DOP-C02 Monitoring and Logging Practice Test 15 — 15 Questions

Question 1

A DevOps engineer notices that a critical Lambda function occasionally times out. The engineer wants to monitor the function's duration and log the timeout errors for analysis. Which TWO steps should the engineer take to achieve this? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudWatch Logs for the Lambda function to capture logs.. Enabling CloudWatch Logs for the Lambda function captures logs, including timeout error messages, which can be analyzed. Option D is correct because AWS X-Ray traces the function's execution and displays duration in the console, helping to monitor performance and identify timeouts. Option B is incorrect because storing logs in S3 is for archival, not real-time monitoring or analysis. Option C is incorrect because CloudWatch automatically provides the Duration metric; a metric filter is not needed to monitor it; instead, a CloudWatch alarm can be created directly on the Duration metric. Option E is incorrect because CloudTrail logs API calls, not function execution details.

Answer

Store Lambda logs in an Amazon S3 bucket for analysis.

Answer

Create a CloudWatch metric filter to monitor the Duration metric and set an alarm.

Answer

Enable AWS CloudTrail to log all Lambda function invocations.

Question 2

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The operations team wants to analyze application access logs and error rates. They need to identify the top IP addresses making requests, as well as the distribution of HTTP status codes over time. Which THREE steps should the team take to achieve this? (Select THREE.)

Accepted Answer

Enable access logs on the Application Load Balancer and store them in an Amazon S3 bucket.. Enabling access logs on the Application Load Balancer and storing them in an S3 bucket captures detailed HTTP request data, including client IPs, request paths, and HTTP status codes. This raw log data is essential for analyzing top IP addresses and status code distributions over time.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Enable VPC Flow Logs to capture IP traffic data.

Question 3

A company runs a production web application on Amazon EC2 instances that are part of an Auto Scaling group. The instances are behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics and set up a CloudWatch dashboard to monitor the application. Recently, the team noticed that the CPU Utilization metric for the Auto Scaling group shows a spike every day at 2:00 PM, but the application performance remains normal. The team wants to investigate the cause of the CPU spike. What should the team do FIRST to identify the root cause?

Accepted Answer

Use CloudWatch Logs Insights to query the application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM.. The correct first step is to use CloudWatch Logs Insights to query application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM. This allows the team to investigate the root cause of the CPU spike by analyzing log data, such as cron jobs or batch processes. Option A (CloudTrail) logs API calls, not CPU usage or instance-level processes. Option C (disabling scheduled tasks) would modify the environment without understanding the cause. Option D (increasing instance size) is a reactive measure, not an investigative step.

Answer

Enable AWS CloudTrail to log all API calls to the instances.

Answer

Disable any scheduled tasks on the instances to see if the spike stops.

Answer

Increase the instance size to provide more CPU capacity to handle the spike.

Question 4

A company has a microservices architecture running on Amazon ECS with Fargate. The operations team uses Amazon CloudWatch Container Insights to monitor the cluster. They notice that one of the services is experiencing high memory utilization, causing occasional task failures. The team wants to set up proactive monitoring to receive alerts when memory utilization exceeds 80% for more than 5 minutes. They also want to automate the response by replacing the failing tasks. The team has already created a CloudWatch alarm on the MemoryUtilized metric. Which additional steps should the team take to achieve the desired proactive monitoring and automated response?

Accepted Answer

Configure the CloudWatch alarm to trigger an Auto Scaling action that increases the desired count of the service to replace failing tasks.. A CloudWatch alarm can trigger an Auto Scaling action to replace failing tasks when memory utilization exceeds 80% for 5 minutes. Option A is wrong because CloudWatch Logs Insights is for querying logs, not for automated response. Option B is wrong because while CloudWatch Events (now EventBridge) can trigger Lambda, the alarm already exists and the action should be on the alarm itself; additionally, restarting tasks via Lambda may not effectively handle the high memory issue. Option D is wrong because CloudTrail is for auditing API calls, not for automation.

Answer

Use CloudWatch Logs Insights to run queries on the task logs to identify the cause of high memory.

Answer

Create a CloudWatch Events rule that triggers an AWS Lambda function to restart the tasks when the alarm state changes.

Answer

Enable AWS CloudTrail to log all ECS API calls to audit the task failures.

Question 5

A company runs a multi-region application on Amazon EC2 instances across us-east-1 and eu-west-1. The application uses an Amazon Aurora global database for writes in us-east-1 and reads in eu-west-1. The DevOps team wants to monitor the replication lag between the primary and secondary regions. They have set up a CloudWatch alarm on the AuroraReplicaLag metric in both regions. However, they notice that the alarm in eu-west-1 sometimes triggers false positives when the lag spikes briefly but then recovers. The team wants to reduce false alarms while still being alerted to sustained high lag that could impact read replicas. The team is already using a standard CloudWatch alarm with a period of 1 minute and evaluation periods of 1. What should the team change to reduce false positives?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if the lag is high for 3 consecutive minutes.. Increasing the number of evaluation periods to 3 means the alarm triggers only after the lag is high for 3 consecutive minutes, reducing false positives from brief spikes. Option A is wrong because raising the threshold would not address the underlying issue of transient spikes; it would simply ignore lower lag values. Option B is wrong because reducing the period to 30 seconds would generate more data points and likely more false alarms due to short-lived spikes. Option D is wrong because a composite alarm with CPUUtilization is not necessary; the focus is on replication lag, and the solution is to adjust evaluation periods.

Answer

Increase the alarm threshold to a higher value, such as 10 seconds.

Answer

Reduce the metric period to 30 seconds to get more granular data.

Answer

Create a composite alarm that triggers when both the AuroraReplicaLag and CPUUtilization metrics are high.

Question 6

A company runs a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads to an S3 bucket. The operations team uses CloudWatch Logs for monitoring, but they are finding it difficult to correlate logs across multiple Lambda functions that handle different parts of the workflow. The team wants to trace requests as they flow through the application and identify bottlenecks or errors. The team has already enabled CloudWatch Logs for all Lambda functions. What should the team do to achieve end-to-end request tracing?

Accepted Answer

Enable AWS X-Ray on the Lambda functions and API Gateway to trace requests end-to-end.. AWS X-Ray provides end-to-end tracing and integrates with Lambda and API Gateway, enabling request tracing across the entire workflow. Option A is wrong because CloudWatch Contributor Insights analyzes top contributors to latency but does not trace requests across services. Option B is wrong because CloudTrail logs API calls, not application-level tracing, and cannot correlate requests across Lambda functions. Option C is wrong because CloudWatch ServiceLens provides service maps but relies on X-Ray for actual tracing; without X-Ray, ServiceLens cannot trace requests.

Answer

Use CloudWatch Contributor Insights to analyze the log data and identify the top contributors to latency.

Answer

Use AWS CloudTrail to log all API calls and correlate them with CloudWatch Logs.

Answer

Create a CloudWatch ServiceLens service map to visualize the application components.

Question 7

A company runs a critical application on Amazon EKS. The DevOps team uses Prometheus for monitoring and Grafana for visualization. The team has set up a Prometheus server on an EC2 instance to scrape metrics from the EKS cluster. However, they are experiencing high memory usage on the Prometheus server, and some metrics are being dropped because of the retention period. The team wants to implement a scalable and managed monitoring solution that can store metrics for longer durations without the operational overhead of managing the Prometheus server. The team also wants to retain the ability to use PromQL queries and Grafana dashboards. What should the team do?

Accepted Answer

Migrate to Amazon Managed Service for Prometheus to ingest and store metrics, and use Amazon Managed Grafana for visualization.. Amazon Managed Service for Prometheus is a scalable, fully managed service that ingests and stores Prometheus metrics, supports PromQL queries, and integrates seamlessly with Amazon Managed Grafana. This eliminates the operational overhead of managing a Prometheus server while enabling longer retention and scaling. Option A is incorrect because Amazon Managed Grafana is a visualization tool only; it does not store metrics. Option C is incorrect because increasing the EC2 instance size does not address the operational overhead or scalability issues; it only postpones the problem. Option D is incorrect because Amazon CloudWatch Container Insights does not support PromQL natively, and migrating to CloudWatch would require rewriting queries and dashboards, losing compatibility with existing Prometheus and Grafana setups.

Answer

Use Amazon Managed Grafana to visualize metrics directly from the EKS cluster without a Prometheus server.

Answer

Increase the EC2 instance size for the Prometheus server and extend the retention period.

Answer

Set up Amazon CloudWatch Container Insights to collect metrics from the EKS cluster and store them in CloudWatch Logs.

Question 8

A company runs a web application on an Auto Scaling group of EC2 instances. The operations team uses CloudWatch alarms to monitor the application. They have set up a CPUUtilization alarm that triggers when the average CPU exceeds 70% for 5 minutes. The alarm triggers a scaling policy to add instances. Recently, the team noticed that the alarm frequently triggers during the day, but the application performance is acceptable. They suspect the alarm is too sensitive and want to reduce the number of false alarms. The team wants to keep the alarm responsive to real CPU spikes but avoid triggering on short bursts. What should the team change in the alarm configuration?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if CPU is high for 3 consecutive periods.. The alarm is triggering too frequently due to short CPU bursts. The goal is to reduce false alarms while remaining responsive to sustained high CPU. Increasing the number of evaluation periods requires the CPU to exceed the threshold for multiple consecutive periods before triggering, filtering out transient spikes. Thus, option C is correct. Option A (composite alarm) would add complexity but does not address the sensitivity to short bursts. Option B (reducing period to 1 minute) would make the alarm more sensitive, increasing false alarms. Option D (lowering threshold to 60%) would also increase sensitivity, making false alarms worse.

Answer

Create a composite alarm that combines CPUUtilization with MemoryUtilization.

Answer

Reduce the metric period to 1 minute and keep evaluation periods at 1.

Answer

Lower the threshold to 60% to catch more CPU spikes.

Question 9

Refer to the exhibit. A DevOps engineer runs this query to investigate a spike in errors. What is the most likely interpretation?

Accepted Answer

The error rate is increasing sharply in the last 15 minutes.. The query counts ERROR messages per 5-minute bin for a specific log stream. The output shows a clear increasing trend from 1 to 12 errors over the last 20 minutes, indicating a recent escalation of errors.

Answer

The error rate is decreasing over time.

Answer

The error rate is stable with no significant change.

Answer

The query is incorrectly filtering log streams.

Question 10

Refer to the exhibit. An alarm is configured as shown. The CPU utilization averages 85% for 10 minutes, then spikes to 95% for the next 5 minutes, and returns to 80%. How many times will the SNS topic receive a notification?

Accepted Answer

0. The alarm has a threshold of 85%, with strict greater-than comparison (not greater than or equal). The data shows two 5-minute periods averaging exactly 85% (which does not breach) and one period at 95% (which breaches). The alarm requires 3 consecutive breach periods to change from OK to ALARM; only 1 breach period is present. Therefore, the alarm remains in OK state and no notification is sent. The SNS topic receives 0 notifications.

Answer

1

Answer

2

Answer

3

Question 11

Refer to the exhibit. A security engineer runs this AWS Config query. What is the intended purpose?

Accepted Answer

Find all t2 instances that are not using approved AMIs.. The query selects EC2 instances of type t2.* whose AMI ID is not in the list of approved AMIs (those tagged with 'approved'). This identifies instances running unapproved AMIs.

Answer

Find all resources that are not approved.

Answer

Find all t2 instances that are using approved AMIs.

Answer

Find all instances regardless of type that are not using approved AMIs.

Question 12

Refer to the exhibit. A security team reviews this CloudTrail log entry. Which finding is most concerning?

Accepted Answer

The user did not authenticate with MFA.. The session was created without MFA (mfaAuthenticated: false). This is a security concern because the role allows console access and the user did not use MFA, increasing risk of unauthorized access. The termination is the action, but the lack of MFA is a security gap.

Answer

The event occurred in us-east-1.

Answer

The instance was terminated by an assumed role.

Answer

The source IP is from a public IP.

Question 13

Refer to the exhibit. A network engineer reviews VPC Flow Logs. Which statement about the traffic is correct?

Accepted Answer

Outbound HTTP traffic to the internet is blocked.. The VPC Flow Logs show that outbound traffic from the internal network to the internet on port 80 (HTTP) is being explicitly rejected (REJECT). This indicates that outbound HTTP traffic is blocked, while other traffic (such as HTTPS on port 443) may be accepted or handled differently. The logs do not show any accepted traffic on port 80, confirming the block.

Answer

Internal traffic on port 80 is allowed.

Answer

Outbound HTTPS traffic is being rejected.

Answer

All traffic is accepted.

Question 14

Refer to the exhibit. A user from IP 10.0.0.50 receives a 403 error when accessing https://d123.cloudfront.net/secret.pdf. The S3 bucket policy is as shown. What is the most likely cause of the error?

Accepted Answer

The CloudFront distribution does not have an Origin Access Control (OAC) configured.. The S3 bucket policy restricts access to requests originating from IP range 10.0.0.0/24. However, when using CloudFront to serve S3 content, the IP address seen by S3 is the CloudFront origin IP, not the viewer's IP. Therefore, the condition fails unless CloudFront's IP is within the range, which it is not. The correct fix is to use CloudFront's Origin Access Control (OAC) and remove the IP condition or use CloudFront functions to forward the viewer IP.

Answer

The S3 bucket policy should use 'Principal": { "AWS": "cloudfront.amazonaws.com" }'.

Answer

The S3 bucket policy does not allow s3:GetObject from CloudFront.

Answer

The user's IP address is not in the allowed range.

Question 15

Refer to the exhibit. A DevOps engineer runs the CloudWatch Logs Insights query and sees a spike in errors at 12:00. Which action would best help identify the root cause?

Accepted Answer

Query the logs around 12:00 without aggregation to see the actual error messages.. The query shows a sudden spike at 12:00. To identify the root cause, the engineer should look at the error messages themselves around that time. Filtering by @timestamp and @message to see the actual error messages will help identify the type of error. Adding a filter for a specific error pattern or grouping by error message would also help.

Answer

Add a filter for @logStream to see which log stream has the most errors.

Answer

Increase the limit to 100 to see more results.

Answer

Change the bin time to 1m to get more granular data.