DOP-C02 Incident and Event Response Practice Test 9 — 15 Questions

Question 1

A company is designing an incident response strategy for its Amazon EKS cluster. Which THREE steps should be taken to ensure rapid response to a compromised pod?

Accepted Answer

Delete the pod using kubectl delete pod.. Deleting the pod with `kubectl delete pod` immediately terminates the compromised container, stopping any malicious activity. This is a rapid containment step that removes the pod from the cluster without affecting the broader deployment or namespace, allowing the incident response team to investigate and remediate without unnecessary disruption.

Answer

Delete the entire namespace to ensure all resources are removed.

Answer

Scale down the deployment to 0 replicas.

Question 2

During an incident, a DevOps engineer needs to block traffic from a specific IP address that is attacking an Application Load Balancer. Which TWO actions can the engineer take to mitigate this?

Accepted Answer

Use AWS WAF to create an IP set rule that blocks the IP address.. AWS WAF (option C) can be integrated with an Application Load Balancer to create a web access control list (web ACL) that includes an IP set rule. This rule can explicitly block traffic from a specific source IP address at the application layer (Layer 7), which is the appropriate layer for an ALB. This allows the engineer to mitigate the attack without modifying network-level components.

Answer

Configure Amazon CloudFront to block the IP address.

Answer

Modify the network ACL for the ALB's subnet to deny the IP address.

Answer

Enable VPC Flow Logs to capture traffic from the IP address.

Question 3

A DevOps engineer is troubleshooting an issue where an EC2 instance running a web application becomes unresponsive every few hours. CloudWatch logs show no application errors, but the instance's status checks are passing. The engineer suspects a memory leak. Which AWS service can be used to capture memory utilization metrics at a granular level to confirm the leak?

Accepted Answer

CloudWatch Agent. The CloudWatch Agent can be installed on EC2 instances to collect custom metrics such as memory usage and send them to CloudWatch, allowing granular monitoring. Option A is incorrect because EC2 Status Checks only verify system status (e.g., network reachability). Option B is incorrect because AWS Config tracks configuration changes, not performance metrics. Option C is incorrect because CloudTrail records API activity, not system metrics.

Answer

EC2 Status Checks

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance fails, and automatic failover does not occur within the expected 1-2 minutes. The DevOps team needs to quickly restore database availability. What should the team do first?

Accepted Answer

Reboot the DB instance with failover selected.. When automatic failover does not occur within the expected 1-2 minutes, the fastest way to manually trigger a failover is to reboot the DB instance with the 'Reboot with Failover' option selected. This forces the RDS service to promote the standby replica to the new primary, restoring database availability without waiting for the automated health check to complete. Option D is correct because it directly initiates the failover process, leveraging the existing Multi-AZ setup.

Answer

Restore the latest automated snapshot to a new DB instance.

Answer

Modify the DB instance to change the Multi-AZ setting to enable automatic failover.

Answer

Connect to the standby instance directly and promote it to primary.

Question 5

A DevOps engineer receives an alert that an EC2 instance's CPU utilization has been above 90% for the last 30 minutes. The engineer needs to investigate the root cause. Which AWS service should the engineer use to get OS-level process details and identify which process is consuming the CPU?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run commands (e.g., 'top', 'ps') remotely on EC2 instances to obtain OS-level process details and identify which process is consuming CPU. Option A is wrong because AWS Config records configuration changes, not OS-level processes. Option B is wrong because AWS CloudTrail logs API calls, not system-level metrics. Option D is wrong because Amazon CloudWatch provides aggregated CPU utilization metrics but cannot provide process-level details.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 6

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The DevOps team needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which combination of services should be used?

Accepted Answer

CloudWatch Logs Insights and CloudWatch Dashboards. CloudWatch Logs Insights allows real-time querying of CloudWatch Logs, and CloudWatch Dashboards can display the results as a real-time dashboard showing the count of ERROR-level log entries across all instances. Option A is incorrect because Amazon Athena is designed for querying data stored in S3, not real-time log streams. Option B is incorrect because while Kinesis Data Analytics and Elasticsearch Service could be used, they add unnecessary complexity and cost compared to the native CloudWatch integration. Option C is incorrect because Amazon S3 and QuickSight are not suitable for real-time monitoring; QuickSight is for business intelligence and batch analytics.

Answer

Amazon Athena and Amazon QuickSight

Answer

Amazon Kinesis Data Analytics and Amazon Elasticsearch Service

Answer

Amazon S3 and Amazon QuickSight

Question 7

A DevOps team is configuring an Auto Scaling group for a web application behind an Application Load Balancer. The team wants to automatically replace instances that fail the health check. Which scaling policy should be used?

Accepted Answer

Default health check replacement. The Auto Scaling group's default health check replacement behavior automatically terminates and replaces any instance that fails the configured health check (either EC2 status checks or ELB health checks). When an Application Load Balancer marks an instance as unhealthy, the Auto Scaling group detects this via the ELB health check integration and launches a new instance to maintain the desired capacity. This is the simplest and most direct mechanism for replacing failed instances without additional scaling policies.

Answer

Target tracking scaling policy

Answer

Step scaling policy

Answer

Manual scaling

Question 8

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

Accepted Answer

Use the awslogs log driver in the task definition.. The awslogs log driver is the simplest native integration between Amazon ECS and CloudWatch Logs. By specifying the log driver in the task definition, the ECS container agent automatically captures stdout and stderr from the container and streams them to CloudWatch Logs without any additional agents or custom code.

Answer

Install the CloudWatch Agent in each container.

Answer

Configure AWS CloudTrail to capture logs.

Answer

Write logs to a file and use an S3 bucket with event notifications.

Question 9

A DevOps engineer is troubleshooting an issue where an Amazon RDS instance's CPU utilization is consistently high. The engineer has enabled Performance Insights and sees that the top SQL query is a SELECT statement that scans many rows. What is the best course of action to reduce CPU utilization?

Accepted Answer

Add appropriate indexes to optimize the query.. Adding appropriate indexes can reduce the number of rows scanned by the SELECT query, directly reducing CPU utilization. Option A is incorrect: creating a read replica offloads read traffic from the primary instance, but the problematic query would still run on whichever instance it is executed. If the query is still executed on the primary, the CPU remains high. Additionally, the issue is a specific query scanning many rows, not general read load. Option B is incorrect: increasing allocated storage improves I/O performance but does not reduce CPU usage caused by scanning many rows. Option C is incorrect: increasing the DB instance size provides more CPU capacity, but it does not address the root cause of inefficient querying; optimizing the query is a more cost-effective and sustainable solution.

Answer

Create a read replica to offload read traffic.

Answer

Increase the allocated storage to improve I/O.

Answer

Increase the DB instance size to handle the load.

Question 10

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer has updated the files in the S3 bucket. What should the engineer do to ensure users see the latest content?

Accepted Answer

Create an invalidation for the updated file paths.. Creating a CloudFront invalidation for the specific file paths forces the edge locations to fetch the updated content from the S3 origin immediately, ensuring users see the latest files. Option B is incorrect because changing the bucket policy to allow public access does not affect CloudFront's cache; it only controls direct access to the bucket. Option C is incorrect because reducing the TTL affects how long new content is cached but does not clear already-cached outdated content. Option D is incorrect because deleting and recreating the distribution is an overly disruptive solution; a simple invalidation suffices.

Answer

Change the S3 bucket policy to allow public access.

Answer

Reduce the TTL for the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 11

A DevOps team is investigating a security incident where an unauthorized user accessed an S3 bucket. The team needs to determine what actions were taken by the user. Which TWO AWS services should be used together to investigate? (Choose TWO.)

Accepted Answer

S3 server access logs. (S3 server access logs) and Option D (AWS CloudTrail) are correct. S3 server access logs provide detailed records of requests made to the bucket, including object-level operations. AWS CloudTrail logs all API calls to S3, including who made the call, from where, and what action was taken. Option B (Amazon CloudWatch metrics) is incorrect because CloudWatch metrics provide performance and monitoring data, not detailed access logs. Option C (AWS Config) is incorrect because Config records configuration changes and compliance, not access history. Option E (Amazon GuardDuty) is incorrect because GuardDuty is a threat detection service that identifies suspicious activity but does not provide detailed logs of past actions.

Answer

Amazon CloudWatch metrics

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A DevOps engineer needs to receive notifications when an EC2 instance's status check fails. Which TWO services should the engineer use? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Alarms (Option E) can monitor EC2 instance status checks (both system and instance checks) and trigger an action when the alarm state changes to ALARM. Amazon SNS (Option B) is the service that delivers the notification by publishing messages to subscribers (e.g., email, SMS, HTTP endpoints) when the CloudWatch alarm triggers. Together, they provide a complete monitoring and notification pipeline for status check failures.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

An EC2 instance shows as 'running' in the AWS console, but the system status check is 'impaired'. What is the most likely cause?

Accepted Answer

The underlying physical host has experienced a failure.. System status checks indicate problems with the underlying physical host, such as loss of network connectivity, power loss, or hardware failure. Option A is incorrect because security group rules affect network traffic but do not impact system status checks. Option B is incorrect because a corrupted EBS root volume would be detected by instance status checks, not system status checks. Option C is incorrect because the operating system not responding would be reflected in instance status checks, which monitor OS-level issues.

Answer

The instance's security group rules are blocking traffic.

Answer

The EBS root volume is corrupted.

Answer

The instance's operating system is not responding.

Question 14

A Lambda function has the above IAM policy attached. The function is failing to write logs to CloudWatch Logs. What is the most likely reason?

Accepted Answer

The log group ARN in the resource does not match the Lambda function's log group.. The IAM policy specifies a Resource ARN that includes a specific log group pattern (e.g., arn:aws:logs:region:account-id:log-group:/aws/lambda/function-name:*). If the Lambda function is configured to write to a different log group (for example, if the function name differs from the one in the ARN), the logs:PutLogEvents action will be denied because the resource ARN does not match. Option A is incorrect because the policy does include the necessary logs:PutLogEvents action (assuming it's listed). Option B is incorrect because ec2:DescribeInstances is unrelated to writing logs to CloudWatch Logs. Option D is incorrect because there is no KMS key specified in the policy, so no KMS permission is needed.

Answer

The policy does not include the 'logs:PutLogEvents' action.

Answer

The policy does not allow 'ec2:DescribeInstances' on a specific resource.

Answer

The Lambda function does not have permission to use the KMS key for log encryption.

Question 15

The CloudWatch alarm 'HighCPU' has transitioned to ALARM state. What does the alarm history indicate about the metric that triggered it?

Accepted Answer

The metric value of 90.0 exceeded the threshold of 80.0.. The alarm history shows that a single datapoint with a value of 90.0 exceeded the threshold of 80.0, causing the alarm to transition to ALARM state. Option A is incorrect because the metric value (90.0) did not remain below the threshold. Option B is incorrect because the value was 90.0, not exactly 80.0. Option D is incorrect because the alarm history indicates that only one datapoint breached the threshold, not three consecutive datapoints.

Answer

The metric value remained below the threshold.

Answer

The metric value was exactly 80.0 at the time of the alarm.

Answer

The alarm was triggered after 3 consecutive datapoints breached the threshold.