DOP-C02 Monitoring and Logging Practice Test 3 — 15 Questions

Question 1

A DevOps engineer is responsible for monitoring a set of microservices running on Amazon ECS with Fargate. The services are fronted by an Application Load Balancer (ALB). The engineer needs to collect and analyze application logs centrally with minimal latency and operational overhead. The logs should be searchable and retainable for 90 days. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the CloudWatch agent as a Daemon service on the ECS cluster to collect logs from all tasks and forward them to CloudWatch Logs.. The CloudWatch agent can be deployed as a Daemon service on the ECS cluster to collect logs from all tasks and forward them to CloudWatch Logs. This provides near real-time search, configurable retention (up to 90 days), and minimal latency with low operational overhead. Option B is wrong because FireLens is a container log driver that sends logs directly to a destination; while it can send to CloudWatch Logs, it requires per-task configuration and does not aggregate logs from all tasks as seamlessly as a Daemon service. Option C is wrong because storing logs in S3 introduces latency and requires additional services like Athena for querying, increasing operational overhead and not meeting the minimal latency requirement. Option D is wrong because using a sidecar container for every task increases cost and complexity, and Kinesis Data Firehose adds latency compared to direct CloudWatch Logs ingestion.

Answer

Use the FireLens log driver in the ECS task definition to send logs to Amazon CloudWatch Logs.

Answer

Configure the ECS tasks to write logs to Amazon S3 and use Amazon Athena to query the logs.

Answer

Add a sidecar container to each ECS task that streams logs to Amazon Kinesis Data Firehose, which delivers to Amazon OpenSearch Service.

Question 2

A DevOps team is designing a centralized logging solution for multiple AWS accounts. The team needs to collect logs from EC2 instances, Lambda functions, and VPC Flow Logs, and store them in a central account for analysis. The solution must be cost-effective and support near real-time log aggregation. Which THREE steps should the team take? (Choose three.)

Accepted Answer

Deliver logs from the central account's CloudWatch Logs to Amazon Kinesis Data Firehose, which writes to Amazon S3.. Option E is correct because CloudWatch Logs cross-account subscription filters allow log groups in source accounts (EC2, Lambda, and VPC Flow Logs) to stream log events directly into a central account's CloudWatch Logs log group, enabling near real-time aggregation without custom forwarding code. Option B is correct because delivering the centralized CloudWatch Logs to Kinesis Data Firehose provides a managed, cost-effective pipeline that batches and writes logs to Amazon S3 for durable, low-cost storage and later analysis. Option D is correct because Amazon Athena can query the S3-stored logs directly using standard SQL, giving a serverless, pay-per-query analysis layer over the centralized log archive. Option A is not appropriate because VPC Flow Logs can be delivered directly to CloudWatch Logs or S3, and inserting a Lambda function per account adds unnecessary complexity, cost, and latency. Option C is not required because OpenSearch Service is a relatively expensive indexing/search layer, whereas the scenario's cost-effectiveness and S3-based analysis are already satisfied by Firehose plus Athena.

Answer

Configure VPC Flow Logs to deliver to a Lambda function in each account, which forwards logs to the central account.

Answer

Use Amazon OpenSearch Service to index and search the logs in near real time.

Question 3

A company runs a microservices architecture on Amazon EKS. The DevOps team wants to monitor application performance and detect anomalies in request latency. They need to collect metrics, logs, and traces from all services. Which THREE AWS services should the team use together to implement a complete observability solution? (Choose three.)

Accepted Answer

AWS X-Ray. AWS X-Ray (A) is correct because it collects and analyzes distributed traces across microservices on EKS, letting the team pinpoint latency bottlenecks and trace requests end-to-end through the service mesh. Amazon CloudWatch Container Insights (E) is correct because it gathers container-level metrics and logs from EKS worker nodes and pods, providing the performance telemetry needed to detect anomalies in request latency. AWS CloudWatch ServiceLens (B) is correct because it integrates CloudWatch metrics/logs with X-Ray traces into a single view, correlating application performance data with underlying infrastructure to accelerate anomaly detection. AWS CloudTrail (C) is not appropriate here because it records AWS API activity for auditing and governance, not application performance metrics, logs, or traces. Amazon Managed Service for Prometheus (D) is not selected because, while it is a valid metrics store, the scenario's complete observability solution is satisfied by X-Ray, Container Insights, and ServiceLens working together.

Answer

AWS CloudTrail

Answer

Amazon Managed Service for Prometheus

Question 4

A company is using AWS X-Ray to trace requests through a microservices application. Some traces are incomplete, showing only the root segment without any subsegments. The application uses the X-Ray SDK for Java. What is the most likely cause?

Accepted Answer

The sampling rate is set to a low value, causing many requests to be dropped.. A low sampling rate in the X-Ray SDK causes the SDK to drop many requests before they are sent to the daemon. When the sampling rate is too low, the SDK may decide not to record subsegments for a given request, resulting in traces that contain only the root segment without any subsegments. This is a common misconfiguration where the sampling decision is made at the segment level, and subsegments are only generated if the segment is sampled in.

Option A is incorrect because the x-amzn-trace-id header is not required for tracing; the SDK can generate its own trace ID.

Option B is incorrect because segment documents that exceed the maximum size are rejected by the API, not silently ignored.

Option C is incorrect because the X-Ray daemon is required for the SDK to send traces to the X-Ray API. If the daemon is not running, the SDK cannot send segments, resulting in no traces at all, not incomplete traces with only root segments. The incomplete traces described are typically due to sampling issues.

Answer

The application is missing the x-amzn-trace-id header in incoming requests.

Answer

The segment document size exceeds the maximum allowed size.

Answer

The X-Ray daemon is not running on the EC2 instances.

Question 5

A DevOps team is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a custom application. The team notices that logs are missing from some instances intermittently. The CloudWatch agent configuration is identical across all instances. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent's state file has become corrupted due to disk full condition. The CloudWatch agent maintains a persistent state file (typically at /opt/aws/amazon-cloudwatch-agent/etc/ or /var/lib/amazon/amazon-cloudwatch-agent/) that tracks which log lines have already been published to CloudWatch Logs. If the disk fills up, this state file can become corrupted or truncated, causing the agent to lose track of its position and silently drop log batches. Since the configuration is identical across instances, a per-instance environmental issue like disk exhaustion is the most plausible cause of intermittent, instance-specific log loss.

Answer

The VPC Flow Logs are consuming all available network bandwidth

Answer

The EC2 instances are running out of CPU credits, causing the agent to skip log batches

Answer

The IAM role attached to the instances has been rotated incorrectly

Question 6

A DevOps engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must collect logs from all accounts into a centralized Amazon S3 bucket for analysis. Which THREE steps are required to set up this centralized logging?

Accepted Answer

Create an S3 bucket in the central logging account with bucket policies allowing cross-account writes. Option B is correct because the central logging account must host an S3 bucket whose bucket policy explicitly grants cross-account write (s3:PutObject) permissions to the source accounts or their service principals, otherwise CloudTrail and CloudWatch Logs deliveries from other accounts will be denied. Option C is correct because AWS CloudTrail must be enabled (typically as an organization trail via AWS Organizations) in each account and configured with an S3 bucket policy permitting CloudTrail to write to the centralized bucket, which is the standard mechanism for aggregating API activity logs across accounts. Option E is correct because CloudWatch Logs subscription filters can forward log groups to a destination (often a Kinesis Data Firehose delivery stream or a cross-account Logs destination) that ultimately delivers the data into the centralized S3 bucket, enabling log aggregation beyond just CloudTrail. Option A is not required because VPC Flow Logs are optional network-level telemetry and are not a mandatory step for centralized logging of account activity. Option D is not required because Kinesis Data Streams is an ingestion service that is not necessary for the described S3-based centralized logging architecture.

Answer

Enable VPC Flow Logs for all VPCs in every account and send them to the centralized bucket

Answer

Set up Amazon Kinesis Data Streams in the central account to ingest logs from all accounts

Question 7

A company uses AWS Lambda functions to process data from an Amazon SQS queue. The Lambda function sometimes fails due to timeouts. The DevOps team wants to monitor the number of function timeouts and receive alerts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure a CloudWatch alarm on the 'Timeouts' metric from AWS/Lambda namespace. Lambda automatically publishes a 'Timeouts' metric to CloudWatch, and a CloudWatch alarm can be configured directly on that metric for efficient monitoring and alerting. Option A is wrong because EventBridge rules capture raw execution results but do not specifically isolate timeouts without additional logic; using the metric is more direct. Option B is wrong because AWS X-Ray is designed for tracing individual requests, not for aggregate metric-based alerting, making it inefficient for monitoring timeout rates. Option C is wrong because running a CloudWatch Logs Insights query periodically is reactive and not real-time; it depends on log ingestion and is less efficient than using a pre-existing metric.

Answer

Create an Amazon EventBridge rule that captures Lambda execution results and triggers an SNS topic

Answer

Enable AWS X-Ray on the Lambda function and analyze traces for timeouts

Answer

Create a CloudWatch Logs Insights query to search for 'Task timed out' and run it periodically

Question 8

A DevOps team is using Amazon CloudWatch Synthetics canaries to monitor the availability of a web application. The canary is configured to run every 5 minutes. The team notices that the canary fails occasionally but the application is healthy. Which action will help identify if the failures are due to network issues between the canary and the application?

Accepted Answer

Configure the canary to run inside the same VPC as the application using a VPC endpoint. Configuring the canary to run inside the same VPC as the application using a VPC endpoint eliminates the public internet path and any network variability between the canary and the application. This isolates whether the intermittent failures are due to network issues (e.g., internet routing, NAT, or firewall) or actual application problems. If the canary still fails when running inside the VPC, the issue is likely with the application itself; if it succeeds, the problem was external network connectivity.

Answer

Enable VPC Flow Logs for the canary's VPC and analyze the logs for dropped packets

Answer

Enable AWS X-Ray tracing on the canary to trace the request path

Answer

Increase the canary's memory and timeout settings to reduce false positives

Question 9

A company uses Amazon ECS with Fargate for containerized applications. The DevOps team notices that some tasks are failing with 'OutOfMemoryError' but the CloudWatch metric 'MemoryUtilization' for the service shows values well below the task memory limit. What is the most likely cause of this discrepancy?

Accepted Answer

The container's memory usage is hitting the kernel's memory cgroup limit before the Docker-reported usage reaches the task memory limit.. The most likely cause is that the container's memory usage is hitting the kernel's memory cgroup limit before the Docker-reported usage reaches the task memory limit. In AWS Fargate, the task memory limit is enforced by the kernel cgroup, but the 'MemoryUtilization' metric is based on Docker's reported memory usage, which may not include certain kernel-level allocations such as page cache or kernel memory. This can cause the container to be OOM-killed while the metric still shows lower usage.

Answer

The CloudWatch metric 'MemoryUtilization' is aggregated across all tasks in the service, so individual task spikes are averaged out.

Answer

The task definition has a memory reservation but no hard limit, causing ECS to overcommit memory.

Answer

The container is using swap space, which is not included in the MemoryUtilization metric.

Question 10

An application running on Amazon EKS generates logs that need to be sent to CloudWatch Logs for central monitoring. The DevOps team deploys the CloudWatch agent as a DaemonSet in the cluster. However, logs from some pods are not appearing in CloudWatch. Which configuration issue is most likely causing this?

Accepted Answer

The IAM role associated with the worker nodes does not have the necessary permissions to write to CloudWatch Logs.. The CloudWatch agent running as a DaemonSet needs IAM permissions to call the CloudWatch Logs API (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents). If the worker node IAM role lacks these permissions and no IRSA/service account role is configured, the agent silently fails to ship logs for pods on those nodes. This is the most common cause of partial log delivery in EKS.

Answer

The pods are using the fluentd sidecar instead of the CloudWatch agent.

Answer

The CloudWatch agent is configured to collect logs from stdout, but the application writes logs to files.

Answer

The DaemonSet is not scheduled on all nodes due to taints and tolerations.

Question 11

A company uses AWS Lambda functions for data processing. The operations team notices that some functions are taking longer to execute than expected. They want to analyze the execution durations to identify functions that exceed the 75th percentile latency. Which CloudWatch feature should be used?

Accepted Answer

Use CloudWatch metrics with the percentile statistic for 'Duration'.. CloudWatch supports percentile statistics (ExtendedStatistics such as p50, p90, p99, p75) natively for standard metrics that report per-invocation data points, and AWS Lambda's 'Duration' metric is one of them -- this is the same mechanism used to power the p50/p90/p99 Duration graphs shown in the Lambda console's native monitoring tab. You can request GetMetricData/GetMetricStatistics with ExtendedStatistics='p75' directly against the Duration metric with no need to touch raw logs. CloudWatch Logs Insights `stats percentile(...)` can also compute percentiles from REPORT log lines, but it is the slower, more expensive, log-scanning fallback -- unnecessary here because the native metric statistic already exposes p75 directly. X-Ray and dashboard percentile widgets are secondary options: X-Ray doesn't aggregate percentiles across the whole invocation population by default, and a dashboard widget is just a rendering of the same underlying metric statistic, not a separate computation path.

Answer

Use AWS X-Ray to trace the Lambda functions and analyze latency percentiles.

Answer

Use CloudWatch dashboards with a percentile widget on the 'Duration' metric.

Answer

Use CloudWatch Logs Insights to query the Lambda log groups and calculate custom percentiles using the `stats` command.

Question 12

A DevOps team is designing a monitoring solution for a multi-tier web application running on AWS. The application consists of an Application Load Balancer, EC2 instances in an Auto Scaling group, and an RDS database. Which TWO approaches provide centralized logging and monitoring across all tiers?

Accepted Answer

Configure all services to send logs to Amazon S3 and use Amazon Athena for ad-hoc querying.. The unified CloudWatch agent only collects system and application logs from EC2 instances; it does not natively capture RDS database logs or other managed-service logs. Since the stem's multi-tier application explicitly includes an RDS database, this option does not, by its own stated reasoning, provide centralized monitoring 'across all tiers' and should not be marked correct as written.

Answer

Enable AWS CloudTrail for all accounts and regions.

Answer

Use AWS Config rules to monitor configuration changes across resources.

Answer

Enable VPC Flow Logs to capture network traffic.

Question 13

Refer to the exhibit. The IAM policy above is attached to an EC2 instance role. The CloudWatch agent on the instance is configured to send logs to the 'MyAppLogs' log group. However, logs are not appearing in CloudWatch. What is the most likely issue?

Accepted Answer

The policy does not allow the 'logs:PutLogEvents' action on the specific log stream resource.. The policy only grants permissions for log streams under the log group (using the * wildcard for log streams), but it does not include permission to describe or interact with the log group itself. However, the real issue is that the resource ARN for PutLogEvents requires a log stream resource, not just the log group. The correct resource should be "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:log-stream:*" for PutLogEvents. Option A is wrong because the log group name matches. Option B is wrong because the region is correct. Option D is wrong because CloudWatch Logs agent does not require S3 permissions.

Answer

The instance role needs additional permissions to write to S3 for log delivery.

Answer

The log group name in the policy does not match the log group name configured in the agent.

Answer

The region in the policy ARN does not match the region where the log group is created.

Question 14

Refer to the exhibit. A DevOps engineer runs the AWS CLI command shown to retrieve the RequestCount metric for an ELB. The output shows datapoints with Sum values. What is the total number of requests received by the load balancer during the entire hour?

Accepted Answer

18600 requests. 18600 requests. The AWS CLI command retrieves the RequestCount metric with a period of 300 seconds (5-minute intervals). Each datapoint's Sum value represents the total number of requests received in that 5-minute window. To find the total requests for the entire hour, sum all 12 datapoints. The exhibit shows datapoints like 1500, 2000, ... 1800, and their total is 18600. Option B (3500) is incorrect because it only sums two datapoints instead of all twelve. Option C (36000) is incorrect because it likely multiplies a single datapoint by 12 without considering the actual values. Option D is incorrect because the total is determinable by summing the datapoints.

Answer

1500 + 2000 = 3500 requests

Answer

36000 requests

Answer

Cannot be determined from the data

Question 15

A DevOps team uses AWS CloudFormation to deploy a web application. They want to receive notifications when a stack update fails. Which combination of services should they use?

Accepted Answer

Use Amazon EventBridge to capture CloudFormation events and invoke an AWS Lambda function that sends an email.. Amazon EventBridge natively receives CloudFormation stack events (including UPDATE_FAILED) and can route them to targets such as Lambda, which then sends the email notification. This is the event-driven, serverless pattern AWS recommends for reacting to CloudFormation state changes.

Answer

Use AWS Config rules to monitor stack status and trigger an SNS notification.

Answer

Create a CloudWatch alarm on the CloudFormation stack event metric 'UPDATE_FAILED' and configure an SNS topic to send email notifications.

Answer

Enable S3 event notifications on the CloudFormation template bucket and subscribe an SNS topic.