DOP-C02 Incident and Event Response Practice Test 9 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a multi-tier web application. During an incident, the stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The operations team needs to investigate the root cause quickly without losing the stack's current state. What is the MOST efficient approach?

Accepted Answer

Use the ContinueUpdateRollback API with the ResourcesToSkip parameter.. Option C is correct because using 'ContinueUpdateRollback' with the 'ResourcesToSkip' parameter allows skipping resources that caused the failure while preserving the stack. Option A is wrong because deleting the stack removes all resources. Option B is wrong because creating a new stack does not help investigate the current failure. Option D is wrong because manually fixing resources and retrying the update without rollback is risky; the stack is already in rollback.

Answer

Create a change set and execute it to see the changes.

Answer

Delete the stack and recreate it using the same template.

Answer

Manually fix the resources and then retry the stack update.

Question 2

A company runs a production database on Amazon RDS for MySQL. The database experiences a sudden spike in connections, causing the application to time out. The DevOps team needs to diagnose the issue quickly. Which combination of actions should be taken? (Choose two.)

Accepted Answer

Check CloudWatch metrics for DatabaseConnections and CPUUtilization.. Option A is correct because CloudWatch RDS metrics provide real-time connection count. Option D is correct because Performance Insights helps identify SQL queries causing the spike. Option B is wrong because increasing instance size is a mitigation, not diagnosis. Option C is wrong because the RDS console does not show individual connections. Option E is wrong because VPC Flow Logs show network traffic, not database connections.

Answer

Immediately scale up the RDS instance to handle the load.

Answer

Analyze VPC Flow Logs to identify the source IPs of connections.

Answer

Use the RDS console to view the number of active connections per user.

Question 3

A Lambda function 'my-function' is invoked multiple times, but no logs appear in CloudWatch. The DevOps engineer runs the above CLI command and sees that the log group exists but 'storedBytes' is 0. What is the MOST likely cause?

Accepted Answer

The Lambda execution role lacks permissions to create log streams and put log events.. Option D is correct because the Lambda function's execution role must have permissions to create log streams and put log events. Without these permissions, the function cannot write logs. Option A is wrong because log groups with 0 storedBytes indicate no logs were written, not that there are too many. Option B is wrong because the retention policy does not prevent log creation. Option C is wrong because Lambda automatically creates log groups when logging is configured properly.

Answer

The Lambda function is invoked too frequently, causing CloudWatch to throttle log ingestion.

Answer

The log group's retention policy of 7 days deletes logs immediately after creation.

Answer

The Lambda function does not have a log group; the one shown belongs to another resource.

Question 4

A company uses AWS Elastic Beanstalk for its web application. After a deployment, the environment health changes to 'Severe' and the application becomes unresponsive. The DevOps team needs to quickly revert to the previous working version. What is the FASTEST way to achieve this?

Accepted Answer

Use the Elastic Beanstalk console to deploy the previous application version.. Option A is correct because Elastic Beanstalk supports rolling back to a previous application version through the console or CLI. Option B is wrong because terminating and recreating takes longer and loses configuration. Option C is wrong because swapping URLs with a different environment requires that environment to exist. Option D is wrong because redeploying the same version may not fix the issue if the environment configuration has changed.

Answer

Swap environment URLs with a different environment that runs the previous version.

Answer

Terminate the environment and create a new one with the previous version.

Answer

Redeploy the same application version to the environment.

Question 5

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Option B is correct because Fargate tasks require a VPC and subnets with outbound internet access (NAT Gateway or Internet Gateway) to pull images from ECR or Docker Hub. Option A is wrong because CPU/memory limits would cause tasks to fail with resource errors, not prevent starting. Option C is wrong because the security group is already configured. Option D is wrong because the task definition is already defined.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 6

A company configures AWS CloudTrail to deliver logs to S3 bucket 'my-app-logs'. However, no log files appear. The DevOps engineer runs the above command and sees the bucket policy. What is the issue?

Accepted Answer

The service principal in the bucket policy is incorrect; it should be 'cloudtrail.amazonaws.com'.. Option D is correct because CloudTrail requires the S3 bucket policy to grant the service principal 'cloudtrail.amazonaws.com', not 'delivery.logs.amazonaws.com'. Option A is wrong because the policy allows PutObject. Option B is wrong because CloudTrail can deliver to buckets with ACL settings as long as the policy is correct. Option C is wrong because the bucket exists and the policy is present.

Answer

The bucket policy requires bucket-owner-full-control ACL, but CloudTrail does not support ACLs.

Answer

The bucket policy does not allow the s3:PutObject action.

Answer

The bucket does not exist; the policy retrieval failed silently.

Question 7

A DevOps team uses AWS CodePipeline to deploy a web application. The pipeline has a manual approval step. During an incident, the deployment is stuck at the approval step because the approver is on leave. The team needs to unblock the pipeline quickly. What is the BEST action to take?

Accepted Answer

Retry the action in the approval stage from the CodePipeline console.. Option C is correct because the pipeline can be manually retried from the approval step, which re-initiates the approval action. Option A is wrong because changing the pipeline definition requires a stack update. Option B is wrong because the console allows approving or rejecting directly. Option D is wrong because the manual approval is a step, not a stage.

Answer

Update the pipeline definition to remove the manual approval step temporarily.

Answer

Use the CodePipeline console to approve the action directly as a different user.

Answer

Disable the transition to the approval stage and manually run the remaining stages.

Question 8

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The target group health checks are failing. The DevOps engineer checks the instance logs and finds that the application is running but taking longer than 30 seconds to respond. What is the MOST likely cause?

Accepted Answer

The health check timeout is set too low, causing the ALB to mark instances unhealthy.. Option B is correct because ALB health checks have a configurable timeout; if the response takes longer than the timeout, the health check fails, causing 503 errors. Option A is wrong because security groups typically do not cause intermittent failures. Option C is wrong because the application is running, so it is not crashing. Option D is wrong because scaling policies do not directly cause 503 errors.

Answer

The Auto Scaling group's scaling policy is too aggressive, causing frequent instance replacements.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The EC2 instances are running out of memory and the application is crashing.

Question 9

An EC2 instance is in 'running' state according to the CLI output, but the application hosted on it is unreachable. The DevOps engineer checks the security group and finds it allows inbound HTTP traffic from 0.0.0.0/0. The instance has a public IP. What is the MOST likely issue?

Accepted Answer

The instance's OS firewall (e.g., iptables) is blocking the traffic.. Option D is correct because the instance's operating system may have a firewall (e.g., iptables) blocking inbound traffic. Option A is wrong because the instance has a public IP. Option B is wrong because security groups are stateful and allow return traffic. Option C is wrong because the security group allows all inbound HTTP.

Answer

The network ACL is blocking inbound HTTP traffic.

Answer

The instance does not have a public IP address assigned.

Answer

The security group is attached to the instance but does not allow inbound HTTP.

Question 10

A company uses AWS Systems Manager Patch Manager to patch its EC2 instances. After a patch window, some instances report a 'Failed' status. The DevOps engineer needs to investigate the cause. Which actions should be taken? (Choose three.)

Accepted Answer

Check the S3 bucket where Patch Manager logs are stored for detailed error messages.. Option A is correct because Patch Manager logs to S3; checking logs helps identify failures. Option B is correct because Systems Manager requires the SSM Agent to be running and updated. Option D is correct because each patch has a status in the compliance report. Option C is wrong because CloudTrail is for API activity, not patch details. Option E is wrong because AWS Config shows resource configurations, not patch failures.

Answer

Review CloudTrail logs for the RunCommand API calls.

Answer

Use AWS Config to check the configuration history of the instances.

Question 11

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. Option D is correct because AWS Config conformance packs can evaluate whether CloudTrail trails are enabled across accounts using managed rules. Option A is wrong because Trusted Advisor does not monitor CloudTrail configuration across all accounts. Option B is wrong because CloudTrail itself does not monitor trail configuration. Option C is wrong because CloudWatch Events can be used but require custom rules per account; Config is more efficient.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 12

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error 'The overall deployment failed because too many individual instances failed deployment'. The team checks the instance logs and finds that the 'BeforeInstall' lifecycle event script returned a non-zero exit code. What is the BEST approach to resolve this?

Accepted Answer

Fix the script error in the revision and redeploy.. Option B is correct because fixing the script and redeploying addresses the root cause. Option A is wrong because ignoring errors may cause application issues. Option C is wrong because using an in-place deployment does not fix the script. Option D is wrong because altering the script on running instances is not a permanent fix and the deployment will still fail.

Answer

Set the 'ignoreScriptFailure' option to true in the AppSpec file and redeploy.

Answer

Manually run the script on an instance and then resume the deployment.

Answer

Change the deployment configuration to 'AllAtOnce' to speed up deployment.

Question 13

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application generates logs that are sent to CloudWatch Logs using the CloudWatch agent. Recently, the operations team noticed that some instances are missing logs for certain periods. The CloudWatch agent is configured to batch log events and send them every 5 seconds. The instances have high CPU utilization (90%+) during the missing periods. The DevOps engineer suspects that the agent is being throttled or failing. Which of the following is the MOST likely cause and the BEST course of action?

Accepted Answer

The CloudWatch agent is being starved of CPU resources, causing it to drop logs. Increase the CPU credits or instance size.. Option A is correct because high CPU utilization can cause the CloudWatch agent to miss its scheduled batch upload, leading to log loss. Option B is wrong because disk space issues would cause different symptoms (disk full errors). Option C is wrong because the log group retention does not cause missing logs. Option D is wrong because network bandwidth, while possible, is less likely than CPU starvation given the high CPU utilization.

Answer

The network bandwidth is saturated, causing log delivery to fail. Increase instance network performance.

Answer

The CloudWatch Logs retention policy is set to 1 day, so older logs are deleted. Increase retention.

Answer

The instances are running out of disk space, preventing log buffering. Add more EBS volume space.

Question 14

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a large backlog of messages, and the Lambda function is processing them slowly. The DevOps team wants to increase throughput without making changes to the Lambda code. The team decides to increase the reserved concurrency to 10. However, after the change, the Lambda function starts to experience throttling errors (RateExceeded). The team also notices that other Lambda functions in the same account are also being throttled. What is the MOST likely cause?

Accepted Answer

The account's Lambda concurrency limit has been reached due to the increased reserved concurrency.. Option B is correct because the account-level Lambda concurrency limit may be reached. Increasing reserved concurrency for one function reduces the pool available for others. Option A is wrong because SQS batch size does not cause throttling. Option C is wrong because SQS polling interval is controlled by Lambda. Option D is wrong because IAM permissions would cause access denied errors, not throttling.

Answer

The SQS queue's polling interval is too high, causing Lambda to poll infrequently.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The SQS queue's visibility timeout is too short, causing messages to be processed multiple times.

Question 15

A company hosts a static website on Amazon S3 with CloudFront as the CDN. Users report that they see an old version of the website even after the DevOps team updated the S3 objects. The team verified that the new objects are in the S3 bucket and are publicly accessible. The CloudFront distribution has a default TTL of 24 hours. To immediately serve the new content to users, the team needs to invalidate the CloudFront cache. Which of the following is the CORRECT approach to achieve this with minimal impact?

Accepted Answer

Create a CloudFront invalidation request for the path '/*'.. Option D is correct because creating a CloudFront invalidation for the path '/*' will remove all cached objects and force CloudFront to fetch new content from S3. Option A is wrong because changing the origin path does not invalidate cache. Option B is wrong because updating TTL affects future caching, not existing cache. Option C is wrong because S3 does not control CloudFront cache.

Answer

Change the CloudFront origin path to point to a new S3 bucket.

Answer

Update the CloudFront distribution's default TTL to 0 and wait for the changes to propagate.

Answer

Delete the S3 objects and re-upload them with different names.