DOP-C02 Monitoring and Logging Practice Test 12 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL and wants to monitor slow queries to optimize performance. Which actions should the DevOps engineer take to capture and analyze slow query logs? (Choose THREE.)

Accepted Answer

Enable the slow query log parameter in the RDS DB parameter group. To capture and analyze slow query logs in Amazon RDS for MySQL, the DevOps engineer should enable the slow query log parameter in the DB parameter group (B), configure RDS to publish logs to Amazon CloudWatch Logs (D), and use CloudWatch Logs Insights to query and analyze the logs (E). Option A (CloudTrail) captures API activity, not SQL queries. Option C (Performance Insights) monitors database performance metrics but does not capture slow query logs.

Answer

Use AWS CloudTrail to capture SQL queries

Answer

Enable RDS Performance Insights

Question 2

A company is using AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails. Which services can be used together to send an email notification on stack failure? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS (Option C) is correct because it can send email notifications to subscribers when a CloudFormation stack creation fails. AWS CloudFormation (Option D) is correct because it can directly publish failure events to an SNS topic via the 'NotificationARNs' parameter in stack creation, enabling automated email alerts without additional services.

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon CloudWatch

Question 3

A DevOps engineer notices that a CloudWatch alarm for high CPU utilization on an EC2 instance is not triggering despite the CPU consistently above the threshold. The instance is in a VPC with a public subnet and has internet access. What is the most likely cause?

Accepted Answer

The instance is using basic monitoring (5-minute intervals) which delays the alarm.. With basic monitoring, EC2 metrics are published to CloudWatch every 5 minutes. If the CloudWatch alarm is configured with a period shorter than 5 minutes (e.g., 1 minute), it will never receive metric data points at that interval, so the alarm cannot evaluate and trigger. Even though the CPU is consistently above the threshold, the alarm never fires because it is missing data. Option A is incorrect because CloudWatch can collect metrics from instances without a public IP via a VPC endpoint. Option C is incorrect because CPU utilization metrics are standard metrics sent automatically by the hypervisor and do not require any IAM permissions on the instance. Option D is incorrect because the instance is running and sending data, so the alarm state would not be INSUFFICIENT_DATA; if it were, the alarm would show that state, not fail to trigger.

Answer

The EC2 instance does not have a public IP address.

Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.

Answer

The CloudWatch alarm is in the 'INSUFFICIENT_DATA' state because the instance is stopped.

Question 4

An application running on Amazon ECS Fargate writes logs to CloudWatch Logs. The logs include sensitive data such as credit card numbers, which must be masked before storage. What is the most cost-effective solution that requires the least operational overhead?

Accepted Answer

Use a CloudWatch Logs subscription filter to invoke an AWS Lambda function that masks sensitive data and writes the sanitized logs to a different log group.. CloudWatch Logs subscription filters can invoke a Lambda function in real-time as logs are ingested, allowing the function to mask sensitive data (e.g., credit card numbers) and write the sanitized logs to a different log group. This approach requires no additional infrastructure, no streaming services, and no changes to the application code, making it the most cost-effective and operationally lightweight solution.

Answer

Stream logs to Amazon Kinesis Data Firehose with a Lambda transformation, then deliver to CloudWatch Logs.

Answer

Configure a CloudWatch Logs subscription to stream logs to Amazon S3, and use S3 Object Lambda to mask data on retrieval.

Answer

Deploy a sidecar container in the ECS task that reads logs from stdout, masks data, and sends to CloudWatch Logs.

Question 5

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The DevOps team wants to detect and alert on any IAM user who creates an access key and then uses it to make API calls within 24 hours, as this may indicate a compromised account. Which combination of actions should be taken to achieve this with minimal latency?

Accepted Answer

Enable S3 Event Notifications on the CloudTrail S3 bucket to invoke a Lambda function that processes new log files and checks for the pattern.. CloudTrail delivers logs to S3 within about 15 minutes; using S3 Events to trigger a Lambda that analyzes the logs in near-real-time allows detection within the 24-hour window. Option A is wrong because CloudWatch Logs Insights queries are not real-time and require logs to be streamed to CloudWatch Logs, which adds latency. Option B is wrong because Athena is not real-time. Option C is wrong because EventBridge can detect API calls but cannot correlate the creation of a key with its subsequent use in a single rule; it would require complex pattern matching.

Answer

Use Amazon Athena to query CloudTrail logs in S3 every hour and send alerts for matches.

Answer

Create an Amazon EventBridge rule that matches CreateAccessKey and any subsequent API call from the same user within 24 hours.

Answer

Stream CloudTrail logs to CloudWatch Logs and create a metric filter to detect the pattern, then set an alarm.

Question 6

A DevOps engineer needs to monitor the memory utilization of an Amazon RDS for MySQL instance. Which AWS service should be used to collect and visualize this metric?

Accepted Answer

Enhanced Monitoring for RDS.. Enhanced Monitoring for RDS provides memory, CPU, and other OS-level metrics, sending them to CloudWatch Logs for visualization via CloudWatch dashboards. Option A is incorrect because CloudWatch default metrics for RDS do not include memory utilization; Enhanced Monitoring is required. Option B is incorrect because AWS Systems Manager Inventory collects software inventory and system configuration from EC2 instances, not RDS memory metrics. Option D is incorrect because AWS Trusted Advisor provides best-practice checks and recommendations, not real-time memory monitoring.

Answer

CloudWatch default metrics for RDS.

Answer

AWS Systems Manager Inventory.

Answer

AWS Trusted Advisor.

Question 7

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The DevOps team wants to monitor the end-to-end latency of API requests, including the time spent in API Gateway and Lambda. Which approach provides the most granular breakdown?

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. AWS X-Ray provides end-to-end tracing with detailed segments for API Gateway and Lambda, allowing per-request breakdown of latency across each component. Option A (Lambda Insights) offers OS-level metrics like CPU and memory, not request-level latency breakdown. Option C (VPC Flow Logs) captures network traffic metadata but not application layer latency. Option D (combining CloudWatch metrics) only gives aggregate statistics and cannot break down latency per request or within a single request's path.

Answer

Enable Lambda Insights to get per-request latency breakdown.

Answer

Enable VPC Flow Logs to capture network round-trip times.

Answer

Use CloudWatch metrics for API Gateway and Lambda, then add them together.

Question 8

A company has a production Amazon EKS cluster with multiple node groups. The DevOps team notices that some pods are frequently restarting due to OOMKilled errors, but the cluster-level metrics (CPU, memory) appear normal. Which CloudWatch Container Insights metric should be analyzed to identify the specific node or pod causing the issue?

Accepted Answer

pod_memory_utilization.. Container Insights provides pod-level memory utilization metrics (pod_memory_utilization) that can pinpoint which pod is exceeding its memory limit, causing OOMKilled errors. Option A (node_memory_utilization) is aggregate at node level and may not show individual pod issues. Option B (number_of_running_pods) does not indicate memory usage. Option D (pod_cpu_utilization) is for CPU, not memory.

Answer

node_memory_utilization.

Answer

number_of_running_pods.

Answer

pod_cpu_utilization.

Question 9

A DevOps engineer needs to centrally collect and analyze logs from multiple AWS accounts and on-premises servers. Which AWS service should be used to aggregate logs in a single dashboard?

Accepted Answer

Amazon CloudWatch Logs.. Amazon CloudWatch Logs is the correct service to centrally collect and analyze logs from multiple AWS accounts and on-premises servers in a single dashboard. It supports cross-account log aggregation via subscription filters and can visualize logs using CloudWatch Logs Insights. Option A (Amazon Athena) is a query service for S3 data, not a dashboard. Option B (Amazon S3) is an object storage service, not a dashboard. Option D (Amazon Kinesis Data Firehose) is a streaming data delivery service, not a dashboard.

Answer

Amazon Athena.

Answer

Amazon S3.

Answer

Amazon Kinesis Data Firehose.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails due to a resource limit exceeded error. Which approach should be used?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack, and subscribe an email endpoint.. CloudFormation natively supports sending stack events (including creation failures) to an SNS topic. By configuring an SNS topic as a notification option in the stack creation request, the DevOps team can subscribe an email endpoint to receive real-time notifications when a resource limit exceeded error occurs, without needing additional services or custom logic.

Answer

Create an Amazon EventBridge rule that matches CloudFormation resource limit exceeded events and sends to SQS.

Answer

Use AWS Config to detect when a stack is in a failed state.

Answer

Enable CloudTrail and create a CloudWatch alarm on the CreateStack API call.

Question 11

A DevOps team is troubleshooting a performance issue where an Amazon RDS for PostgreSQL instance's CPU utilization spikes every hour. The team suspects a specific query from an application. Which combination of tools can identify the problematic query?

Accepted Answer

Amazon RDS Performance Insights and Enhanced Monitoring.. Amazon RDS Performance Insights identifies the top SQL queries consuming database load, and Enhanced Monitoring provides OS-level metrics (CPU, memory, etc.) to correlate with query performance. Option A is wrong because CloudWatch Logs Insights can analyze application logs if the query logs are shipped, but CloudWatch metrics alone do not show individual queries. Option C is wrong because VPC Flow Logs capture network traffic metadata, not database queries. Option D is wrong because CloudTrail records AWS API calls (e.g., RDS Start/Stop), not SQL queries within the database.

Answer

CloudWatch Logs Insights and CloudWatch metrics.

Answer

VPC Flow Logs and Lambda.

Answer

CloudTrail and CloudWatch alarms.

Question 12

A DevOps engineer wants to monitor the health of an Auto Scaling group and receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon EventBridge.. The correct answers are C (Amazon EventBridge) and D (Amazon SNS). Amazon EventBridge can capture Auto Scaling lifecycle events (such as instance launch and termination) and route them to Amazon SNS, which sends notifications (e.g., email or SMS). AWS CloudTrail (A) logs API calls but does not trigger real-time notifications. AWS Config (B) records configuration changes but is not designed for event-driven notifications. AWS Lambda (E) could be used as a target, but it is not required because EventBridge can directly invoke SNS.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Lambda.

Question 13

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search across multiple log groups and visualize trends. Which TWO services can be used together to achieve this?

Accepted Answer

CloudWatch Logs Insights.. Options A and E are correct. CloudWatch Logs Insights can query across multiple log groups using a SQL-like query language, and CloudWatch Dashboards can visualize the results by adding graphs and widgets. Option B (Amazon Elasticsearch Service with Kibana) is not directly integrated with CloudWatch Logs for real-time querying; it requires setting up subscriptions and additional infrastructure. Option C (Amazon Athena) queries data in Amazon S3, not directly in CloudWatch Logs. Option D (Amazon QuickSight) is a business intelligence tool that typically requires data in S3 or a database, and is not optimized for direct CloudWatch Logs querying.

Answer

Amazon Elasticsearch Service with Kibana.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Question 14

A DevOps engineer is designing a centralized logging solution for 10 AWS accounts. Logs must be stored in a central S3 bucket with encryption and access logging. Which THREE services/resources are required to meet these requirements?

Accepted Answer

AWS CloudTrail.. To meet the requirements, three services are needed: AWS CloudTrail for logging API activity across accounts and delivering logs to a central S3 bucket; AWS KMS customer managed key to encrypt the logs at rest in S3; and Amazon S3 server access logs to record requests made to the central S3 bucket for auditing. Option A (AWS Config) is not required for centralized logging; it focuses on resource configuration compliance, not log delivery. Option D (Amazon CloudWatch Logs) is not directly required for storage in S3, as CloudTrail can deliver directly to S3 without CloudWatch Logs.

Answer

AWS Config.

Answer

Amazon CloudWatch Logs.

Question 15

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance fails to write logs to CloudWatch Logs in the log group 'MyAppLogs'. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on the log stream resource.. To write logs to CloudWatch Logs, the IAM policy must grant permissions on both the log group and the log stream resources. The policy likely specifies only the log group ARN (e.g., 'arn:aws:logs:region:account-id:log-group:MyAppLogs') but omits the log stream ARN (e.g., 'arn:aws:logs:region:account-id:log-group:MyAppLogs:log-stream:*'). CloudWatch Logs requires permissions on the log stream for actions like PutLogEvents. Option B is incorrect because the CloudWatch agent is not mandatory; the AWS SDK can be used directly. Option C is incorrect because the region in the resource ARN is specified correctly (assuming it matches the actual region). Option D is incorrect because 'logs:DescribeLogGroups' is not required for writing logs; the necessary action is 'logs:PutLogEvents' and related actions.

Answer

The CloudWatch agent is not installed on the instance.

Answer

The policy specifies the wrong region in the resource ARN.

Answer

The policy does not include the 'logs:DescribeLogGroups' action.