DOP-C02 Monitoring and Logging Practice Test 17 — 15 Questions

Question 1

A company is using Amazon CloudWatch to monitor a production environment. The DevOps team wants to receive notifications when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which TWO steps should the team take to achieve this? (Choose TWO.)

Accepted Answer

Configure an Amazon SNS topic and subscribe the team's email address to it, then set the alarm to send notifications to the SNS topic.. Option A (Create a CloudWatch alarm) and Option C (Configure an SNS topic) are correct. A CloudWatch alarm monitors the metric and triggers an action (e.g., SNS notification) when the condition is met. Option B (Create a CloudWatch dashboard) is for visualization, not notification. Option D (Enable detailed monitoring) is not required for this alarm; basic monitoring (5-minute) is sufficient for 5-minute evaluation periods. Option E (Create a CloudWatch Logs metric filter) is for logs, not EC2 metrics.

Answer

Enable detailed monitoring on the EC2 instance to get 1-minute metrics.

Answer

Create a CloudWatch Logs metric filter to count CPU utilization errors.

Answer

Create a CloudWatch dashboard to visualize CPU utilization.

Question 2

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team wants to collect and visualize metrics such as CPU, memory, and network utilization at the task level. Which TWO services should the team use to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. Option A (CloudWatch Container Insights) and Option D (Amazon CloudWatch) are correct. Container Insights collects metrics from ECS tasks, and CloudWatch stores and visualizes them via dashboards. Option B (CloudWatch Logs) is for logs, not metrics. Option C (AWS X-Ray) is for tracing. Option E (Amazon Managed Service for Prometheus) can scrape metrics but is not the standard integrated solution for ECS Fargate; Container Insights is the recommended approach.

Answer

Amazon Managed Service for Prometheus

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 3

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that all logs be encrypted at rest using a customer-managed AWS KMS key. Which THREE steps are necessary to meet this requirement? (Choose THREE.)

Accepted Answer

Grant the IAM role used by the application to write logs permission to use the KMS key (kms:Encrypt, kms:Decrypt).. Options A, B, and C are correct. A KMS key must be created (A), the CloudWatch Logs log group must be associated with the key (B), and the IAM role that writes logs must have permission to use the key (C). Option D (enable server-side encryption with S3) is not applicable because logs are stored in CloudWatch Logs, not S3. Option E (enable encryption on the log stream) is not a supported action; encryption is set at the log group level.

Answer

Enable encryption on each log stream individually.

Answer

Enable server-side encryption on the Amazon S3 bucket where logs are exported.

Question 4

A company is using AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that all CloudTrail logs are delivered to a central Amazon S3 bucket and that the logs are encrypted and cannot be deleted. Which THREE steps should the team take to meet these requirements? (Choose THREE.)

Accepted Answer

Enable default encryption (SSE-S3) on the central S3 bucket.. Options A, C, and D are correct. Enabling log file validation (A) ensures integrity. Enabling SSE-S3 encryption (C) encrypts logs at rest. Enabling S3 Object Lock (D) prevents deletion. Option B (enable log file integrity) is duplicate of A? Actually, CloudTrail log file validation provides integrity. Option E (enable MFA Delete) is not supported on S3 buckets for this purpose; Object Lock is used.

Answer

Enable MFA Delete on the central S3 bucket to require multi-factor authentication for deletions.

Answer

Enable CloudTrail log file integrity by using AWS KMS.

Question 5

A DevOps engineer needs to set up a monitoring solution for an application running on Amazon EKS. The application emits custom metrics that need to be stored in Amazon CloudWatch and visualized on a dashboard. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch agent to emit custom metrics to CloudWatch.. Option A is correct because the CloudWatch agent can be configured to emit custom application metrics to Amazon CloudWatch, which is the required destination for storing the metrics. The agent uses the CloudWatch PutMetricData API to send these metrics, enabling centralized monitoring and alerting within CloudWatch.

Answer

Use CloudWatch Logs Insights to analyze the custom metrics.

Answer

Use Amazon Managed Service for Prometheus to scrape the metrics.

Question 6

A company runs a containerized web application on Amazon ECS with AWS Fargate. The application is critical and requires high availability. The DevOps team has set up an Amazon CloudWatch alarm that triggers an auto scaling action when the average CPU utilization exceeds 75% for 5 minutes. However, during a recent traffic spike, the application became slow and some requests timed out, even though the CloudWatch alarm did not fire. The team checked the ECS service auto scaling configuration and found that the target tracking scaling policy based on average CPU utilization is set with a target value of 75%. The ECS service is configured with a minimum of 2 tasks and a maximum of 10 tasks. Upon investigation, they noticed that the CPU utilization metric for the service remained below 75% during the spike, but the memory utilization was high (over 90%). The application logs show that the tasks were running out of memory, causing garbage collection pauses and slow responses. Which course of action should the DevOps engineer take to prevent this issue in the future?

Accepted Answer

Add a second target tracking scaling policy based on average memory utilization with a target value of 75%.. Option B is correct because the issue is memory pressure, not CPU. Adding a target tracking scaling policy based on memory utilization will scale the service when memory is high. Option A is wrong because increasing the minimum number of tasks would not dynamically respond to memory spikes. Option C is wrong because the issue is not CPU. Option D is wrong because the application is already containerized; increasing task memory is a static change that may not handle dynamic spikes efficiently, and the best practice is to auto scale based on memory.

Answer

Decrease the CPU target value to 50% to trigger scaling earlier.

Answer

Increase the minimum number of tasks from 2 to 5 to provide more capacity upfront.

Answer

Increase the task memory limit in the task definition to 8 GB.

Question 7

A company uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams. The Lambda function processes records in batches and writes the results to an Amazon DynamoDB table. Recently, the operations team noticed that the Lambda function is experiencing a high number of throttling errors (HTTP 400) when writing to DynamoDB. The DynamoDB table has on-demand capacity mode enabled. The CloudWatch metrics show that the DynamoDB consumed write capacity is well below the provisioned limits, but the Lambda function's error rate is increasing. The Lambda function's reserved concurrency is set to 100, and the function's timeout is 1 minute. The Kinesis stream has 10 shards. What is the MOST likely cause of the throttling errors?

Accepted Answer

The DynamoDB table is experiencing hot partitions due to uneven access patterns.. Option C is correct because the DynamoDB table has on-demand capacity, but throttling can still occur due to per-partition throughput limits. When many writes target the same partition key, the partition can throttle even if overall capacity is not exceeded. Option A is wrong because the function's concurrency is not the issue; throttling is from DynamoDB. Option B is wrong because the function timeout is not causing throttling. Option D is wrong because the batch size affects the number of records per invocation but not DynamoDB throttling directly.

Answer

The Lambda function's timeout is too short, causing the function to retry and overload DynamoDB.

Answer

The Lambda function's reserved concurrency is too high, causing too many concurrent invocations.

Answer

The Kinesis stream's batch size is too large, causing the Lambda function to write too many records at once.

Question 8

A DevOps engineer is responsible for monitoring an AWS environment that includes multiple EC2 instances running a web application. The engineer needs to set up a solution that sends an email alert when the average CPU utilization across all instances exceeds 80% for 10 consecutive minutes. The engineer has created a CloudWatch alarm with the metric `CPUUtilization` aggregated across all instances using the statistic `Average` and a period of 5 minutes. The alarm is set to trigger when the metric exceeds 80% for 2 consecutive periods (10 minutes). The alarm's action is configured to send a notification to an Amazon SNS topic that has an email subscription. However, the engineer is not receiving the email alerts. The engineer verified that the SNS topic exists and the email subscription is confirmed. The CloudWatch alarm shows that the metric value exceeded the threshold for 2 periods, but the alarm state is still 'OK'. What is the MOST likely reason for this?

Accepted Answer

The CloudWatch alarm requires 2 consecutive evaluation periods with the metric exceeding the threshold, but the alarm is still evaluating because of insufficient data points.. Option A is correct because the alarm must be in the 'ALARM' state to send notifications. If the metric exceeds the threshold but the alarm does not transition to ALARM, it may be due to missing data points or insufficient data to evaluate. Option B is wrong because the SNS topic appears to be correctly configured. Option C is wrong because the email subscription is confirmed. Option D is wrong because the metric is being published; the alarm shows values.

Answer

The email subscription is not confirmed.

Answer

The metric `CPUUtilization` is not being published to CloudWatch.

Answer

The SNS topic is not configured to allow CloudWatch to publish to it.

Question 9

A DevOps engineer notices that a critical Lambda function occasionally times out. The engineer wants to monitor the function's duration and log the timeout errors for analysis. Which TWO steps should the engineer take to achieve this? (Select TWO.)

Accepted Answer

Enable CloudWatch Logs for the Lambda function to capture logs.. Option A is correct because CloudWatch Logs can capture Lambda function logs including error messages. Option B is correct because CloudWatch metrics can track the Duration metric. Option C is wrong because X-Ray traces requests but does not directly log errors or track duration in CloudWatch. Option D is wrong because CloudTrail logs API calls, not function execution. Option E is wrong because S3 is not a monitoring service.

Answer

Store Lambda logs in an Amazon S3 bucket for analysis.

Answer

Use AWS X-Ray to trace the function and view duration in the X-Ray console.

Answer

Enable AWS CloudTrail to log all Lambda function invocations.

Question 10

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The operations team wants to analyze application access logs and error rates. They need to identify the top IP addresses making requests, as well as the distribution of HTTP status codes over time. Which THREE steps should the team take to achieve this? (Select THREE.)

Accepted Answer

Enable access logs on the Application Load Balancer and store them in an Amazon S3 bucket.. Enabling access logs on the Application Load Balancer and storing them in an S3 bucket captures detailed HTTP request data, including client IPs, request paths, and HTTP status codes. This raw log data is essential for analyzing top IP addresses and status code distributions over time.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Enable VPC Flow Logs to capture IP traffic data.

Question 11

A company runs a production web application on Amazon EC2 instances that are part of an Auto Scaling group. The instances are behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics and set up a CloudWatch dashboard to monitor the application. Recently, the team noticed that the CPU Utilization metric for the Auto Scaling group shows a spike every day at 2:00 PM, but the application performance remains normal. The team wants to investigate the cause of the CPU spike. What should the team do FIRST to identify the root cause?

Accepted Answer

Use CloudWatch Logs Insights to query the application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM.. Option A is correct because CloudWatch Logs Insights can query instance logs to identify processes causing high CPU. Option B is wrong because increasing instance size is not a first step for investigation. Option C is wrong because a cron job may be the cause, but the first step is to check logs. Option D is wrong because CloudTrail logs API calls, not CPU usage.

Answer

Enable AWS CloudTrail to log all API calls to the instances.

Answer

Disable any scheduled tasks on the instances to see if the spike stops.

Answer

Increase the instance size to provide more CPU capacity to handle the spike.

Question 12

A company has a microservices architecture running on Amazon ECS with Fargate. The operations team uses Amazon CloudWatch Container Insights to monitor the cluster. They notice that one of the services is experiencing high memory utilization, causing occasional task failures. The team wants to set up proactive monitoring to receive alerts when memory utilization exceeds 80% for more than 5 minutes. They also want to automate the response by replacing the failing tasks. The team has already created a CloudWatch alarm on the MemoryUtilized metric. Which additional steps should the team take to achieve the desired proactive monitoring and automated response?

Accepted Answer

Configure the CloudWatch alarm to trigger an Auto Scaling action that increases the desired count of the service to replace failing tasks.. Option A is correct because a CloudWatch Alarm can trigger an Auto Scaling action to replace tasks. Option B is wrong because CloudWatch Events (now EventBridge) can trigger Lambda, but the alarm already exists; the action should be on the alarm. Option C is wrong because CloudWatch Logs Insights is for querying logs, not for automated response. Option D is wrong because CloudTrail is for auditing API calls, not for automation.

Answer

Use CloudWatch Logs Insights to run queries on the task logs to identify the cause of high memory.

Answer

Create a CloudWatch Events rule that triggers an AWS Lambda function to restart the tasks when the alarm state changes.

Answer

Enable AWS CloudTrail to log all ECS API calls to audit the task failures.

Question 13

A company runs a multi-region application on Amazon EC2 instances across us-east-1 and eu-west-1. The application uses an Amazon Aurora global database for writes in us-east-1 and reads in eu-west-1. The DevOps team wants to monitor the replication lag between the primary and secondary regions. They have set up a CloudWatch alarm on the AuroraReplicaLag metric in both regions. However, they notice that the alarm in eu-west-1 sometimes triggers false positives when the lag spikes briefly but then recovers. The team wants to reduce false alarms while still being alerted to sustained high lag that could impact read replicas. The team is already using a standard CloudWatch alarm with a period of 1 minute and evaluation periods of 1. What should the team change to reduce false positives?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if the lag is high for 3 consecutive minutes.. Option A is correct because increasing evaluation periods requires the lag to be high for a longer duration before triggering an alarm. Option B is wrong because reducing the period would cause more frequent data points, potentially increasing false alarms. Option C is wrong because increasing the threshold would only alert on higher lag, but false positives are due to brief spikes. Option D is wrong because a composite alarm combining multiple metrics is not needed; the issue is with the evaluation period.

Answer

Increase the alarm threshold to a higher value, such as 10 seconds.

Answer

Reduce the metric period to 30 seconds to get more granular data.

Answer

Create a composite alarm that triggers when both the AuroraReplicaLag and CPUUtilization metrics are high.

Question 14

A company runs a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads to an S3 bucket. The operations team uses CloudWatch Logs for monitoring, but they are finding it difficult to correlate logs across multiple Lambda functions that handle different parts of the workflow. The team wants to trace requests as they flow through the application and identify bottlenecks or errors. The team has already enabled CloudWatch Logs for all Lambda functions. What should the team do to achieve end-to-end request tracing?

Accepted Answer

Enable AWS X-Ray on the Lambda functions and API Gateway to trace requests end-to-end.. Option C is correct because AWS X-Ray provides end-to-end tracing and integrates with Lambda and API Gateway. Option A is wrong because CloudWatch Contributor Insights analyzes top contributors but does not trace requests across services. Option B is wrong because CloudWatch ServiceLens provides service maps but relies on X-Ray for tracing. Option D is wrong because CloudTrail logs API calls, not application-level tracing.

Answer

Use CloudWatch Contributor Insights to analyze the log data and identify the top contributors to latency.

Answer

Use AWS CloudTrail to log all API calls and correlate them with CloudWatch Logs.

Answer

Create a CloudWatch ServiceLens service map to visualize the application components.

Question 15

A company runs a critical application on Amazon EKS. The DevOps team uses Prometheus for monitoring and Grafana for visualization. The team has set up a Prometheus server on an EC2 instance to scrape metrics from the EKS cluster. However, they are experiencing high memory usage on the Prometheus server, and some metrics are being dropped because of the retention period. The team wants to implement a scalable and managed monitoring solution that can store metrics for longer durations without the operational overhead of managing the Prometheus server. The team also wants to retain the ability to use PromQL queries and Grafana dashboards. What should the team do?

Accepted Answer

Migrate to Amazon Managed Service for Prometheus to ingest and store metrics, and use Amazon Managed Grafana for visualization.. Option D is correct because Amazon Managed Service for Prometheus is a scalable, managed service compatible with PromQL and can be used with Grafana. Option A is wrong because Amazon CloudWatch Container Insights provides metrics but not PromQL. Option B is wrong because moving Prometheus to a larger instance does not solve the scalability issue. Option C is wrong because Amazon Managed Grafana is a visualization service, not a metrics storage backend.

Answer

Use Amazon Managed Grafana to visualize metrics directly from the EKS cluster without a Prometheus server.

Answer

Increase the EC2 instance size for the Prometheus server and extend the retention period.

Answer

Set up Amazon CloudWatch Container Insights to collect metrics from the EKS cluster and store them in CloudWatch Logs.