DOP-C02 Incident and Event Response Practice Test 7 — 15 Questions

Question 1

A DevOps engineer is designing an incident response plan for a serverless application using AWS Lambda, API Gateway, and DynamoDB. Which TWO services should be used to monitor and alert on errors and latency?

Accepted Answer

Amazon CloudWatch. Option A (CloudWatch) provides metrics and alarms. Option D (X-Ray) provides tracing for latency. Option B is wrong because CloudTrail records API calls but not latency. Option C is wrong because Config monitors configuration changes. Option E is wrong because GuardDuty is for security threats.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The team wants to automate the response to an instance failure. Which THREE steps should be taken to ensure automatic recovery and notification?

Accepted Answer

Configure Auto Scaling to replace unhealthy instances. Option A is correct to terminate unhealthy instances. Option C is correct to send notifications via SNS. Option D is correct to configure health checks on ALB. Option B is wrong because scaling policies adjust capacity but do not handle individual instance failures. Option E is wrong because CloudWatch can terminate instances but Auto Scaling handles it.

Answer

Create a CloudWatch alarm to terminate the instance

Answer

Create a scaling policy based on CPU utilization

Question 3

During a security incident, a DevOps engineer discovers that an EC2 instance has been compromised. The instance has an IAM role with permissions to access S3 and DynamoDB. Which THREE immediate actions should the engineer take to contain the incident?

Accepted Answer

Stop the EC2 instance. Option A is correct to stop the instance. Option D is correct to detach the IAM role to prevent further actions. Option E is correct to isolate the instance by modifying the security group. Option B is wrong because snapshotting may capture malware. Option C is wrong because terminating destroys evidence.

Answer

Terminate the instance immediately

Answer

Create an AMI of the instance for forensic analysis

Question 4

A company's production EC2 instance running a web application becomes unresponsive. The operations team checks CloudWatch metrics and sees a CPU Utilization spike to 100% for the last 10 minutes. What is the MOST efficient first step to restore service?

Accepted Answer

Reboot the EC2 instance from the AWS Management Console or CLI. Option B is correct because restarting the EC2 instance is the quickest way to restore service when the instance is unresponsive. Option A is wrong because creating an AMI takes time; option C is wrong because investigating CloudWatch Logs delays restoration; option D is wrong because terminating the instance without recovery would cause data loss.

Answer

Check the instance's system logs in CloudWatch Logs to identify the root cause

Answer

Create an AMI of the instance and launch a new instance from that AMI

Answer

Terminate the instance and launch a new one from the latest AMI

Question 5

A DevOps engineer receives a CloudWatch alarm that an Auto Scaling group has been in an 'Insufficient data' state for 20 minutes. What does this indicate?

Accepted Answer

The alarm has not received enough metric data to evaluate. The 'Insufficient data' state in CloudWatch alarms indicates that the alarm has not received enough metric data points to determine whether the threshold has been breached. This can occur when the metric is not being published, the data collection period is too short, or the metric namespace is misconfigured. It does not directly indicate instance health, scaling needs, or agent installation status.

Answer

All instances in the Auto Scaling group are unhealthy

Answer

The Auto Scaling group needs to scale up

Answer

The CloudWatch agent is not installed on the instances

Question 6

A company uses AWS CloudTrail to log API calls. An IAM user's credentials are compromised, and the attacker launches multiple EC2 instances in regions that are not typically used. The security team wants to receive near-real-time notifications of any API calls from this user. What is the MOST effective solution?

Accepted Answer

Create a CloudTrail trail that delivers to CloudWatch Logs, then set up a CloudWatch Events rule to invoke a Lambda function that sends an SNS notification. Option A is correct because CloudTrail can send events to CloudWatch Events (now Amazon EventBridge) in near real-time, which can trigger a Lambda function to send notifications. Option B is wrong because CloudWatch Logs Insights is for querying historical logs; C is wrong because S3 events are not near-real-time; D is wrong because Config rules are for configuration compliance, not API call monitoring.

Answer

Create an AWS Config rule that checks for EC2 instances in unauthorized regions

Answer

Configure CloudTrail to deliver logs to an S3 bucket and enable S3 event notifications to SQS

Answer

Use CloudWatch Logs Insights to query CloudTrail logs every 5 minutes and send results via email

Question 7

A company experiences an unexpected spike in network traffic to a web application hosted on EC2 instances behind an Application Load Balancer. The DevOps team needs to investigate the source IP addresses generating the traffic. Which AWS service should they use to capture the traffic?

Accepted Answer

VPC Flow Logs. Option B is correct because VPC Flow Logs capture IP traffic information including source and destination IPs. Option A is wrong because CloudTrail logs API calls, not network traffic; C is wrong because CloudWatch Logs captures application logs; D is wrong because AWS Config records resource configuration changes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

An organization uses AWS Systems Manager to manage its EC2 instances. After a security incident, the security team wants to ensure that all future API calls to Systems Manager are logged and monitored. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS CloudTrail for the Systems Manager service. Option C is correct because enabling CloudTrail for Systems Manager logs all API calls. Option A is wrong because S3 server access logs are for S3 bucket access, not Systems Manager; B is wrong because CloudWatch Logs agent runs on instances, not for API calls; D is wrong because Config rules track configuration, not API calls.

Answer

Enable S3 server access logging on the Systems Manager log bucket

Answer

Install the CloudWatch Logs agent on each instance to capture Systems Manager logs

Answer

Create an AWS Config rule to monitor Systems Manager usage

Question 9

A company runs a critical application on an Amazon RDS for MySQL DB instance. The application experiences intermittent connection timeouts. The DevOps team notices that the DB instance's CPU and memory metrics are normal. What should the team check NEXT to diagnose the issue?

Accepted Answer

Check the 'DatabaseConnections' CloudWatch metric to see if the connection count is near the max_connections limit. Option A is correct because connection timeouts with normal CPU/memory often indicate that the DB instance's maximum connections limit has been reached. Option B is wrong because Enhanced Monitoring is for OS-level metrics, not connections; C is wrong because query latency is not directly related to connection timeouts; D is wrong because storage is not the issue here.

Answer

Enable Enhanced Monitoring to check OS-level metrics

Answer

Examine the slow query log to identify long-running queries

Answer

Verify that the DB instance's storage is not full

Question 10

A DevOps engineer receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. How should the engineer respond?

Accepted Answer

Verify the instance's system and instance status checks, then consider terminating the instance to allow the Auto Scaling group to launch a new one. Option B is correct because if the instance fails status checks, the engineer should verify the instance is healthy and replace it if needed. Option A is wrong because status checks are internal, not security group issues; C is wrong because terminating the instance manually may not be necessary; D is wrong because the Auto Scaling group will launch a new instance only if the instance is terminated or marked unhealthy.

Answer

Immediately terminate the instance to trigger a replacement

Answer

Do nothing, because the Auto Scaling group will automatically replace the instance

Answer

Check the security group rules to ensure they allow traffic

Question 11

A company uses Amazon CloudFront to distribute content globally. Users in some regions report slow load times. The DevOps team wants to identify the geographic regions where performance is worst. Which tool should they use?

Accepted Answer

CloudFront reports in the AWS Management Console. Option C is correct because CloudFront reports show metrics like total requests, error rates, and latency by geographic region. Option A is wrong because CloudWatch metrics are per distribution, not per region; B is wrong because access logs do not aggregate performance; D is wrong because Route 53 is for DNS, not performance analysis.

Answer

Amazon CloudWatch Metrics for CloudFront

Answer

CloudFront access logs in S3

Answer

Amazon Route 53 latency records

Question 12

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences periodic spikes in response times. The CloudWatch metrics show high CPU and memory usage for the tasks during these spikes. What is the MOST effective approach to handle these spikes?

Accepted Answer

Configure target tracking scaling policies for the ECS service using CPU or memory utilization. Option D is correct because using Application Auto Scaling with target tracking based on CPU or memory utilization dynamically adjusts the task count. Option A is wrong because it does not address scaling; B is wrong because it does not scale automatically; C is wrong because it does not use metrics for scaling.

Answer

Use a larger Fargate task size to handle the spikes

Answer

Increase the CPU and memory limits for the ECS task definition

Answer

Set up a scheduled scaling action to add tasks during peak hours

Question 13

A company uses AWS CloudFormation to manage infrastructure. An engineer notices that a stack update has failed, leaving the stack in a ROLLBACK_IN_PROGRESS state. Which TWO actions should the engineer take to investigate and resolve the issue?

Accepted Answer

View the stack events in the CloudFormation console to see the specific error message. Options B and D are correct. The engineer should view the stack events to see the specific error, then review the change set to understand what changes were attempted. Option A is wrong because deleting the stack would lose resources; C is wrong because re-launching may repeat the error; E is wrong because stopping rollback is not recommended without understanding the issue.

Answer

Manually stop the rollback and continue with the update

Answer

Re-launch the stack with the same template

Answer

Delete the stack and re-launch it

Question 14

A company runs a web application on EC2 instances behind an Application Load Balancer. The application is experiencing intermittent 503 errors. The DevOps team suspects that the target group's health check settings may be causing healthy instances to be marked as unhealthy. Which THREE configurations should the team review?

Accepted Answer

Health check interval. Options A, C, and E are correct. Health check path, interval, and threshold all affect how the ALB determines instance health. Option B is wrong because cross-zone load balancing does not affect health checks; D is wrong because stickiness is about session persistence.

Answer

Stickiness setting

Answer

Cross-zone load balancing setting

Question 15

A DevOps team needs to implement a solution to automatically remediate an S3 bucket that becomes publicly accessible. Which TWO services should they use together?

Accepted Answer

AWS Config. AWS Config can continuously monitor S3 bucket configurations and trigger an AWS Lambda function via a custom rule or managed rule (e.g., s3-bucket-public-read-prohibited) when a bucket becomes publicly accessible. Lambda then executes the remediation logic, such as applying a bucket policy that blocks public access. This pair provides an automated, event-driven remediation pipeline without manual intervention.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

Amazon GuardDuty