DOP-C02 Monitoring and Logging Practice Test 11 — 15 Questions

Question 1

A DevOps engineer needs to set up a monitoring solution for an AWS Lambda function that processes messages from an Amazon SQS queue. The engineer wants to be alerted if the function fails to process a message (i.e., the message ends up in the dead-letter queue). Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch alarm on the ApproximateNumberOfMessagesVisible metric of the dead-letter queue.. The `ApproximateNumberOfMessagesVisible` metric on the dead-letter queue (DLQ) directly reflects the number of messages that have failed processing and been moved there. By creating a CloudWatch alarm on this metric (e.g., when it exceeds 0 for a period), the engineer receives an alert precisely when messages are failing, without needing to parse logs or rely on indirect indicators.

Answer

Enable CloudTrail to log SQS API calls and create a metric filter for SendMessage to the DLQ.

Answer

Create a CloudWatch Events rule to monitor the Lambda function errors.

Answer

Configure the Lambda function's dead-letter queue to send notifications via Amazon SNS.

Question 2

A company runs a web application behind an Application Load Balancer (ALB) in a production AWS account. The DevOps team needs to analyze HTTP request patterns and identify the top IP addresses generating errors. They want to store the data cost-effectively for querying with SQL. Which solution meets these requirements?

Accepted Answer

Enable ALB access logs and store them in Amazon S3, then use Amazon Athena to query the logs with SQL.. ALB access logs provide detailed HTTP request data (including source IP, request URI, response code, etc.) and are stored in Amazon S3, which is cost-effective for long-term storage. Amazon Athena allows querying these logs directly with standard SQL without needing to load data into a database, meeting the requirement for SQL-based analysis of top IP addresses generating errors.

Answer

Use CloudWatch Metrics to monitor error rates and top IPs via custom metrics.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query the logs.

Answer

Stream the ALB logs to Amazon Kinesis Data Analytics and use SQL applications.

Question 3

A DevOps engineer is tasked with ensuring that all Amazon S3 buckets in the account have server access logging enabled. The engineer needs to be automatically notified when a new bucket is created without logging enabled. Which AWS service should they use?

Accepted Answer

Use AWS Config with a managed rule to check if S3 bucket logging is enabled, and configure an SNS topic for notifications.. AWS Config provides continuous monitoring and evaluation of your AWS resource configurations. By using the managed rule 's3-bucket-server-access-logging-enabled', AWS Config can automatically check all S3 buckets (including newly created ones) for server access logging. When a bucket is non-compliant, AWS Config can trigger an SNS notification to alert the DevOps engineer, meeting the requirement for automatic notification without custom code.

Answer

Use AWS CloudTrail to detect CreateBucket API calls and trigger a Lambda function to check logging.

Answer

Use AWS Trusted Advisor to check S3 bucket logging and send notifications via Amazon SNS.

Answer

Use Amazon S3 Event Notifications to trigger a Lambda function when a new bucket is created.

Question 4

A company is using Amazon CloudWatch Logs to collect logs from multiple EC2 instances. They need to filter logs in real time and send specific log events to a custom application for processing. Which TWO services can they use to achieve this?

Accepted Answer

Configure a CloudWatch Logs subscription filter that invokes an AWS Lambda function.. Option B is correct because a CloudWatch Logs subscription filter performs real-time filtering of log events and can deliver matching events directly to AWS Lambda, which then runs the custom application logic for processing. Option D is correct because a subscription filter can also stream filtered log events to Amazon Kinesis Data Firehose, which reliably delivers them to a custom destination for processing. Option A is incorrect because Kinesis Data Analytics analyzes streaming data but is not a CloudWatch Logs subscription destination for real-time log filtering. Option C is incorrect because CloudWatch Events (EventBridge) rules react to AWS service events, not individual CloudWatch Logs log events, and cannot filter log events to SQS. Option E is incorrect because S3 event notifications only trigger on object creation in S3 and do not provide real-time filtering of CloudWatch Logs streams.

Answer

Use Amazon Kinesis Data Analytics to process the log stream.

Answer

Create a CloudWatch Events rule to capture log events and send them to Amazon SQS.

Answer

Use Amazon S3 event notifications to trigger a Lambda function on new log files.

Question 5

A DevOps engineer is setting up centralized logging for a multi-account environment using AWS Organizations. The engineer needs to aggregate logs from all accounts into a single Amazon S3 bucket. Which TWO steps are necessary?

Accepted Answer

Create a bucket policy on the central S3 bucket that grants permissions to the source accounts.. A bucket policy on the central S3 bucket can grant cross-account permissions to source accounts to write logs. This allows services like CloudTrail and VPC Flow Logs from member accounts to deliver logs directly to the central bucket without requiring IAM roles in each account for reading logs.

Answer

Create IAM roles in each account to allow the central bucket to read logs.

Answer

Enable CloudTrail organization trail in the management account to deliver logs to the central bucket.

Answer

Set up a cross-account subscription in CloudWatch Logs to forward logs to the central account.

Question 6

A company uses Amazon CloudWatch Synthetics canaries to monitor endpoint availability. The canaries are failing intermittently with timeout errors. The DevOps team needs to diagnose the issue. Which THREE aspects should they investigate?

Accepted Answer

The canary script execution time and memory usage.. Canary scripts have a maximum execution time of 5 minutes (300 seconds) and a memory limit of 1 GB. If the script execution time or memory usage exceeds these limits, the canary will fail with a timeout error. Investigating these metrics in CloudWatch can reveal whether the script is too resource-intensive or slow, causing the intermittent failures.

Answer

The canary schedule and frequency.

Answer

CloudWatch Logs retention policy for the canary logs.

Question 7

Refer to the exhibit. A DevOps engineer runs the AWS CLI command to get the average TargetResponseTime for an ALB over a 1-hour period. The output shows only three datapoints. What is the most likely reason?

Accepted Answer

The ALB did not receive any requests during most of the 5-minute periods.. The command uses a period of 300 seconds (5 minutes), so over a 1-hour period we expect 12 data points if the metric is consistently reported. However, TargetResponseTime is only emitted when the ALB receives at least one request in that interval. The output shows only three data points, indicating that for the majority of the 5-minute periods, the ALB received no requests, so no metric data was published. Option A correctly identifies this. Option B is incorrect because TargetResponseTime is a valid metric for Application Load Balancers. Option C is incorrect because the command appears to include the necessary parameters to retrieve the average. Option D is incorrect because a 300-second period is standard; using a smaller period would not produce more data points if there are no requests.

Answer

The metric TargetResponseTime is not available for Application Load Balancers.

Answer

The command is missing the 'Statistics' parameter with 'Average'.

Answer

The period of 300 seconds is too large; a smaller period should be used.

Question 8

A company is running a production web application on Auto Scaling EC2 instances behind an ALB. They have enabled detailed CloudWatch metrics on the EC2 instances and enabled CloudTrail. Recently, users reported intermittent 503 errors. The operations team reviews CloudWatch dashboards but sees no spike in CPU or memory. What is the MOST likely cause of the 503 errors?

Accepted Answer

The target group has an insufficient number of healthy instances due to health check failures. ALB returns HTTP 503 when no healthy targets are available in the target group to serve the request. If health checks are failing intermittently — due to application-level issues, misconfigured health check paths, or slow responses — targets are marked unhealthy and removed from rotation, leaving insufficient capacity and producing 503s. Because CPU and memory show no spike, the cause is not resource saturation but target availability.

Answer

Insufficient CloudTrail logging trail configuration

Answer

Detailed monitoring is disabled for the EC2 instances

Answer

The security group for the ALB is misconfigured

Question 9

A DevOps engineer is tasked with centralizing logs from multiple AWS accounts into a single Amazon OpenSearch Service domain. The engineer sets up Amazon Kinesis Data Firehose to deliver logs from each account to the OpenSearch domain. However, some accounts show failed deliveries in the Firehose console. Which configuration is MOST likely causing the failures?

Accepted Answer

The IAM role assumed by Firehose in each account does not have permissions to write to the cross-account OpenSearch domain. The most likely cause of failed deliveries is that the IAM role assumed by Kinesis Data Firehose in each source account lacks the necessary permissions to write to the cross-account Amazon OpenSearch Service domain. Firehose uses a service-linked or custom IAM role to perform actions such as `es:ESHttpPut` and `es:ESHttpPost` against the OpenSearch domain endpoint. Without explicit cross-account trust and resource-based policy allowing the Firehose role's ARN, the delivery will fail with an authorization error.

Answer

The source accounts do not have a CloudWatch Logs subscription filter to send logs to Firehose

Answer

The Kinesis Data Streams used as the Firehose source is not encrypted

Answer

The OpenSearch domain's access policy does not allow access from the S3 bucket used by Firehose

Question 10

A company wants to monitor CPU utilization of its EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service to monitor CPU utilization of EC2 instances and trigger an alert when the metric exceeds a threshold for a specified period. CloudWatch collects metrics from EC2 instances, and alarms can be configured to watch a metric over a time period and perform actions (e.g., send an SNS notification) when the threshold is breached. This directly matches the requirement.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 11

A DevOps engineer notices that an Amazon RDS for MySQL instance's CPU is consistently high during business hours. The engineer wants to identify the specific queries causing the high CPU. Which combination of services should be used to capture and analyze the queries? (Choose the best answer.)

Accepted Answer

Enable RDS Performance Insights and analyze the top SQL queries. RDS Performance Insights provides a database performance tuning feature that visualizes database load and identifies the specific SQL queries causing high CPU. It captures query-level metrics such as wait events, SQL digest, and host/user information, allowing the DevOps engineer to pinpoint the exact queries responsible for the CPU spike during business hours.

Answer

Enable RDS Enhanced Monitoring and view metrics in CloudWatch

Answer

Enable AWS X-Ray tracing on the application and database

Answer

Enable RDS audit logs and stream them to Amazon CloudWatch Logs

Question 12

An organization wants to ensure that all API calls made in their AWS account are logged for security analysis. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that logs all API calls made in an AWS account, providing a record of actions taken by users, roles, or AWS services. It captures API activity across the AWS Management Console, SDKs, CLI, and other services. Enabling CloudTrail meets the requirement to log all API calls for security analysis.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 13

A company uses Amazon CloudWatch Logs to store application logs. A DevOps engineer needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which approach is the MOST efficient and cost-effective?

Accepted Answer

Use CloudWatch Logs Insights to run a query that counts ERROR entries across all log groups and add the query to a CloudWatch dashboard. CloudWatch Logs Insights allows you to run a query across all log groups in real time using a single query, and you can add that query directly to a CloudWatch dashboard. This approach is both efficient (no need to create per-log-group metric filters) and cost-effective (you pay only for the data scanned by the query, not for ongoing metric filter evaluation).

Answer

Create a CloudWatch Logs metric filter for each log group to count ERROR entries, and then create a CloudWatch dashboard

Answer

Export logs to Amazon S3 and use Amazon Athena to query and visualize in Amazon QuickSight

Answer

Create a Kinesis Data Firehose delivery stream to stream logs to Amazon OpenSearch Service and build a dashboard in OpenSearch Dashboards

Question 14

A company runs a fleet of EC2 instances behind an Auto Scaling group. The DevOps team wants to detect and respond to memory leaks in their application. They have configured CloudWatch agent to collect memory metrics. However, the metric shows unpredictable spikes. The team needs to correlate these spikes with application logs to identify the root cause. Which solution provides the BEST correlation?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns around the time of memory spikes. CloudWatch Logs Insights allows you to query application logs directly in CloudWatch Logs using a purpose-built query language. By filtering logs around the timestamps of memory spikes, you can correlate specific error patterns or log entries with the metric data, enabling root cause analysis without moving data or adding complexity.

Answer

Export the memory metric and application logs to Amazon S3 and use Amazon Athena to join them

Answer

Enable AWS X-Ray on the application to trace requests and identify memory-heavy requests

Answer

Use Amazon EventBridge to capture EC2 instance state changes and correlate with memory spikes

Question 15

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an Auto Scaling policy to add more EC2 instances when the queue depth exceeds a threshold. Which CloudWatch metric should the alarm use?

Accepted Answer

ApproximateNumberOfMessagesVisible. (ApproximateNumberOfMessagesVisible) is the correct metric because it represents the number of messages available to be retrieved from the queue. When this number exceeds a threshold, it indicates that consumer EC2 instances are not keeping up, so an Auto Scaling policy can add more instances to handle the load. Option A (NumberOfMessagesSent) is a count of messages sent, not the current queue depth. Option B (ApproximateNumberOfMessagesNotVisible) represents messages that are in flight (being processed) and not available for retrieval. Option D (SentMessageSize) is the size of messages sent, not the count. Therefore, C is correct.

Answer

NumberOfMessagesSent

Answer

ApproximateNumberOfMessagesNotVisible

Answer

SentMessageSize