DOP-C02 Monitoring and Logging Practice Test 17 — 15 Questions

Question 1

A DevOps engineer wants to monitor the health of an Auto Scaling group and receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon EventBridge.. Amazon EventBridge (option C) is correct because it can capture Auto Scaling group state-change events such as EC2 Instance Launch Successful and EC2 Instance Terminate Successful, and route them to a target for notification. Amazon SNS (option D) is correct because it serves as the notification target, delivering email, SMS, or HTTP messages to subscribers when EventBridge matches those Auto Scaling events. Together, EventBridge detects the launch/termination events and SNS publishes the alerts, which is exactly the monitoring-and-notification pattern requested. AWS CloudTrail (A) only records API activity for auditing and does not natively push notifications, AWS Config (B) evaluates resource compliance and configuration history rather than real-time launch/terminate alerts, and AWS Lambda (E) is a compute target that could process events but is not itself a notification service.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Lambda.

Question 2

Refer to the exhibit. A DevOps engineer checks the CloudWatch alarm configuration and state. The alarm is in ALARM state for CPUUtilization averaging 90% over 5 minutes, but no notification was received. What is the most likely reason?

Accepted Answer

The SNS topic does not have any confirmed subscriptions.. A CloudWatch alarm in ALARM state triggers its configured actions, typically publishing to an SNS topic. If no notification is received, the most likely cause is that the SNS topic has no confirmed subscriptions—meaning no endpoint (email, SMS, Lambda, etc.) has completed the subscription confirmation handshake. Without a confirmed subscription, SNS accepts the publish but delivers to no one, so the alarm fires silently. This is a common operational oversight.

Answer

The EC2 instance is stopped.

Answer

The alarm period is set to 300 seconds, which is too long.

Answer

The alarm has insufficient data to evaluate.

Question 3

A company is running a batch processing job on Amazon EMR that writes results to an Amazon S3 bucket. The job runs daily and takes about 2 hours. The DevOps team wants to be alerted if the job fails or takes longer than 3 hours. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function when the EMR cluster changes to 'TERMINATED' state, then check the job duration and send an alert if it exceeded 3 hours.. It uses CloudWatch Events to detect the EMR cluster's 'TERMINATED' state, which triggers a Lambda function that can check the job duration against the 3-hour threshold and send an alert via SNS if needed. This approach is cost-effective (no polling, event-driven) and operationally efficient, as it decouples monitoring from the job itself and handles both failure and timeout scenarios without modifying the EMR job code.

Answer

Configure Amazon Simple Notification Service (SNS) directly from the EMR job to send notifications on completion.

Answer

Create a CloudWatch alarm on the EMR cluster's EC2 instance CPUUtilization metric to detect abnormal runtime.

Answer

Use Amazon CloudWatch Logs to monitor the job's log stream and create a metric filter for 'FAILED' messages.

Question 4

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom health check endpoint '/health'. The DevOps team notices that the ALB is marking some instances as unhealthy even though the application is running fine. The team checks the security groups and network ACLs and confirms they allow traffic. What should the team check next?

Accepted Answer

Confirm that the health check path is correctly configured to '/health' on the target group.. If security groups and NACLs are confirmed correct, the next most likely cause is a misconfigured health check path on the target group — for example, the path is set to '/' or '/healthz' instead of '/health', so the ALB receives a 404 and marks the instance unhealthy. Verifying the exact path string in the target group's health check settings is the correct next diagnostic step. The other options either do not apply or are premature tuning steps.

Answer

Ensure the health check path is case-insensitive.

Answer

Increase the health check interval and timeout values.

Answer

Verify that the health check port matches the application port.

Question 5

A company is using Amazon CloudWatch Logs to collect logs from multiple applications. The DevOps team wants to create a metric filter to count the number of ERROR log entries and trigger an alarm when the count exceeds 10 in 5 minutes. Which TWO steps must the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group that extracts ERROR count.. Option B is correct because a CloudWatch Logs metric filter must be defined on the log group to parse log events and publish a custom metric that counts occurrences of the ERROR pattern; this is the mechanism that turns raw log data into a numeric CloudWatch metric. Option C is correct because once the metric exists, a CloudWatch alarm is created against that metric with a threshold of 10 and an evaluation period of 5 minutes so it can trigger when the count exceeds the limit. Option A is not needed because subscription filters stream logs to destinations like Kinesis Data Firehose for processing, not for creating metrics or alarms. Option D is irrelevant because retention policy only controls how long log events are stored and does not affect metric filtering or alarming. Option E is unnecessary because a dashboard only visualizes metrics and does not create the metric or trigger the alarm.

Answer

Create a subscription filter to stream logs to Amazon Kinesis Data Firehose.

Answer

Set a log group retention policy to retain logs indefinitely.

Answer

Create a CloudWatch dashboard to visualize the ERROR count.

Question 6

A company runs a containerized application on Amazon ECS with Fargate launch type. The application consists of three microservices: frontend, backend, and database. The ECS cluster is in a VPC with public and private subnets. The frontend service is publicly accessible via an Application Load Balancer (ALB) in public subnets. The backend service communicates with the database service, which runs as a stateful service with persistent storage using Amazon EFS. The DevOps team is using CloudWatch Container Insights and has enabled Prometheus metrics for the ECS cluster. Recently, the team observed that the frontend service's response time has increased significantly, and some requests are timing out. The team checked the ALB metrics and saw an increase in 5xx errors. They also noticed that the backend service's CPU utilization is high, and the database service's disk I/O is high. The team suspects a bottleneck in the backend service. Which course of action should the team take FIRST to identify the root cause?

Accepted Answer

Check the backend service's application logs in CloudWatch Logs to identify errors or slow database queries.. The first step is to analyze the backend service's application logs to identify any errors or slow operations. High CPU and disk I/O may be caused by inefficient queries or code issues. Option A is incorrect because disabling health checks would hide the problem and could route traffic to unhealthy tasks. Option B is incorrect because migrating to RDS does not address the immediate issue and is a significant change without root cause analysis. Option D is incorrect because increasing the desired count without understanding the root cause may temporarily alleviate load but does not fix underlying performance issues and can increase costs.

Answer

Disable the health check for the backend service in the ALB target group.

Answer

Migrate the database service to Amazon RDS for better performance.

Answer

Increase the desired count of the backend service to reduce load per task.

Question 7

A company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS Multi-AZ database. The DevOps team has configured the EC2 instances to send application logs to CloudWatch Logs using the CloudWatch agent. They also set up a CloudWatch alarm on the ALB's 5xx error count. During a recent deployment, the team noticed that the alarm did not trigger even though the application was returning 5xx errors. The team verified that the CloudWatch agent is running on the instances and logs are appearing in CloudWatch Logs. What should the team do to ensure the alarm triggers correctly?

Accepted Answer

Verify that the CloudWatch alarm is using the correct metric 'HTTPCode_Target_5XX_Count' and that the threshold is appropriate.. The ALB publishes two separate 5xx metrics: HTTPCode_ELB_5XX_Count (errors generated by the load balancer itself, e.g., 503 due to no healthy targets) and HTTPCode_Target_5XX_Count (errors returned by the backend targets). Since the application is returning 5xx errors from the EC2 instances, the alarm should use HTTPCode_Target_5XX_Count. The team likely set the alarm on HTTPCode_ELB_5XX_Count, which would not trigger for backend errors. Option A is not the best because creating a log-based metric filter would create a separate alarm and does not fix the existing ALB alarm. Option B is wrong because switching to HTTPCode_ELB_5XX_Count still tracks the wrong metric. Option C is unrelated because the agent is already working and logs are flowing.

Answer

Create a metric filter on the EC2 instance's log group to count 5xx errors and create an alarm on that.

Answer

Change the CloudWatch alarm to use the 'HTTPCode_ELB_5XX_Count' metric instead.

Answer

Restart the CloudWatch agent on the EC2 instances.

Question 8

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked successfully, but it frequently times out after 15 seconds. The function's CloudWatch Logs show that the timeout occurs while the function is making an HTTP request to an external API. The function's reserved concurrency is set to 5, and the SQS queue has a visibility timeout of 30 seconds. Which change would MOST effectively reduce the number of timeouts?

Accepted Answer

Increase the Lambda function's timeout to 30 seconds.. The function times out at 15 seconds while waiting on an external HTTP call, so the most direct fix is to raise the Lambda timeout to 30 seconds, giving the external API enough time to respond. The SQS visibility timeout (30s) already exceeds the current Lambda timeout, so it is not the bottleneck. Increasing the timeout is the change that most directly reduces the number of timeouts.

Answer

Increase the SQS queue's visibility timeout to 60 seconds.

Answer

Decrease the SQS batch size to 1.

Answer

Increase the Lambda function's reserved concurrency to 10.

Question 9

A company uses Amazon CloudWatch Logs to store application logs from EC2 instances. The security team requires that logs be retained for 5 years for compliance. Which action should be taken to meet this requirement cost-effectively?

Accepted Answer

Export the logs to Amazon S3 and use S3 Glacier Deep Archive for long-term storage.. Exporting logs to Amazon S3 and using lifecycle policies to transition them to S3 Glacier Deep Archive is the most cost-effective way to retain logs for 5 years. S3 provides low-cost storage, and Glacier Deep Archive offers the lowest storage cost for long-term archival, making it ideal for compliance requirements. In contrast, retaining logs in CloudWatch Logs beyond a short period is more expensive due to higher storage costs. Option B is incorrect because setting a 5-year retention policy in CloudWatch Logs incurs significant costs compared to exporting to S3. Option C is incorrect because disabling retention causes logs to expire after 90 days, not indefinite. Option D is incorrect because AWS CloudTrail captures API activity, not application logs.

Answer

Set a log retention policy of 5 years on the CloudWatch Logs log groups.

Answer

Disable log retention and let CloudWatch Logs keep the logs indefinitely.

Answer

Use AWS CloudTrail to store the logs for 5 years.

Question 10

A company is using Amazon CloudWatch Synthetics to monitor the availability of a web application. The canary runs every 5 minutes from multiple locations. Recently, the canary has been failing intermittently with HTTP 503 errors, but the application team reports that the application is healthy. Which step should the DevOps engineer take to identify the cause of the false positives?

Accepted Answer

Review the canary's CloudWatch Logs to check for network errors or timeouts.. Reviewing the canary's CloudWatch Logs is the correct first step because Synthetics canaries write detailed logs and screenshots for each run, including network errors, timeouts, and HTTP response details. Since the application team reports the app is healthy, the 503 errors are likely caused by the canary's network path, DNS resolution, or a transient issue that the logs will reveal. This is the diagnostic step that identifies the root cause of the false positives.

Answer

Increase the canary timeout setting to allow more time for the application to respond.

Answer

Add more canary locations to increase coverage.

Answer

Increase the canary run frequency to every 1 minute.

Question 11

A company is using Amazon CloudWatch Logs Insights to analyze application logs. The DevOps team needs to create a metric filter that counts occurrences of the word 'ERROR' in the log events. Which CloudWatch Logs Insights query should be used to test the metric filter?

Accepted Answer

fields @timestamp, @message | filter @message like /ERROR/. To test a metric filter that counts occurrences of the word 'ERROR' in log events, you need a CloudWatch Logs Insights query that filters log events containing 'ERROR'. The query `fields @timestamp, @message | filter @message like /ERROR/` does exactly that: it selects the timestamp and message fields and filters for messages that match the regular expression /ERROR/. This allows you to verify that the filter pattern will correctly identify the relevant log events.

Answer

fields @timestamp, @message | stats count() by bin(5m)

Answer

fields @timestamp, @message | parse @message '[*] *' as @severity, @log

Answer

fields @timestamp, @message | sort @timestamp desc

Question 12

A company is using Amazon CloudWatch to monitor a production environment. The DevOps team wants to receive notifications when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which TWO steps should the team take to achieve this? (Choose TWO.)

Accepted Answer

Configure an Amazon SNS topic and subscribe the team's email address to it, then set the alarm to send notifications to the SNS topic.. Option B is correct because CloudWatch alarms cannot send email directly; they must publish to an Amazon SNS topic, and the team's email address must be subscribed to that topic so the notification is delivered. Option C is correct because the alarm must be defined on the EC2 CPUUtilization metric with a threshold of 90% and an evaluation period of 5 consecutive 1-minute datapoints (5 minutes) to match the requirement. Option A is not required because basic monitoring already provides CPUUtilization at 5-minute intervals, which is sufficient for a 5-minute evaluation period; detailed monitoring only changes the granularity to 1 minute. Option D is incorrect because CloudWatch Logs metric filters operate on log events, not on the CPUUtilization metric. Option E is incorrect because a dashboard only visualizes metrics and does not generate notifications.

Answer

Enable detailed monitoring on the EC2 instance to get 1-minute metrics.

Answer

Create a CloudWatch Logs metric filter to count CPU utilization errors.

Answer

Create a CloudWatch dashboard to visualize CPU utilization.

Question 13

A DevOps engineer needs to set up a monitoring solution for an application running on Amazon EKS. The application emits custom metrics that need to be stored in Amazon CloudWatch and visualized on a dashboard. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch agent to emit custom metrics to CloudWatch.. The CloudWatch agent can be configured to emit custom application metrics to Amazon CloudWatch, which is the required destination for storing the metrics. The agent uses the CloudWatch PutMetricData API to send these metrics, enabling centralized monitoring and alerting within CloudWatch.

Answer

Use CloudWatch Logs Insights to analyze the custom metrics.

Answer

Use Amazon Managed Service for Prometheus to scrape the metrics.

Question 14

A company runs a containerized web application on Amazon ECS with AWS Fargate. The application is critical and requires high availability. The DevOps team has set up an Amazon CloudWatch alarm that triggers an auto scaling action when the average CPU utilization exceeds 75% for 5 minutes. However, during a recent traffic spike, the application became slow and some requests timed out, even though the CloudWatch alarm did not fire. The team checked the ECS service auto scaling configuration and found that the target tracking scaling policy based on average CPU utilization is set with a target value of 75%. The ECS service is configured with a minimum of 2 tasks and a maximum of 10 tasks. Upon investigation, they noticed that the CPU utilization metric for the service remained below 75% during the spike, but the memory utilization was high (over 90%). The application logs show that the tasks were running out of memory, causing garbage collection pauses and slow responses. Which course of action should the DevOps engineer take to prevent this issue in the future?

Accepted Answer

Add a second target tracking scaling policy based on average memory utilization with a target value of 75%.. The issue is that the application is running out of memory, causing performance degradation, but the scaling policy only monitors CPU. To prevent this, you should add a target tracking scaling policy based on memory utilization. This will trigger scaling when memory exceeds the target, providing additional tasks to handle the load and preventing memory exhaustion.

Answer

Decrease the CPU target value to 50% to trigger scaling earlier.

Answer

Increase the minimum number of tasks from 2 to 5 to provide more capacity upfront.

Answer

Increase the task memory limit in the task definition to 8 GB.

Question 15

A company uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams. The Lambda function processes records in batches and writes the results to an Amazon DynamoDB table. Recently, the operations team noticed that the Lambda function is experiencing a high number of throttling errors (HTTP 400) when writing to DynamoDB. The DynamoDB table has on-demand capacity mode enabled. The CloudWatch metrics show that the DynamoDB consumed write capacity is well below the provisioned limits, but the Lambda function's error rate is increasing. The Lambda function's reserved concurrency is set to 100, and the function's timeout is 1 minute. The Kinesis stream has 10 shards. What is the MOST likely cause of the throttling errors?

Accepted Answer

The DynamoDB table is experiencing hot partitions due to uneven access patterns.. The most likely cause is hot partitions in the DynamoDB table due to uneven access patterns. Even with on-demand capacity, DynamoDB partitions have throughput limits, and if the Lambda function writes to a few partitions heavily, throttling occurs. The consumed write capacity being below provisioned limits indicates that the issue is not overall capacity but partition-level contention.

Answer

The Lambda function's timeout is too short, causing the function to retry and overload DynamoDB.

Answer

The Lambda function's reserved concurrency is too high, causing too many concurrent invocations.

Answer

The Kinesis stream's batch size is too large, causing the Lambda function to write too many records at once.