DOP-C02 Monitoring and Logging Practice Test 17 — 15 Questions

Question 1

A company is migrating its on-premises applications to AWS and wants to maintain the same level of monitoring for its Linux-based EC2 instances. They currently use Nagios for monitoring. They want a managed AWS service that can monitor instance health, system metrics, and application logs. Which solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the Amazon CloudWatch agent on each EC2 instance to collect system metrics and logs, and send them to CloudWatch.. The Amazon CloudWatch agent (unified CloudWatch agent) can collect system metrics (CPU, memory, disk) and logs from EC2 instances and send them to CloudWatch, providing a managed monitoring solution similar to Nagios. Option B is incorrect because AWS CloudTrail is for auditing API calls, not for monitoring system metrics or logs. Option C is incorrect because AWS Systems Manager Inventory collects software inventory and configuration data, not real-time metrics or logs. Option D is incorrect because AWS Config tracks resource configuration changes for compliance, not for monitoring system health.

Answer

Use AWS CloudTrail to monitor instance activity and capture log files.

Answer

Use AWS Systems Manager Inventory to collect system configuration and log files.

Answer

Use AWS Config to track instance configuration changes and trigger alerts.

Question 2

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with timeout errors. The DevOps team needs to troubleshoot the root cause. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Increase the canary timeout configuration to allow more time for the endpoint to respond.. Options B, D, and E are correct. B: Increasing the canary timeout configuration can resolve timeout errors if the endpoint is slow but still functional. D: Reviewing VPC Flow Logs helps identify network issues such as dropped or denied requests that could cause timeouts. E: Examining canary logs in CloudWatch Logs provides detailed error messages and execution traces to pinpoint the failure cause. Option A is incorrect because CloudTrail records API calls, not canary execution details; canary logs are in CloudWatch Logs. Option C is incorrect because canaries run in AWS Lambda, not on EC2 instances, so EC2 CPU utilization is irrelevant.

Answer

Use AWS CloudTrail to review Canary API calls.

Answer

Check the EC2 instance CPU utilization in the VPC where the canaries run.

Question 3

A DevOps engineer is configuring a centralized logging solution using Amazon CloudWatch Logs. They need to ensure that logs from multiple AWS accounts are aggregated into a single CloudWatch Logs account. Which approach meets this requirement?

Accepted Answer

Create a subscription filter in each account that delivers log events to a CloudWatch Logs destination in the central account.. CloudWatch Logs supports cross-account subscription filters that can deliver log events to a CloudWatch Logs destination in a central account. The destination is a logical resource that points to a Kinesis Data Stream or Lambda function in the central account, and the source account creates a subscription filter that sends matching log events to that destination. This allows centralized aggregation without requiring each account to manage separate streaming infrastructure.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket, then use Amazon Athena to query.

Answer

Set up a cross-account destination using an Amazon Kinesis Data Streams stream in the central account and configure each account to send logs to that stream.

Answer

Configure each application to use the PutLogEvents API to send logs directly to the central account's log group.

Question 4

A company is using AWS CloudTrail to track API calls. They want to be notified immediately when an IAM user creates a new access key. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic.. To be notified immediately when an IAM user creates a new access key, the most efficient approach is to use Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic. CloudTrail records the 'CreateAccessKey' API call as an event. An EventBridge rule can be configured to match this specific event pattern and send the event to an SNS topic, which can then send notifications via email, SMS, etc. This provides real-time notification without additional services. Option A (CloudWatch Logs with metric filter and alarm) requires sending CloudTrail logs to CloudWatch Logs, which adds latency and complexity; it is not as direct as EventBridge. Option B (AWS Config with Lambda) is not designed for real-time event notification. Option C (EventBridge with Lambda and SES) adds unnecessary Lambda processing since SNS can directly send email when subscribed to the topic.

Answer

Amazon CloudWatch Logs with a metric filter and alarm.

Answer

AWS Config with an AWS Lambda function.

Answer

Amazon CloudWatch Events (Amazon EventBridge) with an AWS Lambda function that sends an email via Amazon SES.

Question 5

A DevOps engineer needs to audit changes to IAM policies over the past 90 days. The engineer wants to see who made the change, what the change was, and when it occurred. Which AWS tool should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct choice because it records all API calls made to the AWS environment, including IAM policy changes, and stores them as events with details such as the identity of the caller (IAM user or role), the time of the request, and the request parameters. By querying CloudTrail logs over the past 90 days, the DevOps engineer can audit who made the change, what the change was (e.g., the specific IAM policy document modification), and when it occurred.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

IAM Access Analyzer

Question 6

A company is using Amazon RDS for MySQL and wants to monitor database connections. They need to set up an alarm when the number of connections exceeds 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric and statistic should be used?

Accepted Answer

DatabaseConnections metric with Average statistic. The Average statistic of the DatabaseConnections metric over a 5-minute period provides a smoothed representation of connection usage, which is appropriate for detecting sustained breaches of the 80% threshold. Using Average reduces sensitivity to transient spikes, ensuring the alarm triggers only when the average number of connections remains above the threshold for the entire evaluation period, aligning with the requirement of 'more than 5 minutes'.

Answer

DatabaseConnections metric with Maximum statistic

Answer

DatabaseConnections metric with Sum and then divide by the number of data points

Answer

DatabaseConnections metric with Sum statistic

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer. They use Amazon CloudFront for content delivery. The DevOps team notices that some requests are returning HTTP 503 errors intermittently. After checking the CloudFront and ALB logs, they find that the errors originate from the ALB. What is the most likely cause?

Accepted Answer

The ALB is experiencing a surge in traffic and is scaling up, but during the scaling activity, some requests are rejected.. When an Application Load Balancer (ALB) experiences a sudden surge in traffic that exceeds its current capacity, it may temporarily reject requests with HTTP 503 errors while it scales up. During the scaling activity, the ALB's target group might not have enough healthy registered targets to handle the load, causing the ALB to return 503 responses until new instances are provisioned and pass health checks. This matches the intermittent nature of the errors described in the scenario.

Answer

The SSL certificate on the ALB is expired.

Answer

The security group for the ALB is blocking traffic from CloudFront.

Answer

CloudFront is configured to forward an HTTP method that the ALB does not support.

Question 8

A DevOps team is implementing a comprehensive logging strategy for a microservices architecture running on Amazon EKS. They need to collect logs from all containers and send them to a centralized log analytics platform. The solution must be agentless and support multi-line log events. Which approach should the team use?

Accepted Answer

Deploy a Fluent Bit DaemonSet on the EKS cluster and configure it to send logs to Amazon CloudWatch Logs.. Fluent Bit is a lightweight, CNCF-graduated log processor that can be deployed as a DaemonSet on EKS to collect logs from all nodes without requiring sidecar containers. It supports multi-line log events natively via its multiline filter plugin, and it can output directly to Amazon CloudWatch Logs using the cloudwatch_logs output plugin, meeting the agentless requirement since it runs as a Kubernetes DaemonSet rather than as a per-pod sidecar.

Answer

Use the Amazon CloudWatch agent as a sidecar container in each pod to forward logs to CloudWatch Logs.

Answer

Install the Amazon Kinesis Agent on each EC2 instance and configure it to stream logs to Amazon Kinesis Data Firehose.

Answer

Deploy a Fluentd DaemonSet on the EKS cluster and configure it to send logs to Amazon S3.

Question 9

A company uses AWS CloudTrail to log API activity in their AWS account. They need to ensure that any changes to CloudTrail configuration itself are detected and alerted upon in real time. Which service should they use?

Accepted Answer

Use Amazon CloudWatch Events (EventBridge) to create a rule matching the StopLogging or UpdateTrail API calls.. Amazon CloudWatch Events (EventBridge) can monitor CloudTrail API calls in real time by creating a rule that matches specific API calls such as StopLogging or UpdateTrail. When these calls are made, the rule triggers an action (e.g., SNS notification or Lambda function) to alert administrators immediately. This provides the real-time detection required for changes to CloudTrail configuration itself.

Answer

Enable AWS Config rules to monitor CloudTrail configuration changes.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs for changes.

Answer

Enable Amazon GuardDuty to detect changes to CloudTrail.

Question 10

A company has a multi-account AWS environment using AWS Organizations. The security team needs to centrally monitor and analyze VPC Flow Logs from all accounts. The solution must be cost-effective and allow querying across accounts. Which approach should they take?

Accepted Answer

Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.. It uses a centralized Amazon S3 bucket to aggregate VPC Flow Logs from all accounts, which is cost-effective (S3 storage costs are low) and enables cross-account querying via Amazon Athena using standard SQL. This approach avoids per-ingestion costs of services like CloudWatch Logs or Kinesis and provides a serverless, scalable query engine for analyzing logs across accounts.

Answer

Use Amazon Elasticsearch Service (Amazon OpenSearch Service) with a cross-account ingestion pipeline.

Answer

Stream VPC Flow Logs from each account to Amazon Kinesis Data Analytics for real-time analysis.

Answer

Configure each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription.

Question 11

A DevOps engineer needs to set up a monitoring solution for an AWS Lambda function that processes messages from an Amazon SQS queue. The engineer wants to be alerted if the function fails to process a message (i.e., the message ends up in the dead-letter queue). Which approach should they use?

Accepted Answer

Create a CloudWatch alarm on the ApproximateNumberOfMessagesVisible metric of the dead-letter queue.. The `ApproximateNumberOfMessagesVisible` metric on the dead-letter queue (DLQ) directly reflects the number of messages that have failed processing and been moved there. By creating a CloudWatch alarm on this metric (e.g., when it exceeds 0 for a period), the engineer receives an alert precisely when messages are failing, without needing to parse logs or rely on indirect indicators.

Answer

Enable CloudTrail to log SQS API calls and create a metric filter for SendMessage to the DLQ.

Answer

Create a CloudWatch Events rule to monitor the Lambda function errors.

Answer

Configure the Lambda function's dead-letter queue to send notifications via Amazon SNS.

Question 12

A company runs a web application behind an Application Load Balancer (ALB) in a production AWS account. The DevOps team needs to analyze HTTP request patterns and identify the top IP addresses generating errors. They want to store the data cost-effectively for querying with SQL. Which solution meets these requirements?

Accepted Answer

Enable ALB access logs and store them in Amazon S3, then use Amazon Athena to query the logs with SQL.. ALB access logs provide detailed HTTP request data (including source IP, request URI, response code, etc.) and are stored in Amazon S3, which is cost-effective for long-term storage. Amazon Athena allows querying these logs directly with standard SQL without needing to load data into a database, meeting the requirement for SQL-based analysis of top IP addresses generating errors.

Answer

Use CloudWatch Metrics to monitor error rates and top IPs via custom metrics.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query the logs.

Answer

Stream the ALB logs to Amazon Kinesis Data Analytics and use SQL applications.

Question 13

A DevOps engineer is tasked with centralizing logs from multiple AWS accounts into a single Amazon OpenSearch Service domain. The engineer sets up Amazon Kinesis Data Firehose to deliver logs from each account to the OpenSearch domain. However, some accounts show failed deliveries in the Firehose console. Which configuration is MOST likely causing the failures?

Accepted Answer

The IAM role assumed by Firehose in each account does not have permissions to write to the cross-account OpenSearch domain. The most likely cause of failed deliveries is that the IAM role assumed by Kinesis Data Firehose in each source account lacks the necessary permissions to write to the cross-account Amazon OpenSearch Service domain. Firehose uses a service-linked or custom IAM role to perform actions such as `es:ESHttpPut` and `es:ESHttpPost` against the OpenSearch domain endpoint. Without explicit cross-account trust and resource-based policy allowing the Firehose role's ARN, the delivery will fail with an authorization error.

Answer

The source accounts do not have a CloudWatch Logs subscription filter to send logs to Firehose

Answer

The Kinesis Data Streams used as the Firehose source is not encrypted

Answer

The OpenSearch domain's access policy does not allow access from the S3 bucket used by Firehose

Question 14

A DevOps engineer notices that an Amazon RDS for MySQL instance's CPU is consistently high during business hours. The engineer wants to identify the specific queries causing the high CPU. Which combination of services should be used to capture and analyze the queries? (Choose the best answer.)

Accepted Answer

Enable RDS Performance Insights and analyze the top SQL queries. RDS Performance Insights provides a database performance tuning feature that visualizes database load and identifies the specific SQL queries causing high CPU. It captures query-level metrics such as wait events, SQL digest, and host/user information, allowing the DevOps engineer to pinpoint the exact queries responsible for the CPU spike during business hours.

Answer

Enable RDS Enhanced Monitoring and view metrics in CloudWatch

Answer

Enable AWS X-Ray tracing on the application and database

Answer

Enable RDS audit logs and stream them to Amazon CloudWatch Logs

Question 15

An organization wants to ensure that all API calls made in their AWS account are logged for security analysis. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. (AWS CloudTrail) is correct because it records all API calls made in the AWS account, providing a log of actions for security analysis. Option B (AWS Config) is incorrect because it tracks resource configuration changes, not API calls. Option C (Amazon CloudWatch Logs) is incorrect because it stores logs from various sources but does not natively capture API calls; CloudTrail is the service designed for that purpose. Option D (VPC Flow Logs) is incorrect because it captures IP traffic information for network interfaces, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs