DOP-C02 Monitoring and Logging Practice Test 11 — 15 Questions

Question 1

A DevOps team is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a custom application. The team notices that logs are missing from some instances intermittently. The CloudWatch agent configuration is identical across all instances. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent's state file has become corrupted due to disk full condition. Option B is correct because the CloudWatch agent will stop sending logs if the disk space dedicated to the log buffer is full, which can happen if the destination log group or stream is throttled. Option A is wrong because VPC Flow Logs do not affect CloudWatch Logs. Option C is wrong because IAM roles are typically checked at startup, and intermittent issues are unlikely. Option D is wrong because CPU utilization does not directly cause log loss; the agent prioritizes logs.

Answer

The VPC Flow Logs are consuming all available network bandwidth

Answer

The EC2 instances are running out of CPU credits, causing the agent to skip log batches

Answer

The IAM role attached to the instances has been rotated incorrectly

Question 2

A company is using AWS CloudFormation to deploy a microservices architecture. The operations team wants to receive real-time notifications when any stack operation fails. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Options A and E are correct. CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack events and trigger an SNS topic to send notifications. Option B is wrong because Lambda alone doesn't provide notifications. Option C is wrong because CloudTrail is for API auditing, not real-time notification. Option D is wrong because CloudWatch Logs doesn't trigger SNS directly for stack events.

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 3

A DevOps engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must collect logs from all accounts into a centralized Amazon S3 bucket for analysis. Which THREE steps are required to set up this centralized logging?

Accepted Answer

Create an S3 bucket in the central logging account with bucket policies allowing cross-account writes. Options A, B, and D are correct. Creating a log archive bucket with appropriate cross-account permissions, enabling CloudTrail in all accounts with the same S3 bucket, and configuring CloudWatch Logs to export to the centralized bucket. Option C is wrong because VPC Flow Logs are not required for all accounts. Option E is wrong because Kinesis is not necessary; S3 is sufficient.

Answer

Enable VPC Flow Logs for all VPCs in every account and send them to the centralized bucket

Answer

Set up Amazon Kinesis Data Streams in the central account to ingest logs from all accounts

Question 4

A company is running a critical application on Amazon ECS with Fargate launch type. The application writes logs to Amazon CloudWatch Logs. The DevOps team needs to set up an alert when the application generates more than 100 error logs in any 5-minute window. Which configuration should be used?

Accepted Answer

Create a CloudWatch Logs metric filter for 'ERROR' and a CloudWatch alarm on the resulting metric with a period of 5 minutes. Option D is correct because a CloudWatch Logs metric filter can parse logs for the word 'ERROR' and create a custom metric, and a CloudWatch alarm can be set on that metric. Option A is wrong because CloudWatch Logs Insights is for querying, not real-time alerting. Option B is wrong because EventBridge can't directly parse log contents. Option C is wrong because CloudTrail is for API calls.

Answer

Create a CloudWatch Logs Insights query that runs every 5 minutes and triggers an SNS notification

Answer

Create an Amazon EventBridge rule that matches CloudWatch Logs events for the word 'ERROR' and triggers an alarm

Answer

Enable AWS CloudTrail logging for the ECS task and create a metric filter on CloudTrail logs

Question 5

A DevOps engineer is troubleshooting an issue where an Amazon RDS for MySQL instance is experiencing high latency. The engineer wants to identify which queries are causing the problem. Which AWS service should be used?

Accepted Answer

Amazon RDS Performance Insights. Option B is correct because RDS Performance Insights provides a database performance tuning and monitoring feature that allows you to assess the load on your database and determine when and where to take action. Option A is wrong because CloudWatch metrics show aggregate performance, not per-query. Option C is wrong because CloudTrail records API calls. Option D is wrong because VPC Flow Logs capture network traffic.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Metrics

Answer

VPC Flow Logs

Question 6

A company uses AWS Lambda functions to process data from an Amazon SQS queue. The Lambda function sometimes fails due to timeouts. The DevOps team wants to monitor the number of function timeouts and receive alerts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure a CloudWatch alarm on the 'Timeouts' metric from AWS/Lambda namespace. Option D is correct because Lambda automatically publishes 'Timeout' metrics to CloudWatch, and a CloudWatch alarm can be configured on that metric. Option A is wrong because CloudWatch Logs Insights requires querying logs, which is not real-time. Option B is wrong because EventBridge can capture Lambda events but requires creating a rule and target. Option C is wrong because X-Ray is for tracing, not metrics.

Answer

Create an Amazon EventBridge rule that captures Lambda execution results and triggers an SNS topic

Answer

Enable AWS X-Ray on the Lambda function and analyze traces for timeouts

Answer

Create a CloudWatch Logs Insights query to search for 'Task timed out' and run it periodically

Question 7

A DevOps team is using Amazon CloudWatch Synthetics canaries to monitor the availability of a web application. The canary is configured to run every 5 minutes. The team notices that the canary fails occasionally but the application is healthy. Which action will help identify if the failures are due to network issues between the canary and the application?

Accepted Answer

Configure the canary to run inside the same VPC as the application using a VPC endpoint. Option C is correct because CloudWatch Synthetics canaries support the use of VPC endpoints or placement within a VPC to run from the same network environment as the application, allowing canary failures due to network issues to be distinguished from application issues. Option A is wrong because X-Ray traces the application, not the canary. Option B is wrong because VPC Flow Logs capture network metadata but are not directly integrated with canaries. Option D is wrong because enabling detailed CloudWatch metrics on the ALB does not isolate canary network issues.

Answer

Enable VPC Flow Logs for the canary's VPC and analyze the logs for dropped packets

Answer

Enable AWS X-Ray tracing on the canary to trace the request path

Answer

Increase the canary's memory and timeout settings to reduce false positives

Question 8

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Use the CloudWatch Logs console or API to associate the KMS key with the log group. Options A and C are correct. To encrypt CloudWatch Logs with a customer-managed KMS key, you must first create the KMS key and then associate it with the log group using the CloudWatch Logs console or API. Option B is wrong because you cannot associate a key with a log stream directly; it's at the log group level. Option D is wrong because CloudWatch Logs does not support default encryption with a KMS key at the account level. Option E is wrong because the key policy must allow CloudWatch Logs to use the key, but the key policy is set on the key itself, not on the log group.

Answer

Enable default encryption for CloudWatch Logs in the AWS account settings

Answer

Update the log group's resource policy to reference the KMS key

Answer

Associate the KMS key with each log stream individually

Question 9

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an auto scaling action when the queue depth exceeds a threshold. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Option D is correct because CloudWatch can monitor the ApproximateNumberOfMessagesVisible metric from SQS, and a CloudWatch alarm can trigger an auto scaling policy based on that metric. Option A is wrong because SQS does not directly invoke Lambda for scaling. Option B is wrong because EventBridge can capture SQS events but is not the standard way to trigger auto scaling. Option C is wrong because CloudWatch Logs does not directly trigger auto scaling.

Answer

Amazon CloudWatch Logs and Amazon EC2 Auto Scaling

Answer

Amazon EventBridge and Amazon EC2 Auto Scaling

Answer

Amazon SQS and AWS Lambda

Question 10

A company is using AWS CloudFormation to manage infrastructure. The DevOps team wants to receive notifications when CloudFormation stack creation fails. Which AWS service should be used to capture the stack failure event and send a notification?

Accepted Answer

Amazon EventBridge. Option B is correct because Amazon EventBridge can capture CloudFormation stack events (such as CREATE_FAILED) and route them to an SNS topic for notification. Option A is wrong because CloudWatch Logs stores logs but does not directly send notifications. Option C is wrong because CloudTrail records API calls but is not the most efficient for real-time notifications. Option D is wrong because SQS is a queue, not a notification service.

Answer

Amazon SQS

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 11

A company is running a production application on Amazon ECS with Fargate. The DevOps team needs to monitor the application's performance and set up alerts for high memory usage. Which THREE steps should the team take to achieve this?

Accepted Answer

Create a custom CloudWatch metric and publish memory usage data from the application. Options B, C, and E are correct. To monitor memory usage in ECS Fargate, you must enable the ECS task metadata endpoint, which allows the container to publish memory metrics to CloudWatch. Then create a custom CloudWatch metric from the container, and set up a CloudWatch alarm on that metric. Option A is wrong because Container Insights requires the CWAgent configuration. Option D is wrong because CloudWatch does not automatically collect memory metrics from Fargate; custom metrics are needed.

Answer

Configure CloudWatch to automatically collect memory metrics from Fargate tasks

Answer

Enable Amazon CloudWatch Container Insights for the ECS cluster

Question 12

A DevOps engineer is troubleshooting an application that runs on Amazon EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. CloudWatch metrics for the ALB show an increase in 'HTTPCode_ELB_5XX_Count' but the backend 'HealthyHostCount' remains stable. Which action should the engineer take to identify the root cause?

Accepted Answer

Enable and review the ALB access logs stored in Amazon S3 to analyze the HTTP response codes and request patterns.. Option C is correct because increasing the ALB's idle timeout will not help if requests are taking longer than the timeout. Option A is wrong because it would only help if there were autoscaling issues. Option B is wrong because the backend is healthy, so the issue is likely with the ALB configuration. Option D is correct because checking ALB access logs can reveal the exact requests that are failing, allowing analysis of latency or errors.

Answer

Increase the size of the EC2 instances to handle more requests.

Answer

Enable detailed CloudWatch metrics on the EC2 instances to monitor CPU and memory.

Answer

Increase the idle timeout setting on the ALB.

Question 13

A company uses AWS CloudTrail to monitor API activity. The DevOps team needs to ensure that any deletion of an S3 bucket is detected in real time and triggers an automated response. Which combination of AWS services should be used to meet these requirements?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a CloudWatch Events rule matching the DeleteBucket event, and target a Lambda function.. Option B is correct because CloudTrail logs can be sent to CloudWatch Logs, which can trigger a CloudWatch Events rule (now Amazon EventBridge) to invoke a Lambda function for automated response. Option A is wrong because S3 does not natively trigger on bucket deletion. Option C is wrong because CloudWatch Logs alone cannot trigger a response without a subscription filter or metric alarm. Option D is wrong because CloudTrail does not directly invoke Lambda; it must go through CloudWatch Logs or EventBridge.

Answer

Use CloudWatch Logs to monitor the logs, and create a metric filter to trigger an alarm when the DeleteBucket event appears.

Answer

Configure S3 event notifications to send to an SQS queue, and poll the queue with a Lambda function.

Answer

Configure CloudTrail to deliver logs to an S3 bucket, and use S3 event notifications to invoke a Lambda function.

Question 14

A company is running a critical application on Amazon RDS for PostgreSQL. The DevOps team needs to set up monitoring to detect when database connections exceed 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric should be used to create an alarm?

Accepted Answer

DatabaseConnections. Option A is correct because the DatabaseConnections metric shows the number of connections to the DB instance. Option B is wrong because CPUUtilization measures CPU usage, not connections. Option C is wrong because FreeableMemory measures available memory. Option D is wrong because DiskQueueDepth measures disk I/O.

Answer

FreeableMemory

Answer

CPUUtilization

Answer

DiskQueueDepth

Question 15

A company uses Amazon ECS with Fargate for containerized applications. The DevOps team notices that some tasks are failing with 'OutOfMemoryError' but the CloudWatch metric 'MemoryUtilization' for the service shows values well below the task memory limit. What is the most likely cause of this discrepancy?

Accepted Answer

The container's memory usage is hitting the kernel's memory cgroup limit before the Docker-reported usage reaches the task memory limit.. Option D is correct because the MemoryUtilization metric reported by ECS is based on the container's memory usage as seen by the Docker daemon, but the Linux kernel's Out-Of-Memory (OOM) killer may terminate the container if the task's soft memory limit is exceeded, even if the reported utilization is below the hard limit. Option A is wrong because memory limits are defined in the task definition, not by ECS automatically. Option B is wrong because memory is allocated per task, not per container, and the task memory limit is the total. Option C is wrong because swap is not typically used in Fargate.

Answer

The CloudWatch metric 'MemoryUtilization' is aggregated across all tasks in the service, so individual task spikes are averaged out.

Answer

The task definition has a memory reservation but no hard limit, causing ECS to overcommit memory.

Answer

The container is using swap space, which is not included in the MemoryUtilization metric.