DOP-C02 Monitoring and Logging Practice Test 14 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy a microservices architecture. The operations team wants to receive real-time notifications when any stack operation fails. Which TWO AWS services can be used together to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack state changes, including failures, and trigger an Amazon SNS topic to send real-time notifications. Therefore, options D (CloudWatch Events/EventBridge) and E (SNS) are correct. Option A is incorrect because AWS Lambda alone does not provide notification capabilities; it would need to be triggered by another service. Option B is incorrect because CloudWatch Logs stores logs but does not natively trigger notifications for stack failures. Option C is incorrect because AWS CloudTrail records API activity for auditing, not real-time stack event notifications.

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 2

A company is running a critical application on Amazon ECS with Fargate launch type. The application writes logs to Amazon CloudWatch Logs. The DevOps team needs to set up an alert when the application generates more than 100 error logs in any 5-minute window. Which configuration should be used?

Accepted Answer

Create a CloudWatch Logs metric filter for 'ERROR' and a CloudWatch alarm on the resulting metric with a period of 5 minutes. A CloudWatch Logs metric filter can be configured to count occurrences of the word 'ERROR' in log streams. This filter creates a custom metric that can be monitored by a CloudWatch alarm with a period of 5 minutes. When the metric exceeds the threshold of 100, the alarm triggers an action such as an SNS notification. Option A is incorrect because CloudWatch Logs Insights is a query tool for interactive analysis, not for continuous real-time alerting. Option B is incorrect because EventBridge events are not generated from log content directly; you would need a metric filter or subscription filter to turn log data into events. Option D is incorrect because AWS CloudTrail logs API activities, not application error logs written to CloudWatch Logs.

Answer

Create a CloudWatch Logs Insights query that runs every 5 minutes and triggers an SNS notification

Answer

Create an Amazon EventBridge rule that matches CloudWatch Logs events for the word 'ERROR' and triggers an alarm

Answer

Enable AWS CloudTrail logging for the ECS task and create a metric filter on CloudTrail logs

Question 3

A DevOps engineer is troubleshooting an issue where an Amazon RDS for MySQL instance is experiencing high latency. The engineer wants to identify which queries are causing the problem. Which AWS service should be used?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is a database performance tuning tool that visualizes database load (Average Active Sessions) broken down by SQL statement, wait event, user, and host. It directly identifies which queries are consuming the most DB load, making it the correct tool for diagnosing high-latency MySQL workloads. It retains up to 7 days of free performance data and up to 2 years with paid retention.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Metrics

Answer

VPC Flow Logs

Question 4

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Use the CloudWatch Logs console or API to associate the KMS key with the log group. Option E is correct because CloudWatch Logs encryption at rest with a customer-managed key requires first creating a customer-managed KMS key in KMS and attaching a key policy that grants the CloudWatch Logs service principal (logs..amazonaws.com) the necessary kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:Describe* permissions. Option A is correct because, once the key exists, you must explicitly associate it with the specific log group using the CloudWatch Logs console, the AWS CLI (aws logs associate-kms-key --log-group-name --kms-key-id ), or the AssociateKmsKey API; encryption is applied at the log group level. Option B is not correct because CloudWatch Logs has no account-level 'default encryption' toggle; encryption must be set per log group. Option C is not correct because a log group resource policy controls access to log data, not KMS encryption, and does not enable encryption at rest. Option D is not correct because KMS keys are associated with log groups, not individual log streams, so per-stream association is neither possible nor required.

Answer

Enable default encryption for CloudWatch Logs in the AWS account settings

Answer

Update the log group's resource policy to reference the KMS key

Answer

Associate the KMS key with each log stream individually

Question 5

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an auto scaling action when the queue depth exceeds a threshold. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Amazon SQS automatically publishes queue metrics (such as ApproximateNumberOfMessagesVisible) to Amazon CloudWatch. CloudWatch alarms can monitor these metrics and trigger scaling policies on an EC2 Auto Scaling group when the threshold is breached. This is the standard, native integration for queue-depth-based auto scaling.

Answer

Amazon CloudWatch Logs and Amazon EC2 Auto Scaling

Answer

Amazon EventBridge and Amazon EC2 Auto Scaling

Answer

Amazon SQS and AWS Lambda

Question 6

A company is using AWS CloudFormation to deploy a microservices architecture. The operations team wants to receive real-time notifications when any stack operation fails. Which TWO AWS services can be used together to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture CloudFormation stack events (such as CREATE_FAILED) using event rules and route them to targets like Amazon SNS for notifications. Option A is wrong because Amazon SQS is a message queue service and does not directly send notifications; it requires a consumer. Option B is wrong because Amazon CloudWatch Logs stores log data but does not capture CloudFormation events or send notifications. Option C is wrong because AWS CloudTrail records API calls but is not designed for real-time event-driven notifications; it is better suited for auditing.

Answer

Amazon SQS

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 7

A company is running a production application on Amazon ECS with Fargate. The DevOps team needs to monitor the application's performance and set up alerts for high memory usage. Which THREE steps should the team take to achieve this?

Accepted Answer

Create a custom CloudWatch metric and publish memory usage data from the application. Options B, C, and D are correct. To monitor memory usage in ECS Fargate, you must enable the ECS task metadata endpoint (option D), which allows the container to access task metadata and publish custom memory metrics to CloudWatch. Then create a custom CloudWatch metric (option B) and set up a CloudWatch alarm on that metric (option C). Option A is incorrect because CloudWatch does not automatically collect memory metrics from Fargate tasks; custom metrics are required. Option E is incorrect because CloudWatch Container Insights provides visibility into container-level metrics but does not collect memory metrics from Fargate tasks without additional configuration; custom metrics are still needed for memory monitoring.

Answer

Configure CloudWatch to automatically collect memory metrics from Fargate tasks

Answer

Enable Amazon CloudWatch Container Insights for the ECS cluster

Question 8

A DevOps engineer is troubleshooting an application that runs on Amazon EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. CloudWatch metrics for the ALB show an increase in 'HTTPCode_ELB_5XX_Count' but the backend 'HealthyHostCount' remains stable. Which action should the engineer take to identify the root cause?

Accepted Answer

Enable and review the ALB access logs stored in Amazon S3 to analyze the HTTP response codes and request patterns.. ALB access logs capture detailed information about each request, including HTTP status codes, request processing times, and target response times. By analyzing these logs in Amazon S3, the engineer can identify which specific requests are resulting in 503 errors, examine if there are patterns such as high latency or target unavailability, and determine the root cause. Option A is incorrect because increasing instance size does not address the intermittent 503 errors; if the instances are healthy (HealthyHostCount stable), the issue is likely not capacity but something else like configuration or request handling. Option B is incorrect because detailed CloudWatch metrics on instances, while useful for performance, would not directly reveal why the ALB is returning 503 errors; the backend might be healthy but returning errors or timing out. Option D is incorrect because increasing the idle timeout would only help if requests are being dropped due to idle connections, but 503 errors typically indicate that the targets are not responding or are returning errors, not idle timeouts.

Answer

Increase the size of the EC2 instances to handle more requests.

Answer

Enable detailed CloudWatch metrics on the EC2 instances to monitor CPU and memory.

Answer

Increase the idle timeout setting on the ALB.

Question 9

A company uses AWS CloudTrail to monitor API activity. The DevOps team needs to ensure that any deletion of an S3 bucket is detected in real time and triggers an automated response. Which combination of AWS services should be used to meet these requirements?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a CloudWatch Events rule matching the DeleteBucket event, and target a Lambda function.. CloudTrail logs can be sent to CloudWatch Logs, and a CloudWatch Events rule (now Amazon EventBridge) can be created to match the DeleteBucket event and trigger a Lambda function for automated response in real time. Option A is incorrect because CloudWatch Logs monitors log data, but a metric filter on DeleteBucket events in CloudTrail logs can trigger an alarm, but that is not as direct as EventBridge. More importantly, CloudWatch Logs metric filters have latency and are not the best for real-time response. Option B is incorrect because S3 event notifications are for operations on objects, not for bucket-level operations like deletion. Option C is incorrect because while CloudTrail can deliver logs to S3, S3 event notifications are not triggered by CloudTrail log file delivery; they are for object-level events. Using EventBridge directly with CloudTrail is the correct real-time approach.

Answer

Use CloudWatch Logs to monitor the logs, and create a metric filter to trigger an alarm when the DeleteBucket event appears.

Answer

Configure S3 event notifications to send to an SQS queue, and poll the queue with a Lambda function.

Answer

Configure CloudTrail to deliver logs to an S3 bucket, and use S3 event notifications to invoke a Lambda function.

Question 10

A company is running a critical application on Amazon RDS for PostgreSQL. The DevOps team needs to set up monitoring to detect when database connections exceed 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric should be used to create an alarm?

Accepted Answer

DatabaseConnections. Amazon RDS publishes the DatabaseConnections metric to CloudWatch, representing the number of client connections currently open to the DB instance. To alarm at 80% of max connections, you compare DatabaseConnections against the instance's max_connections parameter. This is the only listed metric that directly measures connection count.

Answer

FreeableMemory

Answer

CPUUtilization

Answer

DiskQueueDepth

Question 11

A DevOps engineer sets up a CloudWatch dashboard to monitor an application's performance. The application runs on EC2 instances in an Auto Scaling group. The engineer wants to display the average CPU utilization across all instances in the group. Which CloudWatch metric and statistic should be used?

Accepted Answer

CPUUtilization metric with the Average statistic, filtered by Auto Scaling group.. To display the average CPU utilization across all instances in an Auto Scaling group, you should use the CPUUtilization metric with the Average statistic, filtered by the Auto Scaling group dimension. This aggregates the CPU utilization of all instances, providing a representative average.

Answer

CPUUtilization metric with the Sum statistic, filtered by Auto Scaling group.

Answer

StatusCheckFailed metric with the Average statistic, filtered by Auto Scaling group.

Answer

NetworkOut metric with the Average statistic, filtered by Auto Scaling group.

Question 12

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team needs to receive notifications when stack creation fails. Which approach should be used to automate this monitoring?

Accepted Answer

Create a CloudWatch Events rule that matches CloudFormation 'CREATE_FAILED' stack events and targets an SNS topic.. CloudWatch Events (now Amazon EventBridge) can match CloudFormation stack events with the detail-type 'CloudFormation Stack Status Change' and filter for CREATE_FAILED, then target an SNS topic for notification. This is the native, event-driven approach for automating failure alerts without polling or log parsing. It provides near-real-time notification with minimal configuration.

Answer

Use AWS Config rules to detect failed stack creations.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' API calls.

Answer

Stream CloudFormation logs to CloudWatch Logs and create a metric filter for 'CREATE_FAILED'.

Question 13

A DevOps engineer wants to receive an alert when the total number of error logs in an application exceeds 100 within a 5-minute period. The application writes logs to CloudWatch Logs. How can this be achieved?

Accepted Answer

Create a metric filter on the log group for 'ERROR', then create a CloudWatch alarm on the resulting metric with a threshold of 100.. A metric filter on the CloudWatch Logs group can count occurrences of the pattern 'ERROR', creating a custom metric. A CloudWatch alarm on that metric with a threshold of 100 and a 5-minute period will trigger when the error count exceeds 100. Option A is incorrect because dashboards are for visualization, not automated alerts. Option B is incorrect because CloudWatch Logs Insights is for ad-hoc queries, not continuous real-time alerting. Option C is incorrect because subscription filters send logs to destinations like Lambda, but the Lambda would need custom logic to count and alert, which is not as direct as a metric filter. The metric filter with alarm is the simplest native solution.

Answer

Create a CloudWatch dashboard with a line chart for error count and manually monitor it.

Answer

Use CloudWatch Logs Insights to run a query every 5 minutes and trigger an alert based on the result.

Answer

Create a CloudWatch Logs subscription filter to send matching logs to a Lambda function, which counts errors and sends an alert.

Question 14

A company uses AWS Organizations to manage multiple accounts. The DevOps team needs to monitor for any IAM user creation across all accounts in the organization. Which THREE steps should be taken to implement this centralized monitoring?

Accepted Answer

Create a CloudWatch Logs metric filter on the organization's CloudTrail log group for 'CreateUser' events.. Option B is correct because an organization trail created in the management account automatically applies to all member accounts, delivering CloudTrail events such as IAM CreateUser to a central S3 bucket and CloudWatch Logs, which is the foundation for centralized monitoring. Option A is correct because a CloudWatch Logs metric filter on the organization's CloudTrail log group can match the 'CreateUser' event name and turn each occurrence into a custom metric, enabling detection of IAM user creation across all accounts. Option E is correct because a CloudWatch alarm on that metric can trigger notifications through Amazon SNS, providing the DevOps team with real-time alerts when IAM users are created. Option C is not needed because S3 event notifications on object creation only signal that a log file was delivered, not that a CreateUser event occurred, and CloudWatch Logs metric filters are the appropriate mechanism. Option D is not appropriate because AWS Config rules evaluate resource configuration compliance and are not the primary real-time event-detection mechanism for API calls like CreateUser; CloudTrail plus CloudWatch is the intended solution.

Answer

Configure an S3 bucket to receive CloudTrail logs from all accounts and enable S3 event notifications for object creation.

Answer

Use AWS Config rules to detect IAM user creation across accounts.

Question 15

A DevOps engineer is troubleshooting a performance issue with an Amazon RDS for MySQL database. The engineer suspects that slow queries are causing high CPU utilization. Which TWO actions can the engineer take to identify the slow queries?

Accepted Answer

Enable the slow query log and publish it to CloudWatch Logs.. Enable the slow query log and publish it to CloudWatch Logs (Option C) allows you to capture and analyze slow SQL queries. Performance Insights (Option D) provides a dashboard to visualize database load and identify the top SQL statements causing performance issues. Option A is incorrect because event subscriptions for low storage notify about storage events, not slow queries. Option B is incorrect because monitoring CPUUtilization only indicates high CPU usage but does not identify specific slow queries. Option E is incorrect because Enhanced Monitoring provides OS-level metrics like CPU and memory, not the actual SQL queries.

Answer

Create an RDS event subscription for 'low storage' events.

Answer

Monitor the 'CPUUtilization' metric in CloudWatch.

Answer

Enable Enhanced Monitoring to view process list and SQL queries.