DOP-C02 Monitoring and Logging — 20 Questions

Question 1

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The DevOps team wants to monitor HTTP 5xx errors and receive alerts when the error rate exceeds 5% over a 5-minute period. Which combination of services and configurations should be used to meet these requirements?

Accepted Answer

Use CloudWatch ALB metrics (HTTPCode_ELB_5XX_Count) and create a CloudWatch Alarm on the Sum statistic with a threshold based on total request count.. Option C is correct because ALB automatically publishes the `HTTPCode_ELB_5XX_Count` metric to CloudWatch, and you can create a CloudWatch alarm using the `Sum` statistic over a 5-minute period. To detect when the error rate exceeds 5%, you need to combine this metric with the `RequestCount` metric in a math expression (e.g., `m1/m2*100 > 5`) or use a composite alarm, as the alarm threshold must be based on the ratio of 5xx errors to total requests, not just the raw count.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query 5xx logs, then create a metric filter and alarm.

Answer

Configure AWS Config rules to check ALB 5xx error counts and trigger alarms.

Answer

Use AWS X-Ray to trace requests and create a CloudWatch alarm based on X-Ray error rate.

Question 2

A DevOps team is using Amazon CloudWatch Logs to collect application logs from multiple EC2 instances. They notice that some log entries are missing and that the CloudWatch agent is consuming high CPU. The log group has a retention policy of 30 days. Which action should the team take to reduce CPU usage without losing log data?

Accepted Answer

Increase the batch size in the CloudWatch agent configuration.. Increasing the batch size in the CloudWatch agent configuration reduces the number of HTTP API calls made to CloudWatch Logs, which lowers CPU overhead from frequent network I/O and serialization. The agent buffers log events and sends them in larger, less frequent batches, directly addressing high CPU consumption without discarding any log data.

Answer

Use JSON format for logs instead of plain text.

Answer

Set the agent's timezone to UTC.

Answer

Change the log group retention policy to 7 days.

Question 3

A company wants to monitor the number of messages in an Amazon SQS queue and send an alert if the queue depth exceeds 1000 for more than 5 minutes. Which AWS service should be used to create the alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it can monitor SQS queue metrics (such as ApproximateNumberOfMessagesVisible) and trigger an alarm when the metric exceeds a threshold (e.g., 1000) for a specified evaluation period (e.g., 5 minutes). CloudWatch Alarms directly integrate with SQS via the AWS/SQS namespace and support actions like sending notifications through Amazon SNS.

Answer

Amazon EventBridge

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Question 4

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are deployed in multiple AWS regions. The team wants to aggregate the canary results into a single dashboard in the US East (N. Virginia) region. What is the MOST efficient way to achieve this?

Accepted Answer

Create a cross-region CloudWatch dashboard and add metrics from each region using metric math.. Option B is correct because CloudWatch cross-region dashboards allow you to aggregate metrics from multiple regions into a single dashboard without data movement. By using metric math, you can reference metric IDs from different regions directly in the dashboard widget, enabling real-time aggregation of Synthetics canary success/failure rates and latency metrics from all regions into a unified view in US East (N. Virginia). This approach avoids unnecessary data replication, reduces latency, and minimizes operational overhead.

Answer

Replicate the canaries to US East (N. Virginia) and run them from there.

Answer

Set up a Lambda function in each region to push canary results to a central S3 bucket, then create a dashboard from S3.

Answer

Create a CloudWatch Logs Insights query across all regions and visualize results.

Question 5

A DevOps team is troubleshooting a slow application. They enabled AWS X-Ray tracing and see that one of the downstream services has a high average response time. However, the traces show that the service itself is fast; the delay is in the network call from the upstream service. Which X-Ray feature should the team use to identify the root cause?

Accepted Answer

Examine the trace map to see the connection between services.. The trace map in AWS X-Ray provides a visual representation of the service graph, showing the connections and latency between services. Since the delay is in the network call from the upstream service to the downstream service, the trace map can highlight the specific edge where the high latency occurs, allowing the team to pinpoint whether the issue is due to network congestion, DNS resolution, or a slow HTTP connection. This is the most direct way to identify the root cause of the inter-service communication delay.

Answer

Add annotations to the traces for better filtering.

Answer

View the raw segments of the upstream service.

Answer

Adjust the sampling rules to capture more traces.

Question 6

A company needs to monitor the CPU utilization of its Amazon RDS for PostgreSQL instance. The metric should be available in Amazon CloudWatch with a granularity of 1 minute. Which action should the team take?

Accepted Answer

No additional configuration is needed; RDS automatically sends metrics to CloudWatch.. Amazon RDS for PostgreSQL automatically publishes metrics, including CPU utilization, to CloudWatch with a default granularity of 1 minute for standard instances. No additional configuration is required to enable this basic monitoring. The metrics are collected by the RDS hypervisor layer and sent to CloudWatch without needing an agent or extra setup.

Answer

Install the CloudWatch agent on the RDS instance.

Answer

Enable Enhanced Monitoring for the RDS instance.

Answer

Enable Performance Insights for the RDS instance.

Question 7

A company runs a containerized application on Amazon ECS Fargate. The DevOps team wants to collect custom application metrics (e.g., request count, error rate) and send them to Amazon CloudWatch. The team wants to minimize changes to the application code. Which solution should be used?

Accepted Answer

Run the CloudWatch agent as a sidecar container in the ECS task definition, configured to collect StatsD metrics from the application container.. Option B is correct because the CloudWatch agent can run as a sidecar container in the same ECS task definition and listen for StatsD metrics (over UDP port 8125) from the application container. This approach requires zero changes to the application code—the application simply emits StatsD-formatted metrics, and the CloudWatch agent forwards them to CloudWatch via the PutMetricData API. It minimizes operational overhead while enabling custom metric collection from containerized workloads on Fargate.

Answer

Have the application call the CloudWatch PutMetricData API directly.

Answer

Use the ECS agent's built-in metric collection feature.

Answer

Modify the application to send logs using the embedded metric format.

Question 8

A DevOps engineer is designing a monitoring solution for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The team needs to monitor for errors and latency. Which TWO actions should the engineer take to implement comprehensive monitoring? (Choose TWO.)

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. Option D is correct because AWS X-Ray provides end-to-end tracing for requests as they travel through API Gateway, Lambda, and DynamoDB, enabling the team to identify latency bottlenecks and errors across the entire serverless application. This is essential for comprehensive monitoring of distributed applications, as it captures detailed timing and error data for each component.

Answer

Enable DynamoDB Accelerator (DAX) to reduce latency.

Answer

Enable detailed billing metrics for cost analysis.

Answer

Configure CloudWatch Logs for DynamoDB.

Question 9

A company uses Amazon CloudWatch Logs to store logs from multiple applications. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Additionally, logs must be retained for 7 years for compliance. Which THREE steps should the DevOps engineer take to meet these requirements? (Choose THREE.)

Accepted Answer

Set the log group retention policy to 2557 days (7 years).. Option A is correct because CloudWatch Logs log group retention policies accept values in days, and 7 years equals 2557 days (7 × 365.25, accounting for leap years). Setting this retention policy ensures logs are automatically deleted after the compliance period, meeting the 7-year retention requirement without manual intervention.

Answer

Modify the existing log group to use the KMS key by updating the log group settings.

Answer

Set the log group retention policy to 'Never expire' and use lifecycle policies to transition logs to Amazon S3 Glacier after 30 days.

Question 10

A DevOps engineer is monitoring an Amazon EC2 Auto Scaling group. The engineer wants to receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures API calls made to the EC2 Auto Scaling service, including RunInstances and TerminateInstances events. By sending these events to Amazon CloudWatch Logs, you can create metric filters that trigger CloudWatch Alarms, which then publish notifications to an SNS topic. This combination allows you to receive real-time notifications when instances are launched or terminated.

Answer

AWS X-Ray

Answer

AWS Config

Answer

Amazon CloudWatch Alarms

Question 11

A company runs a production web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is deployed across three Availability Zones. The DevOps team recently noticed that the application's error rate is spiking periodically, but they cannot correlate the spikes with any known deployments or changes. The team has enabled detailed CloudWatch metrics for the ALB and EC2, and they are using CloudWatch Logs for application logs. They also have AWS X-Ray enabled for tracing.

The team observes that during error spikes, the ALB's 5XX count increases, but the EC2 instance-level CPU and memory metrics remain normal. The application logs show 'Connection timed out' errors. The team suspects the issue is related to network connectivity but is not sure.

Which course of action should the DevOps team take to identify the root cause of the periodic error spikes?

Accepted Answer

Enable VPC Flow Logs for the subnets and analyze the logs to identify dropped connections during the error spikes.. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including whether the traffic was accepted or rejected. Since the application logs show 'Connection timed out' errors and instance-level metrics are normal, the issue likely lies in the network path (e.g., security groups, NACLs, or subnet routing) rather than the application or compute layer. Analyzing VPC Flow Logs during the error spikes will reveal if connections are being dropped or rejected, pinpointing the root cause of the timeouts.

Answer

Increase the EC2 instance size to handle higher traffic and reduce timeouts.

Answer

Configure a step scaling policy for the Auto Scaling group based on ALB 5XX count.

Answer

Enable ALB access logs and analyze the 5xx response patterns.

Question 12

A company runs a critical application on Amazon ECS with Fargate. The application experiences intermittent slow responses. The DevOps team enabled Container Insights and CloudWatch ServiceLens. However, traces from the application do not appear in ServiceLens. The application uses the AWS X-Ray SDK for tracing. What is the MOST likely cause?

Accepted Answer

The X-Ray daemon is not running in the task definition.. The X-Ray daemon is required to act as a local intermediary that receives trace segments from the X-Ray SDK and forwards them to the AWS X-Ray API. In Amazon ECS with Fargate, the daemon must be explicitly included as a sidecar container in the task definition. Without it, the SDK cannot send traces, which explains why traces are missing from ServiceLens despite the SDK being integrated.

Answer

The X-Ray SDK cannot send traces to AWS X-Ray from Fargate tasks.

Answer

ServiceLens does not support Amazon ECS with Fargate launch type.

Answer

The application is not sending metrics to CloudWatch Container Insights.

Question 13

A DevOps team has set up centralized logging for multiple AWS accounts using Amazon OpenSearch Service. The team uses CloudWatch cross-account observability to collect logs from various accounts into a monitoring account. Recently, logs from one source account stopped appearing in the monitoring account's OpenSearch dashboard. Other source accounts continue to send logs successfully. Which step should the team take to troubleshoot this issue?

Accepted Answer

Check the source account's CloudWatch Logs subscription filter for the OpenSearch destination.. Option B is correct because the most likely cause of logs from a single source account failing to appear is a misconfigured or broken CloudWatch Logs subscription filter. This filter is responsible for forwarding log events from the source account to the OpenSearch destination in the monitoring account. If the filter is missing, misconfigured, or has been accidentally deleted, logs will not be sent, while other accounts continue to work normally.

Answer

Verify that the monitoring account's CloudWatch cross-account observability is enabled.

Answer

Review the source account's CloudWatch Logs retention policy to confirm logs are not expired.

Answer

Ensure the IAM role in the source account has the correct trust policy for the monitoring account.

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack fails to create or update. What is the MOST efficient way to achieve this?

Accepted Answer

Configure an SNS topic in the stack's notification options.. Option A is correct because AWS CloudFormation natively supports specifying Amazon SNS topic ARNs in the stack's notification options. When a stack operation (create, update, or delete) fails, CloudFormation automatically publishes a notification to the configured SNS topic without requiring any custom code, additional resources, or external event processing. This is the most efficient approach as it leverages built-in functionality with zero maintenance overhead.

Answer

Create a custom resource in the stack that publishes to Amazon SNS.

Answer

Create a CloudWatch alarm on the StackStatus metric.

Answer

Use Amazon EventBridge to capture CloudFormation events and publish to SNS.

Question 15

A DevOps engineer is troubleshooting a production AWS Lambda function that occasionally times out. The function has a timeout of 30 seconds and uses a synchronous invocation. The engineer wants to capture invocation logs to identify the cause. Which approach will provide the MOST detailed diagnostic information?

Accepted Answer

Enable AWS X-Ray tracing on the Lambda function.. Option D is correct because AWS X-Ray provides end-to-end tracing for Lambda functions, capturing detailed timing information for each invocation, including subsegments for downstream calls, function initialization, and execution phases. This allows the engineer to pinpoint exactly where time is being spent, which is essential for diagnosing intermittent timeouts in synchronous invocations.

Answer

Enable AWS CloudTrail data events for Lambda.

Answer

Create a CloudWatch dashboard with function duration metrics.

Answer

Add more logging statements to the function code and check CloudWatch Logs.

Question 16

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics for the ALB and is using CloudWatch Logs for the EC2 instances. Recently, users report intermittent 503 errors. The team notices that the ALB's 'RequestCount' metric shows a sudden drop during error periods, while the 'ActiveConnectionCount' remains steady. Which TWO steps should the team take to diagnose the issue? (Choose two.)

Accepted Answer

Enable and analyze the ALB access logs to see the HTTP response codes and target processing time.. Option A is correct because ALB access logs contain detailed per-request data, including HTTP response codes (e.g., 503) and target processing time. Analyzing these logs will reveal whether the 503 errors are coming from the ALB itself (e.g., due to request queue overflow) or from the targets, and whether the sudden drop in RequestCount is due to clients aborting or the ALB throttling requests.

Answer

Check the Amazon Route 53 health checks for the ALB DNS name.

Answer

Review the EC2 instances' CloudWatch metrics for CPU utilization and network traffic.

Answer

Inspect AWS CloudTrail logs for the ALB to see if there are any configuration changes.

Question 17

A DevOps team is designing a monitoring strategy for a microservices application deployed on Amazon EKS. The application emits custom metrics, and the team needs to collect them with minimal latency and at high resolution. The team also needs to retain logs for 90 days for compliance. Which THREE steps should the team take to meet these requirements? (Choose three.)

Accepted Answer

Use Fluent Bit daemonset to send application logs to CloudWatch Logs.. Option A is correct because Fluent Bit is a lightweight, high-performance log processor that can be deployed as a DaemonSet on Amazon EKS to collect application logs with minimal latency. It sends logs directly to CloudWatch Logs, which supports a retention policy of up to 10 years, easily meeting the 90-day compliance requirement. Fluent Bit's low resource footprint and efficient data pipeline ensure high-resolution log collection without impacting application performance.

Answer

Stream logs to Amazon Kinesis Data Firehose for transformation before landing in CloudWatch Logs.

Answer

Enable CloudWatch Container Insights for the EKS cluster.

Question 18

Your company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running a web server. The web servers write access logs to a shared Amazon EFS filesystem. The operations team needs to monitor the web server logs in real-time to detect and alert on 5xx error spikes. Currently, the team manually SSHes into instances to tail logs, which is inefficient and doesn't provide real-time alerting. The team wants a centralized, near-real-time logging solution with minimal operational overhead. They have asked you to design a solution that ingests logs from the EFS filesystem into a centralized log analytics platform. Which solution would you recommend?

Accepted Answer

Install and configure the Amazon CloudWatch Logs agent on each EC2 instance to tail the log files from the EFS mount and send them to CloudWatch Logs. Create a metric filter and alarm for 5xx errors.. Option D is correct because installing the CloudWatch Logs agent on each EC2 instance allows it to tail the log files from the shared EFS mount point and stream them to CloudWatch Logs in near real-time. This provides centralized log ingestion with minimal operational overhead, and you can create a metric filter and alarm to detect and alert on 5xx error spikes without manual SSH access.

Answer

Enable AWS CloudTrail data events for the EC2 instances to capture log file modifications.

Answer

Configure an Amazon EventBridge scheduled rule to invoke an AWS Lambda function that reads new log lines from EFS and publishes them to Amazon CloudWatch Logs.

Answer

Stream the log files to Amazon Kinesis Data Streams using a custom producer, then use a Lambda function to analyze and alert on 5xx errors.

Question 19

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

Accepted Answer

Use AWS X-Ray to instrument the application and collect trace data.. AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Answer

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Answer

Enable CloudWatch Logs Insights to query API logs for slow requests.

Answer

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Answer

Set up VPC Flow Logs to analyze network latency between services.

Question 20

A company is using AWS CloudTrail to log API activity in their AWS account. They want to ensure that any modification to CloudTrail configuration itself is logged and that the logs are immutable. Which combination of actions should they take? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the destination S3 bucket in governance mode.. Option A is correct because enabling S3 Object Lock in governance mode on the destination S3 bucket prevents any user, including the root user, from overwriting or deleting CloudTrail log objects during the retention period, ensuring immutability. Option B is correct because enabling log file validation creates a digest file that uses SHA-256 hashing to verify that log files have not been modified, deleted, or tampered with after delivery, providing integrity assurance.

Answer

Disable log file validation to reduce overhead.

Answer

Store CloudTrail logs in a CloudWatch Logs log group with a retention policy.

Answer

Enable CloudTrail Insights to detect configuration changes.