DOP-C02 Monitoring and Logging Practice Test 15 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails due to a resource limit exceeded error. Which approach should be used?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack, and subscribe an email endpoint.. Option B is correct because CloudFormation natively supports sending stack events (including creation failures) to an SNS topic. By configuring an SNS topic as a notification option in the stack creation request, the DevOps team can subscribe an email endpoint to receive real-time notifications when a resource limit exceeded error occurs, without needing additional services or custom logic.

Answer

Create an Amazon EventBridge rule that matches CloudFormation resource limit exceeded events and sends to SQS.

Answer

Use AWS Config to detect when a stack is in a failed state.

Answer

Enable CloudTrail and create a CloudWatch alarm on the CreateStack API call.

Question 2

A DevOps team is troubleshooting a performance issue where an Amazon RDS for PostgreSQL instance's CPU utilization spikes every hour. The team suspects a specific query from an application. Which combination of tools can identify the problematic query?

Accepted Answer

Amazon RDS Performance Insights and Enhanced Monitoring.. Option D is correct because Performance Insights shows the top SQL queries by load, and RDS Enhanced Monitoring provides OS-level metrics. Option A is wrong because CloudWatch does not show individual queries. Option B is wrong because CloudTrail captures API calls, not database queries. Option C is wrong because VPC Flow Logs capture network traffic, not queries.

Answer

CloudWatch Logs Insights and CloudWatch metrics.

Answer

VPC Flow Logs and Lambda.

Answer

CloudTrail and CloudWatch alarms.

Question 3

A DevOps engineer wants to monitor the health of an Auto Scaling group and receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon EventBridge.. Option A and Option C are correct. Amazon SNS can send notifications, and CloudWatch Events (now Amazon EventBridge) can capture Auto Scaling lifecycle events and trigger SNS. Option B (CloudTrail) logs API calls but does not directly trigger notifications. Option D (Lambda) can be used but is not required; SNS alone is sufficient. Option E (Config) records configuration changes but is not the primary choice for real-time notifications.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Lambda.

Question 4

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search across multiple log groups and visualize trends. Which TWO services can be used together to achieve this?

Accepted Answer

CloudWatch Logs Insights.. Option A and Option C are correct. CloudWatch Logs Insights can query multiple log groups, and CloudWatch Dashboards can visualize the results. Option B (Athena) queries data in S3, not directly in CloudWatch Logs. Option D (Kibana) requires Elasticsearch Service, which adds complexity. Option E (QuickSight) can visualize but requires data in S3 or a database.

Answer

Amazon Elasticsearch Service with Kibana.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Question 5

A DevOps engineer is designing a centralized logging solution for 10 AWS accounts. Logs must be stored in a central S3 bucket with encryption and access logging. Which THREE services/resources are required to meet these requirements?

Accepted Answer

AWS CloudTrail.. Option A, Option C, and Option E are correct. CloudTrail can deliver logs to a central S3 bucket. S3 server access logs record requests to the bucket. KMS encryption key encrypts the logs. Option B (CloudWatch Logs) is not required for storage. Option D (Config) is not required for logging.

Answer

AWS Config.

Answer

Amazon CloudWatch Logs.

Question 6

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance fails to write logs to CloudWatch Logs in the log group 'MyAppLogs'. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on the log stream resource.. Option B is correct because the resource ARN in the policy specifies the log group but does not include the log stream ARN. To write logs, the policy must also allow resources for the log streams. Option A is wrong because the actions are correct. Option C is wrong because CloudWatch agent is not required if using the AWS SDK. Option D is wrong because the region is specified correctly.

Answer

The CloudWatch agent is not installed on the instance.

Answer

The policy specifies the wrong region in the resource ARN.

Answer

The policy does not include the 'logs:DescribeLogGroups' action.

Question 7

Refer to the exhibit. A DevOps engineer checks the CloudWatch alarm configuration and state. The alarm is in ALARM state for CPUUtilization averaging 90% over 5 minutes, but no notification was received. What is the most likely reason?

Accepted Answer

The SNS topic does not have any confirmed subscriptions.. Option B is correct because the alarm actions are configured with an SNS topic ARN, but the topic might not have any subscriptions (e.g., email not confirmed). Option A is wrong because the alarm is in ALARM state, so data is available. Option C is wrong because the period is 300 seconds (5 minutes), which is valid. Option D is wrong because the instance is running (CPU data exists).

Answer

The EC2 instance is stopped.

Answer

The alarm period is set to 300 seconds, which is too long.

Answer

The alarm has insufficient data to evaluate.

Question 8

Refer to the exhibit. A CloudFormation template deploys a Lambda function with X-Ray tracing enabled. However, traces are not appearing in the X-Ray console. What is the most likely missing configuration?

Accepted Answer

The Lambda execution role does not have permissions to upload trace data to X-Ray.. Option D is correct because the Lambda function's IAM role only has the AWSLambdaBasicExecutionRole, which grants permissions to write to CloudWatch Logs but not to send trace data to X-Ray. The function needs the AWSXRayDaemonWriteAccess policy or equivalent permissions. Option A is wrong because Node.js 18 is supported. Option B is wrong because the code logs the event but does not affect X-Ray. Option C is wrong because the TracingConfig is set to Active.

Answer

The Lambda runtime (nodejs18.x) does not support X-Ray tracing.

Answer

The TracingConfig mode is set to 'Active' but should be 'PassThrough'.

Answer

The Lambda function code does not use the AWS X-Ray SDK.

Question 9

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The operations team notices that the application's error rate spiked for 10 minutes last night, but no CloudWatch alarm was triggered. The team has a CloudWatch alarm on the ALB's 'HTTPCode_Target_5XX_Count' metric with a threshold of 100 over 5 consecutive periods of 1 minute. What is the MOST likely reason the alarm did not trigger?

Accepted Answer

The alarm's period is set to 5 minutes instead of 1 minute.. Option A is correct because CloudWatch metrics are published at 1-minute granularity for ALB, and the alarm evaluates 5 consecutive periods (5 minutes) of data. The spike lasted 10 minutes, so the alarm should have triggered. However, if the alarm was created with a period of 5 minutes (not 1 minute), it would require 25 minutes of data to trigger, missing the 10-minute spike. Option B is incorrect because the ALB publishes metrics every 1 minute by default. Option C is incorrect because the ALB sends metrics to CloudWatch, not CloudWatch Logs. Option D is incorrect because the spike is for the target group, not the load balancer itself.

Answer

The ALB publishes metrics only at 5-minute granularity.

Answer

The ALB sends metrics to CloudWatch Logs instead of CloudWatch Metrics.

Answer

The alarm is configured on the wrong metric namespace.

Question 10

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5 and a batch size of 10. The SQS queue has a visibility timeout of 30 seconds, and the Lambda function typically completes processing each batch in 10 seconds. Recently, the engineer noticed that messages are repeatedly processed, causing duplicates. The CloudWatch Logs show that the function is experiencing throttling errors. What is the MOST likely cause of the duplicate processing?

Accepted Answer

Lambda is throttling the function, and the visibility timeout expires before the function can process the messages.. Option C is correct. When Lambda throttles, it cannot process the messages, so SQS does not delete them. The visibility timeout of 30 seconds may expire before Lambda retries, making the messages visible again. Option A is incorrect because the batch size of 10 is within the maximum of 10. Option B is incorrect because reserved concurrency does not cause duplicate processing directly. Option D is incorrect because DLQ would store messages, not cause duplicates.

Answer

The SQS queue's dead-letter queue (DLQ) is not configured, causing messages to be reprocessed.

Answer

The function's batch size is too large, causing timeouts.

Answer

The function's reserved concurrency is too high, causing overloading.

Question 11

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket for long-term storage and analysis. The logs include AWS CloudTrail, VPC Flow Logs, and Amazon RDS audit logs. Which solution is the MOST operationally efficient?

Accepted Answer

Configure each account to deliver logs directly to a central S3 bucket using a bucket policy that allows cross-account writes.. Option D is correct. Amazon S3 supports cross-account access via bucket policies, and enabling S3 server access logs is not required for this use case. Option A is incorrect because CloudWatch Logs subscription filters can stream to a cross-account S3 bucket, but Kinesis Data Firehose adds unnecessary complexity. Option B is incorrect because aggregating into a single CloudWatch Logs account and then exporting requires additional steps. Option C is incorrect because it requires manual configuration per account.

Answer

Configure each account to send logs to a central CloudWatch Logs account, then export to S3.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to the central bucket.

Question 12

An e-commerce platform uses Amazon DynamoDB as its primary database. During a flash sale, the application experienced high read latency. The DevOps team wants to set up CloudWatch alarms to detect high read latency proactively. The team has enabled DynamoDB Accelerator (DAX) for caching. Which metric should the team use to create a CloudWatch alarm for read latency?

Accepted Answer

DAX's CacheHitLatency metric.. Option C is correct. With DAX enabled, the application reads from DAX, so the relevant latency metric is the DAX cache hit latency. Option A is incorrect because DynamoDB read latency does not reflect DAX caching. Option B is incorrect because DynamoDB consumed read capacity is not a latency metric. Option D is incorrect because DAX cache hit count is a count, not a latency measure.

Answer

DAX's CacheHitCount metric.

Answer

DynamoDB's ConsumedReadCapacityUnits metric.

Answer

DynamoDB's SuccessfulRequestLatency metric for GetItem operations.

Question 13

A company runs a microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. The DevOps team wants to monitor the number of HTTP 5xx errors returned by each service. They configure the ALB to send access logs to an S3 bucket and enable CloudWatch Container Insights. However, the team cannot view 5xx errors per service. What should the team do to achieve this?

Accepted Answer

Enable ALB access logging and parse the logs to filter by target group, then correlate with the ECS service name.. Option B is correct. ALB access logs contain the target group, but not the service name. By using the target group, you can map to the service. Option A is incorrect because CloudWatch Logs Insights can query access logs, but the logs need to be in CloudWatch Logs, not S3. Option C is incorrect because Container Insights provides metrics per task, not per service. Option D is incorrect because adding a response header would not be visible in metrics.

Answer

Use CloudWatch Logs Insights to query the ALB access logs directly from S3.

Answer

Enable Container Insights and create a CloudWatch dashboard to view HTTP 5xx errors per ECS service.

Answer

Configure the ALB to add a custom header with the service name and use CloudWatch metrics.

Question 14

A company is running a batch processing job on Amazon EMR that writes results to an Amazon S3 bucket. The job runs daily and takes about 2 hours. The DevOps team wants to be alerted if the job fails or takes longer than 3 hours. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function when the EMR cluster changes to 'TERMINATED' state, then check the job duration and send an alert if it exceeded 3 hours.. Option B is correct because it uses CloudWatch Events to detect the EMR cluster's 'TERMINATED' state, which triggers a Lambda function that can check the job duration against the 3-hour threshold and send an alert via SNS if needed. This approach is cost-effective (no polling, event-driven) and operationally efficient, as it decouples monitoring from the job itself and handles both failure and timeout scenarios without modifying the EMR job code.

Answer

Configure Amazon Simple Notification Service (SNS) directly from the EMR job to send notifications on completion.

Answer

Create a CloudWatch alarm on the EMR cluster's EC2 instance CPUUtilization metric to detect abnormal runtime.

Answer

Use Amazon CloudWatch Logs to monitor the job's log stream and create a metric filter for 'FAILED' messages.

Question 15

A DevOps engineer is setting up monitoring for an Amazon RDS for PostgreSQL instance. The engineer wants to track the number of active database connections over time to plan for scaling. Which approach should the engineer use?

Accepted Answer

Enable Enhanced Monitoring and view the 'DatabaseConnections' metric in CloudWatch.. Option B is correct. Enhanced Monitoring provides OS-level metrics including the number of database connections. Option A is incorrect because RDS event subscriptions are for events like failover, not metrics. Option C is incorrect because Performance Insights shows database load, not connection count. Option D is incorrect because CloudWatch Logs does not directly provide connection count metrics.

Answer

Configure CloudWatch Logs to monitor the PostgreSQL error log for connection entries.

Answer

Enable RDS event subscriptions to receive notifications about connection changes.

Answer

Use Performance Insights to view the number of active connections.