DOP-C02 Monitoring and Logging Practice Test 10 — 15 Questions

Question 1

A company uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team notices that some instances are failing health checks but are not being terminated by Auto Scaling. What should be investigated to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the health check grace period setting in the Auto Scaling group. If it is too long, instances failing health checks may not be terminated quickly.. The health check grace period in an Auto Scaling group controls how long Auto Scaling waits before checking the health of a newly launched instance. If this grace period is set too long, instances that fail health checks before the grace period expires will not be terminated promptly, leading to the observed behavior where unhealthy instances remain in service even though they are failing health checks. The default grace period is 300 seconds, but if it is excessively long, it delays the termination of instances that fail health checks during that period.

Answer

Confirm that the load balancer's health check target is pointing to the correct port and path on the instances.

Answer

Ensure the instances are sending health check requests to the load balancer.

Answer

Verify that the security group for the instances allows inbound traffic from the load balancer on the health check port.

Question 2

A DevOps engineer is configuring a centralized logging solution using Amazon CloudWatch Logs. They need to ensure that logs from multiple AWS accounts are aggregated into a single CloudWatch Logs account. Which approach meets this requirement?

Accepted Answer

Create a subscription filter in each account that delivers log events to a CloudWatch Logs destination in the central account.. CloudWatch Logs supports cross-account subscription filters that can deliver log events to a CloudWatch Logs destination in a central account. The destination is a logical resource that points to a Kinesis Data Stream or Lambda function in the central account, and the source account creates a subscription filter that sends matching log events to that destination. This allows centralized aggregation without requiring each account to manage separate streaming infrastructure.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket, then use Amazon Athena to query.

Answer

Set up a cross-account destination using an Amazon Kinesis Data Streams stream in the central account and configure each account to send logs to that stream.

Answer

Configure each application to use the PutLogEvents API to send logs directly to the central account's log group.

Question 3

A company is using AWS CloudTrail to track API calls. They want to be notified immediately when an IAM user creates a new access key. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic.. To be notified immediately when an IAM user creates a new access key, the most efficient approach is to use Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic. CloudTrail records the 'CreateAccessKey' API call as an event. An EventBridge rule can be configured to match this specific event pattern and send the event to an SNS topic, which can then send notifications via email, SMS, etc. This provides real-time notification without additional services. Option A (CloudWatch Logs with metric filter and alarm) requires sending CloudTrail logs to CloudWatch Logs, which adds latency and complexity; it is not as direct as EventBridge. Option B (AWS Config with Lambda) is not designed for real-time event notification. Option C (EventBridge with Lambda and SES) adds unnecessary Lambda processing since SNS can directly send email when subscribed to the topic.

Answer

Amazon CloudWatch Logs with a metric filter and alarm.

Answer

AWS Config with an AWS Lambda function.

Answer

Amazon CloudWatch Events (Amazon EventBridge) with an AWS Lambda function that sends an email via Amazon SES.

Question 4

A DevOps engineer needs to audit changes to IAM policies over the past 90 days. The engineer wants to see who made the change, what the change was, and when it occurred. Which AWS tool should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct choice because it records all API calls made to the AWS environment, including IAM policy changes, and stores them as events with details such as the identity of the caller (IAM user or role), the time of the request, and the request parameters. By querying CloudTrail logs over the past 90 days, the DevOps engineer can audit who made the change, what the change was (e.g., the specific IAM policy document modification), and when it occurred.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

IAM Access Analyzer

Question 5

A company is using Amazon RDS for MySQL and wants to monitor database connections. They need to set up an alarm when the number of connections exceeds 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric and statistic should be used?

Accepted Answer

DatabaseConnections metric with Average statistic. The Average statistic of the DatabaseConnections metric over a 5-minute period provides a smoothed representation of connection usage, which is appropriate for detecting sustained breaches of the 80% threshold. Using Average reduces sensitivity to transient spikes, ensuring the alarm triggers only when the average number of connections remains above the threshold for the entire evaluation period, aligning with the requirement of 'more than 5 minutes'.

Answer

DatabaseConnections metric with Maximum statistic

Answer

DatabaseConnections metric with Sum and then divide by the number of data points

Answer

DatabaseConnections metric with Sum statistic

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer. They use Amazon CloudFront for content delivery. The DevOps team notices that some requests are returning HTTP 503 errors intermittently. After checking the CloudFront and ALB logs, they find that the errors originate from the ALB. What is the most likely cause?

Accepted Answer

The ALB is experiencing a surge in traffic and is scaling up, but during the scaling activity, some requests are rejected.. When an Application Load Balancer (ALB) experiences a sudden surge in traffic that exceeds its current capacity, it may temporarily reject requests with HTTP 503 errors while it scales up. During the scaling activity, the ALB's target group might not have enough healthy registered targets to handle the load, causing the ALB to return 503 responses until new instances are provisioned and pass health checks. This matches the intermittent nature of the errors described in the scenario.

Answer

The SSL certificate on the ALB is expired.

Answer

The security group for the ALB is blocking traffic from CloudFront.

Answer

CloudFront is configured to forward an HTTP method that the ALB does not support.

Question 7

A DevOps engineer is troubleshooting a slow-running Lambda function. The function processes messages from an SQS queue. Which CloudWatch metric should be examined first to determine if the function is experiencing throttling?

Accepted Answer

Throttles. The Throttles metric directly indicates when Lambda is rejecting invocation requests due to concurrency limits being reached. Since the question asks specifically about throttling, this is the first metric to examine to confirm whether the function is being rate-limited by AWS.

Answer

Invocations

Answer

ConcurrentExecutions

Answer

Duration

Question 8

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Which TWO steps must be taken to achieve this?

Accepted Answer

Add a statement to the KMS key policy that allows CloudWatch Logs to use the key.. To encrypt CloudWatch Logs at rest with a customer-managed KMS key, you must add a statement to the KMS key policy granting CloudWatch Logs permission to use the key (option B). Then, use the put-log-group-encryption API to associate the KMS key with the log group (option E). Option C is incorrect because CloudWatch Logs uses key policies, not grants. Option D is incorrect because you specify the key ARN at the log group level, not per log stream. Option A is incorrect because you do not need to recreate the log group; you can associate the key with an existing log group.

Answer

Recreate the log group after associating the key.

Answer

Create a KMS grant to allow CloudWatch Logs to use the key.

Answer

Specify the KMS key ARN when creating each log stream.

Question 9

A DevOps team is troubleshooting a slow website that uses Amazon CloudFront with an Application Load Balancer as the origin. The team notices that cache hit ratio is low. Which THREE actions are most likely to improve the cache hit ratio?

Accepted Answer

Enable CloudFront Origin Shield to reduce load on the origin and increase cache effectiveness.. CloudFront Origin Shield acts as an additional caching layer that consolidates requests from multiple edge locations, reducing the load on the origin and increasing the likelihood of cache hits by serving cached content from the Origin Shield regional cache. This improves cache effectiveness, especially for origins with high latency or limited capacity.

Answer

Configure CloudFront to forward all cookies to the origin.

Answer

Decrease the default TTL for objects.

Question 10

A company is using Amazon CloudWatch Logs to collect application logs. They need to search and analyze the logs in near real-time. Which TWO AWS services can be used to achieve this?

Accepted Answer

Amazon CloudWatch Logs Insights. Amazon CloudWatch Logs Insights (option A) is correct because it is a purpose-built, interactive query engine within CloudWatch Logs that lets you search, filter, and analyze log data in near real-time using a specialized query syntax, with results returned in seconds. Amazon OpenSearch Service (option E) is also correct because it can ingest CloudWatch Logs (typically via a subscription filter to Lambda or Kinesis) and provides near real-time search, dashboards, and analytics on that log data. Option B, Amazon CloudWatch Synthetics, is wrong because it creates canaries to monitor endpoints and availability, not to search or analyze log content. Option C, Amazon Kinesis Data Analytics, is wrong because it is for running SQL/Flink stream processing over streaming data, not for ad-hoc log search and analysis. Option D, Amazon Athena, is wrong because it queries data in S3 with SQL on a batch/interactive basis and does not natively search CloudWatch Logs in near real-time.

Answer

Amazon CloudWatch Synthetics

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Athena

Question 11

A company is running a production application on Amazon ECS with AWS Fargate. The application has unpredictable traffic patterns and occasionally experiences increased latency. The DevOps team needs to configure scaling based on a custom metric that tracks the number of active user sessions in real time. Which solution will allow the team to scale the ECS service based on this custom metric?

Accepted Answer

Publish the custom metric to Amazon CloudWatch, then create a target tracking scaling policy in Application Auto Scaling for the ECS service.. Application Auto Scaling is the service that scales ECS services, and it supports target tracking policies based on custom CloudWatch metrics. Publishing the custom session-count metric to CloudWatch and then creating a target tracking scaling policy for the ECS service is the correct, fully managed approach.

Answer

Use AWS Auto Scaling to scale the ECS service based on the custom metric.

Answer

Create a CloudWatch dashboard to visualize the metric and manually adjust the service count.

Answer

Use an AWS Lambda function to directly update the desired count of the ECS service based on the metric.

Question 12

A DevOps team is implementing a comprehensive logging strategy for a microservices architecture running on Amazon EKS. They need to collect logs from all containers and send them to a centralized log analytics platform. The solution must be agentless and support multi-line log events. Which approach should the team use?

Accepted Answer

Deploy a Fluent Bit DaemonSet on the EKS cluster and configure it to send logs to Amazon CloudWatch Logs.. Fluent Bit is a lightweight, CNCF-graduated log processor that can be deployed as a DaemonSet on EKS to collect logs from all nodes without requiring sidecar containers. It supports multi-line log events natively via its multiline filter plugin, and it can output directly to Amazon CloudWatch Logs using the cloudwatch_logs output plugin, meeting the agentless requirement since it runs as a Kubernetes DaemonSet rather than as a per-pod sidecar.

Answer

Use the Amazon CloudWatch agent as a sidecar container in each pod to forward logs to CloudWatch Logs.

Answer

Install the Amazon Kinesis Agent on each EC2 instance and configure it to stream logs to Amazon Kinesis Data Firehose.

Answer

Deploy a Fluentd DaemonSet on the EKS cluster and configure it to send logs to Amazon S3.

Question 13

A company uses AWS CloudTrail to log API activity in their AWS account. They need to ensure that any changes to CloudTrail configuration itself are detected and alerted upon in real time. Which service should they use?

Accepted Answer

Use Amazon CloudWatch Events (EventBridge) to create a rule matching the StopLogging or UpdateTrail API calls.. Amazon CloudWatch Events (EventBridge) can monitor CloudTrail API calls in real time by creating a rule that matches specific API calls such as StopLogging or UpdateTrail. When these calls are made, the rule triggers an action (e.g., SNS notification or Lambda function) to alert administrators immediately. This provides the real-time detection required for changes to CloudTrail configuration itself.

Answer

Enable AWS Config rules to monitor CloudTrail configuration changes.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs for changes.

Answer

Enable Amazon GuardDuty to detect changes to CloudTrail.

Question 14

A company is using Amazon RDS for PostgreSQL and wants to monitor the database for performance issues. They need to capture slow queries and analyze them over time. Which combination of AWS services should they use?

Accepted Answer

Enable RDS Performance Insights and Enhanced Monitoring.. RDS Performance Insights provides a database performance schema with detailed wait events and SQL-level metrics to identify slow queries, while Enhanced Monitoring offers OS-level metrics (CPU, memory, disk I/O) at sub-minute granularity. Together, they allow you to capture and analyze slow queries over time without additional log parsing or export overhead.

Answer

Enable RDS Event notifications to send alerts for performance issues.

Answer

Enable CloudWatch Logs for PostgreSQL and export logs to Amazon S3.

Answer

Use CloudWatch Metrics to monitor database connections and CPU utilization.

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team needs to centrally monitor and analyze VPC Flow Logs from all accounts. The solution must be cost-effective and allow querying across accounts. Which approach should they take?

Accepted Answer

Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.. It uses a centralized Amazon S3 bucket to aggregate VPC Flow Logs from all accounts, which is cost-effective (S3 storage costs are low) and enables cross-account querying via Amazon Athena using standard SQL. This approach avoids per-ingestion costs of services like CloudWatch Logs or Kinesis and provides a serverless, scalable query engine for analyzing logs across accounts.

Answer

Use Amazon Elasticsearch Service (Amazon OpenSearch Service) with a cross-account ingestion pipeline.

Answer

Stream VPC Flow Logs from each account to Amazon Kinesis Data Analytics for real-time analysis.

Answer

Configure each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription.