DOP-C02 Monitoring and Logging Practice Test 3 — 15 Questions

Question 1

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The security team requires that logs be encrypted at rest using a customer-managed KMS key. Which configuration step should the engineer perform to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the KMS key with the CloudWatch log group using the console or CLI. CloudWatch Logs can be encrypted at rest using a customer-managed KMS key, and the key must be associated with the log group. Option A is incorrect because the CloudWatch agent does not handle encryption at rest; encryption is applied server-side by CloudWatch Logs. Option B is incorrect because while a KMS key policy is necessary to grant CloudWatch Logs permissions, the key must also be explicitly associated with the log group. Option C is incorrect because CloudWatch Logs does not store logs in an S3 bucket by default; encryption is applied at the log group level, not via S3.

Answer

Configure the CloudWatch agent to encrypt logs before sending

Answer

Create a KMS key and attach a policy allowing CloudWatch Logs to use it

Answer

Enable default encryption on the S3 bucket that stores logs

Question 2

An e-commerce application runs on Amazon ECS with Fargate. The operations team notices that the application's latency increases during peak hours. The engineer needs to correlate high CPU usage with increased request latency to identify the root cause. Which approach should be used?

Accepted Answer

Enable Container Insights and ServiceLens to correlate metrics and traces. Container Insights for Amazon ECS with Fargate collects CPU, memory, and other metrics, while ServiceLens integrates CloudWatch metrics with AWS X-Ray traces to provide end-to-end visibility. This correlation allows the engineer to identify high CPU usage and its impact on request latency. Option A is incorrect because CloudWatch Logs Insights only analyzes log data, not metrics or traces. Option C is incorrect because CloudWatch Synthetics canaries monitor endpoint availability and performance from outside, but do not provide internal CPU metrics. Option D is incorrect because setting up a Prometheus server on an EC2 instance adds operational overhead and does not integrate with ECS Fargate natively; Container Insights and ServiceLens are the recommended AWS-native solution.

Answer

Use CloudWatch Logs Insights to query container logs

Answer

Configure CloudWatch Synthetics canaries to measure latency

Answer

Set up a Prometheus server on an EC2 instance to scrape container metrics

Question 3

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team needs to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the audit account, and that any log file validation failures trigger an immediate notification. What should the engineer do to meet this requirement?

Accepted Answer

Enable CloudTrail log file validation and create a CloudWatch alarm on the DigestDeliveryFailed metric. Enabling CloudTrail log file validation triggers the generation of digest files that contain hash values for verifying log file integrity. CloudTrail also emits the DigestDeliveryFailed metric to CloudWatch when a digest file delivery fails. Creating a CloudWatch alarm on this metric allows you to send immediate notifications via SNS when a validation failure occurs. Option B (Lambda function) is unnecessary because CloudTrail already provides the necessary metrics for this alerting. Option C (SNS notifications for all events) would generate excessive notifications and does not directly address log file validation failures. Option D (CloudWatch Logs and metric filter) is not the standard approach; CloudTrail directly emits the DigestDeliveryFailed metric, which is simpler and more reliable.

Answer

Create a Lambda function that checks the integrity of logs and publishes to SNS

Answer

Configure CloudTrail to deliver logs to the S3 bucket and enable SNS notifications for all events

Answer

Send CloudTrail logs to CloudWatch Logs and create a metric filter for validation errors

Question 4

A company runs a microservices application on Amazon EKS. The DevOps team wants to collect and visualize metrics such as pod CPU and memory usage, and set up alerts. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Container Insights and CloudWatch Alarms. Amazon CloudWatch Container Insights and CloudWatch Alarms. Container Insights collects, aggregates, and summarizes metrics and logs from containerized applications and microservices running on Amazon EKS. It provides pre-built dashboards for pod CPU, memory, network, and disk metrics. CloudWatch Alarms can be set on these metrics to trigger notifications or automated actions. Option A (Prometheus and Grafana on EC2) is possible but not an AWS service combination; it requires manual setup and maintenance. Option B (AWS X-Ray and Amazon CloudWatch ServiceLens) is for distributed tracing and service maps, not for collecting CPU/memory metrics. Option C (AWS CloudTrail and Amazon CloudWatch Logs) is for auditing API calls and storing log data, not for metrics visualization and alerting.

Answer

Prometheus and Grafana on EC2

Answer

AWS X-Ray and Amazon CloudWatch ServiceLens

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 5

A DevOps engineer needs to centralize logs from multiple AWS accounts into a single CloudWatch Logs account. Which feature should be used?

Accepted Answer

CloudWatch Logs cross-account subscription. CloudWatch Logs cross-account subscription (Option D) allows you to stream log data from multiple source AWS accounts to a single destination account's CloudWatch Logs log group. This is the native, managed feature designed specifically for centralizing logs across accounts without needing additional infrastructure or data transformation.

Answer

CloudWatch Logs Insights

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 6

A company uses Amazon RDS for MySQL. The database performance has degraded, and the engineer suspects that slow queries are the cause. Which service should be used to identify and analyze the slow queries?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct service because it provides a database-specific performance schema that visualizes database load and identifies the exact SQL queries causing performance degradation. It integrates directly with RDS for MySQL, offering a dashboard that breaks down wait events, SQL text, and host-level metrics, making it the ideal tool for analyzing slow queries.

Answer

Amazon CloudWatch Metrics

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 7

A company is using AWS Lambda to process streaming data from Amazon Kinesis. The processing rate is slower than expected, and the engineer needs to monitor the number of records that are failing processing. Which metric should be used to create a CloudWatch alarm?

Accepted Answer

IteratorAge. The IteratorAge metric measures the age of the last record in the Lambda function's iterator, indicating how far behind real-time the processing is. A high or increasing IteratorAge suggests that records are being retried or stuck due to processing failures, making it the correct metric to monitor for records failing processing in a Kinesis-triggered Lambda.

Answer

Invocations

Answer

Errors

Answer

Throttles

Question 8

A DevOps engineer needs to set up centralized logging for an application running on multiple EC2 instances across different AWS accounts. The logs must be aggregated in a single S3 bucket and also be analyzed in near real-time. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon Kinesis Data Firehose. (Kinesis Data Firehose) and Option D (CloudWatch Logs subscription) are correct. CloudWatch Logs subscription can forward logs to Kinesis Data Firehose, which can then deliver to S3 in near real-time. Option A (SQS) is wrong because SQS is for decoupling, not for log aggregation. Option C (CloudTrail) is wrong because CloudTrail is for API activity logging, not for application log aggregation. Option E (Lambda) is wrong because Lambda alone cannot efficiently aggregate logs from multiple accounts.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Answer

AWS Lambda

Question 9

A company uses Amazon CloudWatch to monitor a fleet of EC2 instances. The DevOps team wants to receive notifications when the CPU utilization exceeds 90% for 5 minutes and also when the status check fails. Which THREE steps should be taken to set up these alerts?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 300 seconds and threshold 90. The correct steps are A, C, and E. Option A creates a CloudWatch alarm on the CPUUtilization metric with a period of 300 seconds (5 minutes) and threshold 90%, which directly meets the requirement of exceeding 90% for 5 minutes. Option C creates an alarm on the StatusCheckFailed metric to notify when EC2 status checks fail. Option E creates an SNS topic and subscribes the team's email, which is necessary to receive notifications from the alarms. Option B is incorrect because a period of 60 seconds with 5 evaluation periods would trigger after 5 minutes only if each 1-minute period is above threshold, but the simpler and intended solution is a single period of 300 seconds. Option D is incorrect because composite alarms are not required; separate alarms for different conditions are standard practice.

Answer

Set the CPUUtilization alarm with a period of 60 seconds and 5 evaluation periods

Answer

Create a single composite alarm that combines both conditions

Question 10

A company wants to ensure that all changes to its Amazon S3 bucket policies are logged for auditing purposes. Which TWO AWS services should be enabled to capture these changes?

Accepted Answer

AWS Config. Options B and E are correct because AWS Config records resource configuration changes, including S3 bucket policies, and AWS CloudTrail logs API calls such as PutBucketPolicy. Option A is incorrect because Amazon CloudWatch monitors operational metrics and logs, not auditing of policy changes. Option C is incorrect because Amazon GuardDuty provides threat detection, not audit logging. Option D is incorrect because VPC Flow Logs capture network traffic, not configuration changes.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 11

A company is using Amazon CloudWatch Logs to monitor application logs from EC2 instances. The DevOps engineer notices that some log entries are missing. The CloudWatch agent is installed and configured. What is the most likely cause of the missing log entries?

Accepted Answer

The CloudWatch agent's rate limit is set too low, causing log entries to be dropped.. The CloudWatch agent has a configurable rate limit that controls how many log events can be sent per second. If the agent cannot keep up with the log generation rate, it may drop entries, resulting in missing log entries. Option A is correct because the rate limit can be set too low. Option B is incorrect because compression does not cause log loss; the agent compresses logs before sending, but that does not drop entries. Option C is incorrect because log retention policies only delete logs after they are stored, not during ingestion. Option D is incorrect because there is no maximum size limit on log events in CloudWatch Logs.

Answer

The CloudWatch agent is compressing logs before sending, causing some entries to be lost.

Answer

The log group retention policy is set to 1 day, and logs older than that are automatically deleted.

Answer

The log group's maximum size limit has been exceeded.

Question 12

A DevOps engineer is tasked with setting up a centralized logging solution for a multi-account AWS environment. Which service should be used to aggregate logs from multiple accounts?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription. Amazon CloudWatch Logs can aggregate logs across accounts using cross-account subscriptions with a central destination (e.g., Kinesis or Lambda). Option C is correct. Option A is incorrect because S3 is a storage service, not for real-time aggregation. Option B is incorrect as CloudTrail is for API activity, not application logs. Option D is incorrect because AWS Config is for configuration compliance.

Answer

Amazon S3 with cross-region replication

Answer

AWS CloudTrail with organization trails

Answer

AWS Config with aggregated compliance rules

Question 13

A company runs a critical application on Amazon ECS with Fargate. The DevOps engineer wants to receive alerts when the application's error rate exceeds 5% over a 5-minute period. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch Logs metric filter to count errors, then a CloudWatch alarm.. The correct solution is to use Amazon CloudWatch Logs metric filter to count errors from application logs, which creates a custom metric representing the error count or rate. Then, a CloudWatch alarm can be configured on that metric to trigger when the error rate exceeds 5% over a 5-minute period. Option C is correct. Option A is incorrect because CloudWatch Synthetics is for synthetic monitoring (endpoint health checks), not for analyzing logs for error rates. Option B is incorrect because CloudWatch Logs Insights is an interactive query tool for ad-hoc analysis, not designed for real-time alarming. Option D is incorrect because CloudWatch Contributor Insights analyzes top contributors (e.g., error sources), but does not directly count error rates for alarms.

Answer

Amazon CloudWatch Synthetics to monitor the application endpoint and create an alarm.

Answer

Amazon CloudWatch Logs Insights to query logs every 5 minutes and trigger a Lambda function.

Answer

Amazon CloudWatch Contributor Insights to detect error patterns, then an alarm.

Question 14

A DevOps engineer is designing a monitoring solution for an application that runs on Amazon EC2 instances in an Auto Scaling group. The engineer needs to collect memory utilization metrics and visualize them in a dashboard. What should the engineer do?

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. Memory utilization is not collected by default by CloudWatch. The CloudWatch agent must be installed on EC2 instances to collect memory and disk metrics as custom metrics. Option A is incorrect because simply creating a custom namespace does not collect data; the agent is needed to publish data. Option C is incorrect because detailed monitoring only increases the frequency of default metrics (CPU, network, etc.) and does not include memory. Option D is incorrect because CloudTrail captures API calls, not system-level metrics like memory usage.

Answer

Create a custom CloudWatch metric namespace and publish memory data using the AWS CLI.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics.

Answer

Use AWS CloudTrail to capture memory utilization events from the EC2 instances.

Question 15

A company uses AWS X-Ray to trace requests through its microservices application. The DevOps engineer notices that some traces are incomplete. What is a possible reason?

Accepted Answer

The X-Ray SDK sampling rate is configured too low, causing many requests to be skipped.. The X-Ray SDK uses a sampling rate to decide which requests to record. If the sampling rate is set too low, a large percentage of requests are skipped, leading to incomplete traces. The DevOps engineer would observe missing segments for requests that were not sampled, even though the daemon and SDK are functioning correctly.

Answer

The X-Ray daemon is not running on the application servers.

Answer

X-Ray cannot trace requests that cross multiple AWS services.

Answer

X-Ray requires the CloudWatch agent to be installed on all EC2 instances.