DOP-C02 Incident and Event Response Practice Test 7 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team notices that an IAM user in the production account has been making changes to security group rules that are not compliant with the company's policy. The team wants to automatically revoke any non-compliant security group rules and notify the security team. What is the MOST efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an AWS Config managed rule to detect non-compliant security group rules, and configure an automatic remediation action with AWS Systems Manager Automation.. AWS Config managed rules can continuously evaluate security group rules against a desired policy (e.g., disallowing SSH from 0.0.0.0/0). When a non-compliant change is detected, AWS Config can trigger an automatic remediation action using an AWS Systems Manager Automation document that revokes the offending rule. This provides both detection and automated correction without manual intervention, making it the most efficient solution.

Answer

Create a CloudWatch alarm on the SecurityGroupEvent metric to notify the security team.

Answer

Apply a Service Control Policy (SCP) that denies changes to security groups in the production account.

Answer

Set up a CloudTrail trail that logs security group modifications and use Amazon Detective to analyze the changes.

Question 2

A company is experiencing a DDoS attack on their web application hosted on Amazon EC2 behind an Application Load Balancer (ALB). The attack is causing high CPU utilization on the instances. The security team needs to mitigate the attack with minimal disruption to legitimate users. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Configure AWS WAF rate-based rules to block excessive requests from specific IP addresses.. AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate, which directly mitigates DDoS attacks by limiting excessive traffic from specific sources. This approach minimizes disruption to legitimate users because it only blocks IPs that exceed the threshold, preserving access for normal traffic patterns.

Answer

Enable AWS Shield Advanced on the ALB for additional DDoS protection.

Answer

Scale up the EC2 instances by increasing their instance size.

Answer

Place an Amazon CloudFront distribution in front of the ALB to cache content.

Question 3

An e-commerce platform uses Amazon DynamoDB as its primary database. During a flash sale, the application experiences throttling errors. The operations team needs to implement a solution to handle sudden traffic spikes while keeping costs under control. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache read-intensive data.. DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from milliseconds to microseconds, offloading read requests from the main DynamoDB table. During a flash sale, caching read-intensive data (e.g., product details) with DAX reduces the number of read capacity units consumed, helping to avoid throttling while keeping costs under control by not requiring a permanent increase in provisioned capacity.

Answer

Increase the read and write capacity units manually before the sale.

Answer

Switch from on-demand to provisioned capacity with auto scaling.

Answer

Enable DynamoDB Streams and replicate data to a read replica.

Question 4

A DevOps engineer is troubleshooting an Amazon RDS for PostgreSQL instance that is running out of storage. The engineer wants to resolve the issue without downtime. Which TWO actions can achieve this? (Choose two.)

Accepted Answer

Enable storage auto scaling on the DB instance.. Enabling storage auto scaling on an Amazon RDS for PostgreSQL instance allows the database to automatically increase its allocated storage when it detects that available storage is running low, preventing out-of-storage errors without requiring manual intervention or downtime. Option E is correct because modifying the DB instance to increase the allocated storage size is a dynamic operation that can be performed without downtime, as Amazon RDS supports online storage scaling for PostgreSQL instances, allowing the change to take effect while the database remains available.

Answer

Create a read replica and promote it to primary.

Answer

Delete old automated snapshots to free up storage.

Answer

Scale up the DB instance to a larger instance class.

Question 5

An application log excerpt shows repeated HTTP 500 errors for the /api/orders endpoint, with occasional successful health checks. The application runs on EC2 instances behind an ALB. What is the MOST likely cause of this pattern?

Accepted Answer

The backend service that the /api/orders endpoint depends on is unavailable or failing.. The pattern of repeated HTTP 500 errors for /api/orders with occasional successful health checks strongly indicates that the backend service dependency (e.g., a database, cache, or another microservice) is intermittently failing or unavailable. HTTP 500 errors are server-side errors, meaning the application code is running but cannot complete the request due to a downstream failure. Successful health checks confirm the EC2 instances themselves are healthy and in-service, ruling out instance-level or ALB misconfiguration issues.

Answer

The EC2 instances are running out of memory and the application is crashing.

Answer

The ALB is misconfigured and routing requests to the wrong target group.

Answer

The EC2 instances are not passing health checks and are being deregistered from the target group.

Question 6

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes messages from an Amazon SQS queue. Recently, the processing time has increased, and the SQS queue depth is growing. The CloudWatch metrics show that the ECS service's CPU utilization is consistently around 70%, memory utilization is 80%, and the number of running tasks is at the maximum allowed (10). The service is configured with a target tracking scaling policy based on CPU utilization with a target value of 50%. However, the auto scaling does not seem to be adding tasks. The engineer checks the ECS service events and finds no scaling activity. What is the MOST likely reason the auto scaling is not working, and what action should be taken to resolve the issue?

Accepted Answer

The service has reached the maximum number of tasks defined in the auto scaling configuration; increase the maximum tasks.. The auto scaling is not adding tasks because the ECS service has already reached the maximum number of tasks defined in the auto scaling configuration (10). With CPU utilization at 70% and the target tracking policy set to 50%, the policy would normally trigger scale-out actions, but since the maximum task count is already hit, no scaling activity occurs. The engineer must increase the maximum tasks in the auto scaling configuration to allow further scale-out.

Answer

The scaling policy is not properly configured; recreate it with a lower target value.

Answer

The CloudWatch metric is not being emitted correctly; check the metric namespace.

Answer

The ECS service is using Fargate, which does not support target tracking scaling policies.

Question 7

A company is using AWS CloudFormation to deploy infrastructure. An engineer needs to ensure that any changes to the production stack are reviewed and approved before they are applied. The engineer also wants to prevent unauthorized changes. Which solution should the engineer implement?

Accepted Answer

Use CloudFormation Change Sets and require manual approval to execute the change set.. CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact running resources before you apply them. By requiring manual approval to execute the change set, the engineer ensures that all modifications are reviewed and approved, preventing unauthorized changes. This directly meets the requirement for a review-and-approval workflow without introducing unnecessary complexity.

Answer

Use CloudFormation StackSets to manage the production stack across multiple accounts.

Answer

Use AWS Service Catalog to create a product for the stack and require approval for any portfolio changes.

Answer

Use AWS CodePipeline to deploy the stack and require manual approval at the deploy stage.

Question 8

A company has a legacy application running on an EC2 instance that is not part of an Auto Scaling group. The instance is experiencing a memory leak. The DevOps engineer needs to collect memory metrics to analyze the issue without modifying the application. What should the engineer do?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. The CloudWatch agent is required to collect custom metrics like memory utilization from an EC2 instance because the standard EC2 monitoring only captures hypervisor-level metrics (CPU, network, disk I/O). By installing and configuring the CloudWatch agent, the engineer can collect memory metrics without modifying the application code, directly addressing the memory leak analysis requirement.

Answer

Use the AWS Management Console to view memory metrics from the EC2 monitoring tab.

Answer

Use EC2Rescue to generate a memory dump and analyze it.

Answer

Enable CloudWatch detailed monitoring on the instance.

Question 9

A company uses AWS Lambda functions to process incoming events from Amazon S3. The operations team notices that some events are not being processed, and there is no error in the Lambda function logs. What is the most likely cause?

Accepted Answer

The Lambda function has reserved concurrency set to a low value, causing throttling.. When a Lambda function has reserved concurrency set to a low value, it limits the number of concurrent executions allowed for that function. If incoming S3 events exceed this limit, the Lambda service throttles the invocations, causing some events to be silently dropped without generating errors in the function logs because the function never actually runs. This matches the symptom of missing events with no error logs.

Answer

The S3 event notification is configured to send to an SNS topic that is not subscribed to the Lambda function.

Answer

The S3 bucket policy does not allow the Lambda function to be invoked.

Answer

The Lambda function has a timeout that is too short.

Question 10

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover due to an availability zone outage. After the failover, the application team reports that the database endpoint is not resolving to the new primary. What is the most likely reason?

Accepted Answer

The application is using a cached DNS resolution that points to the old primary.. After an RDS Multi-AZ failover, the DNS CNAME record for the DB instance is updated to point to the new primary in the standby AZ. However, if the application or its DNS resolver has cached the previous DNS resolution, it will continue to use the old IP address, which is no longer reachable. This is a common issue that can be resolved by reducing the TTL on the DNS record or implementing retry logic with DNS re-resolution in the application.

Answer

The RDS CNAME record was not updated by AWS after the failover.

Answer

The application is using the read replica endpoint instead of the primary endpoint.

Answer

The application is using a Route 53 health check that failed and redirected traffic away from the endpoint.

Question 11

A DevOps engineer is investigating why an Amazon ECS service is not scaling out as expected. The service has a target tracking scaling policy based on average CPU utilization. The CloudWatch alarm shows that CPU utilization has exceeded the target for several minutes, but no scaling activity has occurred. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is still in effect from a previous scaling activity.. Target tracking scaling policies in Amazon ECS have a cooldown period (default 300 seconds) that prevents the policy from initiating additional scaling activities immediately after a previous scaling action. If a recent scaling activity occurred, the cooldown period would still be in effect, causing the policy to ignore the alarm even though CPU utilization has exceeded the target. This is the most likely reason no scaling activity is observed despite the alarm being triggered.

Answer

The ECS service is configured with a minimum healthy percent that prevents scaling out.

Answer

The ECS service does not have an IAM role that allows it to call CloudWatch.

Answer

The CloudWatch alarm is configured with a period that is too long.

Question 12

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which TWO steps should be taken to accomplish this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send a notification to an Amazon SNS topic.. Amazon CloudWatch Events (now Events) can be configured to match specific API calls logged by CloudTrail, such as CreateAccessKey. When the rule triggers, it can invoke an SNS topic to send an alert, enabling real-time notification. This approach directly monitors the API activity without additional overhead.

Answer

Enable CloudTrail Insights to detect unusual activity in the account.

Answer

Create an AWS Config rule that checks for access key creation and sends an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query on the CloudTrail logs and set an alarm.

Question 13

A company is experiencing a DDoS attack on its application hosted on AWS. The application uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The security team needs to mitigate the attack with minimal latency impact on legitimate users. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Enable AWS Shield Advanced on the ALB.. AWS Shield Advanced provides enhanced DDoS mitigation for ALBs, including access to the DDoS Response Team (DRT) and financial protection against scaling costs. It operates at the network and transport layers with minimal latency, as it inspects traffic inline without introducing significant processing delay. This makes it a critical first line of defense for high-availability applications under attack.

Answer

Disable cross-zone load balancing on the ALB to limit the number of instances receiving traffic.

Answer

Configure the Auto Scaling group to scale based on the NetworkIn metric to handle the increased traffic.

Question 14

A security engineer reviews the CloudTrail log entry above and notices that a security group was modified to allow SSH access from anywhere. The engineer wants to ensure that such changes are automatically detected and remediated in the future. What should the engineer do?

Accepted Answer

Create an AWS Config rule that checks security group rules and triggers an AWS Systems Manager Automation document to revoke the ingress rule.. AWS Config can continuously evaluate security group rules against a custom or managed rule (e.g., restricted-ssh) and, upon detecting a noncompliant rule allowing 0.0.0.0/0 on port 22, trigger an AWS Systems Manager Automation document that automatically revokes the offending ingress rule. This provides both detection and remediation without manual intervention, meeting the requirement for automated detection and remediation.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter that alerts on AuthorizeSecurityGroupIngress events with 0.0.0.0/0.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the source IP is 0.0.0.0/0.

Answer

Enable Amazon GuardDuty to detect and block such changes in real time.

Question 15

A DevOps engineer updates an ECS service via CloudFormation. The stack update fails with the message 'Resource update cancelled'. The engineer notices that the ECS service's desired count was temporarily reduced during the update. What is the most likely cause of the failure?

Accepted Answer

The ECS service's minimum healthy percent was set to 100, causing the desired count reduction to zero to be rejected.. The error 'Resource update cancelled' occurs because CloudFormation detected that the ECS service update was not progressing as expected. When the minimum healthy percent is set to 100, the deployment process cannot reduce the desired count to zero (or below the current running count) without violating the requirement that 100% of the tasks remain healthy. This causes the update to be cancelled as CloudFormation waits indefinitely for the deployment to complete, eventually timing out and rolling back.

Answer

The ECS service's target group had an unhealthy instance that prevented the deregistration.

Answer

The ECS service deployment circuit breaker was triggered due to a timeout.

Answer

The ECS service did not have the required IAM role to call ecs:UpdateService.