DOP-C02 Monitoring and Logging Practice Test 2 — 15 Questions

Question 1

Drag and drop the steps to configure an AWS Auto Scaling group with a launch template and scaling policies.

Accepted Answer

Create launch template, then Auto Scaling group, then configure network, then set capacities, then add scaling policy. First create the launch template, then create the Auto Scaling group, then configure network, then set capacities, then add scaling policy.

Answer

Auto Scaling group, then launch template, then configure network, then set capacities, then add scaling policy

Answer

Configure network, then launch template, then Auto Scaling group, then set capacities, then add scaling policy

Answer

Create launch template, then Auto Scaling group, then configure network, then add scaling policy, then set capacities

Question 2

Drag and drop the steps to set up an AWS CodeBuild project to build a Docker image and push it to Amazon ECR.

Accepted Answer

Create ECR repository, then Write buildspec.yml, then Create CodeBuild project with privileged mode, then Start build. The correct order to set up an AWS CodeBuild project for building a Docker image and pushing to Amazon ECR is: first create the ECR repository, then write the buildspec.yml file, then create the CodeBuild project with privileged mode enabled, and finally start the build. This sequence ensures the repository exists, the build specification is ready, and the project has the necessary permissions to build and push the Docker image.

Answer

Create CodeBuild project, then Create ECR repository, then Write buildspec.yml, then Start build

Answer

Write buildspec.yml, then Create ECR repository, then Create CodeBuild project without privileged mode, then Start build

Answer

Create ECR repository, then Start build, then Create CodeBuild project, then Write buildspec.yml

Question 3

Match each AWS monitoring or logging tool to its purpose.

Accepted Answer

Amazon CloudWatch: Monitors AWS resources and applications by collecting metrics, logs, and setting alarms.. Correctly match each tool to its core purpose. CloudWatch is for metrics and alarms; CloudTrail for API auditing; AWS Config for configuration compliance. Common confusions involve swapping their descriptions.

Answer

Amazon CloudWatch: Records API calls for auditing and compliance.

Answer

AWS CloudTrail: Monitors performance metrics and sets alarms.

Question 4

Match each AWS service health or performance concept to its meaning.

Accepted Answer

Amazon CloudWatch: Monitors AWS resources and applications in real-time.. The correct matches are: Amazon CloudWatch monitors resources in real-time; AWS Trusted Advisor optimizes cost, security, and performance; AWS Health Dashboard provides personalized health alerts. Common confusions involve swapping monitoring (CloudWatch) with auditing (CloudTrail) and recommendations (Trusted Advisor) with monitoring.

Answer

Amazon CloudWatch: Audits API calls for governance and compliance.

Answer

AWS Trusted Advisor: Provides real-time monitoring of application performance.

Question 5

A company uses AWS CloudTrail to log API activity across multiple accounts in AWS Organizations. The security team wants to receive near-real-time notifications for specific high-risk API calls, such as IAM policy changes or S3 bucket policy modifications. What is the MOST efficient and scalable solution?

Accepted Answer

Deliver CloudTrail logs to an S3 bucket, enable S3 Event Notifications to trigger a Lambda function that filters and publishes to SNS.. It uses S3 Event Notifications to trigger a Lambda function in near-real-time when CloudTrail logs are delivered to S3. The Lambda function can filter for specific high-risk API calls (e.g., IAM policy changes, S3 bucket policy modifications) and publish only relevant events to an SNS topic, providing a scalable and cost-effective solution that avoids polling or complex querying.

Answer

Create a CloudWatch Events rule that matches the specific API calls and publishes to an SNS topic.

Answer

Use CloudWatch Logs Insights to query CloudTrail logs and set up a metric filter with an alarm.

Answer

Enable AWS Config rules to detect changes and trigger an SNS notification.

Question 6

A DevOps engineer manages a production environment with EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 5xx errors from the ALB. The engineer needs to identify whether the errors originate from the targets or the ALB itself. Which CloudWatch metric should be examined to differentiate between these two sources?

Accepted Answer

HTTPCode_Target_5XX_Count. HTTPCode_Target_5XX_Count, is the correct metric to identify 5xx errors originating from the targets (EC2 instances). The ALB has separate metrics for target errors (HTTPCode_Target_5XX_Count) and ALB errors (HTTPCode_ELB_5XX_Count). Option A (TargetResponseTime) measures latency, not error codes. Option B (UnhealthyHostCount) counts unhealthy targets based on health checks, not specific HTTP errors. Option D (RequestCount) is total requests, not error codes.

Answer

TargetResponseTime

Answer

UnhealthyHostCount

Answer

RequestCount

Question 7

A company uses Amazon RDS for PostgreSQL and wants to monitor database performance metrics such as CPU utilization, memory, and disk I/O. Which AWS service should be used to set up custom dashboards and alarms for these metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (Option D) is the correct service for monitoring Amazon RDS performance metrics such as CPU utilization, memory, and disk I/O. CloudWatch provides built-in metrics for RDS, allows creation of custom dashboards to visualize these metrics, and supports setting alarms for proactive notifications. Option A (AWS X-Ray) is used for tracing and analyzing requests through applications, not for infrastructure metrics. Option B (Amazon VPC Flow Logs) captures IP traffic information for network troubleshooting, not database performance. Option C (AWS CloudTrail) logs API calls for auditing, not performance monitoring. Therefore, CloudWatch is the appropriate choice for this use case.

Answer

AWS X-Ray

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 8

A company runs a microservices application on Amazon ECS with Fargate. The application logs are sent to CloudWatch Logs. Recently, the operations team noticed that logs from one service are missing for certain time periods. The service is very chatty and produces a high volume of logs. The CloudWatch Logs agent is configured with default settings. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent is dropping logs due to the default batch size and timeout settings.. The CloudWatch Logs agent has a default batch size limit (1MB) and batch timeout (5 seconds). High-volume logs may be dropped if the buffer fills and the agent cannot flush quickly enough. Option A is wrong because CloudWatch Logs does not have per-log-group throttling, but it does have per-account throttling. Option B is wrong because the agent does not stop sending logs when the log group is full; it overwrites old logs if retention is set. Option D is wrong because CloudWatch Logs retention policy does not affect ingestion.

Answer

CloudWatch Logs has a throttling limit on log ingestion per log group.

Answer

The log group has reached its maximum size and stopped accepting new logs.

Answer

The log retention policy is set to 1 day, so older logs are automatically deleted.

Question 9

A company wants to monitor network traffic to and from its VPC for security analysis. It needs to capture IP traffic information, including accepted and rejected connection attempts, and store the data in S3 for long-term analysis. Which AWS service should be used?

Accepted Answer

Amazon VPC Flow Logs. VPC Flow Logs capture network traffic metadata and can be published to S3. Option A is wrong because CloudWatch Logs is for application logs, not network flows. Option C is wrong because GuardDuty is a threat detection service, not a log source. Option D is wrong because CloudTrail tracks API calls.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 10

A company wants to be alerted when the root user signs in to the AWS Management Console. Which service should be used to create a monitoring rule for this event?

Accepted Answer

Amazon CloudWatch Events (now Events) with a rule for the 'RootSignIn' event from CloudTrail. Amazon CloudWatch Events (now Events) can monitor AWS CloudTrail API calls and trigger actions based on specific events. The 'RootSignIn' event is a predefined CloudTrail event that fires when the root user signs in to the AWS Management Console. By creating a CloudWatch Events rule that matches this event, you can send notifications (e.g., via SNS) or invoke automated responses, meeting the alerting requirement.

Answer

AWS Config

Answer

Amazon S3

Answer

AWS IAM

Question 11

A company uses Amazon CloudWatch to monitor its EC2 instances. A DevOps engineer notices that some metrics (e.g., memory utilization) are not available in the CloudWatch console. The engineer wants to collect these metrics. What should the engineer do?

Accepted Answer

Install and configure the CloudWatch Agent on the EC2 instances.. Install and configure the CloudWatch Agent on the EC2 instances. By default, EC2 only reports basic metrics like CPU and network. To collect custom metrics such as memory utilization, you must install the CloudWatch Agent, which can collect custom metrics and send them to CloudWatch. Option A is incorrect because enabling VPC Flow Logs captures network traffic logs, not instance-level metrics. Option C is incorrect because while you can create metric filters from CloudWatch Logs, that requires the agent to first send logs to CloudWatch Logs; the direct method to collect memory metrics is via the CloudWatch Agent. Option D is incorrect because detailed monitoring only increases the frequency of existing metrics (e.g., CPU) but does not enable new metrics like memory.

Answer

Enable VPC Flow Logs for the instance's subnet.

Answer

Send the metrics to CloudWatch Logs and create a metric filter.

Answer

Enable detailed monitoring on the EC2 instances.

Question 12

A company runs a critical application on Amazon EKS. The operations team needs to monitor the health of the Kubernetes cluster and the applications running on it. Which THREE services can be used together to achieve comprehensive monitoring? (Choose THREE.)

Accepted Answer

AWS X-Ray. Correct options: A, D, E. Option A (AWS X-Ray) provides distributed tracing to monitor requests across microservices, helping identify performance bottlenecks in applications running on EKS. Option D (Amazon CloudWatch Container Insights) collects, aggregates, and summarizes metrics and logs from containerized applications and microservices, offering pod-level metrics and logs for EKS clusters. Option E (Amazon Managed Service for Prometheus) is a fully managed, scalable monitoring solution compatible with Prometheus, commonly used for Kubernetes monitoring and alerting. Option B (Amazon VPC Flow Logs) captures network traffic metadata but does not provide application or cluster health information. Option C (AWS CloudTrail) records API activity for governance and auditing, not real-time cluster monitoring. Together, X-Ray, Container Insights, and Managed Prometheus provide comprehensive monitoring of application performance, container metrics, and Prometheus-based observability.

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 13

A DevOps engineer needs to collect and analyze logs from multiple AWS services, including EC2, Lambda, and API Gateway. The logs must be stored in a central location for long-term retention and analyzed using SQL queries. Which TWO services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Correct options: B and E. Option B: CloudWatch Logs can collect logs from many AWS services. Option E: Exporting logs to S3 and using Athena allows SQL-based analysis. Option A is wrong because CloudTrail is for API logs, not all service logs. Option C is wrong because Kinesis Data Firehose is for real-time streaming, not for ad-hoc SQL queries. Option D is wrong because SQS is a message queue, not a log store.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Question 14

A DevOps engineer needs to monitor the memory utilization of an Amazon EC2 instance running a critical application. Which AWS service should be used to collect and track this metric?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service for monitoring memory utilization of EC2 instances. CloudWatch can collect custom metrics like memory utilization via the CloudWatch Agent. AWS CloudTrail (A) records API calls, not memory metrics. AWS X-Ray (B) traces application requests, not system metrics. AWS Config (C) records resource configuration changes, not utilization metrics.

Answer

AWS CloudTrail

Answer

AWS X-Ray

Answer

AWS Config

Question 15

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The security team requires that logs be encrypted at rest using a customer-managed KMS key. Which configuration step should the engineer perform to meet this requirement?

Accepted Answer

Associate the KMS key with the CloudWatch log group using the console or CLI. CloudWatch Logs can be encrypted at rest using a customer-managed KMS key, and the key must be associated with the log group. Option A is incorrect because the CloudWatch agent does not handle encryption at rest; encryption is applied server-side by CloudWatch Logs. Option B is incorrect because while a KMS key policy is necessary to grant CloudWatch Logs permissions, the key must also be explicitly associated with the log group. Option C is incorrect because CloudWatch Logs does not store logs in an S3 bucket by default; encryption is applied at the log group level, not via S3.

Answer

Configure the CloudWatch agent to encrypt logs before sending

Answer

Create a KMS key and attach a policy allowing CloudWatch Logs to use it

Answer

Enable default encryption on the S3 bucket that stores logs