the error persists.

Answer

Use AWS CloudTrail to check for any recent changes to the ECS task execution IAM role.

Question 5

A company uses AWS CodePipeline to deploy a serverless application. The pipeline includes a source stage from AWS CodeCommit, a build stage using AWS CodeBuild, and a deploy stage using AWS CloudFormation. During a recent production deployment, the pipeline failed at the deploy stage with the error 'Insufficient permissions to perform action: iam:PassRole'. A DevOps engineer needs to resolve the issue and ensure the pipeline can deploy successfully. Which TWO actions should the engineer take to resolve the error? (Choose two.)

Accepted Answer

Modify the CodePipeline service role to allow iam:PassRole for the CloudFormation execution role.. The error 'Insufficient permissions to perform action: iam:PassRole' indicates that the CodePipeline service role lacks permission to pass the CloudFormation execution role. Granting iam:PassRole to the CodePipeline service role for that specific role resolves the immediate error. Additionally, the CloudFormation execution role's trust policy must allow CloudFormation to assume it; otherwise, even after passing, CloudFormation cannot use the role. Both actions are necessary for a successful deployment.

Answer

Add a permissions boundary to the CloudFormation execution role that allows iam:PassRole.

Answer

Update the CodeBuild service role to include iam:PassRole for the CloudFormation execution role.

Answer

Attach a policy to the CloudFormation execution role that allows iam:PassRole to itself.

Question 6

A DevOps engineer is configuring an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked but occasionally fails due to throttling errors from a downstream service. The engineer needs to ensure that failed messages are retried and that the function can handle the errors without losing messages. Which solution should the engineer implement?

Accepted Answer

Configure the SQS queue as an event source for the Lambda function and set a dead-letter queue for the function's failed invocations.. The Lambda SQS event source mapping automatically retries failed batches. Configuring a dead-letter queue for the Lambda function captures failed invocation records after retries are exhausted, preventing message loss. This combination ensures failed messages are retried and then preserved for analysis, which meets the requirement. Other options either do not provide retry logic or focus on scaling rather than error handling.

Answer

Set the Lambda function's reserved concurrency to a high value to avoid throttling.

Answer

Configure the SQS queue as an event source for the Lambda function and set the maximumRetryAttempts to 5.

Answer

Configure a dead-letter queue (DLQ) for the SQS queue and set the maxReceiveCount to a suitable value.

Question 7

A DevOps engineer is building an automated remediation workflow for a fleet of EC2 instances managed by AWS Systems Manager. When a CloudWatch alarm fires, the response must run a runbook on the affected instance, capture diagnostic output, and notify the on-call team only after remediation is attempted. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create an AWS Systems Manager Automation runbook and grant the automation execution role the necessary permissions to run commands and read instance output.. Automated remediation requires a runbook that performs the actions and an execution path that starts it when the alarm fires. Routing the alarm through SNS to Lambda, which calls SendCommand for the automation, provides that path, and the Automation runbook with a properly permissioned execution role provides the logic and diagnostic capture before the team is notified.

Answer

Attach an IAM instance profile to the EC2 instances that allows them to publish to the SNS topic directly.

Answer

Create a CloudWatch Logs metric filter that triggers the automation whenever the alarm state changes.

Answer

Enable AWS CloudTrail data events on the EC2 instances so the runbook can read the diagnostic output.

Question 8

A DevOps engineer is setting up an Amazon CloudWatch alarm to monitor the health of a critical application running on an Amazon EC2 instance. The engineer wants to be notified if the instance's status check fails for two consecutive periods. The engineer creates an alarm with the metric StatusCheckFailed, period 60 seconds, evaluation periods 2, and threshold 1. However, the alarm does not trigger when the instance's status check fails. What is the MOST likely reason?

Accepted Answer

The alarm's statistic is set to Average instead of Maximum.. The most likely reason is that the alarm's statistic is set to Average. For the StatusCheckFailed metric, which is binary, using Average can mask failures because the average over a period may be less than 1 even if some samples indicate failure. Setting the statistic to Maximum ensures that any failure within the period results in a value of 1, which will breach the threshold of 1. This is a common pitfall when configuring CloudWatch alarms for binary metrics.

Answer

The alarm's threshold is set to 1, but it should be set to 0.

Answer

The alarm's evaluation periods are set to 2, but they should be set to 1.

Answer

The alarm's period is set to 60 seconds, but it should be set to 300 seconds.

Question 9

A company uses AWS Systems Manager Session Manager to provide secure shell access to EC2 instances without opening inbound ports. During an incident, a DevOps engineer attempts to start a session to a production instance but receives the error: 'The instance does not have a valid SSM agent version or the IAM role is missing.' The engineer verifies that the instance has the SSM agent installed and the IAM role attached has the AmazonSSMManagedInstanceCore policy. What is the MOST likely cause of the issue?

Accepted Answer

The instance's security group does not allow outbound traffic to the SSM service endpoints.. The most likely cause is that the instance's security group does not allow outbound traffic to the SSM service endpoints. Session Manager relies on the SSM agent to communicate with the SSM service over HTTPS. If the security group blocks outbound traffic to the public SSM endpoint or VPC endpoints, the agent cannot establish a connection, leading to session failures. Even with the correct IAM role, network connectivity is required. This is a common oversight in environments with restrictive security groups.

Answer

The instance's IAM role does not have the AmazonSSMManagedInstanceCore policy attached.

Answer

The SSM agent on the instance is not running or needs to be restarted.

Answer

The instance is not registered as a managed instance in Systems Manager.

Question 10

A company uses an Auto Scaling group with a dynamic scaling policy based on a custom CloudWatch metric. After a recent deployment, the metric spikes unexpectedly, causing the Auto Scaling group to launch several EC2 instances. The operations team wants to quickly determine whether the spike was caused by a real load increase or a deployment issue. What is the MOST efficient way to investigate this?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns or deployment markers that coincide with the metric spike.. CloudWatch Logs Insights allows you to query application logs for error patterns or deployment markers (e.g., new version tags, exception stack traces) that coincide with the metric spike. This directly correlates the scaling event with application-level evidence, enabling rapid root-cause analysis without altering infrastructure or relying on indirect notifications.

Answer

Check the SNS topic that the scaling policy publishes to for notifications.

Answer

Use AWS CloudTrail to review API calls that modified the scaling policy.

Answer

Temporarily disable the scaling policy and manually increase the desired capacity to handle the load.

Question 11

A company runs a critical application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) in front. During a load test, the team notices a sudden increase in 5xx errors from the ALB, and some tasks become unhealthy. The task logs show occasional 'OutOfMemoryError' exceptions. The task definition currently has 512 CPU units and 1024 MiB memory. What should the team do to mitigate the issue while maintaining a cost-effective approach?

Accepted Answer

Increase the task definition memory to 2048 MiB while keeping CPU at 512 units.. The application is experiencing OutOfMemoryError, indicating the current 1024 MiB memory allocation is insufficient. Increasing memory to 2048 MiB while keeping CPU at 512 units directly resolves the memory constraint without unnecessary CPU cost. ECS Fargate allows independent scaling of CPU and memory within valid combinations, and this change maintains a cost-effective approach by only increasing the resource that is actually constrained.

Answer

Increase the task definition CPU to 1024 units and memory to 2048 MiB.

Answer

Configure the ECS service to use a rolling update with a longer health check grace period.

Answer

Decrease the task definition memory to 512 MiB to force garbage collection more frequently.

Question 12

A DevOps engineer is investigating an incident where an EC2 instance became unreachable. The engineer checks the AWS Management Console and finds the instance is running, but the status check shows '2/2 checks passed' and the system log shows no errors. What should the engineer do NEXT to diagnose the connectivity issue?

Accepted Answer

Check the security group and network ACL rules to ensure inbound traffic is allowed.. Since the instance is running, status checks pass, and the system log shows no errors, the issue is not with the operating system or underlying hardware. The most likely cause is a network-layer restriction, such as security group or network ACL rules blocking inbound traffic. Checking these rules is the correct next step because they control traffic at the instance and subnet levels, respectively, and misconfigurations here are a common cause of unreachability despite healthy instance status.

Answer

Review the CloudWatch metrics for CPU utilization and network throughput.

Answer

Reboot the instance to reset the network interface.

Answer

Stop and start the instance to move it to new underlying hardware.

Question 13

A company has an AWS Lambda function that processes S3 events. The function is invoked multiple times for the same S3 object, causing duplicate processing. The engineer suspects the issue is related to retries from the S3 event notification or Lambda's built-in retry behavior. What is the MOST effective way to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store a record of processed S3 object keys and check for existence before processing.. Storing processed S3 object keys in a DynamoDB table and checking for existence before processing ensures idempotency at the application level. This approach directly handles duplicate invocations caused by S3 event retries or Lambda's built-in retry behavior, as the function can conditionally skip processing if the key already exists in DynamoDB. It provides a durable, consistent, and scalable mechanism to prevent duplicate processing regardless of how many times the function is invoked for the same object.

Answer

Modify the S3 bucket event notification configuration to use a prefix filter that excludes duplicate objects.

Answer

Set the Lambda function's ReservedConcurrency to 1 to prevent concurrent executions.

Answer

Use an Amazon SQS FIFO queue as the event source and enable content-based deduplication.

Question 14

An organization uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with 'UPDATE_ROLLBACK_FAILED' status. The engineer needs to bring the stack to a consistent state without losing data. What is the BEST approach?

Accepted Answer

Use the 'ContinueUpdateRollback' API to skip the resource that caused the failure.. The 'ContinueUpdateRollback' API is the best approach because it allows the stack to resume the rollback process, skipping the resource that caused the failure, and bringing the stack to a consistent 'UPDATE_ROLLBACK_COMPLETE' state without manual intervention or data loss. This API is specifically designed for the 'UPDATE_ROLLBACK_FAILED' status, enabling you to skip resources that cannot be rolled back (e.g., due to a non-reversible change) while preserving the rest of the stack's state.

Answer

Create a new stack from the same template and migrate resources.

Answer

Manually correct the resource configuration that caused the failure, then perform a stack update.

Answer

Delete the stack and then recreate it from the same template.

Question 15

A DevOps team observes that an Amazon CloudFront distribution is returning HTTP 504 errors for a small percentage of requests. The origin is an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The team has already checked the ALB's access logs and found that the ALB returns 200 OK for all requests. What should the team investigate NEXT?

Accepted Answer

Check the ALB's idle timeout settings and compare with CloudFront origin timeout.. The ALB returns 200 OK for all requests, so the origin itself is not failing. However, HTTP 504 errors from CloudFront typically indicate that the origin (ALB) is not responding within CloudFront's timeout window. The ALB's idle timeout (default 60 seconds) can cause the ALB to close idle connections, while CloudFront's origin timeout (default 30 seconds) is separate. If the ALB's idle timeout is shorter than the time CloudFront waits for a response, the ALB may close the connection before CloudFront receives the full response, leading to a 504. Option D directly addresses this mismatch.

Answer

Check the ALB target group health check settings and ensure instances are healthy.

Answer

Examine the request headers in CloudFront logs to identify unusual patterns.

Answer

Review the CloudFront cache hit ratio and optimize caching strategies.