DOP-C02 Incident and Event Response Practice Test 8 — 15 Questions

Question 1

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 2

A company configures AWS CloudTrail to deliver logs to S3 bucket 'my-app-logs'. However, no log files appear. The DevOps engineer runs the above command and sees the bucket policy. What is the issue?

Accepted Answer

The service principal in the bucket policy is incorrect; it should be 'cloudtrail.amazonaws.com'.. CloudTrail requires the S3 bucket policy to grant the service principal 'cloudtrail.amazonaws.com' for delivering logs. The bucket policy shown likely contains 'delivery.logs.amazonaws.com' which is incorrect and prevents log delivery. Option A is wrong because the policy does allow s3:PutObject. Option B is wrong because CloudTrail can deliver to buckets with various ACL settings as long as the policy is correct. Option D is wrong because the bucket exists and the policy retrieval succeeded.

Answer

The bucket policy requires bucket-owner-full-control ACL, but CloudTrail does not support ACLs.

Answer

The bucket policy does not allow the s3:PutObject action.

Answer

The bucket does not exist; the policy retrieval failed silently.

Question 3

A DevOps team uses AWS CodePipeline to deploy a web application. The pipeline has a manual approval step. During an incident, the deployment is stuck at the approval step because the approver is on leave. The team needs to unblock the pipeline quickly. What is the BEST action to take?

Accepted Answer

Use the CodePipeline console to approve the action directly as a different user.. The CodePipeline console allows any authorized user (with appropriate IAM permissions) to manually approve a pending approval action. This directly unblocks the pipeline without modifying the pipeline definition or requiring the original approver. Option D is incorrect because retrying the action only re-sends the approval request to the same approver who is unavailable, so it does not unblock the pipeline. Options A and C are not best actions: A involves modifying the pipeline definition which is time-consuming and may violate compliance; C would stop the pipeline rather than unblock it.

Answer

Update the pipeline definition to remove the manual approval step temporarily.

Answer

Disable the transition to the approval stage and manually run the remaining stages.

Answer

Retry the action in the approval stage from the CodePipeline console.

Question 4

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The target group health checks are failing. The DevOps engineer checks the instance logs and finds that the application is running but taking longer than 30 seconds to respond. What is the MOST likely cause?

Accepted Answer

The health check timeout is set too low, causing the ALB to mark instances unhealthy.. The ALB health check timeout is configured to a value less than 30 seconds, causing the health check to fail before the application responds. This results in the target group marking instances as unhealthy and returning 503 errors. Option A is incorrect because aggressive scaling would cause instance replacements but not directly 503 errors. Option B is incorrect because security group rules affect connectivity, not health check timeouts. Option D is incorrect because the application is still running, albeit slowly, not crashing.

Answer

The Auto Scaling group's scaling policy is too aggressive, causing frequent instance replacements.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The EC2 instances are running out of memory and the application is crashing.

Question 5

An EC2 instance is in 'running' state according to the CLI output, but the application hosted on it is unreachable. The DevOps engineer checks the security group and finds it allows inbound HTTP traffic from 0.0.0.0/0. The instance has a public IP. What is the MOST likely issue?

Accepted Answer

The instance's OS firewall (e.g., iptables) is blocking the traffic.. The instance's operating system firewall (e.g., iptables) can block inbound HTTP traffic. Option A is wrong because while network ACLs can block traffic, there is no indication of an ACL misconfiguration, and the security group is already open, making an OS-level issue more likely. Option B is wrong because the question explicitly states the instance has a public IP. Option C is wrong because the security group is attached and allows inbound HTTP from 0.0.0.0/0.

Answer

The network ACL is blocking inbound HTTP traffic.

Answer

The instance does not have a public IP address assigned.

Answer

The security group is attached to the instance but does not allow inbound HTTP.

Question 6

A company uses AWS Systems Manager Patch Manager to patch its EC2 instances. After a patch window, some instances report a 'Failed' status. The DevOps engineer needs to investigate the cause. Which actions should be taken? (Choose three.)

Accepted Answer

Check the S3 bucket where Patch Manager logs are stored for detailed error messages.. Patch Manager logs detailed error messages to an S3 bucket, which can be reviewed to identify specific failure reasons. Option B is correct because the Patch Manager dashboard provides a compliance view showing the status of each patch on each instance, helping to identify which patches failed. Option D is correct because the SSM Agent must be running and up to date on each instance for Patch Manager to successfully apply patches; a non-functional agent can cause failures. Option C is wrong because CloudTrail logs API calls like RunCommand, but does not contain detailed patch-level error details. Option E is wrong because AWS Config tracks resource configuration history, not patch failure information.

Answer

Review CloudTrail logs for the RunCommand API calls.

Answer

Use AWS Config to check the configuration history of the instances.

Question 7

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 8

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error 'The overall deployment failed because too many individual instances failed deployment'. The team checks the instance logs and finds that the 'BeforeInstall' lifecycle event script returned a non-zero exit code. What is the BEST approach to resolve this?

Accepted Answer

Fix the script error in the revision and redeploy.. The deployment failed due to a script error in the BeforeInstall lifecycle event. The root cause is the script itself, so fixing the script error in the revision and redeploying addresses the issue permanently. Option A is wrong because setting 'ignoreScriptFailure' to true would mask the error and could lead to application issues. Option B is wrong because manually running the script on an instance does not fix the underlying issue in the revision, and the deployment will fail again. Option D is wrong because changing the deployment configuration to 'AllAtOnce' does not fix the script error and may cause more instances to fail simultaneously.

Answer

Set the 'ignoreScriptFailure' option to true in the AppSpec file and redeploy.

Answer

Manually run the script on an instance and then resume the deployment.

Answer

Change the deployment configuration to 'AllAtOnce' to speed up deployment.

Question 9

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application generates logs that are sent to CloudWatch Logs using the CloudWatch agent. Recently, the operations team noticed that some instances are missing logs for certain periods. The CloudWatch agent is configured to batch log events and send them every 5 seconds. The instances have high CPU utilization (90%+) during the missing periods. The DevOps engineer suspects that the agent is being throttled or failing. Which of the following is the MOST likely cause and the BEST course of action?

Accepted Answer

The CloudWatch agent is being starved of CPU resources, causing it to drop logs. Increase the CPU credits or instance size.. The most likely cause is CPU starvation of the CloudWatch agent. With CPU utilization above 90%, the agent may not get enough CPU cycles to process and send logs within the 5-second batch interval, causing logs to be dropped or delayed. The best course of action is to increase CPU resources, either by scaling up the instance type or by using a larger instance with more CPU credits (if using T-series). Option A is unlikely because high CPU utilization does not directly imply network saturation. Option B is incorrect because retention policy affects log availability over time, not real-time missing logs. Option D is incorrect because disk space issues would typically cause errors like 'disk full', but the problem states high CPU, not disk.

Answer

The network bandwidth is saturated, causing log delivery to fail. Increase instance network performance.

Answer

The CloudWatch Logs retention policy is set to 1 day, so older logs are deleted. Increase retention.

Answer

The instances are running out of disk space, preventing log buffering. Add more EBS volume space.

Question 10

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a large backlog of messages, and the Lambda function is processing them slowly. The DevOps team wants to increase throughput without making changes to the Lambda code. The team decides to increase the reserved concurrency to 10. However, after the change, the Lambda function starts to experience throttling errors (RateExceeded). The team also notices that other Lambda functions in the same account are also being throttled. What is the MOST likely cause?

Accepted Answer

The account's Lambda concurrency limit has been reached due to the increased reserved concurrency.. The account-level Lambda concurrency limit may be reached. Increasing reserved concurrency for one function reduces the pool available for others. Option A is wrong because the SQS queue's polling interval does not cause throttling. Option C is wrong because IAM permissions would cause access denied errors, not throttling. Option D is wrong because SQS visibility timeout issues would cause duplicate processing, not throttling.

Answer

The SQS queue's polling interval is too high, causing Lambda to poll infrequently.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The SQS queue's visibility timeout is too short, causing messages to be processed multiple times.

Question 11

A company hosts a static website on Amazon S3 with CloudFront as the CDN. Users report that they see an old version of the website even after the DevOps team updated the S3 objects. The team verified that the new objects are in the S3 bucket and are publicly accessible. The CloudFront distribution has a default TTL of 24 hours. To immediately serve the new content to users, the team needs to invalidate the CloudFront cache. Which of the following is the CORRECT approach to achieve this with minimal impact?

Accepted Answer

Create a CloudFront invalidation request for the path '/*'.. The correct approach is to create a CloudFront invalidation request for the path '/*'. This removes all cached objects from edge locations and forces CloudFront to fetch the latest content from the S3 origin. Changing the origin path does not invalidate cache; it only changes where new requests are sent. Setting TTL to 0 affects future caching but does not clear existing cached objects. Deleting and re-uploading with different names would change URLs, requiring users to update bookmarks, and is not minimal impact.

Answer

Change the CloudFront origin path to point to a new S3 bucket.

Answer

Update the CloudFront distribution's default TTL to 0 and wait for the changes to propagate.

Answer

Delete the S3 objects and re-upload them with different names.

Question 12

A DevOps engineer receives a CloudWatch alarm indicating that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance is part of an Auto Scaling group behind an Application Load Balancer. What is the MOST efficient initial step to troubleshoot the high CPU usage?

Accepted Answer

Review the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization.. Reviewing the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization is the most efficient initial step to diagnose high CPU usage. CPU credit balance is critical for burstable performance instances (e.g., T2/T3), as a depleted credit balance directly causes sustained high CPU utilization. Network utilization metrics can reveal if the high CPU is driven by excessive traffic or a DDoS-like pattern, allowing targeted remediation without unnecessary scaling or configuration changes.

Answer

Modify the Auto Scaling group to use a larger instance type.

Answer

Check the ALB's HTTP 5xx error rate metric for the target group.

Answer

Immediately increase the desired capacity of the Auto Scaling group.

Question 13

An organization uses AWS Systems Manager Incident Manager for incident response. They have created a response plan with an engagement plan that pages the on-call engineer via SMS. The engineer acknowledges the incident but then does not take any further action. What is the BEST way to automate escalation?

Accepted Answer

Configure an escalation plan in the response plan that pages a secondary contact after a specified timeout.. Systems Manager Incident Manager supports escalation plans with timeouts and multiple engagement levels. Option A is wrong because manual re-paging does not provide automated escalation and requires human intervention. Option B is wrong because CloudWatch Events can trigger actions but is not the built-in escalation mechanism within Incident Manager; that capability is provided by escalation plans. Option C is wrong because while a Lambda function could be used, it is not the best or simplest approach; Incident Manager natively supports escalation plans.

Answer

Manually re-page the on-call engineer with a higher urgency.

Answer

Use Amazon CloudWatch Events to trigger a second SMS if the incident is not resolved within a time frame.

Answer

Create an AWS Lambda function that checks the incident status and pages the next responder if no action is taken.

Question 14

A company's production environment consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances run a web application that stores session data in an ElastiCache Redis cluster. The company has enabled detailed CloudWatch metrics and set up a dashboard. The operations team notices that the average CPU utilization across the Auto Scaling group spikes to 95% every 15 minutes, coinciding with a high number of Redis connections. What is the MOST likely cause?

Accepted Answer

The ALB has session stickiness enabled, causing traffic to be routed to the same instances.. ALB session stickiness (sticky sessions) causes the load balancer to route requests from the same client to the same EC2 instance. When a large number of clients connect simultaneously (e.g., due to a periodic batch job), they may all be routed to the same few instances, causing CPU spikes on those instances. The high number of Redis connections corresponds to the sessions being stored in Redis. This explains the 15-minute periodic spikes. Option A is incorrect because Memcached is not used; the question states ElastiCache Redis. Option B is incorrect because the scaling policy is based on CPU utilization, not memory. Option D is incorrect because the cluster size doesn't cause periodic spikes; it would cause consistent high utilization.

Answer

The application is using Memcached instead of Redis, causing increased load.

Answer

The Auto Scaling group's scaling policy is based on memory utilization instead of CPU.

Answer

The ElastiCache cluster is not large enough to handle the number of requests.

Question 15

A DevOps engineer is setting up an incident response system for a critical application. The engineer needs to ensure that notifications are sent to the appropriate team when specific CloudWatch alarms trigger. Which TWO services can be used to trigger notifications based on CloudWatch alarms? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS can be directly subscribed to CloudWatch alarms to send notifications via email, SMS, etc. Option D is correct because AWS Chatbot integrates with SNS to deliver notifications to chat channels like Slack and Microsoft Teams. Option A is incorrect: AWS Systems Manager is a management and automation service, not a notification delivery service. Option C is incorrect: Amazon SQS is a message queue service, not designed for direct notification delivery from CloudWatch alarms. Option E is incorrect: AWS Lambda can be triggered by CloudWatch alarms but is not a notification service; it would need to invoke another service to send notifications.

Answer

AWS Systems Manager

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda