DOP-C02 Monitoring and Logging Practice Test 14 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a slow web application. The application runs on EC2 instances behind an ALB. The engineer notices that the ALB's TargetResponseTime metric shows high p99 values, but the CPU and memory on the EC2 instances are well below thresholds. What is the most likely cause?

Accepted Answer

The application is waiting on a slow database query or external API call. High p99 TargetResponseTime on the ALB with low CPU and memory on the EC2 instances indicates that the bottleneck is not compute capacity but rather a dependency external to the application server. The application is likely waiting on a slow database query or external API call, which increases response time without consuming significant local CPU or memory. This is a classic symptom of an I/O-bound or network-bound dependency.

Answer

The Auto Scaling group has too many instances, causing increased network overhead

Answer

The ALB is routing requests to instances in different Availability Zones, increasing latency

Answer

The ALB idle timeout is set too low, causing connections to be dropped

Question 2

A company wants to monitor the number of messages that are published to an Amazon SNS topic. Which CloudWatch metric should be used?

Accepted Answer

NumberOfMessagesPublished. Option A is correct because SNS publishes the NumberOfMessagesPublished metric. Option B (NumberOfNotificationsDelivered) is for deliveries. Option C (PublishSize) is for message size. Option D (SMSMonthToDateSpentUSD) is for SMS costs.

Answer

SMSMonthToDateSpentUSD

Answer

PublishSize

Answer

NumberOfNotificationsDelivered

Question 3

A company has a microservices architecture with 50 services running on Amazon ECS. The DevOps team wants to collect and analyze logs from all services centrally. They need to query logs across services and set up alerts for error patterns. Which solution is the most scalable and cost-effective?

Accepted Answer

Use the awslogs driver to send logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights for querying and metric filters for alerts. Option D is correct because sending logs to CloudWatch Logs and using Logs Insights provides centralized querying and alerting. Option A (S3 + Athena) is cheaper but has slower query times and no real-time alerting. Option B (Elasticsearch) is more complex and costly. Option C (CloudTrail) is for API logs.

Answer

Use AWS CloudTrail to capture all log events and store them in an S3 bucket for analysis

Answer

Deploy an Amazon Elasticsearch cluster and configure the ECS Fargate agent to send logs directly to Elasticsearch

Answer

Send logs to Amazon S3 and use Amazon Athena for querying, with scheduled queries for alerts

Question 4

A DevOps engineer receives an alarm that an EC2 instance's StatusCheckFailed metric has been in ALARM state for 10 minutes. Which action should the engineer take first to investigate?

Accepted Answer

Review the instance's system log and application logs in CloudWatch Logs. Option C is correct because StatusCheckFailed indicates an instance issue; reviewing system logs in CloudWatch Logs can reveal the cause. Option A (restart) might resolve temporarily but does not diagnose. Option B (CloudTrail) logs API calls, not OS-level issues. Option D (Config) is for configuration compliance.

Answer

Use AWS Config to check the instance's configuration compliance

Answer

Check AWS CloudTrail for any API calls that modified the instance

Answer

Restart the EC2 instance to clear the alarm

Question 5

A company wants to receive a notification when an AWS IAM user creates a new access key. Which AWS service should be used to capture this event and trigger a notification?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures API activity, including the CreateAccessKey event when an IAM user creates a new access key. By sending these events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that triggers a notification via SNS, Lambda, or other targets. This combination provides the real-time event-driven notification the company requires.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Answer

AWS Config

Question 6

A DevOps team is setting up centralized logging for a multi-account AWS environment. They want to aggregate logs from all accounts into a single S3 bucket. Which services should be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it can be configured to deliver log files from multiple accounts to a single S3 bucket by setting up a trail in the management account and using the 'Enable for all accounts in my organization' option, which automatically applies the trail to all member accounts in AWS Organizations. This centralizes CloudTrail logs without requiring per-account configuration.

Answer

AWS Config

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3 replication

Question 7

A company uses Amazon RDS for MySQL and wants to monitor slow queries to optimize performance. Which actions should the DevOps engineer take to capture and analyze slow query logs? (Choose THREE.)

Accepted Answer

Enable the slow query log parameter in the RDS DB parameter group. Option A (enable slow query log) is necessary. Option B (publish to CloudWatch Logs) allows centralized access. Option D (use CloudWatch Logs Insights) enables analysis. Option C (RDS Performance Insights) is for performance but not slow queries specifically. Option E (CloudTrail) is not relevant.

Answer

Use AWS CloudTrail to capture SQL queries

Answer

Enable RDS Performance Insights

Question 8

A company is using AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails. Which services can be used together to send an email notification on stack failure? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS (Option C) is correct because it can send email notifications to subscribers when a CloudFormation stack creation fails. AWS CloudFormation (Option D) is correct because it can directly publish failure events to an SNS topic via the 'NotificationARNs' parameter in stack creation, enabling automated email alerts without additional services.

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon CloudWatch

Question 9

A DevOps engineer notices that a CloudWatch alarm for high CPU utilization on an EC2 instance is not triggering despite the CPU consistently above the threshold. The instance is in a VPC with a public subnet and has internet access. What is the most likely cause?

Accepted Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.. Option D is correct because CloudWatch requires the SSM Agent or the CloudWatch agent to send metrics; the standard EC2 metrics include CPU utilization, but if the instance is not sending detailed metrics, the alarm may not trigger if the threshold is based on a higher-resolution metric. However, the most common cause is that the CloudWatch agent is not installed or configured, or the IAM role lacks permissions. If the instance does not have the correct IAM role to publish custom metrics, CloudWatch alarms may not trigger. Option A is wrong because CloudWatch can collect metrics from instances without a public IP if they have a NAT gateway or VPC endpoint. Option B is wrong because CloudWatch alarms are evaluated based on metric data, not instance state. Option C is wrong because standard monitoring collects metrics every 5 minutes, which should be sufficient for high CPU, though detailed monitoring (1-minute) is recommended.

Answer

The EC2 instance does not have a public IP address.

Answer

The instance is using basic monitoring (5-minute intervals) which delays the alarm.

Answer

The CloudWatch alarm is in the 'INSUFFICIENT_DATA' state because the instance is stopped.

Question 10

An application running on Amazon ECS Fargate writes logs to CloudWatch Logs. The logs include sensitive data such as credit card numbers, which must be masked before storage. What is the most cost-effective solution that requires the least operational overhead?

Accepted Answer

Use a CloudWatch Logs subscription filter to invoke an AWS Lambda function that masks sensitive data and writes the sanitized logs to a different log group.. Option D is correct because CloudWatch Logs subscription filters can invoke a Lambda function in real-time as logs are ingested, allowing the function to mask sensitive data (e.g., credit card numbers) and write the sanitized logs to a different log group. This approach requires no additional infrastructure, no streaming services, and no changes to the application code, making it the most cost-effective and operationally lightweight solution.

Answer

Stream logs to Amazon Kinesis Data Firehose with a Lambda transformation, then deliver to CloudWatch Logs.

Answer

Configure a CloudWatch Logs subscription to stream logs to Amazon S3, and use S3 Object Lambda to mask data on retrieval.

Answer

Deploy a sidecar container in the ECS task that reads logs from stdout, masks data, and sends to CloudWatch Logs.

Question 11

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The DevOps team wants to detect and alert on any IAM user who creates an access key and then uses it to make API calls within 24 hours, as this may indicate a compromised account. Which combination of actions should be taken to achieve this with minimal latency?

Accepted Answer

Enable S3 Event Notifications on the CloudTrail S3 bucket to invoke a Lambda function that processes new log files and checks for the pattern.. Option D is correct because CloudTrail delivers logs to S3 within about 15 minutes; using S3 Events to trigger a Lambda that analyzes the logs in near-real-time allows detection within the 24-hour window. Option A is wrong because CloudWatch Logs Insights queries are not real-time and require logs to be streamed to CloudWatch Logs, which adds latency. Option B is wrong because Athena is not real-time. Option C is wrong because EventBridge can detect API calls but cannot correlate the creation of a key with its subsequent use in a single rule; it would require complex pattern matching.

Answer

Use Amazon Athena to query CloudTrail logs in S3 every hour and send alerts for matches.

Answer

Create an Amazon EventBridge rule that matches CreateAccessKey and any subsequent API call from the same user within 24 hours.

Answer

Stream CloudTrail logs to CloudWatch Logs and create a metric filter to detect the pattern, then set an alarm.

Question 12

A DevOps engineer needs to monitor the memory utilization of an Amazon RDS for MySQL instance. Which AWS service should be used to collect and visualize this metric?

Accepted Answer

Enhanced Monitoring for RDS.. Option C is correct because Enhanced Monitoring for RDS provides memory metrics (among others) and sends them to CloudWatch Logs, which can be visualized with CloudWatch dashboards. Option A is wrong because RDS does not expose memory utilization by default in CloudWatch; Enhanced Monitoring is required. Option B is wrong because Trusted Advisor does not collect instance-level metrics. Option D is wrong because Systems Manager is not the primary tool for RDS monitoring.

Answer

CloudWatch default metrics for RDS.

Answer

AWS Systems Manager Inventory.

Answer

AWS Trusted Advisor.

Question 13

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The DevOps team wants to monitor the end-to-end latency of API requests, including the time spent in API Gateway and Lambda. Which approach provides the most granular breakdown?

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. Option D is correct because AWS X-Ray provides tracing that shows the time spent in each component (API Gateway, Lambda, downstream calls) with detailed segments and subsegments. Option A is wrong because CloudWatch metrics give aggregate latency but no breakdown. Option B is wrong because Lambda Insights provides OS-level metrics, not request tracing. Option C is wrong because VPC Flow Logs capture network traffic, not application latency.

Answer

Enable Lambda Insights to get per-request latency breakdown.

Answer

Enable VPC Flow Logs to capture network round-trip times.

Answer

Use CloudWatch metrics for API Gateway and Lambda, then add them together.

Question 14

A company has a production Amazon EKS cluster with multiple node groups. The DevOps team notices that some pods are frequently restarting due to OOMKilled errors, but the cluster-level metrics (CPU, memory) appear normal. Which CloudWatch Container Insights metric should be analyzed to identify the specific node or pod causing the issue?

Accepted Answer

pod_memory_utilization.. Option A is correct because Container Insights provides pod-level memory utilization metrics that can pinpoint which pod is exceeding its memory limit. Option B is wrong because cluster-level memory utilization is aggregate. Option C is wrong because CPU metrics do not indicate memory issues. Option D is wrong because the number of pods does not show memory usage.

Answer

node_memory_utilization.

Answer

number_of_running_pods.

Answer

pod_cpu_utilization.

Question 15

A DevOps engineer needs to centrally collect and analyze logs from multiple AWS accounts and on-premises servers. Which AWS service should be used to aggregate logs in a single dashboard?

Accepted Answer

Amazon CloudWatch Logs.. Option D is correct because CloudWatch Logs can be used as a central destination for log data from multiple sources via subscription filters and cross-account log groups. Option A is wrong because S3 is storage, not a dashboard. Option B is wrong because Athena is a query service, not a dashboard. Option C is wrong because Kinesis is a streaming service, not a dashboard.

Answer

Amazon Athena.

Answer

Amazon S3.

Answer

Amazon Kinesis Data Firehose.