DOP-C02 Incident and Event Response Practice Test 7 — 15 Questions

Question 1

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. CloudWatch alarms for CPU utilization and memory usage did not trigger. The engineer checks the system logs and finds an 'Out of memory: Kill process' error. What is the MOST likely cause of the missed alarms?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CloudWatch agent is not installed or configured to collect memory metrics.. The 'Out of memory: Kill process' error indicates the instance ran out of memory. CloudWatch by default only collects CPU and disk metrics, not memory metrics. To monitor memory, the CloudWatch agent must be installed and configured to report memory utilization. Since the alarm did not trigger, the most likely cause is that the CloudWatch agent is not installed or not configured to collect memory metrics. Option B is incorrect because instance store volumes do not affect metric collection; CloudWatch metrics are collected at the hypervisor level. Option C is incorrect because CloudWatch metrics are retained for 15 months by default, and alarms are not deleted due to retention. Option D is incorrect because EBS encryption does not block CloudWatch agent logs; the agent can read system logs regardless of encryption.

Answer

The instance is using instance store volumes instead of EBS, which prevents metric collection.

Answer

The CloudWatch metrics retention period is set to 1 day, so old alarms were deleted.

Answer

The EC2 instance's root EBS volume is encrypted, blocking CloudWatch agent logs.

Question 2

A DevOps team applies the above IAM policy to a group. A developer in this group tries to upload an object to the S3 bucket using the AWS CLI without specifying any encryption. The upload fails with an AccessDenied error. Why does the upload fail?

Accepted Answer

The Deny statement explicitly denies PutObject when encryption is not AES256, overriding the Allow.. The Deny statement explicitly denies `s3:PutObject` when encryption is not AES256 (`StringNotEquals "AES256"`). Since the upload request does not specify any encryption, the condition is true, and the Deny applies, overriding any Allow. Option A is incorrect because the Allow statement's condition (requiring AES256) is not satisfied, so it does not grant permission; however, the failure is due to the explicit Deny, not because Deny is evaluated first. Option B is incorrect because the Allow condition is not met, and the CLI default (SSE-S3) is actually AES256, but the Deny still applies because no encryption headers are present. Option D is incorrect because the Deny condition is met (StringNotEquals AES256 is true when no encryption is specified).

Answer

The Allow statement's condition is satisfied, but the Deny statement is evaluated first and denies the request.

Answer

The Allow statement requires encryption to be AES256, but the CLI defaults to SSE-S3, which is not AES256.

Answer

The Deny statement's condition is not met because the request does not include encryption headers.

Question 3

A company uses AWS CloudFormation to deploy a multi-tier web application. During an incident, the stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The operations team needs to investigate the root cause quickly without losing the stack's current state. What is the MOST efficient approach?

Accepted Answer

Use the ContinueUpdateRollback API with the ResourcesToSkip parameter.. The ContinueUpdateRollback API with the ResourcesToSkip parameter allows you to skip resources that caused the failure and continue the rollback, preserving the stack's state without losing resources that were successfully updated. Option A is incorrect because creating a change set does not help when a stack update is already in rollback; it shows intended changes but cannot skip resources during rollback. Option B is incorrect because deleting and recreating the stack would lose the current state and is not efficient for investigation. Option C is incorrect because manually fixing resources is risky and may not address the root cause; the stack is already in rollback, and the ContinueUpdateRollback API is the proper approach.

Answer

Create a change set and execute it to see the changes.

Answer

Delete the stack and recreate it using the same template.

Answer

Manually fix the resources and then retry the stack update.

Question 4

A Lambda function 'my-function' is invoked multiple times, but no logs appear in CloudWatch. The DevOps engineer runs the above CLI command and sees that the log group exists but 'storedBytes' is 0. What is the MOST likely cause?

Accepted Answer

The Lambda execution role lacks permissions to create log streams and put log events.. The Lambda execution role must have permissions to create log streams and put log events. Without these permissions, the function cannot write logs to CloudWatch, resulting in 0 storedBytes. Option A is incorrect because throttling would not cause storedBytes to be 0; logs would still be written. Option B is incorrect because retention policy only affects log expiration, not creation. Option D is incorrect because the log group exists (as shown) but no logs are written due to missing permissions.

Answer

The Lambda function is invoked too frequently, causing CloudWatch to throttle log ingestion.

Answer

The log group's retention policy of 7 days deletes logs immediately after creation.

Answer

The Lambda function does not have a log group; the one shown belongs to another resource.

Question 5

A company uses AWS Elastic Beanstalk for its web application. After a deployment, the environment health changes to 'Severe' and the application becomes unresponsive. The DevOps team needs to quickly revert to the previous working version. What is the FASTEST way to achieve this?

Accepted Answer

Use the Elastic Beanstalk console to deploy the previous application version.. Elastic Beanstalk supports rolling back to a previous application version through the console or CLI, which is the fastest way to revert. Option B is wrong because swapping URLs requires an existing environment already running the previous version, and setting that up is slower. Option C is wrong because terminating and recreating the environment takes longer and loses configuration and data. Option D is wrong because redeploying the same version does not change anything and won't fix the issue.

Answer

Swap environment URLs with a different environment that runs the previous version.

Answer

Terminate the environment and create a new one with the previous version.

Answer

Redeploy the same application version to the environment.

Question 6

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 7

A DevOps team uses AWS CodePipeline to deploy a web application. The pipeline has a manual approval step. During an incident, the deployment is stuck at the approval step because the approver is on leave. The team needs to unblock the pipeline quickly. What is the BEST action to take?

Accepted Answer

Use the CodePipeline console to approve the action directly as a different user.. The CodePipeline console allows any authorized user (with appropriate IAM permissions) to manually approve a pending approval action. This directly unblocks the pipeline without modifying the pipeline definition or requiring the original approver. Option D is incorrect because retrying the action only re-sends the approval request to the same approver who is unavailable, so it does not unblock the pipeline. Options A and C are not best actions: A involves modifying the pipeline definition which is time-consuming and may violate compliance; C would stop the pipeline rather than unblock it.

Answer

Update the pipeline definition to remove the manual approval step temporarily.

Answer

Disable the transition to the approval stage and manually run the remaining stages.

Answer

Retry the action in the approval stage from the CodePipeline console.

Question 8

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The target group health checks are failing. The DevOps engineer checks the instance logs and finds that the application is running but taking longer than 30 seconds to respond. What is the MOST likely cause?

Accepted Answer

The health check timeout is set too low, causing the ALB to mark instances unhealthy.. The ALB health check timeout is configured to a value less than 30 seconds, causing the health check to fail before the application responds. This results in the target group marking instances as unhealthy and returning 503 errors. Option A is incorrect because aggressive scaling would cause instance replacements but not directly 503 errors. Option B is incorrect because security group rules affect connectivity, not health check timeouts. Option D is incorrect because the application is still running, albeit slowly, not crashing.

Answer

The Auto Scaling group's scaling policy is too aggressive, causing frequent instance replacements.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The EC2 instances are running out of memory and the application is crashing.

Question 9

An EC2 instance is in 'running' state according to the CLI output, but the application hosted on it is unreachable. The DevOps engineer checks the security group and finds it allows inbound HTTP traffic from 0.0.0.0/0. The instance has a public IP. What is the MOST likely issue?

Accepted Answer

The instance's OS firewall (e.g., iptables) is blocking the traffic.. The instance's operating system firewall (e.g., iptables) can block inbound HTTP traffic. Option A is wrong because while network ACLs can block traffic, there is no indication of an ACL misconfiguration, and the security group is already open, making an OS-level issue more likely. Option B is wrong because the question explicitly states the instance has a public IP. Option C is wrong because the security group is attached and allows inbound HTTP from 0.0.0.0/0.

Answer

The network ACL is blocking inbound HTTP traffic.

Answer

The instance does not have a public IP address assigned.

Answer

The security group is attached to the instance but does not allow inbound HTTP.

Question 10

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 11

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error 'The overall deployment failed because too many individual instances failed deployment'. The team checks the instance logs and finds that the 'BeforeInstall' lifecycle event script returned a non-zero exit code. What is the BEST approach to resolve this?

Accepted Answer

Fix the script error in the revision and redeploy.. The deployment failed due to a script error in the BeforeInstall lifecycle event. The root cause is the script itself, so fixing the script error in the revision and redeploying addresses the issue permanently. Option A is wrong because setting 'ignoreScriptFailure' to true would mask the error and could lead to application issues. Option B is wrong because manually running the script on an instance does not fix the underlying issue in the revision, and the deployment will fail again. Option D is wrong because changing the deployment configuration to 'AllAtOnce' does not fix the script error and may cause more instances to fail simultaneously.

Answer

Set the 'ignoreScriptFailure' option to true in the AppSpec file and redeploy.

Answer

Manually run the script on an instance and then resume the deployment.

Answer

Change the deployment configuration to 'AllAtOnce' to speed up deployment.

Question 12

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application generates logs that are sent to CloudWatch Logs using the CloudWatch agent. Recently, the operations team noticed that some instances are missing logs for certain periods. The CloudWatch agent is configured to batch log events and send them every 5 seconds. The instances have high CPU utilization (90%+) during the missing periods. The DevOps engineer suspects that the agent is being throttled or failing. Which of the following is the MOST likely cause and the BEST course of action?

Accepted Answer

The CloudWatch agent is being starved of CPU resources, causing it to drop logs. Increase the CPU credits or instance size.. The most likely cause is CPU starvation of the CloudWatch agent. With CPU utilization above 90%, the agent may not get enough CPU cycles to process and send logs within the 5-second batch interval, causing logs to be dropped or delayed. The best course of action is to increase CPU resources, either by scaling up the instance type or by using a larger instance with more CPU credits (if using T-series). Option A is unlikely because high CPU utilization does not directly imply network saturation. Option B is incorrect because retention policy affects log availability over time, not real-time missing logs. Option D is incorrect because disk space issues would typically cause errors like 'disk full', but the problem states high CPU, not disk.

Answer

The network bandwidth is saturated, causing log delivery to fail. Increase instance network performance.

Answer

The CloudWatch Logs retention policy is set to 1 day, so older logs are deleted. Increase retention.

Answer

The instances are running out of disk space, preventing log buffering. Add more EBS volume space.

Question 13

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a large backlog of messages, and the Lambda function is processing them slowly. The DevOps team wants to increase throughput without making changes to the Lambda code. The team decides to increase the reserved concurrency to 10. However, after the change, the Lambda function starts to experience throttling errors (RateExceeded). The team also notices that other Lambda functions in the same account are also being throttled. What is the MOST likely cause?

Accepted Answer

The account's Lambda concurrency limit has been reached due to the increased reserved concurrency.. The account-level Lambda concurrency limit may be reached. Increasing reserved concurrency for one function reduces the pool available for others. Option A is wrong because the SQS queue's polling interval does not cause throttling. Option C is wrong because IAM permissions would cause access denied errors, not throttling. Option D is wrong because SQS visibility timeout issues would cause duplicate processing, not throttling.

Answer

The SQS queue's polling interval is too high, causing Lambda to poll infrequently.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The SQS queue's visibility timeout is too short, causing messages to be processed multiple times.

Question 14

A company hosts a static website on Amazon S3 with CloudFront as the CDN. Users report that they see an old version of the website even after the DevOps team updated the S3 objects. The team verified that the new objects are in the S3 bucket and are publicly accessible. The CloudFront distribution has a default TTL of 24 hours. To immediately serve the new content to users, the team needs to invalidate the CloudFront cache. Which of the following is the CORRECT approach to achieve this with minimal impact?

Accepted Answer

Create a CloudFront invalidation request for the path '/*'.. The correct approach is to create a CloudFront invalidation request for the path '/*'. This removes all cached objects from edge locations and forces CloudFront to fetch the latest content from the S3 origin. Changing the origin path does not invalidate cache; it only changes where new requests are sent. Setting TTL to 0 affects future caching but does not clear existing cached objects. Deleting and re-uploading with different names would change URLs, requiring users to update bookmarks, and is not minimal impact.

Answer

Change the CloudFront origin path to point to a new S3 bucket.

Answer

Update the CloudFront distribution's default TTL to 0 and wait for the changes to propagate.

Answer

Delete the S3 objects and re-upload them with different names.

Question 15

A DevOps engineer receives a CloudWatch alarm indicating that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance is part of an Auto Scaling group behind an Application Load Balancer. What is the MOST efficient initial step to troubleshoot the high CPU usage?

Accepted Answer

Review the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization.. Reviewing the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization is the most efficient initial step to diagnose high CPU usage. CPU credit balance is critical for burstable performance instances (e.g., T2/T3), as a depleted credit balance directly causes sustained high CPU utilization. Network utilization metrics can reveal if the high CPU is driven by excessive traffic or a DDoS-like pattern, allowing targeted remediation without unnecessary scaling or configuration changes.

Answer

Modify the Auto Scaling group to use a larger instance type.

Answer

Check the ALB's HTTP 5xx error rate metric for the target group.

Answer

Immediately increase the desired capacity of the Auto Scaling group.