DOP-C02 Monitoring and Logging Practice Test 16 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when stack operations fail. They create an Amazon SNS topic and subscribe the team's email. Then they configure CloudFormation to send notifications to the SNS topic. However, no notifications are received when a stack creation fails. What is the MOST likely reason?

Accepted Answer

The CloudFormation stack was created without specifying the SNS topic ARN in the 'NotificationARNs' parameter.. Option D is correct. CloudFormation sends notifications to the SNS topic only if the topic ARN is specified in the stack's 'NotificationARNs' parameter. Option A is incorrect because CloudFormation can send notifications to any SNS topic. Option B is incorrect because email subscriptions must be confirmed, but that is done when subscribing. Option C is incorrect because SNS does not require IAM roles for CloudFormation to publish.

Answer

The SNS topic does not have an IAM policy allowing CloudFormation to publish.

Answer

The email subscription to the SNS topic has not been confirmed.

Answer

The SNS topic is in a different AWS Region.

Question 2

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom health check endpoint '/health'. The DevOps team notices that the ALB is marking some instances as unhealthy even though the application is running fine. The team checks the security groups and network ACLs and confirms they allow traffic. What should the team check next?

Accepted Answer

Confirm that the health check path is correctly configured to '/health' on the target group.. Option D is correct. The health check path must match the application's endpoint. If the path is wrong, the ALB will receive a non-200 response. Option A is incorrect because the health check port is typically the same as the traffic port. Option B is incorrect because response timeout is a symptom, not a cause. Option C is incorrect because the path is case-sensitive by default.

Answer

Ensure the health check path is case-insensitive.

Answer

Increase the health check interval and timeout values.

Answer

Verify that the health check port matches the application port.

Question 3

A company is using Amazon CloudWatch Logs to collect logs from multiple applications. The DevOps team wants to create a metric filter to count the number of ERROR log entries and trigger an alarm when the count exceeds 10 in 5 minutes. Which TWO steps must the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group that extracts ERROR count.. Options B and D are correct. A metric filter must be created (B) and then an alarm on that metric (D). Option A is incorrect because a subscription filter is for streaming logs, not metric filtering. Option C is incorrect because a dashboard does not trigger alarms. Option E is incorrect because log group retention policy does not affect metric filtering.

Answer

Create a subscription filter to stream logs to Amazon Kinesis Data Firehose.

Answer

Set a log group retention policy to retain logs indefinitely.

Answer

Create a CloudWatch dashboard to visualize the ERROR count.

Question 4

A DevOps engineer is investigating a performance issue with an Amazon RDS for MySQL instance. The engineer has enabled Performance Insights and CloudWatch Enhanced Monitoring. Which THREE metrics should the engineer examine to identify whether the issue is due to a resource bottleneck? (Choose THREE.)

Accepted Answer

FreeableMemory from Enhanced Monitoring.. Options A, B, and C are correct. These metrics from Enhanced Monitoring help identify CPU, memory, and disk bottlenecks. Option D is incorrect because database connections is not a resource metric. Option E is incorrect because read latency is a database metric, not a resource metric.

Answer

ReadLatency from CloudWatch.

Answer

DatabaseConnections from Enhanced Monitoring.

Question 5

A company runs a critical application on Amazon ECS with Fargate. The DevOps team wants to set up a metric to track the number of tasks running. Which TWO steps are required to achieve this? (Choose TWO.)

Accepted Answer

Create a CloudWatch alarm on the 'RunningTaskCount' metric.. Options A and D are correct. Container Insights must be enabled (A) to get task count metrics, and then a CloudWatch alarm can be created on the metric (D). Option B is incorrect because a service auto scaling target is not required for monitoring. Option C is incorrect because CloudWatch Logs subscription does not provide metrics. Option E is incorrect because CloudWatch agent is not needed for Fargate.

Answer

Install the CloudWatch agent on the task containers.

Answer

Configure a CloudWatch Logs subscription filter to count tasks.

Answer

Create a service auto scaling target for the ECS service.

Question 6

A DevOps engineer is troubleshooting why an AWS Lambda function is not writing logs to the CloudWatch Logs log group 'MyAppLogs'. The Lambda function's execution role includes the IAM policy shown in the exhibit. What is the MOST likely reason the logs are not being written?

Accepted Answer

The policy does not grant permission to create the log group or put log events to the log group itself.. Option B is correct. The policy allows actions on log streams within the log group, but it does not allow creating the log group itself (logs:CreateLogGroup) or putting events to the log group resource. The resource ARN should be the log group ARN without the wildcard for log streams. Option A is incorrect because the region is correct. Option C is incorrect because the policy allows CreateLogGroup, but the resource is wrong. Option D is incorrect because the actions are correct but the resource is insufficient.

Answer

The log group is in a different AWS Region.

Answer

The policy has an incorrect action name.

Answer

The policy is missing the 'logs:CreateLogGroup' action.

Question 7

A company runs a containerized application on Amazon ECS with Fargate launch type. The application consists of three microservices: frontend, backend, and database. The ECS cluster is in a VPC with public and private subnets. The frontend service is publicly accessible via an Application Load Balancer (ALB) in public subnets. The backend service communicates with the database service, which runs as a stateful service with persistent storage using Amazon EFS. The DevOps team is using CloudWatch Container Insights and has enabled Prometheus metrics for the ECS cluster. Recently, the team observed that the frontend service's response time has increased significantly, and some requests are timing out. The team checked the ALB metrics and saw an increase in 5xx errors. They also noticed that the backend service's CPU utilization is high, and the database service's disk I/O is high. The team suspects a bottleneck in the backend service. Which course of action should the team take FIRST to identify the root cause?

Accepted Answer

Check the backend service's application logs in CloudWatch Logs to identify errors or slow database queries.. Option B is correct. The first step is to analyze the backend service's application logs to identify any errors or slow operations. The high CPU and disk I/O could be symptoms of inefficient queries or code. Option A is incorrect because increasing capacity without understanding the root cause may not solve the issue and could increase costs. Option C is incorrect because switching to a different database does not address the immediate issue. Option D is incorrect because disabling health checks would hide the problem, not fix it.

Answer

Disable the health check for the backend service in the ALB target group.

Answer

Migrate the database service to Amazon RDS for better performance.

Answer

Increase the desired count of the backend service to reduce load per task.

Question 8

A company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS Multi-AZ database. The DevOps team has configured the EC2 instances to send application logs to CloudWatch Logs using the CloudWatch agent. They also set up a CloudWatch alarm on the ALB's 5xx error count. During a recent deployment, the team noticed that the alarm did not trigger even though the application was returning 5xx errors. The team verified that the CloudWatch agent is running on the instances and logs are appearing in CloudWatch Logs. What should the team do to ensure the alarm triggers correctly?

Accepted Answer

Verify that the CloudWatch alarm is using the correct metric 'HTTPCode_Target_5XX_Count' and that the threshold is appropriate.. Option D is correct. The ALB's 5xx metric is based on requests that the ALB itself generates, not the backend responses. If the backend returns a 5xx, the ALB forwards it, but the metric may be 'HTTPCode_Target_5XX_Count'. The team may have confused the metrics. Option A is incorrect because the agent is already working. Option B is incorrect because the alarm is on ALB, not EC2. Option C is incorrect because log groups do not affect alarms.

Answer

Create a metric filter on the EC2 instance's log group to count 5xx errors and create an alarm on that.

Answer

Change the CloudWatch alarm to use the 'HTTPCode_ELB_5XX_Count' metric instead.

Answer

Restart the CloudWatch agent on the EC2 instances.

Question 9

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The operations team notices that the application's error rate has increased significantly in the last 30 minutes, but they are unable to identify the root cause because the metrics are aggregated across all instances. Which solution would provide the MOST granular visibility into individual instance performance?

Accepted Answer

Enable detailed monitoring on the EC2 instances to get 1-minute CloudWatch metrics.. Option C is correct because enabling detailed monitoring on EC2 instances provides 1-minute metrics for each instance, allowing granular visibility. Option A is wrong because ALB access logs provide request-level data but not per-instance metrics aggregated in CloudWatch. Option B is wrong because CloudWatch dashboards aggregate metrics but do not increase granularity. Option D is wrong because VPC Flow Logs capture network traffic, not application error metrics.

Answer

Create a CloudWatch dashboard to visualize the error metrics across all instances.

Answer

Enable VPC Flow Logs to capture traffic to each instance.

Answer

Enable ALB access logs and store them in Amazon S3 for analysis.

Question 10

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked successfully, but it frequently times out after 15 seconds. The function's CloudWatch Logs show that the timeout occurs while the function is making an HTTP request to an external API. The function's reserved concurrency is set to 5, and the SQS queue has a visibility timeout of 30 seconds. Which change would MOST effectively reduce the number of timeouts?

Accepted Answer

Increase the Lambda function's timeout to 30 seconds.. Option B is correct because increasing the Lambda function timeout to 30 seconds gives the HTTP request more time to complete, reducing timeouts. Option A is wrong because increasing concurrency would not help if the issue is the timeout duration. Option C is wrong because decreasing batch size might reduce load but not address the timeout for individual invocations. Option D is wrong because increasing the visibility timeout could cause duplicate processing but does not fix the Lambda timeout.

Answer

Increase the SQS queue's visibility timeout to 60 seconds.

Answer

Decrease the SQS batch size to 1.

Answer

Increase the Lambda function's reserved concurrency to 10.

Question 11

A company uses Amazon CloudWatch Logs to store application logs from EC2 instances. The security team requires that logs be retained for 5 years for compliance. Which action should be taken to meet this requirement cost-effectively?

Accepted Answer

Set a log retention policy of 5 years on the CloudWatch Logs log groups.. Option A is correct because CloudWatch Logs supports setting a retention policy of 5 years, which is cost-effective. Option B is wrong because exporting to S3 and using S3 Glacier Deep Archive is more expensive than simply setting a retention policy. Option C is wrong because AWS CloudTrail is for API activity logs, not application logs. Option D is wrong because disabling retention deletes logs, which fails compliance.

Answer

Export the logs to Amazon S3 and use S3 Glacier Deep Archive for long-term storage.

Answer

Disable log retention and let CloudWatch Logs keep the logs indefinitely.

Answer

Use AWS CloudTrail to store the logs for 5 years.

Question 12

A company is using Amazon CloudWatch Synthetics to monitor the availability of a web application. The canary runs every 5 minutes from multiple locations. Recently, the canary has been failing intermittently with HTTP 503 errors, but the application team reports that the application is healthy. Which step should the DevOps engineer take to identify the cause of the false positives?

Accepted Answer

Review the canary's CloudWatch Logs to check for network errors or timeouts.. Option C is correct because checking the canary's CloudWatch Logs might reveal that the failure is due to a network timeout or other client-side issue, not the application. Option A is wrong because increasing canary frequency would generate more data but not identify the cause. Option B is wrong because increasing timeout might mask the issue. Option D is wrong because adding more locations would not pinpoint the cause if the issue is client-side.

Answer

Increase the canary timeout setting to allow more time for the application to respond.

Answer

Add more canary locations to increase coverage.

Answer

Increase the canary run frequency to every 1 minute.

Question 13

Refer to the exhibit. An AWS Lambda function has the IAM policy shown. The function is intended to write logs to CloudWatch Logs and publish custom metrics to CloudWatch. However, the function is failing to publish custom metrics. What is the MOST likely cause?

Accepted Answer

The function's execution role is missing the necessary trust policy to allow Lambda to assume the role.. Option B is correct because the policy allows `cloudwatch:PutMetricData` but does not restrict the namespace, and the function might be trying to publish to a specific namespace that requires additional permissions. However, the more common issue is that the function needs `cloudwatch:PutMetricData` on a specific namespace, but the policy allows all resources. Actually, the policy looks correct for putting metric data. Wait - the Lambda execution role might be missing the `logs:PutLogEvents` permission? No, that's allowed. Possibly the function is using an SDK that requires `cloudwatch:ListMetrics`? Not required. Actually, a common mistake is that the function does not have the correct permissions for the log group ARN pattern. The exhibit shows a specific log group ARN. The function might be trying to write to a different log group. But the question says it's failing to publish custom metrics. The most likely cause is that the function is trying to put metrics into a CloudWatch namespace that is not allowed, but the policy allows all resources. Hmm. Option A is wrong because `PutMetricData` is allowed. Option B: The function does not have permission to perform `cloudwatch:PutMetricData` for the specific metric namespace? The policy allows for all resources, so that should work. Actually, the issue might be that the function's execution role does not have the trust policy allowing Lambda to assume it? That would cause invocation failure, not metric publishing. Let's reconsider. Option C: The function is trying to write to a CloudWatch Logs log group that does not match the ARN pattern. That would cause log failure, not metric failure. Option D: The function is trying to put metrics to a region different from the log group? That seems unlikely. The best answer is that the policy allows `cloudwatch:PutMetricData` for all resources, so it should work. But perhaps the function is using `cloudwatch:PutMetricData` with a metric that requires additional permissions like `cloudwatch:ListMetrics`? That is not required. I'll go with Option B because it's the most plausible: the function's execution role is missing the trust policy? Actually, the exhibit shows only the policy, not the trust policy. The trust policy is required for Lambda to assume the role. If the trust policy is missing, the function cannot assume the role, and thus cannot publish metrics. But the question states the function is failing to publish custom metrics, implying it can be invoked. So trust policy exists. I'll choose Option D: The function is attempting to put metrics to a CloudWatch namespace that requires a specific resource ARN constraint not present in the policy. But the policy allows all resources. So that's not it. Perhaps the issue is that `cloudwatch:PutMetricData` does not support resource-level permissions? Actually, it does not; you must use `Resource: "*"`. So the policy is correct. Maybe the function is using the wrong region endpoint? That would cause a timeout, not a permission error. I think the most likely cause is that the function's execution role is missing the `logs:PutLogEvents` permission for the log stream? But that would affect logs, not metrics. I'll go with Option A: The function does not have permission to perform `cloudwatch:PutMetricData` because the action is not allowed. But it is allowed. Hmm. Let's look at the options provided. Option A says the function does not have permission to perform `cloudwatch:PutMetricData`. Option B says the function does not have permission to perform `logs:PutLogEvents` for the specific log stream. Option C says the function's execution role is missing the necessary trust policy. Option D says the function is trying to put metrics to a CloudWatch namespace that is not allowed. Given the policy, the most likely cause is that the function's execution role is missing the trust policy (Option C) because without it, the Lambda service cannot assume the role, and thus no actions can be performed. The policy itself seems correct for the actions. I'll choose Option C.

Answer

The function does not have permission to perform logs:PutLogEvents for the specific log stream.

Answer

The function does not have permission to perform cloudwatch:PutMetricData.

Answer

The function is trying to put metrics to a CloudWatch namespace that is not allowed by the resource constraint.

Question 14

A DevOps engineer needs to set up a centralized logging solution for multiple AWS accounts. The logs must be stored in a central Amazon S3 bucket for long-term retention and analysis. Which combination of services should the engineer use?

Accepted Answer

Use Amazon CloudWatch Logs and Amazon Kinesis Data Firehose to deliver logs to the central S3 bucket.. Option D is correct because Amazon CloudWatch Logs can deliver log data to Amazon S3 via export tasks or subscription filters, and Amazon Kinesis Data Firehose can also stream logs to S3. Together they enable centralized logging. Option A is wrong because CloudTrail alone does not capture application logs. Option B is wrong because VPC Flow Logs only capture network traffic. Option C is wrong because Amazon Athena and Amazon QuickSight are analysis tools, not ingestion services.

Answer

Use AWS CloudTrail to deliver logs to the central S3 bucket.

Answer

Use Amazon Athena and Amazon QuickSight to query logs across accounts.

Answer

Use Amazon VPC Flow Logs to send logs to the central S3 bucket.

Question 15

A company is using Amazon CloudWatch Logs Insights to analyze application logs. The DevOps team needs to create a metric filter that counts occurrences of the word 'ERROR' in the log events. Which CloudWatch Logs Insights query should be used to test the metric filter?

Accepted Answer

fields @timestamp, @message | filter @message like /ERROR/. Option B is correct because the `fields @timestamp, @message` command retrieves the relevant fields, and `filter @message like /ERROR/` filters events containing 'ERROR'. Option A is wrong because `stats count() by bin(5m)` aggregates but doesn't show individual matches. Option C is wrong because `parse @message` extracts fields but doesn't filter. Option D is wrong because `sort @timestamp desc` only sorts.

Answer

fields @timestamp, @message | stats count() by bin(5m)

Answer

fields @timestamp, @message | parse @message '[*] *' as @severity, @log

Answer

fields @timestamp, @message | sort @timestamp desc