DOP-C02 Monitoring and Logging — 30 Questions

Question 1

A DevOps team is using Amazon CloudWatch Logs to collect application logs from multiple EC2 instances. They notice that some log entries are missing and that the CloudWatch agent is consuming high CPU. The log group has a retention policy of 30 days. Which action should the team take to reduce CPU usage without losing log data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the batch size in the CloudWatch agent configuration.. Increasing the batch size in the CloudWatch agent configuration reduces the number of HTTP API calls made to CloudWatch Logs, which lowers CPU overhead from frequent network I/O and serialization. The agent buffers log events and sends them in larger, less frequent batches, directly addressing high CPU consumption without discarding any log data.

Answer

Use JSON format for logs instead of plain text.

Answer

Set the agent's timezone to UTC.

Answer

Change the log group retention policy to 7 days.

Question 2

A company uses Amazon CloudWatch Logs to store logs from multiple applications. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Additionally, logs must be retained for 7 years for compliance. Which THREE steps should the DevOps engineer take to meet these requirements? (Choose THREE.)

Accepted Answer

Set the log group retention policy to 2557 days (7 years).. CloudWatch Logs retention accepts a fixed set of values, and the maximum supported retentionInDays is 3653 days (approximately 10 years), not 3650 days. 2557 days (7 years) is still a valid supported value within that maximum.

Answer

Modify the existing log group to use the KMS key by updating the log group settings.

Answer

Set the log group retention policy to 'Never expire' and use lifecycle policies to transition logs to Amazon S3 Glacier after 30 days.

Question 3

A DevOps engineer is monitoring an Amazon EC2 Auto Scaling group. The engineer wants to receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Amazon CloudTrail captures API calls made to the EC2 Auto Scaling service, including RunInstances and TerminateInstances events. CloudTrail can be configured to deliver these events directly to an Amazon SNS topic, enabling real-time notifications when instances are launched or terminated. This makes CloudTrail and SNS a valid combination. Amazon CloudWatch Alarms (option C) are not required for this purpose, as CloudTrail's direct integration with SNS provides the notification capability without additional services.

Answer

AWS X-Ray

Answer

AWS Config

Answer

Amazon CloudWatch Alarms

Question 4

A DevOps team is designing a monitoring strategy for a microservices application deployed on Amazon EKS. The application emits custom metrics, and the team needs to collect them with minimal latency and at high resolution. The team also needs to retain logs for 90 days for compliance. Which THREE steps should the team take to meet these requirements? (Choose three.)

Accepted Answer

Use Fluent Bit daemonset to send application logs to CloudWatch Logs.. Fluent Bit is a lightweight, high-performance log processor that can be deployed as a DaemonSet on Amazon EKS to collect application logs with minimal latency. It sends logs directly to CloudWatch Logs, which supports a retention policy of up to 10 years, easily meeting the 90-day compliance requirement. Fluent Bit's low resource footprint and efficient data pipeline ensure high-resolution log collection without impacting application performance.

Answer

Stream logs to Amazon Kinesis Data Firehose for transformation before landing in CloudWatch Logs.

Answer

Enable CloudWatch Container Insights for the EKS cluster.

Question 5

Match each AWS monitoring or logging tool to its purpose.

Accepted Answer

Amazon CloudWatch: Monitors AWS resources and applications by collecting metrics, logs, and setting alarms.. Correctly match each tool to its core purpose. CloudWatch is for metrics and alarms; CloudTrail for API auditing; AWS Config for configuration compliance. Common confusions involve swapping their descriptions.

Answer

Amazon CloudWatch: Records API calls for auditing and compliance.

Answer

AWS CloudTrail: Monitors performance metrics and sets alarms.

Question 6

A company runs a microservices application on Amazon ECS with Fargate. The application logs are sent to CloudWatch Logs. Recently, the operations team noticed that logs from one service are missing for certain time periods. The service is very chatty and produces a high volume of logs. The CloudWatch Logs agent is configured with default settings. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent is dropping logs due to the default batch size and timeout settings.. On ECS Fargate, container logs are shipped by the awslogs log driver (or FireLens), not a configurable host-based CloudWatch Logs agent — there are no local batch_size/batch_timeout knobs to tune on Fargate. A more accurate cause for a single chatty service losing logs for periods is hitting the CloudWatch Logs PutLogEvents throttle, which is enforced per log stream (5 requests/second, 1 MB/second per account per Region as of documented limits) — a high-volume single service can exceed the per-stream rate and experience throttled/dropped delivery. As written, this question's premise (a tunable 'CloudWatch Logs agent' on Fargate) does not match how ECS Fargate logging actually works.

Answer

CloudWatch Logs has a throttling limit on log ingestion per log group.

Answer

The log group has reached its maximum size and stopped accepting new logs.

Answer

The log retention policy is set to 1 day, so older logs are automatically deleted.

Question 7

A company wants to be alerted when the root user signs in to the AWS Management Console. Which service should be used to create a monitoring rule for this event?

Accepted Answer

Amazon CloudWatch Events (now Events) with a rule for the 'RootSignIn' event from CloudTrail. CloudWatch Events (now part of Amazon EventBridge) can create a rule that matches CloudTrail's 'ConsoleLogin' event, filtering on userIdentity.type == "Root" to identify a root user sign-in specifically. The rule can then target an SNS topic, Lambda function, or other destination to send an alert, making this the correct and native service combination for real-time root sign-in monitoring.

Answer

AWS Config

Answer

Amazon S3

Answer

AWS IAM

Question 8

A DevOps engineer needs to collect and analyze logs from multiple AWS services, including EC2, Lambda, and API Gateway. The logs must be stored in a central location for long-term retention and analyzed using SQL queries. Which TWO services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon Athena is an interactive query service that runs standard SQL directly against log data stored in Amazon S3. While CloudWatch Logs collects the logs from EC2, Lambda, and API Gateway and can export them to S3 for long-term retention, Athena is what actually provides the SQL query capability the requirement asks for. Combined, CloudWatch Logs (collection/central storage) and Athena (SQL analysis) satisfy both halves of the requirement, which is why Athena is one of the two correct services here.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Question 9

A DevOps engineer is setting up an alarm to notify the team when the average CPU utilization of an EC2 instance exceeds 80% for 5 consecutive minutes. Which CloudWatch alarm configuration should be used?

Accepted Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1. It configures a CloudWatch alarm with a 300-second (5-minute) period and 1 evaluation period, meaning the alarm triggers when the average CPU utilization exceeds 80% for a single 5-minute data point. This directly matches the requirement of 'exceeds 80% for 5 consecutive minutes' since the metric is evaluated over a 5-minute window.

Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1, Comparison: LessThanThreshold

Answer

Metric: CPUUtilization, Statistic: Average, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Answer

Metric: CPUUtilization, Statistic: Sum, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Question 10

A company uses Amazon CloudWatch to monitor a fleet of EC2 instances. The DevOps team wants to receive notifications when the CPU utilization exceeds 90% for 5 minutes and also when the status check fails. Which THREE steps should be taken to set up these alerts?

Accepted Answer

Set the CPUUtilization alarm with a period of 60 seconds and 5 evaluation periods. The correct steps are B, C, and E. Option B creates a CloudWatch alarm on CPUUtilization with a period of 60 seconds and 5 evaluation periods, which triggers when CPU utilization exceeds 90% for 5 consecutive minutes. Option C creates an alarm on the StatusCheckFailed metric. Option E creates an SNS topic and email subscription for notifications. Option A is incorrect because a period of 300 seconds evaluates a single 5-minute aggregate (e.g., average), which does not guarantee that the metric exceeded the threshold for the entire 5 minutes; it could trigger if a few high minutes raise the average above 90 even if the threshold wasn't exceeded for the full duration. Option D is incorrect because a composite alarm would require underlying alarms and is not a standalone step; separate alarms for different conditions are standard practice.

Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 300 seconds and threshold 90

Answer

Create a single composite alarm that combines both conditions

Question 11

A company is using Amazon CloudWatch Logs to monitor application logs from EC2 instances. The DevOps engineer notices that some log entries are missing. The CloudWatch agent is installed and configured. What is the most likely cause of the missing log entries?

Accepted Answer

The CloudWatch agent's rate limit is set too low, causing log entries to be dropped.. The CloudWatch agent has a configurable rate limit that controls how many log events can be sent per second. If the agent cannot keep up with the log generation rate, it may drop entries, resulting in missing log entries. Option A is correct because the rate limit can be set too low. Option B is incorrect because compression does not cause log loss; the agent compresses logs before sending, but that does not drop entries. Option C is incorrect because log retention policies only delete logs after they are stored, not during ingestion. Option D is incorrect because there is no maximum size limit on log events in CloudWatch Logs.

Answer

The CloudWatch agent is compressing logs before sending, causing some entries to be lost.

Answer

The log group retention policy is set to 1 day, and logs older than that are automatically deleted.

Answer

The log group's maximum size limit has been exceeded.

Question 12

A DevOps engineer is troubleshooting a production issue where an application's response time has increased. The application is deployed on Amazon ECS with Fargate. The engineer wants to identify which microservice is causing the latency. Which AWS service should be used?

Accepted Answer

AWS X-Ray to trace requests and analyze service latency.. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, allowing the engineer to pinpoint which service is introducing latency. By analyzing trace segments and subsegments, X-Ray can break down response times for each component in the application, directly addressing the need to identify the specific microservice causing the delay.

Answer

Amazon CloudWatch Synthetics canary to monitor the application endpoint.

Answer

Amazon CloudWatch Logs Insights to query application logs for errors.

Answer

Amazon CloudWatch ServiceLens to visualize service maps and traces.

Question 13

A company runs a containerized application on Amazon EKS. The DevOps engineer needs to collect application metrics and make them available in Amazon CloudWatch. Which solution should be used?

Accepted Answer

Install the Amazon CloudWatch agent as a DaemonSet on the EKS cluster.. The CloudWatch agent can be deployed as a DaemonSet on EKS to collect application and system-level metrics from each node/pod and publish them to CloudWatch. This is the standard AWS-supported approach for pushing custom and host metrics from EKS worker nodes into CloudWatch. It integrates natively with CloudWatch Logs and Metrics without requiring a separate observability backend.

Answer

Use AWS X-Ray daemon to collect metrics and send them to CloudWatch.

Answer

Deploy the AWS Distro for OpenTelemetry collector on the EKS cluster.

Answer

Enable Amazon CloudWatch Container Insights using the AWS Management Console.

Question 14

A company is using Amazon CloudWatch Logs to collect logs from its containerized applications running on Amazon ECS Fargate. The DevOps engineer wants to centralize logs from multiple services into a single CloudWatch Logs log group. They currently have a log group per service. Which approach minimizes operational overhead and cost?

Accepted Answer

Create a CloudWatch Logs subscription filter on each service log group to stream matching log events to a central log group.. The correct approach because CloudWatch Logs subscription filters can be used to forward log events from multiple source log groups to a central destination. Although subscription filters cannot send logs directly to another CloudWatch Logs group, they can deliver to a Lambda function, which then writes the logs into the central log group. This pattern uses native CloudWatch and Lambda, avoiding the overhead and cost of additional services like Kinesis or S3. It is a common minimal-overhead solution for centralizing logs from multiple ECS services.

Answer

Use Amazon Kinesis Data Firehose to stream logs from each log group to Amazon S3 and then to a central CloudWatch Logs group.

Answer

Export each log group to Amazon S3 and use Amazon Athena to query across all exported logs.

Answer

Modify the application logging configuration in each container to send logs to a single log group and log stream per container.

Question 15

A company is running a production microservices architecture on Amazon ECS with Fargate. The operations team wants to set up centralized logging across all services, including the ability to search logs in near real-time and retain them for 3 years. The logs are currently sent to CloudWatch Logs. Which combination of services would meet these requirements with the least operational overhead?

Accepted Answer

Set a retention policy of 3 years on the CloudWatch Logs log groups and use CloudWatch Logs Insights for searching.. Setting a 3-year retention policy on the CloudWatch Logs log groups and using CloudWatch Logs Insights for searching meets both requirements with the least operational overhead. CloudWatch Logs natively supports retention up to 10 years (3,653 days) and Insights provides near real-time querying without provisioning or managing additional infrastructure. This keeps everything within the existing logging pipeline.

Answer

Stream logs to Amazon OpenSearch Service (Elasticsearch) using a CloudWatch Logs subscription filter.

Answer

Export logs to Amazon S3 and use Amazon Athena to query them.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon S3 with a 3-year lifecycle policy.

Question 16

A company wants to set up centralized logging for its multi-account AWS environment. The logs include CloudTrail, VPC Flow Logs, and Amazon Route 53 resolver query logs. Which TWO services should they use to achieve this with minimal operational overhead? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (A) is correct because it is the native, fully managed central log repository that can receive CloudTrail, VPC Flow Logs, and Route 53 Resolver query logs via log groups, and it supports cross-account subscription filters and CloudWatch Logs Insights for querying with minimal operational overhead. Amazon S3 (B) is correct because it is the standard centralized, durable destination for these log types—CloudTrail delivers to S3 buckets, VPC Flow Logs and Route 53 Resolver query logs can be published directly to S3, and cross-account aggregation is achieved with bucket policies and S3 Lifecycle/Athena for analysis, again with minimal management. Amazon Kinesis Data Streams (C) is not correct because it is a streaming ingestion service requiring custom consumers and shard management, adding operational overhead rather than minimizing it. Amazon OpenSearch Service (D) is not correct because it requires cluster provisioning, scaling, and maintenance, which is more operational overhead than the managed log destinations. AWS CloudTrail (E) is not correct because it is a log source/audit service that records API activity, not a centralized destination for aggregating VPC Flow Logs and Route 53 Resolver query logs.

Answer

Amazon Kinesis Data Streams

Answer

Amazon OpenSearch Service

Answer

AWS CloudTrail

Question 17

A company is running a critical application on Amazon ECS with Fargate launch type. The application experiences periodic performance degradation. The DevOps team needs to set up monitoring to capture detailed metrics at a 1-second granularity. Which solution should be used?

Accepted Answer

Use Amazon CloudWatch Container Insights with high-resolution metrics.. Amazon CloudWatch Container Insights with high-resolution metrics provides detailed, 1-second granularity metrics for ECS tasks running on Fargate. Option A is incorrect because deploying a Prometheus server on EC2 to scrape metrics from ECS tasks is more complex and not a fully managed AWS solution; it would require additional setup and does not natively provide 1-second granularity out of the box. Option B is incorrect because CloudWatch detailed monitoring is typically used for EC2 instances and provides metrics at 1-minute granularity, not 1-second; for ECS, Container Insights is the appropriate service for high-resolution metrics. Option D is incorrect because VPC Flow Logs capture network traffic metadata, not application performance metrics, and thus cannot be used to monitor performance degradation.

Answer

Deploy a Prometheus server on Amazon EC2 and scrape metrics from the ECS tasks.

Answer

Enable CloudWatch detailed monitoring on the ECS service.

Answer

Enable VPC Flow Logs and analyze the logs with Amazon Athena.

Question 18

A company wants to collect and analyze logs from on-premises servers and send them to AWS for centralized monitoring. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Agent on the on-premises servers to send logs to Amazon CloudWatch Logs.. The Amazon CloudWatch Agent can be installed on on-premises servers (including non-EC2 hosts) and configured to send logs to Amazon CloudWatch Logs, providing centralized monitoring without requiring AWS infrastructure on-premises. This is the standard, supported approach for hybrid log collection into CloudWatch.

Answer

Amazon Kinesis Agent on the on-premises servers to send logs to Amazon Kinesis Data Firehose, then to Amazon S3.

Answer

Amazon CloudWatch Agent with the awslogs configuration to send logs to Amazon CloudWatch Logs.

Answer

AWS Systems Manager Agent to collect logs and send to Amazon CloudWatch Logs.

Question 19

A company uses AWS Lambda with an Amazon DynamoDB table to process high-volume clickstream data. The Lambda function writes the data to DynamoDB. Recently, the function has been experiencing throttling and timeouts during peak traffic. The DevOps team needs to set up monitoring to identify the root cause. Which combination of metrics should they analyze?

Accepted Answer

DynamoDB throttled write events and Lambda concurrent executions.. DynamoDB throttled write events indicate when the table is rejecting writes due to exceeding provisioned capacity, which directly causes Lambda timeouts. Lambda concurrent executions show how many function instances are running simultaneously; if this hits the account's concurrency limit, functions are throttled. Analyzing both metrics together helps identify whether the root cause is DynamoDB capacity or Lambda concurrency limits.

Answer

DynamoDB read and write capacity metrics and Lambda error count.

Answer

CloudWatch metrics for Lambda invocations and duration.

Answer

CloudWatch Logs for Lambda function logs and Lambda memory utilization.

Question 20

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). They need to implement a monitoring strategy that provides detailed visibility into application performance, including request-level latency and error codes. Which THREE actions should they take?

Accepted Answer

Enable ALB access logs and store them in Amazon S3.. Option B is correct because ALB access logs capture detailed per-request information—client IP, request path, target, request processing time (target_processing_time), and the returned ELB/target status codes—which directly satisfies the requirement for request-level latency and error codes when stored in Amazon S3. Option C is correct because installing the CloudWatch agent on the EC2 instances lets them publish application logs and custom metrics (e.g., via the CloudWatch agent configuration and PutMetricData) that the ALB itself cannot observe, giving deeper application-level visibility. Option E is correct because enabling detailed CloudWatch metrics for the ALB provides granular metrics such as RequestCount, TargetResponseTime, HTTPCode_Target_5XX_Count, and HTTPCode_ELB_4XX_Count, which are needed to monitor latency and error rates at the load-balancer level. Option A is not appropriate because VPC Flow Logs only record IP-level network traffic metadata (source/destination, ports, bytes, ACCEPT/REJECT) and do not expose HTTP request latency or status codes. Option D is not appropriate because CloudTrail records AWS API control-plane calls (e.g., CreateLoadBalancer, DescribeTargetGroups), not application request performance or error codes.

Answer

Enable VPC Flow Logs to capture traffic patterns.

Answer

Enable AWS CloudTrail to log API calls made to the load balancer.