DOP-C02 Monitoring and Logging Practice Test 10 — 15 Questions

Question 1

A DevOps engineer wants to receive an alert when the total number of error logs in an application exceeds 100 within a 5-minute period. The application writes logs to CloudWatch Logs. How can this be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a metric filter on the log group for 'ERROR', then create a CloudWatch alarm on the resulting metric with a threshold of 100.. A metric filter on the CloudWatch Logs group can count occurrences of the pattern 'ERROR', creating a custom metric. A CloudWatch alarm on that metric with a threshold of 100 and a 5-minute period will trigger when the error count exceeds 100. Option A is incorrect because dashboards are for visualization, not automated alerts. Option B is incorrect because CloudWatch Logs Insights is for ad-hoc queries, not continuous real-time alerting. Option C is incorrect because subscription filters send logs to destinations like Lambda, but the Lambda would need custom logic to count and alert, which is not as direct as a metric filter. The metric filter with alarm is the simplest native solution.

Answer

Create a CloudWatch dashboard with a line chart for error count and manually monitor it.

Answer

Use CloudWatch Logs Insights to run a query every 5 minutes and trigger an alert based on the result.

Answer

Create a CloudWatch Logs subscription filter to send matching logs to a Lambda function, which counts errors and sends an alert.

Question 2

A company uses AWS Lambda functions for data processing. The operations team notices that some functions are taking longer to execute than expected. They want to analyze the execution durations to identify functions that exceed the 75th percentile latency. Which CloudWatch feature should be used?

Accepted Answer

Use CloudWatch metrics with the percentile statistic for 'Duration'.. CloudWatch metrics for Lambda's 'Duration' metric supports percentile statistics, including p75. The operations team can directly use the p75 statistic to analyze execution durations and identify functions exceeding the 75th percentile latency. AWS X-Ray does not directly provide percentile metrics from logs. CloudWatch dashboards display metrics but do not calculate new percentiles. CloudWatch Logs Insights can also compute percentiles, but it is not the primary or simplest CloudWatch feature for this purpose.

Answer

Use AWS X-Ray to trace the Lambda functions and analyze latency percentiles.

Answer

Use CloudWatch dashboards with a percentile widget on the 'Duration' metric.

Answer

Use CloudWatch Logs Insights to query the Lambda log groups and calculate custom percentiles using the `stats` command.

Question 3

A DevOps team is designing a monitoring solution for a multi-tier web application running on AWS. The application consists of an Application Load Balancer, EC2 instances in an Auto Scaling group, and an RDS database. Which TWO approaches provide centralized logging and monitoring across all tiers?

Accepted Answer

Configure all services to send logs to Amazon S3 and use Amazon Athena for ad-hoc querying.. Options B and E are correct. Option B: Sending logs to Amazon S3 and using Athena for ad-hoc queries allows centralized log storage and analysis across all tiers (ALB, EC2, RDS). Option E: Deploying the unified CloudWatch agent on EC2 instances collects system and application logs, sending them to CloudWatch Logs for centralized monitoring. Option A is wrong because CloudTrail only records API calls, not application logs. Option C is wrong because AWS Config monitors resource configuration changes, not operational logs. Option D is wrong because VPC Flow Logs capture only network traffic metadata, not application logs.

Answer

Enable AWS CloudTrail for all accounts and regions.

Answer

Use AWS Config rules to monitor configuration changes across resources.

Answer

Enable VPC Flow Logs to capture network traffic.

Question 4

A company uses AWS Organizations to manage multiple accounts. The DevOps team needs to monitor for any IAM user creation across all accounts in the organization. Which THREE steps should be taken to implement this centralized monitoring?

Accepted Answer

Create a CloudWatch Logs metric filter on the organization's CloudTrail log group for 'CreateUser' events.. Options A, B, and E are correct. Option B: Enabling CloudTrail in the management account with an organization trail captures all API activity across accounts. Option A: Creating a CloudWatch Logs metric filter on the organization's CloudTrail log group for 'CreateUser' events captures the specific event. Option E: Setting a CloudWatch alarm on the metric sends notifications via SNS. Option C is wrong because configuring an S3 bucket with event notifications does not directly enable centralized monitoring and alerting for IAM user creation. Option D is wrong because AWS Config rules are used for resource configuration compliance, not for real-time API call monitoring like IAM user creation.

Answer

Configure an S3 bucket to receive CloudTrail logs from all accounts and enable S3 event notifications for object creation.

Answer

Use AWS Config rules to detect IAM user creation across accounts.

Question 5

A DevOps engineer is troubleshooting a performance issue with an Amazon RDS for MySQL database. The engineer suspects that slow queries are causing high CPU utilization. Which TWO actions can the engineer take to identify the slow queries?

Accepted Answer

Enable the slow query log and publish it to CloudWatch Logs.. Enable the slow query log and publish it to CloudWatch Logs (Option C) allows you to capture and analyze slow SQL queries. Performance Insights (Option D) provides a dashboard to visualize database load and identify the top SQL statements causing performance issues. Option A is incorrect because event subscriptions for low storage notify about storage events, not slow queries. Option B is incorrect because monitoring CPUUtilization only indicates high CPU usage but does not identify specific slow queries. Option E is incorrect because Enhanced Monitoring provides OS-level metrics like CPU and memory, not the actual SQL queries.

Answer

Create an RDS event subscription for 'low storage' events.

Answer

Monitor the 'CPUUtilization' metric in CloudWatch.

Answer

Enable Enhanced Monitoring to view process list and SQL queries.

Question 6

Refer to the exhibit. The IAM policy above is attached to an EC2 instance role. The CloudWatch agent on the instance is configured to send logs to the 'MyAppLogs' log group. However, logs are not appearing in CloudWatch. What is the most likely issue?

Accepted Answer

The policy does not allow the 'logs:PutLogEvents' action on the specific log stream resource.. The policy only grants permissions for log streams under the log group (using the * wildcard for log streams), but it does not include permission to describe or interact with the log group itself. However, the real issue is that the resource ARN for PutLogEvents requires a log stream resource, not just the log group. The correct resource should be "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:log-stream:*" for PutLogEvents. Option A is wrong because the log group name matches. Option B is wrong because the region is correct. Option D is wrong because CloudWatch Logs agent does not require S3 permissions.

Answer

The instance role needs additional permissions to write to S3 for log delivery.

Answer

The log group name in the policy does not match the log group name configured in the agent.

Answer

The region in the policy ARN does not match the region where the log group is created.

Question 7

Refer to the exhibit. A DevOps engineer runs the AWS CLI command shown to retrieve the RequestCount metric for an ELB. The output shows datapoints with Sum values. What is the total number of requests received by the load balancer during the entire hour?

Accepted Answer

18600 requests. 18600 requests. The AWS CLI command retrieves the RequestCount metric with a period of 300 seconds (5-minute intervals). Each datapoint's Sum value represents the total number of requests received in that 5-minute window. To find the total requests for the entire hour, sum all 12 datapoints. The exhibit shows datapoints like 1500, 2000, ... 1800, and their total is 18600. Option B (3500) is incorrect because it only sums two datapoints instead of all twelve. Option C (36000) is incorrect because it likely multiplies a single datapoint by 12 without considering the actual values. Option D is incorrect because the total is determinable by summing the datapoints.

Answer

1500 + 2000 = 3500 requests

Answer

36000 requests

Answer

Cannot be determined from the data

Question 8

Refer to the exhibit. The IAM policy above is attached to a Lambda function's execution role. The Lambda function is supposed to publish custom metrics to CloudWatch using PutMetricData. However, the metrics are not appearing. What is the most likely reason?

Accepted Answer

The function needs to specify a metric name and value when calling PutMetricData.. The most likely reason the metrics are not appearing is that the Lambda function is not providing the required parameters—specifically a metric name and value—when calling PutMetricData. The IAM policy correctly grants the cloudwatch:PutMetricData action, but the API call itself must include at least a MetricName and a Value (or StatisticValues) in the MetricDatum array; otherwise, CloudWatch silently drops the request without publishing any metric. This is a common coding error where the execution role permissions are sufficient but the function logic is incomplete.

Answer

The policy does not include the 'cloudwatch:PutMetricData' action.

Answer

The policy includes unnecessary actions that conflict with each other.

Answer

The policy uses a wildcard resource, which is not allowed for the PutMetricData action.

Question 9

A company runs a microservices application on Amazon ECS with Fargate. The operations team notices that some services are experiencing intermittent high latency, but CPU and memory metrics appear normal. They need to identify the root cause. Which approach should they use?

Accepted Answer

Instrument the application with the AWS X-Ray SDK and use the X-Ray console to analyze traces.. AWS X-Ray provides end-to-end tracing to pinpoint latency issues in distributed applications. Option A is wrong because CloudWatch Logs Insights alone does not trace requests across services. Option B is wrong because Prometheus metrics are aggregated and may not correlate individual requests. Option C is wrong because CloudWatch Synthetics canaries test endpoints but cannot trace internal service calls.

Answer

Enable detailed CloudWatch Logs and use CloudWatch Logs Insights to query logs for slow requests.

Answer

Use Amazon Managed Service for Prometheus to collect custom metrics and set up dashboards.

Answer

Set up CloudWatch Synthetics canaries to monitor the endpoints and measure response times.

Question 10

A DevOps team uses AWS CloudFormation to deploy a web application. They want to receive notifications when a stack update fails. Which combination of services should they use?

Accepted Answer

Use Amazon EventBridge to capture CloudFormation events and invoke an AWS Lambda function that sends an email.. CloudFormation does not publish stack event metrics to CloudWatch Metrics. Instead, you can use Amazon EventBridge to capture CloudFormation events (such as stack update failures) and invoke an AWS Lambda function to send an SNS notification or email directly. Option B is incorrect because there is no 'UPDATE_FAILED' metric in CloudWatch for CloudFormation stacks. Option A is incorrect: AWS Config rules evaluate resource compliance, not real-time stack events. Option D is incorrect: S3 event notifications on the template bucket only track object-level actions, not stack update failures.

Answer

Use AWS Config rules to monitor stack status and trigger an SNS notification.

Answer

Create a CloudWatch alarm on the CloudFormation stack event metric 'UPDATE_FAILED' and configure an SNS topic to send email notifications.

Answer

Enable S3 event notifications on the CloudFormation template bucket and subscribe an SNS topic.

Question 11

An application running on Amazon EC2 instances sends custom metrics to CloudWatch. The team notices that some metrics are not appearing. What is the most likely cause?

Accepted Answer

The CloudWatch agent is not installed or configured on the EC2 instances.. The most likely cause is that the CloudWatch agent is not installed or configured on the EC2 instances. Custom metrics require the CloudWatch agent to collect and send data to CloudWatch. Option A is incorrect because custom metric namespaces do not need to be pre-registered; they are automatically created when metrics are published. Option B is incorrect because instances in a private subnet can still publish metrics using a VPC endpoint or a proxy, so a NAT gateway is not strictly required. Option C is incorrect because even with proper IAM permissions, the CloudWatch agent must be installed and running to collect and send custom metrics. Therefore, option D is correct.

Answer

The custom metric namespace is not pre-registered in CloudWatch.

Answer

The EC2 instances are in a private subnet without a NAT gateway.

Answer

The IAM role attached to the EC2 instance lacks permissions to publish metrics.

Question 12

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. How can this be achieved with minimal overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'CreateAccessKey' event and targets an SNS topic.. D is correct because Amazon EventBridge can capture real-time CloudTrail API events, such as 'CreateAccessKey', and route them directly to an SNS topic for immediate notification. This approach requires no polling, no custom code, and minimal overhead, as EventBridge handles event matching and delivery natively.

Answer

Use CloudWatch Logs Insights to run a query every hour and send results via email.

Answer

Set up an AWS Config rule to detect when an access key is created.

Answer

Configure S3 event notifications on the CloudTrail bucket to trigger a Lambda function.

Question 13

A DevOps engineer needs to aggregate logs from multiple AWS accounts into a central account for analysis. Which service should they use?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters.. Amazon CloudWatch Logs supports cross-account log aggregation via subscription filters, which can forward logs to a central account using Kinesis Data Streams or Firehose. Option A is incorrect because AWS CloudTrail with organization trails only aggregates CloudTrail logs (API activity), not general application logs. Option C is incorrect because AWS Config aggregator collects configuration and compliance data, not log data. Option D is incorrect because while S3 can store logs with cross-account policies, it does not provide the real-time streaming or subscription capabilities needed for log aggregation.

Answer

AWS CloudTrail with organization trails.

Answer

AWS Config with aggregator.

Answer

Amazon S3 with cross-account bucket policies.

Question 14

An application running on AWS Lambda is experiencing cold starts. The team wants to monitor the cold start duration. What should they do?

Accepted Answer

Monitor the 'InitDuration' metric in CloudWatch for the Lambda function.. AWS Lambda automatically publishes the 'InitDuration' metric in CloudWatch for cold starts, which measures the time spent initializing the runtime and code. Option B is incorrect because while CloudWatch Logs Insights can query for 'REPORT' lines, it is more complex and unnecessary since the metric is already available. Option C is incorrect because publishing a custom metric from the Lambda code is redundant; the InitDuration metric is automatically provided. Option D is incorrect because AWS X-Ray can trace cold starts, but the dedicated metric is simpler and directly available.

Answer

Use CloudWatch Logs Insights to query log groups for 'REPORT' lines and calculate duration.

Answer

Publish a custom metric from the Lambda code that measures initialization time.

Answer

Enable AWS X-Ray and trace the Lambda invocation to see cold start duration.

Question 15

A company uses Amazon S3 to store sensitive data. The security team wants to be notified when an S3 bucket policy is modified. Which approach is most efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'PutBucketPolicy' API call and sends a notification to an SNS topic.. CloudTrail logs the PutBucketPolicy API call, and EventBridge can filter on that event and trigger an SNS notification in real time. Option B is wrong because while AWS Config rules can detect changes to bucket policies, they are not designed for real-time alerting; they evaluate resources periodically or on configuration changes, making EventBridge a more efficient choice. Option C is wrong because S3 event notifications only support object-level events (e.g., PutObject), not bucket-level API calls like PutBucketPolicy. Option D is wrong because S3 server access logs are not real-time and require querying with CloudWatch Logs Insights, which is inefficient for immediate notification.

Answer

Set up an AWS Config rule to detect changes to the bucket policy.

Answer

Configure S3 event notifications for 's3:PutBucketPolicy' on the bucket.

Answer

Enable S3 server access logs and use CloudWatch Logs Insights to run queries periodically.