DOP-C02 Incident and Event Response — Timed 10 Questions

Question 1

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?

10 minute time limit — choose an answer to begin.

Accepted Answer

The application is using the database's DNS endpoint for the old primary, which is no longer the writer.. After an RDS Multi-AZ failover, the DNS endpoint for the DB instance remains the same but its underlying IP address changes to point to the new primary (formerly the standby). If the application caches the IP address of the old primary or uses a direct connection to the old writer endpoint, it will attempt to connect to a node that is no longer the writer. The correct practice is to always connect using the RDS instance endpoint (CNAME), which automatically resolves to the current writer, and to avoid caching the resolved IP address. Since the instance status is 'Available', the new primary is ready, so the issue is a stale connection target.

Answer

The security group for the RDS instance has changed during failover.

Answer

The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.

Answer

The database instance is still in the process of failover and is not yet accepting connections.

Question 2

An IAM policy is attached to a role used by an operations team. The team reports that they are unable to start or stop EC2 instances tagged with Environment=Production. Other instances can be described. What is the MOST likely reason for this failure?

Accepted Answer

The condition key ec2:ResourceTag/Environment is not valid for ec2:StartInstances and ec2:StopInstances.. The `ec2:ResourceTag` condition key is not supported for the `ec2:StartInstances` and `ec2:StopInstances` actions in IAM policy evaluation. AWS documentation explicitly states that these actions do not support resource-level permissions based on tags; they only support the `ec2:ResourceTag` condition key for certain read-only or tagging actions. Therefore, the condition in the policy cannot be evaluated, causing the operations team to fail when attempting to start or stop Production-tagged instances.

Answer

The role does not have permission to describe instances, so the condition cannot be evaluated.

Answer

The policy's Resource element is set to '*' and must be restricted to specific instance ARNs.

Answer

The policy does not include the ec2:RebootInstances action.

Question 3

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

Accepted Answer

Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.. AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Answer

Use Amazon GuardDuty to automatically modify the security group membership of the instance.

Answer

Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.

Answer

Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.

Question 4

A DevOps engineer notices that an EC2 instance in an Auto Scaling group is repeatedly failing health checks and being terminated. The engineer needs to capture the root cause by collecting memory dumps and system logs before termination. What should the engineer do?

Accepted Answer

Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.. EC2Rescue is specifically designed to collect memory dumps and system logs from EC2 instances, and by configuring it to run at startup and extending the Auto Scaling health check grace period, the engineer ensures diagnostics are captured before the instance is terminated for failing health checks. This approach directly addresses the need to gather root cause data from a failing instance that is about to be replaced.

Answer

Configure the CloudWatch Agent to collect memory and system logs and publish them to CloudWatch Logs.

Answer

Use AWS Systems Manager Run Command to execute a script on the instance that collects diagnostics before it is terminated.

Answer

Enable EC2 instance metadata service (IMDS) to capture diagnostic data that persists after termination.

Question 5

A company runs a critical web application on AWS. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The Auto Scaling group uses a launch template that specifies an Amazon Linux 2 AMI. The application stores session state in an ElastiCache Redis cluster. Recently, the operations team received alerts that the application is returning 503 errors intermittently. Investigation shows that the ALB target group health checks are failing for some instances, but those instances are still in service. The CloudWatch logs from the instances show that the application is running, but the health check endpoint is timing out after 5 seconds. The health check is configured with a 5-second timeout, 10-second interval, and 2 consecutive successes required to mark healthy. The DevOps engineer suspects that the issue is due to high CPU utilization on the instances causing the health check to respond slowly. The engineer wants to implement a solution that prevents the ALB from routing traffic to instances that are experiencing high CPU, and also automatically scales out to handle the increased load. What should the engineer do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.. It addresses both the immediate issue (high CPU causing health check timeouts) and the scaling requirement. Stopping the instance via a CloudWatch alarm removes it from the ALB target group, preventing traffic routing to unhealthy instances. The target tracking scaling policy based on CPU utilization automatically adds instances when CPU is high, ensuring capacity matches demand.

Answer

Configure the Auto Scaling group to use ELB health checks and set the health check grace period to 600 seconds.

Answer

Create a scheduled scaling action to add more instances during peak hours.

Answer

Increase the health check timeout to 10 seconds and the interval to 20 seconds to give instances more time to respond.

Question 6

A company is experiencing an ongoing security incident where an unauthorized user gained access to an AWS access key and is making API calls. The security team needs to immediately stop the unauthorized access and preserve evidence for investigation. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Enable CloudTrail logging to capture API calls for forensic analysis.. Enabling CloudTrail logging captures detailed API call records, including source IP, user agent, and request parameters, which are essential for forensic analysis and understanding the scope of the incident. Deleting the compromised access key immediately invalidates the credential, stopping all further unauthorized API calls. Together, these actions stop the attack and preserve evidence for investigation.

Answer

Rotate the access key by creating a new key and updating the application.

Answer

Change the IAM policy attached to the user to deny all actions.

Answer

Contact AWS Support to have the key disabled.

Question 7

A company uses AWS Lambda functions to process S3 events. After a recent deployment, some functions fail with timeout errors. The engineer needs to implement a solution that automatically captures and stores the function's input payload for all failed invocations without modifying the Lambda code. Which approach meets these requirements?

Accepted Answer

Use AWS Lambda Destinations with a failure destination pointing to an SQS queue.. A DLQ for an async Lambda invocation does receive the entire original failed event (including the S3 event payload) once retries are exhausted. It is a valid but legacy way to capture the payload; Lambda Destinations (option D) is the modern, AWS-recommended mechanism and additionally provides structured invocation records (request, response, error, and metadata), making it the better answer here, but not because DLQs 'don't capture payload' from S3 events.

Answer

Enable CloudWatch Logs Insights on the Lambda function's log group.

Answer

Use CloudWatch Events to capture Lambda invocation errors.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 8

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Review the canary's CloudWatch Logs for error details.. Option B is correct because CloudWatch Synthetics canaries write detailed execution logs, including error messages, stack traces, and step-level results, to CloudWatch Logs under log groups such as /aws/lambda/cwsyn--; reviewing these logs directly reveals the cause of intermittent ClientError responses. Option C is correct because each canary runs on an underlying Lambda function, and its Lambda logs (including the canary's own log output and any runtime errors) provide the granular diagnostic detail needed to pinpoint why the script is receiving client errors. Option A is not the best diagnostic action because modifying the script to add logging changes the canary rather than investigating the existing failure data, and the current logs already contain error details. Option D is not ideal because CloudWatch metrics for canaries (SuccessPercent, Failed, Duration) only show that failures occurred, not the root cause. Option E is incorrect because CloudTrail records CanaryRun API management calls for auditing, not the runtime error details of individual canary executions.

Answer

Modify the canary script to add more logging.

Answer

Examine CloudWatch metrics for the canary.

Answer

Check CloudTrail for CanaryRun API calls.

Question 9

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. The IAM policy likely includes a condition that denies the s3:PutObject action if the request does not include server-side encryption headers. Without encryption, the condition evaluates to false, and the explicit deny or lack of allow results in an Access Denied error.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-S3 encryption.

Answer

The upload succeeds and is automatically encrypted with SSE-S3.

Question 10

Refer to the exhibit. A CloudWatch alarm is configured for an EC2 instance. The CPU utilization exceeds 80% for two consecutive minutes. What action will occur?

Accepted Answer

The instance will be recovered.. Per AWS documentation, the EC2 'Recover' alarm action (arn:aws:automate:<region>:ec2:recover) can only be associated with an alarm that monitors the StatusCheckFailed_System metric -- it is not supported for CPUUtilization or other general performance metrics. The exhibit shows a CPUUtilization-based alarm with a recover action attached, which is an invalid/unsupported configuration in real AWS (the console and API reject creating or associating this action with a non-status-check metric). This question's exhibit and marked answer need to be corrected -- either change the exhibit's metric to StatusCheckFailed_System (making 'the instance will be recovered' correct), or change the alarm action to something valid for CPUUtilization (e.g., an Auto Scaling or SNS action) and adjust the correct answer accordingly.

Answer

No action will be taken because the period is 60 seconds.

Answer

The instance will be rebooted.

Answer

The instance will be stopped.