DOP-C02 Monitoring and Logging Practice Test 2 — 15 Questions

Question 1

A company wants to set up centralized logging for its multi-account AWS environment. The logs include CloudTrail, VPC Flow Logs, and Amazon Route 53 resolver query logs. Which TWO services should they use to achieve this with minimal operational overhead? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (A) is correct because it is the native, fully managed central log repository that can receive CloudTrail, VPC Flow Logs, and Route 53 Resolver query logs via log groups, and it supports cross-account subscription filters and CloudWatch Logs Insights for querying with minimal operational overhead. Amazon S3 (B) is correct because it is the standard centralized, durable destination for these log types—CloudTrail delivers to S3 buckets, VPC Flow Logs and Route 53 Resolver query logs can be published directly to S3, and cross-account aggregation is achieved with bucket policies and S3 Lifecycle/Athena for analysis, again with minimal management. Amazon Kinesis Data Streams (C) is not correct because it is a streaming ingestion service requiring custom consumers and shard management, adding operational overhead rather than minimizing it. Amazon OpenSearch Service (D) is not correct because it requires cluster provisioning, scaling, and maintenance, which is more operational overhead than the managed log destinations. AWS CloudTrail (E) is not correct because it is a log source/audit service that records API activity, not a centralized destination for aggregating VPC Flow Logs and Route 53 Resolver query logs.

Answer

Amazon Kinesis Data Streams

Answer

Amazon OpenSearch Service

Answer

AWS CloudTrail

Question 2

A company is running a critical application on Amazon ECS with Fargate launch type. The application experiences periodic performance degradation. The DevOps team needs to set up monitoring to capture detailed metrics at a 1-second granularity. Which solution should be used?

Accepted Answer

Use Amazon CloudWatch Container Insights with high-resolution metrics.. Amazon CloudWatch Container Insights with high-resolution metrics provides detailed, 1-second granularity metrics for ECS tasks running on Fargate. Option A is incorrect because deploying a Prometheus server on EC2 to scrape metrics from ECS tasks is more complex and not a fully managed AWS solution; it would require additional setup and does not natively provide 1-second granularity out of the box. Option B is incorrect because CloudWatch detailed monitoring is typically used for EC2 instances and provides metrics at 1-minute granularity, not 1-second; for ECS, Container Insights is the appropriate service for high-resolution metrics. Option D is incorrect because VPC Flow Logs capture network traffic metadata, not application performance metrics, and thus cannot be used to monitor performance degradation.

Answer

Deploy a Prometheus server on Amazon EC2 and scrape metrics from the ECS tasks.

Answer

Enable CloudWatch detailed monitoring on the ECS service.

Answer

Enable VPC Flow Logs and analyze the logs with Amazon Athena.

Question 3

A company wants to collect and analyze logs from on-premises servers and send them to AWS for centralized monitoring. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Agent on the on-premises servers to send logs to Amazon CloudWatch Logs.. The Amazon CloudWatch Agent can be installed on on-premises servers (including non-EC2 hosts) and configured to send logs to Amazon CloudWatch Logs, providing centralized monitoring without requiring AWS infrastructure on-premises. This is the standard, supported approach for hybrid log collection into CloudWatch.

Answer

Amazon Kinesis Agent on the on-premises servers to send logs to Amazon Kinesis Data Firehose, then to Amazon S3.

Answer

Amazon CloudWatch Agent with the awslogs configuration to send logs to Amazon CloudWatch Logs.

Answer

AWS Systems Manager Agent to collect logs and send to Amazon CloudWatch Logs.

Question 4

A company uses AWS Lambda with an Amazon DynamoDB table to process high-volume clickstream data. The Lambda function writes the data to DynamoDB. Recently, the function has been experiencing throttling and timeouts during peak traffic. The DevOps team needs to set up monitoring to identify the root cause. Which combination of metrics should they analyze?

Accepted Answer

DynamoDB throttled write events and Lambda concurrent executions.. DynamoDB throttled write events indicate when the table is rejecting writes due to exceeding provisioned capacity, which directly causes Lambda timeouts. Lambda concurrent executions show how many function instances are running simultaneously; if this hits the account's concurrency limit, functions are throttled. Analyzing both metrics together helps identify whether the root cause is DynamoDB capacity or Lambda concurrency limits.

Answer

DynamoDB read and write capacity metrics and Lambda error count.

Answer

CloudWatch metrics for Lambda invocations and duration.

Answer

CloudWatch Logs for Lambda function logs and Lambda memory utilization.

Question 5

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). They need to implement a monitoring strategy that provides detailed visibility into application performance, including request-level latency and error codes. Which THREE actions should they take?

Accepted Answer

Enable ALB access logs and store them in Amazon S3.. Option B is correct because ALB access logs capture detailed per-request information—client IP, request path, target, request processing time (target_processing_time), and the returned ELB/target status codes—which directly satisfies the requirement for request-level latency and error codes when stored in Amazon S3. Option C is correct because installing the CloudWatch agent on the EC2 instances lets them publish application logs and custom metrics (e.g., via the CloudWatch agent configuration and PutMetricData) that the ALB itself cannot observe, giving deeper application-level visibility. Option E is correct because enabling detailed CloudWatch metrics for the ALB provides granular metrics such as RequestCount, TargetResponseTime, HTTPCode_Target_5XX_Count, and HTTPCode_ELB_4XX_Count, which are needed to monitor latency and error rates at the load-balancer level. Option A is not appropriate because VPC Flow Logs only record IP-level network traffic metadata (source/destination, ports, bytes, ACCEPT/REJECT) and do not expose HTTP request latency or status codes. Option D is not appropriate because CloudTrail records AWS API control-plane calls (e.g., CreateLoadBalancer, DescribeTargetGroups), not application request performance or error codes.

Answer

Enable VPC Flow Logs to capture traffic patterns.

Answer

Enable AWS CloudTrail to log API calls made to the load balancer.

Question 6

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance is unable to send logs to CloudWatch Logs. The log group 'MyAppLogs' exists in the same account and region. What is the most likely reason for the failure?

Accepted Answer

The policy is missing permissions to create log streams.. The IAM policy attached to the EC2 instance role likely grants logs:CreateLogGroup and logs:PutLogEvents but omits logs:CreateLogStream. CloudWatch Logs requires that a log stream be created before any log events can be written to it. Even if the log group exists, the application must first call CreateLogStream to create a stream within that group; without that permission, the PutLogEvents call will fail with an AccessDenied error. Thus, the missing logs:CreateLogStream permission is the most likely cause.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The log group does not exist in the specified region.

Answer

The policy does not allow the logs:PutLogEvents action.

Question 7

A company runs a containerized microservices application on Amazon ECS with Fargate. The operations team wants to collect custom application metrics (e.g., request latency, error counts) and send them to CloudWatch. The team wants to avoid managing any servers or agents. Which solution meets these requirements?

Accepted Answer

Use the CloudWatch Embedded Metric Format to emit metrics from the application code as structured logs. The CloudWatch Embedded Metric Format (EMF) allows applications to output structured JSON logs that CloudWatch automatically converts to metrics, and Fargate tasks can output logs to CloudWatch Logs without an agent. Option A is wrong because the CloudWatch Agent requires running on EC2 or on-premises, not Fargate. Option C is wrong because CloudTrail records API calls, not custom application metrics. Option D is wrong because while StatsD can collect custom metrics, running it in a sidecar container on Fargate would still require managing a container, and the requirement is to avoid managing any servers or agents.

Answer

Install the CloudWatch Agent in the container image and configure it to collect custom metrics

Answer

Enable AWS CloudTrail for the ECS service to capture API calls and derive metrics

Answer

Run a StatsD daemon in a sidecar container and configure it to forward metrics to CloudWatch

Question 8

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances run a custom Java application that uses an RDS for MySQL database and an ElastiCache Redis cluster for session caching. The DevOps team has set up CloudWatch alarms for CPU utilization, memory, and database connections. Recently, customers have been reporting slow page load times and occasional timeouts. The team notices that during peak hours, the ALB's TargetResponseTime metric spikes, and the number of healthy hosts in the target group fluctuates. The CPU and memory metrics on the EC2 instances remain within normal ranges. The database CPU is also normal. The team suspects the issue is related to the application's session management. Which course of action should the DevOps team take to identify the root cause?

Accepted Answer

Monitor ElastiCache metrics such as CPUUtilization, CacheHits, and Evictions to determine if the Redis cluster is overloaded. The symptoms — ALB TargetResponseTime spikes, fluctuating healthy hosts, normal EC2/DB metrics, and session management suspicion — point to the ElastiCache Redis cluster as the bottleneck. Monitoring Redis CPUUtilization, CacheHits, and Evictions will reveal whether the cache is overloaded, evicting sessions, or missing frequently, which would cause session lookups to slow down and health checks to fail. This is the most targeted diagnostic step.

Answer

Enable RDS Performance Insights and look for slow queries or connection storms

Answer

Install the CloudWatch Agent on the EC2 instances to collect additional application-level metrics

Answer

Increase the number of ALB targets and adjust the target group health check interval

Question 9

A company is using Amazon RDS for MySQL and needs to monitor slow queries to optimize database performance. The team has enabled slow query logs and wants to centralize logging in Amazon CloudWatch Logs for real-time analysis and alerting. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Modify the DB parameter group to enable slow_query_log and set log_output to FILE, then configure the RDS instance to publish the slowquery log file to CloudWatch Logs.. RDS for MySQL can natively stream slow query logs to CloudWatch Logs. This is achieved by modifying the DB parameter group to set 'slow_query_log' to 1 and 'log_output' to 'FILE', then enabling the 'slowquery' log export in the RDS console or CLI. This approach requires no additional infrastructure, minimizing operational overhead. Option A is incorrect because Performance Insights focuses on database performance metrics and schema analysis, not slow query log streaming to CloudWatch. Option B is incorrect because Enhanced Monitoring provides OS-level metrics (CPU, memory, etc.), not slow query logs. Option D is incorrect because exporting logs to S3 and using Lambda adds unnecessary complexity and latency; the native CloudWatch integration is more efficient.

Answer

Enable Performance Insights on the RDS instance and use the Performance Insights dashboard to view slow queries.

Answer

Enable Enhanced Monitoring on the RDS instance and configure CloudWatch alarms based on the metrics.

Answer

Configure the RDS instance to export slow query logs to an S3 bucket, then set up a Lambda function to read the logs and send them to CloudWatch Logs.

Question 10

A DevOps engineer is troubleshooting a production issue where an Application Load Balancer (ALB) is returning 503 errors. The ALB targets are EC2 instances in an Auto Scaling group behind the ALB. The engineer checks the ALB access logs in Amazon S3 and finds that the ALB is healthy. However, the 503 errors persist. Which configuration should the engineer check next?

Accepted Answer

Check the security groups for the EC2 instances to ensure they allow traffic from the ALB on the listener port.. The engineer should check the security groups for the EC2 instances to ensure they allow traffic from the ALB on the listener port. Even if the ALB is healthy, 503 errors occur when the ALB cannot reach the targets, often due to security group rules blocking traffic from the ALB's security group or subnet.

Answer

Enable AWS Shield Advanced to protect the ALB from DDoS attacks.

Answer

Verify that the SSL certificate associated with the ALB is not expired.

Answer

Check the ALB's target group health check settings and verify that the health check path is correct.

Question 11

A DevOps engineer is designing a monitoring solution for a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS database. The engineer needs to monitor the health of each component and receive alerts when any component becomes unhealthy. Which of the following CloudWatch metrics should the engineer monitor? (Select THREE.)

Accepted Answer

EC2's StatusCheckFailed metric.. (EC2's StatusCheckFailed metric) is correct because it directly indicates whether an EC2 instance is healthy (e.g., hardware or OS issues). Option D (ALB's HealthyHostCount metric) is correct because it shows the number of registered targets that are considered healthy. Option E (RDS's DatabaseConnections metric) is correct because it can indicate if the database is overwhelmed or unavailable (e.g., reaching max connections). Option A (RDS's ReadLatency) is incorrect because it measures performance, not health directly; a database can have high read latency but still be operational. Option B (ALB's RequestCount metric) is incorrect because it measures traffic volume, not the health of targets.

Answer

RDS's ReadLatency metric.

Answer

Application Load Balancer's RequestCount metric.

Question 12

A company uses Amazon CloudWatch Logs to store application logs. They have a requirement to retain logs for 90 days for operational analysis and then archive them to Amazon S3 for compliance purposes for an additional 5 years. Which of the following steps are necessary to meet this requirement? (Select TWO.)

Accepted Answer

Set the CloudWatch Logs retention policy on the log group to 90 days.. Option A is correct because setting the CloudWatch Logs retention policy on the log group to 90 days ensures logs are automatically deleted from CloudWatch Logs after the operational analysis window, which is exactly the required retention period. Option E is correct because CloudWatch Logs does not natively transition logs to S3; you must use an export task (CreateExportTask) to copy log data to an S3 bucket before the 90-day retention policy deletes it, satisfying the 5-year compliance archive requirement. Option B is incorrect because an S3 lifecycle policy only manages objects already in S3 and does not address getting the logs out of CloudWatch Logs before they expire. Option C is incorrect because a subscription filter streams logs in real time to destinations like Kinesis or Lambda, not directly to S3, and real-time streaming is not required here. Option D is incorrect because CloudWatch Logs has no lifecycle policy feature that transitions logs to S3; retention policies only expire logs, and S3 export must be performed via export tasks.

Answer

Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.

Answer

Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.

Answer

Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.

Question 13

Refer to the exhibit. A DevOps engineer runs the above CloudWatch Logs Insights query on a log group containing application logs. The query returns an empty result set. The engineer knows that the application logs contain ERROR entries. Which of the following is the most likely cause?

Accepted Answer

The filter pattern is case-sensitive and the log entries use lowercase 'error'.. CloudWatch Logs Insights filter patterns are case-sensitive by default. If the application logs contain 'error' in lowercase but the query filters for 'ERROR' (uppercase), the filter will not match any events, resulting in an empty result set. The engineer should use a case-insensitive pattern or match the exact case present in the logs.

Answer

The stats function cannot be used with the filter command.

Answer

The log group does not have any log streams.

Answer

The limit of 20 results is too low and the query times out.

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to monitor the CloudFormation stack events to detect when stack creation or updates fail, and automatically send notifications to a Slack channel. The team has set up an Amazon SNS topic that sends messages to a Slack webhook via a Lambda function. Which solution should the team implement to trigger the SNS topic when a CloudFormation stack fails?

Accepted Answer

Configure the CloudFormation stack to send events to an SNS topic by specifying the topic ARN in the stack's notification options.. Option B (NotificationARNs pointing to the SNS topic) is a correct, simple, direct solution: CloudFormation publishes every stack event, including CREATE_FAILED and UPDATE_FAILED, straight to the SNS topic. Note that Option D describing an EventBridge rule is also technically achievable today because CloudFormation natively delivers Stack Status Change events to the EventBridge default event bus (no CloudTrail needed) as of a 2022 feature launch; however, Option B remains the simplest built-in mechanism for this scenario since it requires no EventBridge rule authoring.

Answer

Use CloudWatch Logs Insights to query CloudFormation logs and set up a scheduled query to send results to SNS.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and create a CloudWatch metric filter that detects failure messages, then trigger an alarm to SNS.

Answer

Create an Amazon EventBridge rule that matches CloudFormation API calls for CreateStack and UpdateStack with a status of CREATE_FAILED or UPDATE_FAILED, and set the target to the SNS topic.

Question 15

A company runs a critical e-commerce application on AWS. The application is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The instances store session data in an ElastiCache for Redis cluster. Recently, users have reported intermittent session timeouts during peak traffic hours. The operations team notices that CloudWatch alarms for the Redis cluster's CPUUtilization and Evictions metrics are frequently breaching thresholds. The team wants to resolve the issue without incurring unnecessary costs. Which solution should the team implement?

Accepted Answer

Enable auto scaling for the ElastiCache Redis cluster to add replicas or shards based on CPU and memory utilization.. The CloudWatch alarms for Redis CPUUtilization and Evictions breaching thresholds indicate the Redis cluster is resource-constrained and evicting session data, causing timeouts. Enabling ElastiCache auto scaling to add replicas or shards based on CPU and memory utilization directly addresses the capacity shortfall and scales elastically with demand. This resolves the root cause without over-provisioning.

Answer

Configure a Lambda function to offload session data to Amazon DynamoDB and use DAX for caching.

Answer

Enable encryption in transit (TLS) for the Redis cluster to reduce overhead.

Answer

Migrate the Redis cluster to a memory-optimized instance type like r6g.large.