DOP-C02 Monitoring and Logging Practice Test 13 — 15 Questions

Question 1

A DevOps engineer needs to monitor the memory utilization of an Amazon RDS for MySQL instance. Which AWS service should be used to collect and visualize this metric?

Accepted Answer

Enhanced Monitoring for RDS.. Enhanced Monitoring for RDS provides memory, CPU, and other OS-level metrics, sending them to CloudWatch Logs for visualization via CloudWatch dashboards. Option A is incorrect because CloudWatch default metrics for RDS do not include memory utilization; Enhanced Monitoring is required. Option B is incorrect because AWS Systems Manager Inventory collects software inventory and system configuration from EC2 instances, not RDS memory metrics. Option D is incorrect because AWS Trusted Advisor provides best-practice checks and recommendations, not real-time memory monitoring.

Answer

CloudWatch default metrics for RDS.

Answer

AWS Systems Manager Inventory.

Answer

AWS Trusted Advisor.

Question 2

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The DevOps team wants to monitor the end-to-end latency of API requests, including the time spent in API Gateway and Lambda. Which approach provides the most granular breakdown?

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. AWS X-Ray provides end-to-end tracing with detailed segments for API Gateway and Lambda, allowing per-request breakdown of latency across each component. Option A (Lambda Insights) offers OS-level metrics like CPU and memory, not request-level latency breakdown. Option C (VPC Flow Logs) captures network traffic metadata but not application layer latency. Option D (combining CloudWatch metrics) only gives aggregate statistics and cannot break down latency per request or within a single request's path.

Answer

Enable Lambda Insights to get per-request latency breakdown.

Answer

Enable VPC Flow Logs to capture network round-trip times.

Answer

Use CloudWatch metrics for API Gateway and Lambda, then add them together.

Question 3

A company has a production Amazon EKS cluster with multiple node groups. The DevOps team notices that some pods are frequently restarting due to OOMKilled errors, but the cluster-level metrics (CPU, memory) appear normal. Which CloudWatch Container Insights metric should be analyzed to identify the specific node or pod causing the issue?

Accepted Answer

pod_memory_utilization.. Container Insights provides pod-level memory utilization metrics (pod_memory_utilization) that can pinpoint which pod is exceeding its memory limit, causing OOMKilled errors. Option A (node_memory_utilization) is aggregate at node level and may not show individual pod issues. Option B (number_of_running_pods) does not indicate memory usage. Option D (pod_cpu_utilization) is for CPU, not memory.

Answer

node_memory_utilization.

Answer

number_of_running_pods.

Answer

pod_cpu_utilization.

Question 4

A DevOps engineer needs to centrally collect and analyze logs from multiple AWS accounts and on-premises servers. Which AWS service should be used to aggregate logs in a single dashboard?

Accepted Answer

Amazon CloudWatch Logs.. Amazon CloudWatch Logs is the correct service to centrally collect and analyze logs from multiple AWS accounts and on-premises servers in a single dashboard. It supports cross-account log aggregation via subscription filters and can visualize logs using CloudWatch Logs Insights. Option A (Amazon Athena) is a query service for S3 data, not a dashboard. Option B (Amazon S3) is an object storage service, not a dashboard. Option D (Amazon Kinesis Data Firehose) is a streaming data delivery service, not a dashboard.

Answer

Amazon Athena.

Answer

Amazon S3.

Answer

Amazon Kinesis Data Firehose.

Question 5

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails due to a resource limit exceeded error. Which approach should be used?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack, and subscribe an email endpoint.. CloudFormation natively supports sending stack events (including creation failures) to an SNS topic. By configuring an SNS topic as a notification option in the stack creation request, the DevOps team can subscribe an email endpoint to receive real-time notifications when a resource limit exceeded error occurs, without needing additional services or custom logic.

Answer

Create an Amazon EventBridge rule that matches CloudFormation resource limit exceeded events and sends to SQS.

Answer

Use AWS Config to detect when a stack is in a failed state.

Answer

Enable CloudTrail and create a CloudWatch alarm on the CreateStack API call.

Question 6

A DevOps team is troubleshooting a performance issue where an Amazon RDS for PostgreSQL instance's CPU utilization spikes every hour. The team suspects a specific query from an application. Which combination of tools can identify the problematic query?

Accepted Answer

Amazon RDS Performance Insights and Enhanced Monitoring.. Amazon RDS Performance Insights identifies the top SQL queries consuming database load, and Enhanced Monitoring provides OS-level metrics (CPU, memory, etc.) to correlate with query performance. Option A is wrong because CloudWatch Logs Insights can analyze application logs if the query logs are shipped, but CloudWatch metrics alone do not show individual queries. Option C is wrong because VPC Flow Logs capture network traffic metadata, not database queries. Option D is wrong because CloudTrail records AWS API calls (e.g., RDS Start/Stop), not SQL queries within the database.

Answer

CloudWatch Logs Insights and CloudWatch metrics.

Answer

VPC Flow Logs and Lambda.

Answer

CloudTrail and CloudWatch alarms.

Question 7

A DevOps engineer wants to monitor the health of an Auto Scaling group and receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon EventBridge.. The correct answers are C (Amazon EventBridge) and D (Amazon SNS). Amazon EventBridge can capture Auto Scaling lifecycle events (such as instance launch and termination) and route them to Amazon SNS, which sends notifications (e.g., email or SMS). AWS CloudTrail (A) logs API calls but does not trigger real-time notifications. AWS Config (B) records configuration changes but is not designed for event-driven notifications. AWS Lambda (E) could be used as a target, but it is not required because EventBridge can directly invoke SNS.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Lambda.

Question 8

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search across multiple log groups and visualize trends. Which TWO services can be used together to achieve this?

Accepted Answer

CloudWatch Logs Insights.. Options A and E are correct. CloudWatch Logs Insights can query across multiple log groups using a SQL-like query language, and CloudWatch Dashboards can visualize the results by adding graphs and widgets. Option B (Amazon Elasticsearch Service with Kibana) is not directly integrated with CloudWatch Logs for real-time querying; it requires setting up subscriptions and additional infrastructure. Option C (Amazon Athena) queries data in Amazon S3, not directly in CloudWatch Logs. Option D (Amazon QuickSight) is a business intelligence tool that typically requires data in S3 or a database, and is not optimized for direct CloudWatch Logs querying.

Answer

Amazon Elasticsearch Service with Kibana.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Question 9

A DevOps engineer is designing a centralized logging solution for 10 AWS accounts. Logs must be stored in a central S3 bucket with encryption and access logging. Which THREE services/resources are required to meet these requirements?

Accepted Answer

AWS CloudTrail.. To meet the requirements, three services are needed: AWS CloudTrail for logging API activity across accounts and delivering logs to a central S3 bucket; AWS KMS customer managed key to encrypt the logs at rest in S3; and Amazon S3 server access logs to record requests made to the central S3 bucket for auditing. Option A (AWS Config) is not required for centralized logging; it focuses on resource configuration compliance, not log delivery. Option D (Amazon CloudWatch Logs) is not directly required for storage in S3, as CloudTrail can deliver directly to S3 without CloudWatch Logs.

Answer

AWS Config.

Answer

Amazon CloudWatch Logs.

Question 10

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance fails to write logs to CloudWatch Logs in the log group 'MyAppLogs'. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on the log stream resource.. To write logs to CloudWatch Logs, the IAM policy must grant permissions on both the log group and the log stream resources. The policy likely specifies only the log group ARN (e.g., 'arn:aws:logs:region:account-id:log-group:MyAppLogs') but omits the log stream ARN (e.g., 'arn:aws:logs:region:account-id:log-group:MyAppLogs:log-stream:*'). CloudWatch Logs requires permissions on the log stream for actions like PutLogEvents. Option B is incorrect because the CloudWatch agent is not mandatory; the AWS SDK can be used directly. Option C is incorrect because the region in the resource ARN is specified correctly (assuming it matches the actual region). Option D is incorrect because 'logs:DescribeLogGroups' is not required for writing logs; the necessary action is 'logs:PutLogEvents' and related actions.

Answer

The CloudWatch agent is not installed on the instance.

Answer

The policy specifies the wrong region in the resource ARN.

Answer

The policy does not include the 'logs:DescribeLogGroups' action.

Question 11

Refer to the exhibit. A DevOps engineer checks the CloudWatch alarm configuration and state. The alarm is in ALARM state for CPUUtilization averaging 90% over 5 minutes, but no notification was received. What is the most likely reason?

Accepted Answer

The SNS topic does not have any confirmed subscriptions.. The alarm is in ALARM state, indicating that CPUUtilization exceeded the threshold, and data is present. However, no notification was received because the SNS topic specified in the alarm actions likely has no confirmed subscriptions. For SNS to deliver a notification (e.g., email), each subscription must be confirmed by the recipient; otherwise, messages are not sent.

Answer

The EC2 instance is stopped.

Answer

The alarm period is set to 300 seconds, which is too long.

Answer

The alarm has insufficient data to evaluate.

Question 12

Refer to the exhibit. A CloudFormation template deploys a Lambda function with X-Ray tracing enabled. However, traces are not appearing in the X-Ray console. What is the most likely missing configuration?

Accepted Answer

The Lambda execution role does not have permissions to upload trace data to X-Ray.. The Lambda function's execution role must have permissions to upload trace data to AWS X-Ray. The default AWSLambdaBasicExecutionRole only grants CloudWatch Logs permissions. To enable X-Ray tracing, the role needs the AWSXRayDaemonWriteAccess policy or equivalent permissions. Option A is incorrect because the Node.js 18 runtime does support X-Ray tracing. Option C is incorrect because setting TracingConfig to 'Active' is correct for enabling tracing; 'PassThrough' would only send traces if the upstream request was sampled, which is not the issue here. Option D is incorrect because the function code does not need to explicitly use the X-Ray SDK to generate traces; when tracing is enabled at the service level, the X-Ray daemon automatically sends invocation traces. The absence of traces points to a permissions issue, not a missing SDK.

Answer

The Lambda runtime (nodejs18.x) does not support X-Ray tracing.

Answer

The TracingConfig mode is set to 'Active' but should be 'PassThrough'.

Answer

The Lambda function code does not use the AWS X-Ray SDK.

Question 13

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The operations team notices that the application's error rate spiked for 10 minutes last night, but no CloudWatch alarm was triggered. The team has a CloudWatch alarm on the ALB's 'HTTPCode_Target_5XX_Count' metric with a threshold of 100 over 5 consecutive periods of 1 minute. What is the MOST likely reason the alarm did not trigger?

Accepted Answer

The alarm's period is set to 5 minutes instead of 1 minute.. The alarm is configured to evaluate 'HTTPCode_Target_5XX_Count' over 5 consecutive periods of 1 minute, meaning it requires 5 minutes of data above the threshold to trigger. The spike lasted 10 minutes, which should have met this condition. However, if the alarm's period is set to 5 minutes instead of 1 minute, the alarm would evaluate 5 consecutive periods of 5 minutes each, requiring 25 minutes of sustained errors. A 10-minute spike would not be enough to trigger the alarm. Therefore, option C is correct. Option A is incorrect because ALB metrics are published at 1-minute granularity. Option B is incorrect because ALB sends metrics to CloudWatch Metrics, not CloudWatch Logs. Option D is incorrect because the metric 'HTTPCode_Target_5XX_Count' is in the correct namespace (AWS/ApplicationELB) and is specific to target groups.

Answer

The ALB publishes metrics only at 5-minute granularity.

Answer

The ALB sends metrics to CloudWatch Logs instead of CloudWatch Metrics.

Answer

The alarm is configured on the wrong metric namespace.

Question 14

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5 and a batch size of 10. The SQS queue has a visibility timeout of 30 seconds, and the Lambda function typically completes processing each batch in 10 seconds. Recently, the engineer noticed that messages are repeatedly processed, causing duplicates. The CloudWatch Logs show that the function is experiencing throttling errors. What is the MOST likely cause of the duplicate processing?

Accepted Answer

Lambda is throttling the function, and the visibility timeout expires before the function can process the messages.. When Lambda throttles due to reserved concurrency of 5, it cannot process all incoming messages. SQS does not delete messages after sending them to Lambda; Lambda must explicitly delete them after processing. If throttling occurs frequently, messages remain in the queue while Lambda retries, but if the visibility timeout of 30 seconds expires before a successful invocation processes the batch, the messages become visible to other consumers or the same consumer, leading to duplicate processing. The typical completion time of 10 seconds per batch is much shorter than the visibility timeout, but throttling delays processing beyond 30 seconds, causing the visibility timeout to expire. Option B is incorrect because a dead-letter queue stores messages that fail repeatedly, but it does not cause duplicates. Option C is incorrect because the batch size of 10 is within the maximum allowed, and the function completes in 10 seconds, so timeout is not the issue. Option D is incorrect because a higher reserved concurrency would reduce throttling, not cause duplicates.

Answer

The SQS queue's dead-letter queue (DLQ) is not configured, causing messages to be reprocessed.

Answer

The function's batch size is too large, causing timeouts.

Answer

The function's reserved concurrency is too high, causing overloading.

Question 15

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket for long-term storage and analysis. The logs include AWS CloudTrail, VPC Flow Logs, and Amazon RDS audit logs. Which solution is the MOST operationally efficient?

Accepted Answer

Configure each account to deliver logs directly to a central S3 bucket using a bucket policy that allows cross-account writes.. The most operationally efficient because it allows each account to deliver logs like CloudTrail and VPC Flow Logs directly to a central S3 bucket via a bucket policy permitting cross-account writes. For Amazon RDS audit logs, which cannot be sent directly to a cross-account S3 bucket, you can configure them to be published to CloudWatch Logs within the same account and then use a subscription filter to forward them to the central S3 bucket. This hybrid approach minimizes overhead compared to other options: Option A (exporting from a central CloudWatch Logs account) adds unnecessary complexity; Option B (Kinesis Data Firehose in each account) introduces additional services and cost; Option C (S3 replication) requires per-account bucket setup and management. Thus, D best balances direct delivery for most logs with a simple workaround for RDS audit logs.

Answer

Configure each account to send logs to a central CloudWatch Logs account, then export to S3.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to the central bucket.