DOP-C02 Monitoring and Logging Practice Test 14 — 15 Questions

Question 1

A company runs a containerized application on Amazon ECS with Fargate launch type. The application consists of three microservices: frontend, backend, and database. The ECS cluster is in a VPC with public and private subnets. The frontend service is publicly accessible via an Application Load Balancer (ALB) in public subnets. The backend service communicates with the database service, which runs as a stateful service with persistent storage using Amazon EFS. The DevOps team is using CloudWatch Container Insights and has enabled Prometheus metrics for the ECS cluster. Recently, the team observed that the frontend service's response time has increased significantly, and some requests are timing out. The team checked the ALB metrics and saw an increase in 5xx errors. They also noticed that the backend service's CPU utilization is high, and the database service's disk I/O is high. The team suspects a bottleneck in the backend service. Which course of action should the team take FIRST to identify the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the backend service's application logs in CloudWatch Logs to identify errors or slow database queries.. The first step is to analyze the backend service's application logs to identify any errors or slow operations. High CPU and disk I/O may be caused by inefficient queries or code issues. Option A is incorrect because disabling health checks would hide the problem and could route traffic to unhealthy tasks. Option B is incorrect because migrating to RDS does not address the immediate issue and is a significant change without root cause analysis. Option D is incorrect because increasing the desired count without understanding the root cause may temporarily alleviate load but does not fix underlying performance issues and can increase costs.

Answer

Disable the health check for the backend service in the ALB target group.

Answer

Migrate the database service to Amazon RDS for better performance.

Answer

Increase the desired count of the backend service to reduce load per task.

Question 2

A company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS Multi-AZ database. The DevOps team has configured the EC2 instances to send application logs to CloudWatch Logs using the CloudWatch agent. They also set up a CloudWatch alarm on the ALB's 5xx error count. During a recent deployment, the team noticed that the alarm did not trigger even though the application was returning 5xx errors. The team verified that the CloudWatch agent is running on the instances and logs are appearing in CloudWatch Logs. What should the team do to ensure the alarm triggers correctly?

Accepted Answer

Verify that the CloudWatch alarm is using the correct metric 'HTTPCode_Target_5XX_Count' and that the threshold is appropriate.. The ALB publishes two separate 5xx metrics: HTTPCode_ELB_5XX_Count (errors generated by the load balancer itself, e.g., 503 due to no healthy targets) and HTTPCode_Target_5XX_Count (errors returned by the backend targets). Since the application is returning 5xx errors from the EC2 instances, the alarm should use HTTPCode_Target_5XX_Count. The team likely set the alarm on HTTPCode_ELB_5XX_Count, which would not trigger for backend errors. Option A is not the best because creating a log-based metric filter would create a separate alarm and does not fix the existing ALB alarm. Option B is wrong because switching to HTTPCode_ELB_5XX_Count still tracks the wrong metric. Option C is unrelated because the agent is already working and logs are flowing.

Answer

Create a metric filter on the EC2 instance's log group to count 5xx errors and create an alarm on that.

Answer

Change the CloudWatch alarm to use the 'HTTPCode_ELB_5XX_Count' metric instead.

Answer

Restart the CloudWatch agent on the EC2 instances.

Question 3

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The operations team notices that the application's error rate has increased significantly in the last 30 minutes, but they are unable to identify the root cause because the metrics are aggregated across all instances. Which solution would provide the MOST granular visibility into individual instance performance?

Accepted Answer

Enable detailed monitoring on the EC2 instances to get 1-minute CloudWatch metrics.. Detailed monitoring on EC2 instances provides 1-minute CloudWatch metrics per instance, enabling granular visibility into individual instance performance, which is essential for identifying the root cause of increased error rates. Option A is incorrect because a CloudWatch dashboard aggregates metrics across all instances and does not provide per-instance granularity. Option C is incorrect because VPC Flow Logs capture network traffic metadata (source/destination IPs, ports, etc.) and not application error metrics. Option D is incorrect because ALB access logs provide request-level data but require additional analysis to extract per-instance error rates and are not real-time.

Answer

Create a CloudWatch dashboard to visualize the error metrics across all instances.

Answer

Enable VPC Flow Logs to capture traffic to each instance.

Answer

Enable ALB access logs and store them in Amazon S3 for analysis.

Question 4

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked successfully, but it frequently times out after 15 seconds. The function's CloudWatch Logs show that the timeout occurs while the function is making an HTTP request to an external API. The function's reserved concurrency is set to 5, and the SQS queue has a visibility timeout of 30 seconds. Which change would MOST effectively reduce the number of timeouts?

Accepted Answer

Increase the Lambda function's timeout to 30 seconds.. Increasing the Lambda function timeout to 30 seconds gives the HTTP request more time to complete, directly addressing the timeout issue. Option B is wrong because increasing the visibility timeout does not affect the Lambda function's execution duration; it only controls how long SQS waits before making a message visible again after a failure. Option C is wrong because decreasing the batch size reduces the number of messages processed per invocation but does not solve the underlying HTTP request timeout. Option D is wrong because increasing reserved concurrency would allow more concurrent invocations but does not fix the timeout for individual invocations; the function still times out after 15 seconds.

Answer

Increase the SQS queue's visibility timeout to 60 seconds.

Answer

Decrease the SQS batch size to 1.

Answer

Increase the Lambda function's reserved concurrency to 10.

Question 5

A company uses Amazon CloudWatch Logs to store application logs from EC2 instances. The security team requires that logs be retained for 5 years for compliance. Which action should be taken to meet this requirement cost-effectively?

Accepted Answer

Export the logs to Amazon S3 and use S3 Glacier Deep Archive for long-term storage.. Exporting logs to Amazon S3 and using lifecycle policies to transition them to S3 Glacier Deep Archive is the most cost-effective way to retain logs for 5 years. S3 provides low-cost storage, and Glacier Deep Archive offers the lowest storage cost for long-term archival, making it ideal for compliance requirements. In contrast, retaining logs in CloudWatch Logs beyond a short period is more expensive due to higher storage costs. Option B is incorrect because setting a 5-year retention policy in CloudWatch Logs incurs significant costs compared to exporting to S3. Option C is incorrect because disabling retention causes logs to expire after 90 days, not indefinite. Option D is incorrect because AWS CloudTrail captures API activity, not application logs.

Answer

Set a log retention policy of 5 years on the CloudWatch Logs log groups.

Answer

Disable log retention and let CloudWatch Logs keep the logs indefinitely.

Answer

Use AWS CloudTrail to store the logs for 5 years.

Question 6

A company is using Amazon CloudWatch Synthetics to monitor the availability of a web application. The canary runs every 5 minutes from multiple locations. Recently, the canary has been failing intermittently with HTTP 503 errors, but the application team reports that the application is healthy. Which step should the DevOps engineer take to identify the cause of the false positives?

Accepted Answer

Review the canary's CloudWatch Logs to check for network errors or timeouts.. Checking the canary's CloudWatch Logs might reveal that the failure is due to a network timeout or other client-side issue, not the application. Option A is wrong because increasing canary frequency would generate more data but not identify the cause. Option B is wrong because increasing timeout might mask the issue. Option D is wrong because adding more locations would not pinpoint the cause if the issue is client-side.

Answer

Increase the canary timeout setting to allow more time for the application to respond.

Answer

Add more canary locations to increase coverage.

Answer

Increase the canary run frequency to every 1 minute.

Question 7

Refer to the exhibit. An AWS Lambda function has the IAM policy shown. The function is intended to write logs to CloudWatch Logs and publish custom metrics to CloudWatch. However, the function is failing to publish custom metrics. What is the MOST likely cause?

Accepted Answer

The function's execution role is missing the necessary trust policy to allow Lambda to assume the role.. The IAM policy shown grants the necessary permissions for `cloudwatch:PutMetricData` and `logs:PutLogEvents`. However, the Lambda function also requires a trust policy on the execution role that allows the Lambda service to assume the role. If this trust policy is missing, the function cannot obtain permissions to perform any actions, including publishing custom metrics. Option D correctly identifies this missing trust policy as the most likely cause.

Answer

The function does not have permission to perform logs:PutLogEvents for the specific log stream.

Answer

The function does not have permission to perform cloudwatch:PutMetricData.

Answer

The function is trying to put metrics to a CloudWatch namespace that is not allowed by the resource constraint.

Question 8

A DevOps engineer needs to set up a centralized logging solution for multiple AWS accounts. The logs must be stored in a central Amazon S3 bucket for long-term retention and analysis. Which combination of services should the engineer use?

Accepted Answer

Use Amazon CloudWatch Logs and Amazon Kinesis Data Firehose to deliver logs to the central S3 bucket.. Amazon CloudWatch Logs can collect logs from various AWS services and applications. To centralize logs from multiple accounts into a single S3 bucket, you can use subscription filters to deliver log events to Amazon Kinesis Data Firehose, which then streams the data to the central S3 bucket. Alternatively, you can use CloudWatch Logs export tasks. This combination enables centralized logging. Option A is incorrect because CloudTrail only captures API activity, not application or system logs. Option B is incorrect because Athena and QuickSight are analytics services, not log ingestion services. Option D is incorrect because VPC Flow Logs capture only network traffic metadata, not all logs.

Answer

Use AWS CloudTrail to deliver logs to the central S3 bucket.

Answer

Use Amazon Athena and Amazon QuickSight to query logs across accounts.

Answer

Use Amazon VPC Flow Logs to send logs to the central S3 bucket.

Question 9

A company is using Amazon CloudWatch Logs Insights to analyze application logs. The DevOps team needs to create a metric filter that counts occurrences of the word 'ERROR' in the log events. Which CloudWatch Logs Insights query should be used to test the metric filter?

Accepted Answer

fields @timestamp, @message | filter @message like /ERROR/. The `fields @timestamp, @message` command retrieves the relevant fields, and `filter @message like /ERROR/` filters events containing 'ERROR'. Option A is wrong because `stats count() by bin(5m)` aggregates but doesn't show individual matches. Option C is wrong because `parse @message` extracts fields but doesn't filter. Option D is wrong because `sort @timestamp desc` only sorts.

Answer

fields @timestamp, @message | stats count() by bin(5m)

Answer

fields @timestamp, @message | parse @message '[*] *' as @severity, @log

Answer

fields @timestamp, @message | sort @timestamp desc

Question 10

A company is using Amazon CloudWatch to monitor a production environment. The DevOps team wants to receive notifications when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which TWO steps should the team take to achieve this? (Choose TWO.)

Accepted Answer

Configure an Amazon SNS topic and subscribe the team's email address to it, then set the alarm to send notifications to the SNS topic.. (Configure an SNS topic) and Option C (Create a CloudWatch alarm) are correct. To receive notifications when CPU utilization exceeds 90% for 5 consecutive minutes, you need a CloudWatch alarm that monitors the CPUUtilization metric with the specified threshold and evaluation period. The alarm must be configured to send notifications to an SNS topic, which then delivers the message to subscribed email addresses. Option A (Enable detailed monitoring) is not required because the evaluation period is 5 minutes, and basic monitoring (5-minute intervals) is sufficient. Option D (Create a CloudWatch Logs metric filter) is for log data, not EC2 metrics. Option E (Create a CloudWatch dashboard) is for visualization, not notification.

Answer

Enable detailed monitoring on the EC2 instance to get 1-minute metrics.

Answer

Create a CloudWatch Logs metric filter to count CPU utilization errors.

Answer

Create a CloudWatch dashboard to visualize CPU utilization.

Question 11

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team wants to collect and visualize metrics such as CPU, memory, and network utilization at the task level. Which TWO services should the team use to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. (Amazon CloudWatch) and Option E (Amazon CloudWatch Container Insights) are correct. Container Insights collects metrics from ECS tasks running on Fargate, and CloudWatch stores and visualizes them via dashboards. Option A (Amazon Managed Service for Prometheus) is a monitoring service but not the standard integrated solution for ECS Fargate metrics; Container Insights is the recommended approach. Option B (Amazon CloudWatch Logs) is for logs, not metrics. Option D (AWS X-Ray) is for tracing.

Answer

Amazon Managed Service for Prometheus

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 12

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that all logs be encrypted at rest using a customer-managed AWS KMS key. Which THREE steps are necessary to meet this requirement? (Choose THREE.)

Accepted Answer

Grant the IAM role used by the application to write logs permission to use the KMS key (kms:Encrypt, kms:Decrypt).. Options A, B, and C are correct. To encrypt CloudWatch Logs at rest with a customer-managed KMS key, you must first create a customer-managed KMS key (option C). Then, associate that KMS key with the CloudWatch Logs log group by specifying the key ARN in the log group's settings (option B). Finally, grant the IAM role used by the application permission to use the KMS key for encryption and decryption operations (option A). Option D is incorrect because encryption is configured at the log group level, not on individual log streams. Option E is incorrect because the scenario involves encrypting logs in CloudWatch Logs, not in an S3 bucket.

Answer

Enable encryption on each log stream individually.

Answer

Enable server-side encryption on the Amazon S3 bucket where logs are exported.

Question 13

A company is using AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that all CloudTrail logs are delivered to a central Amazon S3 bucket and that the logs are encrypted and cannot be deleted. Which THREE steps should the team take to meet these requirements? (Choose THREE.)

Accepted Answer

Enable default encryption (SSE-S3) on the central S3 bucket.. To meet the requirements, the team needs to ensure logs are encrypted and cannot be deleted, and that integrity is maintained. Enabling default encryption (SSE-S3) on the central S3 bucket (option B) encrypts log files at rest. Enabling S3 Object Lock (option C) prevents log files from being deleted or overwritten, meeting the non-deletion requirement. Enabling CloudTrail log file validation (option E) allows the team to verify that log files have not been tampered with, ensuring integrity. Option A (MFA Delete) is not sufficient to prevent deletion in all cases and is not the standard method; Object Lock is more appropriate. Option D (CloudTrail log file integrity using KMS) is incorrect because CloudTrail uses its own log file validation mechanism, not KMS, for integrity.

Answer

Enable MFA Delete on the central S3 bucket to require multi-factor authentication for deletions.

Answer

Enable CloudTrail log file integrity by using AWS KMS.

Question 14

A company uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams. The Lambda function processes records in batches and writes the results to an Amazon DynamoDB table. Recently, the operations team noticed that the Lambda function is experiencing a high number of throttling errors (HTTP 400) when writing to DynamoDB. The DynamoDB table has on-demand capacity mode enabled. The CloudWatch metrics show that the DynamoDB consumed write capacity is well below the provisioned limits, but the Lambda function's error rate is increasing. The Lambda function's reserved concurrency is set to 100, and the function's timeout is 1 minute. The Kinesis stream has 10 shards. What is the MOST likely cause of the throttling errors?

Accepted Answer

The DynamoDB table is experiencing hot partitions due to uneven access patterns.. Even with on-demand capacity, DynamoDB has per-partition throughput limits. When many writes target the same partition key (hot partition), the partition can throttle requests, resulting in HTTP 400 errors. This is consistent with the CloudWatch metrics showing overall consumed write capacity below provisioned limits but increasing error rates. Option B is incorrect because a 1-minute timeout is standard and does not directly cause DynamoDB throttling. Option C is incorrect because reserved concurrency of 100 is reasonable for a 10-shard stream and does not exceed DynamoDB's overall capacity. Option D is incorrect because the batch size affects how many records are processed per invocation but does not cause DynamoDB throttling unless combined with hot partitions.

Answer

The Lambda function's timeout is too short, causing the function to retry and overload DynamoDB.

Answer

The Lambda function's reserved concurrency is too high, causing too many concurrent invocations.

Answer

The Kinesis stream's batch size is too large, causing the Lambda function to write too many records at once.

Question 15

A DevOps engineer is responsible for monitoring an AWS environment that includes multiple EC2 instances running a web application. The engineer needs to set up a solution that sends an email alert when the average CPU utilization across all instances exceeds 80% for 10 consecutive minutes. The engineer has created a CloudWatch alarm with the metric `CPUUtilization` aggregated across all instances using the statistic `Average` and a period of 5 minutes. The alarm is set to trigger when the metric exceeds 80% for 2 consecutive periods (10 minutes). The alarm's action is configured to send a notification to an Amazon SNS topic that has an email subscription. However, the engineer is not receiving the email alerts. The engineer verified that the SNS topic exists and the email subscription is confirmed. The CloudWatch alarm shows that the metric value exceeded the threshold for 2 periods, but the alarm state is still 'OK'. What is the MOST likely reason for this?

Accepted Answer

The CloudWatch alarm requires 2 consecutive evaluation periods with the metric exceeding the threshold, but the alarm is still evaluating because of insufficient data points.. CloudWatch alarms evaluate based on the number of data points in the evaluation period. For a 'M out of N' alarm, if the metric is published every 5 minutes, after two periods there are exactly two data points. However, if there are any missing data points (e.g., due to instances not reporting), the alarm may not have sufficient data to evaluate and will remain in 'INSUFFICIENT_DATA' or 'OK'. The fact that the metric displayed exceeded the threshold does not guarantee the alarm used the correct statistic; the alarm's statistic is 'Average' across instances, which can be affected by missing or delayed data. The most likely reason is insufficient data points for evaluation, causing the alarm to stay in 'OK'.

Answer

The email subscription is not confirmed.

Answer

The metric `CPUUtilization` is not being published to CloudWatch.

Answer

The SNS topic is not configured to allow CloudWatch to publish to it.