DOP-C02 Monitoring and Logging Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. The IAM policy above is attached to a Lambda function's execution role. The Lambda function is supposed to publish custom metrics to CloudWatch using PutMetricData. However, the metrics are not appearing. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The function needs to specify a metric name and value when calling PutMetricData.. The most likely reason the metrics are not appearing is that the Lambda function is not providing the required parameters—specifically a metric name and value—when calling PutMetricData. The IAM policy correctly grants the cloudwatch:PutMetricData action, but the API call itself must include at least a MetricName and a Value (or StatisticValues) in the MetricDatum array; otherwise, CloudWatch silently drops the request without publishing any metric. This is a common coding error where the execution role permissions are sufficient but the function logic is incomplete.

Answer

The policy does not include the 'cloudwatch:PutMetricData' action.

Answer

The policy includes unnecessary actions that conflict with each other.

Answer

The policy uses a wildcard resource, which is not allowed for the PutMetricData action.

Question 2

A company runs a microservices application on Amazon ECS with Fargate. The operations team notices that some services are experiencing intermittent high latency, but CPU and memory metrics appear normal. They need to identify the root cause. Which approach should they use?

Accepted Answer

Instrument the application with the AWS X-Ray SDK and use the X-Ray console to analyze traces.. Intermittent latency with normal CPU and memory metrics points to a distributed tracing problem — the bottleneck is likely in a downstream call, a network hop, or a specific service in the request chain. AWS X-Ray traces requests end-to-end across ECS tasks, Lambda functions, and downstream services, showing exactly where time is spent. This makes it the right tool to pinpoint the root cause of intermittent latency in a microservices architecture.

Answer

Enable detailed CloudWatch Logs and use CloudWatch Logs Insights to query logs for slow requests.

Answer

Use Amazon Managed Service for Prometheus to collect custom metrics and set up dashboards.

Answer

Set up CloudWatch Synthetics canaries to monitor the endpoints and measure response times.

Question 3

An application running on Amazon EC2 instances sends custom metrics to CloudWatch. The team notices that some metrics are not appearing. What is the most likely cause?

Accepted Answer

The CloudWatch agent is not installed or configured on the EC2 instances.. The most likely cause is that the CloudWatch agent is not installed or configured on the EC2 instances. Custom metrics require the CloudWatch agent to collect and send data to CloudWatch. Option A is incorrect because custom metric namespaces do not need to be pre-registered; they are automatically created when metrics are published. Option B is incorrect because instances in a private subnet can still publish metrics using a VPC endpoint or a proxy, so a NAT gateway is not strictly required. Option C is incorrect because even with proper IAM permissions, the CloudWatch agent must be installed and running to collect and send custom metrics. Therefore, option D is correct.

Answer

The custom metric namespace is not pre-registered in CloudWatch.

Answer

The EC2 instances are in a private subnet without a NAT gateway.

Answer

The IAM role attached to the EC2 instance lacks permissions to publish metrics.

Question 4

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. How can this be achieved with minimal overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'CreateAccessKey' event and targets an SNS topic.. D is correct because Amazon EventBridge can capture real-time CloudTrail API events, such as 'CreateAccessKey', and route them directly to an SNS topic for immediate notification. This approach requires no polling, no custom code, and minimal overhead, as EventBridge handles event matching and delivery natively.

Answer

Use CloudWatch Logs Insights to run a query every hour and send results via email.

Answer

Set up an AWS Config rule to detect when an access key is created.

Answer

Configure S3 event notifications on the CloudTrail bucket to trigger a Lambda function.

Question 5

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences periodic slowdowns. The team wants to monitor the number of active connections and the query execution time. Which approach is most cost-effective?

Accepted Answer

Enable Performance Insights and set up CloudWatch alarms on the 'DBLoad' metric.. Performance Insights provides detailed query execution time metrics, enabling monitoring of query performance. It also includes the 'DBLoad' metric which reflects database load from active connections and queries. Combined with CloudWatch alarms, this approach is cost-effective as Performance Insights is included with RDS at no additional cost for up to 7 days of retention (longer retention has a fee). Options A and B are invalid because the CloudWatch agent cannot be installed on RDS instances, and 'QueryExecutionTime' is not a standard CloudWatch metric for RDS. Option D is less suitable for the specific requirement of query execution time; Enhanced Monitoring provides OS-level metrics like processes and memory but does not track query-level execution time.

Answer

Install the CloudWatch agent on the RDS instance to collect custom metrics.

Answer

Use the RDS console to view the 'DatabaseConnections' and 'QueryExecutionTime' metrics.

Answer

Enable Enhanced Monitoring and publish metrics to CloudWatch, then create alarms on relevant metrics.

Question 6

An application running on AWS Lambda is experiencing cold starts. The team wants to monitor the cold start duration. What should they do?

Accepted Answer

Monitor the 'InitDuration' metric in CloudWatch for the Lambda function.. AWS Lambda automatically publishes the 'InitDuration' metric in CloudWatch for cold starts, which measures the time spent initializing the runtime and code. Option B is incorrect because while CloudWatch Logs Insights can query for 'REPORT' lines, it is more complex and unnecessary since the metric is already available. Option C is incorrect because publishing a custom metric from the Lambda code is redundant; the InitDuration metric is automatically provided. Option D is incorrect because AWS X-Ray can trace cold starts, but the dedicated metric is simpler and directly available.

Answer

Use CloudWatch Logs Insights to query log groups for 'REPORT' lines and calculate duration.

Answer

Publish a custom metric from the Lambda code that measures initialization time.

Answer

Enable AWS X-Ray and trace the Lambda invocation to see cold start duration.

Question 7

A company uses Amazon S3 to store sensitive data. The security team wants to be notified when an S3 bucket policy is modified. Which approach is most efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'PutBucketPolicy' API call and sends a notification to an SNS topic.. Amazon EventBridge can match AWS API calls such as PutBucketPolicy via CloudTrail management events and route them to an SNS topic for notification. This is the most efficient, near-real-time, event-driven approach for alerting on bucket policy changes.

Answer

Set up an AWS Config rule to detect changes to the bucket policy.

Answer

Configure S3 event notifications for 's3:PutBucketPolicy' on the bucket.

Answer

Enable S3 server access logs and use CloudWatch Logs Insights to run queries periodically.

Question 8

A DevOps team wants to monitor the disk space utilization on their EC2 instances. What is the simplest way to achieve this?

Accepted Answer

Install the CloudWatch agent on the EC2 instances and configure the disk metric.. The CloudWatch agent can collect disk space metrics from EC2 instances, which is not available with default CloudWatch metrics. Option A is incorrect because AWS Systems Manager Inventory is used for software inventory and configuration, not real-time disk space monitoring. Option C is incorrect because EC2 detailed monitoring only provides more frequent metrics for standard EC2 metrics (CPU, network, etc.), not disk metrics. Option D is incorrect because EC2 basic monitoring also does not include disk metrics.

Answer

Use AWS Systems Manager Inventory to collect disk space data.

Answer

Enable EC2 detailed monitoring in CloudWatch.

Answer

Use EC2 basic monitoring in CloudWatch.

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs show that some requests are timing out. The team needs to identify the source of the issue. Which TWO steps should they take?

Accepted Answer

Enable ALB access logs and analyze them.. Option A is correct because ALB access logs capture detailed per-request information such as request processing time, target response time, and the specific error codes (e.g., 504 Gateway Timeout) returned by the load balancer, which directly helps pinpoint whether timeouts originate at the ALB or the backend targets. Option D is correct because CloudWatch metrics for the ALB, particularly 'TargetResponseTime' and 'RequestCount', reveal latency trends and traffic patterns that indicate whether targets are slow or overloaded, helping isolate the source of the timeouts. Option B is not appropriate because VPC Flow Logs only capture IP-level metadata (source/destination, ports, accept/reject) and cannot show HTTP-layer timing or application-level errors. Option C is not appropriate because AWS WAF logs only record requests that match or are blocked by WAF rules, and the scenario does not indicate WAF is in use or that requests are being blocked. Option E is not appropriate because CloudTrail records AWS API calls for auditing, not application request behavior or latency.

Answer

Enable VPC Flow Logs to capture network traffic.

Answer

Enable AWS WAF logs to inspect HTTP requests.

Answer

Enable AWS CloudTrail to log all API calls.

Question 10

A DevOps engineer is designing a centralized logging solution for a multi-account AWS environment. The solution must be cost-effective and provide real-time log analysis. Which THREE services should they consider?

Accepted Answer

Amazon OpenSearch Service (Elasticsearch). Amazon CloudWatch Logs (D) is correct because it is the native AWS service for collecting, storing, and monitoring log data from EC2 instances, Lambda functions, and other AWS resources, and it supports real-time metric filters and subscription filters for analysis. Amazon Kinesis Data Firehose (B) is correct because it reliably streams log data in near real-time to destinations such as Amazon S3, Amazon OpenSearch Service, or Splunk, and it can transform and batch records cost-effectively. Amazon OpenSearch Service (A) is correct because it provides real-time search, analytics, and visualization of log data via Kibana, making it ideal for interactive log analysis in a centralized multi-account setup. Amazon S3 (C) is not marked correct because, while it is a cost-effective storage destination for logs, it is not a real-time analysis service on its own. AWS CloudTrail (E) is not marked correct because it records API activity and account events for auditing, not application or system log aggregation and real-time analysis.

Answer

Amazon S3

Answer

AWS CloudTrail

Question 11

A company uses AWS Lambda for data processing. The operations team wants to be alerted when a function fails. Which TWO methods can they use?

Accepted Answer

Configure a dead-letter queue (DLQ) for the Lambda function and monitor the queue.. Option D is correct because Lambda automatically publishes the 'Errors' metric to Amazon CloudWatch, and a CloudWatch alarm can be created on that metric to trigger an Amazon SNS notification when the error threshold is breached, directly alerting the operations team. Option C is correct because configuring a dead-letter queue (an Amazon SQS queue or SNS topic) for the Lambda function captures failed asynchronous invocations, and monitoring that queue (e.g., via CloudWatch metrics like ApproximateNumberOfMessagesVisible) provides an alerting mechanism for failures. Option A is incorrect because S3 event notifications only trigger Lambda invocations on object events; they do not detect or report Lambda execution errors. Option B is incorrect because CloudTrail records API activity and management events, not Lambda function invocation failures, and it is not an alerting service. Option E is incorrect because AWS Config evaluates resource configuration compliance, not runtime function failures.

Answer

Configure S3 event notifications to trigger on Lambda errors.

Answer

Enable AWS CloudTrail to log Lambda invocations.

Answer

Use AWS Config to detect Lambda function failures.

Question 12

A Lambda function is unable to write logs to CloudWatch Logs. The IAM policy attached to the function's execution role is shown above. What is the issue?

Accepted Answer

The policy is missing the 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions.. The IAM policy attached to the Lambda execution role is missing the logs:CreateLogGroup and logs:CreateLogStream actions. Without these, Lambda cannot create the log group or log stream, and thus cannot write logs to CloudWatch Logs. The logs:PutLogEvents action alone is insufficient because the log group and stream must exist first.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The region in the ARN does not match the Lambda function's region.

Answer

The action should be 'logs:PutLogEvents' but the resource is too restrictive.

Question 13

A DevOps engineer runs the command above to retrieve CPU utilization for an EC2 instance, but gets no data points. The instance is running and has basic monitoring enabled. What is the most likely reason?

Accepted Answer

The IAM user executing the command lacks 'cloudwatch:GetMetricStatistics' permission.. The command likely fails because the IAM user executing it does not have the 'cloudwatch:GetMetricStatistics' permission. Basic monitoring publishes CPUUtilization metrics every 5 minutes (300 seconds), so a period of 300 seconds is valid. The dimension name 'InstanceId' is correct as shown. Option A is wrong because the dimension name is case-sensitive and 'InstanceId' is correct. Option B is wrong because basic monitoring is enabled by default and publishes CPUUtilization. Option C is wrong because 300 seconds equals the default 5-minute interval, which is the minimum supported period for basic monitoring.

Answer

The dimension name should be 'InstanceId' with a different case.

Answer

The instance has basic monitoring disabled.

Answer

The period of 300 seconds is less than the minimum supported period.

Question 14

A Lambda function is timing out. The log above shows a recent invocation. What is the most likely cause?

Accepted Answer

The function timeout is set too low.. The log shows the function timed out at 3000 ms, which is the default Lambda timeout (3 seconds). The correct answer is D because the timeout value is set too low, causing the function to be terminated before it can complete. Option A is incorrect because memory usage is only 64 MB out of 128 MB, so insufficient memory is not the issue. Option B is incorrect because there is only one invocation shown; frequent invocations would cause throttling, not a timeout. Option C is incorrect because the init duration is normal (e.g., 2.34 ms), indicating that a cold start is not the cause; cold starts increase latency but do not cause timeouts if the function runs within the timeout limit.

Answer

The function is running out of memory.

Answer

The function is being invoked too frequently.

Answer

The function is experiencing a cold start.

Question 15

A DevOps engineer is configuring CloudWatch Logs for a Lambda function that processes streaming data from Kinesis. The function sometimes fails due to memory exhaustion. The engineer wants to ensure that logs from the function are shipped to CloudWatch Logs even when the function fails. Which configuration should be used?

Accepted Answer

Ensure the Lambda function writes logs to stdout or stderr; CloudWatch Logs will automatically capture them. Lambda functions automatically send all output written to stdout (via print or console.log) and stderr to CloudWatch Logs, regardless of whether the function succeeds or fails. This is a built-in behavior of the Lambda runtime, so no additional agents or configuration are needed to capture logs from a failed invocation due to memory exhaustion.

Answer

Configure a Kinesis Agent on the Lambda execution environment to stream logs to CloudWatch Logs

Answer

Install the CloudWatch Logs agent on the Lambda function to continuously send logs

Answer

Enable detailed CloudWatch metrics for the Lambda function