DOP-C02 Monitoring and Logging Practice Test 13 — 15 Questions

Question 1

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences periodic slowdowns. The team wants to monitor the number of active connections and the query execution time. Which approach is most cost-effective?

Accepted Answer

Enable Enhanced Monitoring and publish metrics to CloudWatch, then create alarms on relevant metrics.. Option C is correct because Enhanced Monitoring provides metrics like active connections and query execution time at no additional cost beyond CloudWatch. Option A is wrong because Performance Insights incurs additional cost. Option B is wrong because the RDS console shows basic metrics but not query-level detail. Option D is wrong because using a custom solution is more complex and may incur extra costs.

Answer

Install the CloudWatch agent on the RDS instance to collect custom metrics.

Answer

Use the RDS console to view the 'DatabaseConnections' and 'QueryExecutionTime' metrics.

Answer

Enable Performance Insights and set up CloudWatch alarms on the 'DBLoad' metric.

Question 2

A DevOps engineer needs to aggregate logs from multiple AWS accounts into a central account for analysis. Which service should they use?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters.. Option B is correct because CloudWatch Logs can send log data cross-account using subscription filters with Kinesis Data Streams or Firehose. Option A is wrong because S3 can store logs but does not provide real-time aggregation. Option C is wrong because CloudTrail is for API activity, not general logs. Option D is wrong because Config is for resource configuration.

Answer

AWS CloudTrail with organization trails.

Answer

AWS Config with aggregator.

Answer

Amazon S3 with cross-account bucket policies.

Question 3

An application running on AWS Lambda is experiencing cold starts. The team wants to monitor the cold start duration. What should they do?

Accepted Answer

Monitor the 'InitDuration' metric in CloudWatch for the Lambda function.. Option C is correct because Lambda automatically publishes the 'InitDuration' metric for cold starts. Option A is wrong because CloudWatch Logs Insights can extract cold start info but is not the simplest method. Option B is wrong because X-Ray traces show cold starts but the metric is already available. Option D is wrong because custom metrics are not necessary.

Answer

Use CloudWatch Logs Insights to query log groups for 'REPORT' lines and calculate duration.

Answer

Publish a custom metric from the Lambda code that measures initialization time.

Answer

Enable AWS X-Ray and trace the Lambda invocation to see cold start duration.

Question 4

A company uses Amazon S3 to store sensitive data. The security team wants to be notified when an S3 bucket policy is modified. Which approach is most efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'PutBucketPolicy' API call and sends a notification to an SNS topic.. Option A is correct because CloudTrail logs S3 bucket policy changes, and EventBridge can filter those events to trigger an SNS notification. Option B is wrong because CloudWatch Logs Insights is a query tool, not real-time alerting. Option C is wrong because S3 event notifications are for object-level events, not bucket policy changes. Option D is wrong because Config can detect changes but is not the most efficient for real-time alerting.

Answer

Set up an AWS Config rule to detect changes to the bucket policy.

Answer

Configure S3 event notifications for 's3:PutBucketPolicy' on the bucket.

Answer

Enable S3 server access logs and use CloudWatch Logs Insights to run queries periodically.

Question 5

A DevOps team wants to monitor the disk space utilization on their EC2 instances. What is the simplest way to achieve this?

Accepted Answer

Install the CloudWatch agent on the EC2 instances and configure the disk metric.. Option D is correct because the CloudWatch agent can collect disk metrics from EC2 instances. Option A is wrong because basic monitoring does not include disk metrics. Option B is wrong because detailed monitoring also does not include disk metrics. Option C is wrong because Systems Manager Inventory is for software inventory, not disk space.

Answer

Use AWS Systems Manager Inventory to collect disk space data.

Answer

Enable EC2 detailed monitoring in CloudWatch.

Answer

Use EC2 basic monitoring in CloudWatch.

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs show that some requests are timing out. The team needs to identify the source of the issue. Which TWO steps should they take?

Accepted Answer

Enable ALB access logs and analyze them.. Option A is correct because ALB access logs contain detailed request information. Option C is correct because CloudWatch metrics for ALB show request counts per target. Option B is wrong because CloudTrail logs API calls, not application requests. Option D is wrong because VPC Flow Logs show network traffic but not application-level details. Option E is wrong because WAF logs are for web ACLs, not general request tracing.

Answer

Enable VPC Flow Logs to capture network traffic.

Answer

Enable AWS WAF logs to inspect HTTP requests.

Answer

Enable AWS CloudTrail to log all API calls.

Question 7

A DevOps engineer is designing a centralized logging solution for a multi-account AWS environment. The solution must be cost-effective and provide real-time log analysis. Which THREE services should they consider?

Accepted Answer

Amazon OpenSearch Service (Elasticsearch). Option A is correct because CloudWatch Logs can collect logs from various sources. Option C is correct because Kinesis Data Firehose can stream logs to destinations like S3 or Elasticsearch. Option E is correct because Amazon OpenSearch Service can be used for log analysis. Option B is wrong because S3 is for storage, not real-time analysis. Option D is wrong because CloudTrail is for API logs only.

Answer

Amazon S3

Answer

AWS CloudTrail

Question 8

A company uses AWS Lambda for data processing. The operations team wants to be alerted when a function fails. Which TWO methods can they use?

Accepted Answer

Configure a dead-letter queue (DLQ) for the Lambda function and monitor the queue.. Option A is correct because CloudWatch alarms can monitor the 'Errors' metric. Option D is correct because Lambda can send failed invocation records to a dead-letter queue (DLQ), which can trigger alerts. Option B is wrong because CloudTrail logs API calls, not function execution. Option C is wrong because S3 event notifications are not triggered by Lambda errors. Option E is wrong because Config is for resource configuration, not runtime errors.

Answer

Configure S3 event notifications to trigger on Lambda errors.

Answer

Enable AWS CloudTrail to log Lambda invocations.

Answer

Use AWS Config to detect Lambda function failures.

Question 9

A Lambda function is unable to write logs to CloudWatch Logs. The IAM policy attached to the function's execution role is shown above. What is the issue?

Accepted Answer

The policy is missing the 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions.. Option B is correct because the policy grants permission to put log events but does not include the necessary permissions to create log groups and log streams. The Lambda function needs 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions. Option A is wrong because the resource ARN is valid. Option C is wrong because the region matches. Option D is wrong because the action 'logs:PutLogEvents' is correct for writing logs.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The region in the ARN does not match the Lambda function's region.

Answer

The action should be 'logs:PutLogEvents' but the resource is too restrictive.

Question 10

A DevOps engineer runs the command above to retrieve CPU utilization for an EC2 instance, but gets no data points. The instance is running and has basic monitoring enabled. What is the most likely reason?

Accepted Answer

The IAM user executing the command lacks 'cloudwatch:GetMetricStatistics' permission.. Option A is correct because basic monitoring publishes metrics every 5 minutes (300 seconds), so a period of 300 seconds should work. However, the command may fail due to insufficient permissions. Option B is wrong because basic monitoring does publish CPUUtilization. Option C is wrong because the period matches the default 5-minute interval. Option D is wrong because the command syntax is correct.

Answer

The dimension name should be 'InstanceId' with a different case.

Answer

The instance has basic monitoring disabled.

Answer

The period of 300 seconds is less than the minimum supported period.

Question 11

A Lambda function is timing out. The log above shows a recent invocation. What is the most likely cause?

Accepted Answer

The function timeout is set too low.. Option B is correct because the function timed out at 3000 ms, which is the default timeout (3 seconds). The function needs a longer timeout or optimization. Option A is wrong because memory usage is only 64 MB out of 128 MB. Option C is wrong because there was only one invocation. Option D is wrong because the init duration is normal.

Answer

The function is running out of memory.

Answer

The function is being invoked too frequently.

Answer

The function is experiencing a cold start.

Question 12

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The operations team notices that the error rate on the ALB is increasing, but the CPU utilization on the EC2 instances remains low. Which CloudWatch metric should be examined to determine if the errors are due to a lack of healthy targets?

Accepted Answer

HealthyHostCount. Option A is correct because HealthyHostCount indicates the number of healthy targets per Availability Zone. If it drops, the ALB may return errors. Option B (UnHealthyHostCount) shows unhealthy hosts but not the direct cause of errors. Option C (RequestCount) measures total requests. Option D (TargetResponseTime) measures latency.

Answer

UnHealthyHostCount

Answer

RequestCount

Answer

TargetResponseTime

Question 13

A DevOps engineer is configuring CloudWatch Logs for a Lambda function that processes streaming data from Kinesis. The function sometimes fails due to memory exhaustion. The engineer wants to ensure that logs from the function are shipped to CloudWatch Logs even when the function fails. Which configuration should be used?

Accepted Answer

Ensure the Lambda function writes logs to stdout or stderr; CloudWatch Logs will automatically capture them. Lambda functions automatically send all output written to stdout (via print or console.log) and stderr to CloudWatch Logs, regardless of whether the function succeeds or fails. This is a built-in behavior of the Lambda runtime, so no additional agents or configuration are needed to capture logs from a failed invocation due to memory exhaustion.

Answer

Configure a Kinesis Agent on the Lambda execution environment to stream logs to CloudWatch Logs

Answer

Install the CloudWatch Logs agent on the Lambda function to continuously send logs

Answer

Enable detailed CloudWatch metrics for the Lambda function

Question 14

A company uses Amazon CloudWatch to monitor its production environment. The DevOps team wants to receive an email notification whenever the average CPU utilization of any EC2 instance exceeds 90% for 5 consecutive minutes. Which steps should be taken to set up this notification?

Accepted Answer

Create a CloudWatch alarm on CPUUtilization with a threshold of 90% for 5 consecutive periods, and configure an SNS topic to send email. Option A is correct: create a CloudWatch alarm on the CPUUtilization metric with a threshold of 90% for 5 minutes, and configure an SNS topic to send email. Option B is wrong because CloudTrail is for API logging. Option C is wrong because CloudWatch Logs agent is for log collection. Option D is wrong because Config is for configuration auditing.

Answer

Install the CloudWatch Logs agent on each EC2 instance and configure a metric filter to trigger an SNS notification

Answer

Use AWS CloudTrail to monitor CPU utilization and send notifications via SNS

Answer

Use AWS Config to create a rule that triggers an SNS notification when CPU utilization exceeds 90%

Question 15

A company runs a critical application on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The DevOps team needs to implement a dashboard that shows real-time request latency, error rates, and the number of healthy hosts. Which AWS service should be used to create this dashboard?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards is the correct choice because it provides real-time monitoring and visualization of metrics such as request latency, error rates, and healthy host counts directly from CloudWatch. These metrics are automatically emitted by the Application Load Balancer (e.g., TargetResponseTime, HTTPCode_ELB_5XX_Count, HealthyHostCount) and can be displayed on a customizable dashboard without additional data transformation or querying.

Answer

Amazon QuickSight

Answer

AWS CloudTrail

Answer

AWS Config