DOP-C02 Incident and Event Response Practice Test 8 — 15 Questions

Question 1

A company uses AWS CloudTrail to monitor API activity. The security team notices that an IAM user 'dev-user' deleted an S3 bucket. They need to quickly identify the source IP address of the delete request. Which CloudTrail feature should they use to find this information?

Accepted Answer

Search the CloudTrail event history for the delete event and review the sourceIPAddress field.. Option B is correct because CloudTrail event history includes the sourceIPAddress field in the event record, which directly provides the IP address from which the API call was made. Option A is wrong because CloudTrail Insights detects unusual activity but does not provide the IP address for individual events. Option C is wrong because CloudTrail Lake is used for aggregating and querying trails but the source IP is still found in the event record. Option D is wrong because S3 server access logs are separate from CloudTrail and do not capture IAM user activity.

Answer

Use CloudTrail Lake to query the event and extract the IP address from the userIdentity field.

Answer

Check S3 server access logs for the bucket deletion event.

Answer

Enable CloudTrail Insights to analyze unusual activity.

Question 2

A DevOps engineer receives a CloudWatch alarm that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance hosts a critical web application. What is the MOST appropriate immediate response to mitigate performance impact?

Accepted Answer

Place the instance into an Auto Scaling group with a scale-out policy based on CPU utilization.. Option A is correct because adding the instance to an Auto Scaling group with a scaling policy to launch additional instances can handle increased load. Option B is wrong because rebooting causes downtime and does not address the root cause of high CPU. Option C is wrong because increasing the instance size manually requires a stop and start, causing downtime. Option D is wrong because creating a new AMI and launching a new instance is time-consuming and not immediate.

Answer

Reboot the EC2 instance to clear any temporary processes.

Answer

Create a new AMI from the instance and launch a new larger instance.

Answer

Stop the instance and change its type to a larger instance size.

Question 3

A company uses an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security team reports that a specific client IP address is sending malicious requests and must be blocked immediately. The ALB's security group only allows HTTP/HTTPS from 0.0.0.0/0. What is the FASTEST way to block traffic from this IP address without affecting other traffic?

Accepted Answer

Create an AWS WAF web ACL with an IP set deny rule and associate it with the ALB.. Option C is correct because updating the ALB's security group to deny the specific IP address would block all traffic from that IP inbound to the ALB, but the current security group allows all traffic, so you would need to modify it to deny that IP. However, security groups are stateful and cannot deny rules; they only allow. The correct approach is to use a network ACL on the ALB's subnets, which is not listed. Among the options, Option C (creating a WAF web ACL and associating it with the ALB) is the fastest and most appropriate because AWS WAF can block requests based on IP addresses immediately without changing network infrastructure. Option A is wrong because updating the security group to deny is not possible; security groups only support allow rules. Option B is wrong because modifying the ALB's listener rules does not block traffic; it only affects routing. Option D is wrong because updating route tables would affect all traffic to the ALB, not just that IP.

Answer

Modify the ALB listener rules to drop requests from the client IP.

Answer

Update the ALB security group to add a deny rule for the client IP address.

Answer

Update the VPC route table to drop packets from the client IP.

Question 4

A company uses AWS CloudFormation to manage infrastructure. During a deployment, a stack update fails and the stack is in ROLLBACK_IN_PROGRESS state. The DevOps engineer needs to investigate the failure while preserving the resources that were created before the failure. What should the engineer do?

Accepted Answer

Use the 'continue-update-rollback' API with the 'resources-to-skip' parameter to skip the failing resource.. Option D is correct because using 'continue update rollback' with the 'resources to skip' parameter allows the engineer to skip specific resources and preserve them while continuing the rollback for others. Option A is wrong because deleting the stack removes all resources. Option B is wrong because 'describe stack events' provides information but does not prevent the rollback from continuing. Option C is wrong because 'cancel update' is not a valid operation; CloudFormation does not support canceling a rollback.

Answer

Delete the stack to start fresh.

Answer

Use the 'describe-stack-events' API to view the error and then manually fix the issue.

Answer

Call the 'cancel-update' API to stop the rollback and keep the current state.

Question 5

A company runs a critical Amazon RDS for PostgreSQL database. The database suddenly becomes unresponsive. The DevOps team checks CloudWatch metrics and notices that the 'DatabaseConnections' metric spiked to the maximum limit. What is the MOST likely cause and immediate action?

Accepted Answer

The application has a connection leak; restart the database to clear connections.. Option A is correct because a sudden spike to max connections indicates that the application might have a connection leak, causing connections to accumulate. The immediate action is to restart the database to clear all connections and then investigate the application. Option B is wrong because storage full would cause 'FreeStorageSpace' to be low, not necessarily max connections. Option C is wrong because CPU high would be shown by 'CPUUtilization' metric, not directly connections. Option D is wrong because a network issue would affect connectivity, not cause max connections.

Answer

There is a network connectivity issue; check the VPC settings.

Answer

The database storage is full; increase the allocated storage.

Answer

The database CPU is at 100%; scale up the instance class.

Question 6

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function sometimes fails due to a transient error in a downstream API. The DevOps engineer wants to ensure that failed messages are retried automatically and eventually sent to a dead-letter queue after 3 failed attempts. The SQS queue is configured with a redrive policy that moves messages to a DLQ after 3 receive attempts. However, Lambda functions that fail are not being retried. What is the MOST likely reason?

Accepted Answer

The event source mapping has 'MaximumRetryAttempts' set to 0.. Option D is correct because by default, if a Lambda function fails, the SQS queue treats the message as received and increments the receive count. If the function does not delete the message and returns an error, the message becomes visible again after the visibility timeout. However, if the function returns an error, Lambda will automatically retry the invocation up to 2 times (for a total of 3 attempts) based on the function's retry policy. But if the function is configured with 'MaximumRetryAttempts' set to 0 in its event source mapping, then no retries will occur. The question states that the SQS redrive policy should handle retries after 3 receive attempts, but if the Lambda function is not retrying, it's likely because the event source mapping's 'MaximumRetryAttempts' is set to 0. Option A is wrong because DLQ is configured on the SQS queue, not Lambda. Option B is wrong because the visibility timeout affects when the message becomes visible again, but if the function fails, the message will be retried based on the event source mapping settings. Option C is wrong because the batch size does not affect retries.

Answer

The batch size is set to 1, preventing retries.

Answer

The visibility timeout is set too low, causing messages to be retried immediately.

Answer

The dead-letter queue is not configured on the Lambda function.

Question 7

A company's production environment uses an Amazon ElastiCache Redis cluster for session caching. The operations team reports that the cache hit ratio has dropped significantly, causing increased load on the backend database. What is the MOST likely cause?

Accepted Answer

The cache is under memory pressure and evicting keys to make room.. Option B is correct because a dropped cache hit ratio often indicates that cached keys are being evicted due to memory pressure, especially if the eviction policy is set to 'allkeys-lru' or similar. Option A is wrong because a cluster mode change would cause a temporary disruption but not necessarily a sustained drop in hit ratio. Option C is wrong because a network partition would cause complete cache unavailability, not just a drop in hit ratio. Option D is wrong because encryption in transit does not affect cache performance.

Answer

The cluster was resized from a single node to a cluster mode.

Answer

The encryption in transit was enabled, adding latency.

Answer

There is a network partition between the application and the cache.

Question 8

A company uses AWS CodePipeline for CI/CD. A recent deployment to an Amazon ECS service failed because the new task definition referenced an ECR image that does not exist. The pipeline uses a source stage (CodeCommit), build stage (CodeBuild), and deploy stage (ECS). The engineer wants to catch such errors earlier. What should the engineer add to the pipeline?

Accepted Answer

Add a test stage that runs a script to verify the image exists in ECR.. Option C is correct because adding a test stage after the build stage to validate the image existence in ECR would catch the error before deployment. Option A is wrong because adding a manual approval does not automatically catch the error. Option B is wrong because adding a second build stage does not validate the image. Option D is wrong because adding an invoke action to run a Lambda function would require custom code and is possible but not a built-in validation; however, Option C is more straightforward.

Answer

Add an invoke action that calls a Lambda function to check the image.

Answer

Add a manual approval step before the deploy stage.

Answer

Add a second build stage that re-builds the image.

Question 9

A company runs a web application on EC2 instances behind an ALB. The security team notices that the ALB is receiving a large number of requests from a single IP address, causing high CPU on the instances. They want to block this IP at the load balancer level without affecting other traffic. The ALB currently has a default action of forwarding to the target group. What is the MOST effective way to block this IP?

Accepted Answer

Create an AWS WAF web ACL with an IP match condition and associate it with the ALB.. Option B is correct because AWS WAF can be integrated with ALB to create a rule that blocks requests from a specific IP address. Option A is wrong because security groups cannot deny traffic; they only allow. Option C is wrong because modifying the listener rule's target group would not block the IP; it would just route elsewhere. Option D is wrong because the network ACL is for subnets, not for the ALB directly, and would affect all traffic to the subnets.

Answer

Update the network ACL for the VPC subnets to deny inbound traffic from that IP.

Answer

Add a deny rule in the ALB's security group for the source IP.

Answer

Change the listener rule to forward requests from that IP to a different target group with no instances.

Question 10

A DevOps engineer is investigating a security incident where an EC2 instance was compromised. The engineer needs to collect forensic data without losing volatile information. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Create a snapshot of the attached EBS volumes.. Option B is correct because taking a snapshot of the EBS volume preserves the disk state for analysis. Option C is correct because collecting memory dump captures volatile data like running processes and network connections. Option A is wrong because terminating the instance destroys evidence. Option D is wrong because detaching the volume stops the instance, but if the instance is stopped, memory is lost; better to snapshot while running. Option E is wrong because the instance metadata is not volatile and can be retrieved later.

Answer

Detach the EBS volumes and attach them to a forensic instance.

Answer

Retrieve the instance metadata from the console.

Answer

Terminate the instance immediately to prevent further access.

Question 11

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all CloudTrail trails across the organization are delivering events to a centralized S3 bucket in the management account. Currently, some member accounts have their own trails. Which THREE steps should the security team take to enforce this? (Choose three.)

Accepted Answer

Create an organization trail in the management account that applies to all accounts.. Option A is correct because creating an organization trail in the management account will automatically apply to all accounts. Option B is correct because enabling CloudTrail on the S3 bucket ensures logs are delivered. Option D is correct because SCP can deny the ability to create or modify trails, preventing member accounts from creating separate trails. Option C is wrong because disabling CloudTrail in member accounts is manual and not scalable. Option E is wrong because Config rules can detect but not prevent.

Answer

Manually disable CloudTrail in each member account.

Answer

Use AWS Config rules to detect non-compliant trails and trigger automatic remediation.

Question 12

A company uses Amazon CloudWatch for monitoring. The operations team wants to receive an alert when an EC2 instance's status check fails for 2 consecutive minutes. Which THREE resources should the team configure? (Choose three.)

Accepted Answer

CloudWatch alarm. Option A is correct because a CloudWatch alarm triggers based on a metric. Option C is correct because the 'StatusCheckFailed' metric is the correct metric to monitor instance health. Option D is correct because an SNS topic is needed to send notifications. Option B is wrong because CloudWatch Logs is for log data, not metrics. Option E is wrong because CloudWatch Events is for scheduling or event patterns, but not for metric alarms.

Answer

CloudWatch Events rule

Answer

CloudWatch Logs

Question 13

A DevOps engineer is troubleshooting a failed deployment. The engineer needs to identify the root cause. Which TWO AWS services can provide information about the deployment events and errors? (Choose two.)

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls for deployments. Option C is correct because AWS Config provides a history of configuration changes. Option A is wrong because Amazon Inspector is for vulnerability assessment. Option D is wrong because AWS Trusted Advisor is for cost optimization and best practices. Option E is wrong because AWS Service Catalog is for managing IT service catalogs.

Answer

AWS Trusted Advisor

Answer

AWS Service Catalog

Answer

Amazon Inspector

Question 14

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. CloudWatch alarms for CPU utilization and memory usage did not trigger. The engineer checks the system logs and finds an 'Out of memory: Kill process' error. What is the MOST likely cause of the missed alarms?

Accepted Answer

The CloudWatch agent is not installed or configured to collect memory metrics.. Option D is correct because the CloudWatch agent must be configured to collect memory metrics; CPU metrics are collected by default. Option A is wrong because instance store volumes would not affect CloudWatch metrics. Option B is wrong because CloudWatch metrics are stored for 15 months. Option C is wrong because the root volume size does not prevent metric collection.

Answer

The instance is using instance store volumes instead of EBS, which prevents metric collection.

Answer

The CloudWatch metrics retention period is set to 1 day, so old alarms were deleted.

Answer

The EC2 instance's root EBS volume is encrypted, blocking CloudWatch agent logs.

Question 15

A DevOps team applies the above IAM policy to a group. A developer in this group tries to upload an object to the S3 bucket using the AWS CLI without specifying any encryption. The upload fails with an AccessDenied error. Why does the upload fail?

Accepted Answer

The Deny statement explicitly denies PutObject when encryption is not AES256, overriding the Allow.. Option A is correct because the Deny statement explicitly denies PutObject if encryption is not AES256. The Allow statement only allows if AES256 is specified. Since no encryption is specified, the condition in the Deny statement (StringNotEquals AES256) is true, causing a deny. Option B is wrong because the Allow statement's condition is not met, so it does not grant permission. Option C is wrong because the Deny statement explicitly matches the condition. Option D is wrong because explicit Deny overrides Allow.

Answer

The Allow statement's condition is satisfied, but the Deny statement is evaluated first and denies the request.

Answer

The Allow statement requires encryption to be AES256, but the CLI defaults to SSE-S3, which is not AES256.

Answer

The Deny statement's condition is not met because the request does not include encryption headers.