DOP-C02 Monitoring and Logging Practice Test 2 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics for the ALB and is using CloudWatch Logs for the EC2 instances. Recently, users report intermittent 503 errors. The team notices that the ALB's 'RequestCount' metric shows a sudden drop during error periods, while the 'ActiveConnectionCount' remains steady. Which TWO steps should the team take to diagnose the issue? (Choose two.)

Accepted Answer

Enable and analyze the ALB access logs to see the HTTP response codes and target processing time.. Option A is correct because ALB access logs contain detailed per-request data, including HTTP response codes (e.g., 503) and target processing time. Analyzing these logs will reveal whether the 503 errors are coming from the ALB itself (e.g., due to request queue overflow) or from the targets, and whether the sudden drop in RequestCount is due to clients aborting or the ALB throttling requests.

Answer

Check the Amazon Route 53 health checks for the ALB DNS name.

Answer

Review the EC2 instances' CloudWatch metrics for CPU utilization and network traffic.

Answer

Inspect AWS CloudTrail logs for the ALB to see if there are any configuration changes.

Question 2

A DevOps team is designing a monitoring strategy for a microservices application deployed on Amazon EKS. The application emits custom metrics, and the team needs to collect them with minimal latency and at high resolution. The team also needs to retain logs for 90 days for compliance. Which THREE steps should the team take to meet these requirements? (Choose three.)

Accepted Answer

Use Fluent Bit daemonset to send application logs to CloudWatch Logs.. Option A is correct because Fluent Bit is a lightweight, high-performance log processor that can be deployed as a DaemonSet on Amazon EKS to collect application logs with minimal latency. It sends logs directly to CloudWatch Logs, which supports a retention policy of up to 10 years, easily meeting the 90-day compliance requirement. Fluent Bit's low resource footprint and efficient data pipeline ensure high-resolution log collection without impacting application performance.

Answer

Stream logs to Amazon Kinesis Data Firehose for transformation before landing in CloudWatch Logs.

Answer

Enable CloudWatch Container Insights for the EKS cluster.

Question 3

Your company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running a web server. The web servers write access logs to a shared Amazon EFS filesystem. The operations team needs to monitor the web server logs in real-time to detect and alert on 5xx error spikes. Currently, the team manually SSHes into instances to tail logs, which is inefficient and doesn't provide real-time alerting. The team wants a centralized, near-real-time logging solution with minimal operational overhead. They have asked you to design a solution that ingests logs from the EFS filesystem into a centralized log analytics platform. Which solution would you recommend?

Accepted Answer

Install and configure the Amazon CloudWatch Logs agent on each EC2 instance to tail the log files from the EFS mount and send them to CloudWatch Logs. Create a metric filter and alarm for 5xx errors.. Option D is correct because installing the CloudWatch Logs agent on each EC2 instance allows it to tail the log files from the shared EFS mount point and stream them to CloudWatch Logs in near real-time. This provides centralized log ingestion with minimal operational overhead, and you can create a metric filter and alarm to detect and alert on 5xx error spikes without manual SSH access.

Answer

Enable AWS CloudTrail data events for the EC2 instances to capture log file modifications.

Answer

Configure an Amazon EventBridge scheduled rule to invoke an AWS Lambda function that reads new log lines from EFS and publishes them to Amazon CloudWatch Logs.

Answer

Stream the log files to Amazon Kinesis Data Streams using a custom producer, then use a Lambda function to analyze and alert on 5xx errors.

Question 4

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

Accepted Answer

Use AWS X-Ray to instrument the application and collect trace data.. AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Answer

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Answer

Enable CloudWatch Logs Insights to query API logs for slow requests.

Answer

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Answer

Set up VPC Flow Logs to analyze network latency between services.

Question 5

A company is using AWS CloudTrail to log API activity in their AWS account. They want to ensure that any modification to CloudTrail configuration itself is logged and that the logs are immutable. Which combination of actions should they take? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the destination S3 bucket in governance mode.. Option A is correct because enabling S3 Object Lock in governance mode on the destination S3 bucket prevents any user, including the root user, from overwriting or deleting CloudTrail log objects during the retention period, ensuring immutability. Option B is correct because enabling log file validation creates a digest file that uses SHA-256 hashing to verify that log files have not been modified, deleted, or tampered with after delivery, providing integrity assurance.

Answer

Disable log file validation to reduce overhead.

Answer

Store CloudTrail logs in a CloudWatch Logs log group with a retention policy.

Answer

Enable CloudTrail Insights to detect configuration changes.

Question 6

Drag and drop the steps to configure an AWS Auto Scaling group with a launch template and scaling policies.

Question 7

Drag and drop the steps to set up an AWS CodeBuild project to build a Docker image and push it to Amazon ECR.

Question 8

Match each AWS monitoring or logging tool to its purpose.

Question 9

Match each AWS service health or performance concept to its meaning.

Question 10

A company uses AWS CloudTrail to log API activity across multiple accounts in AWS Organizations. The security team wants to receive near-real-time notifications for specific high-risk API calls, such as IAM policy changes or S3 bucket policy modifications. What is the MOST efficient and scalable solution?

Accepted Answer

Deliver CloudTrail logs to an S3 bucket, enable S3 Event Notifications to trigger a Lambda function that filters and publishes to SNS.. Option A is correct because it uses S3 Event Notifications to trigger a Lambda function in near-real-time when CloudTrail logs are delivered to S3. The Lambda function can filter for specific high-risk API calls (e.g., IAM policy changes, S3 bucket policy modifications) and publish only relevant events to an SNS topic, providing a scalable and cost-effective solution that avoids polling or complex querying.

Answer

Create a CloudWatch Events rule that matches the specific API calls and publishes to an SNS topic.

Answer

Use CloudWatch Logs Insights to query CloudTrail logs and set up a metric filter with an alarm.

Answer

Enable AWS Config rules to detect changes and trigger an SNS notification.

Question 11

A DevOps engineer manages a production environment with EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 5xx errors from the ALB. The engineer needs to identify whether the errors originate from the targets or the ALB itself. Which CloudWatch metric should be examined to differentiate between these two sources?

Accepted Answer

HTTPCode_Target_5XX_Count. Option B is correct because HTTPCode_Target_5XX_Count indicates errors from the target (EC2 instances), while HTTPCode_ELB_5XX_Count indicates errors from the ALB. Option A is wrong because RequestCount is total requests. Option C is wrong because TargetResponseTime measures latency. Option D is wrong because UnhealthyHostCount indicates unhealthy targets, not specific error codes.

Answer

TargetResponseTime

Answer

UnhealthyHostCount

Answer

RequestCount

Question 12

A company uses Amazon RDS for PostgreSQL and wants to monitor database performance metrics such as CPU utilization, memory, and disk I/O. Which AWS service should be used to set up custom dashboards and alarms for these metrics?

Accepted Answer

Amazon CloudWatch. Option A is correct because CloudWatch provides metrics for RDS and allows dashboards and alarms. Option B is wrong because CloudTrail logs API calls, not performance metrics. Option C is wrong because VPC Flow Logs capture network traffic. Option D is wrong because X-Ray is for tracing requests.

Answer

AWS X-Ray

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 13

A company runs a microservices application on Amazon ECS with Fargate. The application logs are sent to CloudWatch Logs. Recently, the operations team noticed that logs from one service are missing for certain time periods. The service is very chatty and produces a high volume of logs. The CloudWatch Logs agent is configured with default settings. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent is dropping logs due to the default batch size and timeout settings.. Option C is correct because the CloudWatch Logs agent has a default batch size limit (1MB) and batch timeout (5 seconds). High-volume logs may be dropped if the buffer fills and the agent cannot flush quickly enough. Option A is wrong because CloudWatch Logs does not have per-log-group throttling, but it does have per-account throttling. Option B is wrong because the agent does not stop sending logs when the log group is full; it overwrites old logs if retention is set. Option D is wrong because CloudWatch Logs retention policy does not affect ingestion.

Answer

CloudWatch Logs has a throttling limit on log ingestion per log group.

Answer

The log group has reached its maximum size and stopped accepting new logs.

Answer

The log retention policy is set to 1 day, so older logs are automatically deleted.

Question 14

A company wants to monitor network traffic to and from its VPC for security analysis. It needs to capture IP traffic information, including accepted and rejected connection attempts, and store the data in S3 for long-term analysis. Which AWS service should be used?

Accepted Answer

Amazon VPC Flow Logs. Option B is correct because VPC Flow Logs capture network traffic metadata and can be published to S3. Option A is wrong because CloudWatch Logs is for application logs, not network flows. Option C is wrong because CloudTrail tracks API calls. Option D is wrong because GuardDuty is a threat detection service, not a log source.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 15

A DevOps team uses AWS Lambda functions to process events from an SQS queue. The Lambda function occasionally fails due to transient errors, and the team wants to capture and analyze the full error details, including stack traces, for debugging. The errors are not always related to invocation failures (e.g., timeouts) but include exceptions thrown within the function code. Which approach will capture the MOST comprehensive error information?

Accepted Answer

Ensure the Lambda function code returns a meaningful error object (e.g., throws an exception) so that the error is logged in CloudWatch Logs with a stack trace.. Option D is correct because returning the error object from the Lambda handler (either by throwing an exception or returning a structured error) will cause Lambda to record the error details in CloudWatch Logs, including stack traces. Option A is wrong because CloudWatch Logs streams all logs, including console log statements, but capturing stack traces requires explicit logging. Option B is wrong because DLQ captures failed events (messages), not error details. Option C is wrong because X-Ray traces requests but may not capture full stack traces of application errors.

Answer

Configure a DLQ on the SQS queue to capture failed messages and inspect them.

Answer

Enable CloudWatch Logs and rely on the automatic logging of invocation results.

Answer

Use AWS X-Ray to trace the function execution and analyze the traces.