DOP-C02 Monitoring and Logging Practice Test 4 — 15 Questions

Question 1

A DevOps engineer needs to aggregate logs from multiple AWS accounts into a central account for analysis. Which service should they use?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters.. Amazon CloudWatch Logs supports cross-account subscription filters, which allow log events from multiple accounts to be aggregated into a central account's log group. This is the native way to centralize logs for analysis without managing S3 buckets or complex policies.

Answer

AWS CloudTrail with organization trails.

Answer

AWS Config with aggregator.

Answer

Amazon S3 with cross-account bucket policies.

Question 2

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The operations team notices that the error rate on the ALB is increasing, but the CPU utilization on the EC2 instances remains low. Which CloudWatch metric should be examined to determine if the errors are due to a lack of healthy targets?

Accepted Answer

HealthyHostCount. `HealthyHostCount` reports the number of targets that pass the ALB's health checks and are eligible to receive traffic. If this metric drops while `RequestCount` stays high, the ALB is distributing the same load across fewer healthy targets, which can cause 5xx errors and timeouts even when backend CPU is low. Examining `HealthyHostCount` (alongside `UnHealthyHostCount`) directly answers whether errors stem from a lack of healthy targets.

Answer

UnHealthyHostCount

Answer

RequestCount

Answer

TargetResponseTime

Question 3

A DevOps engineer notices that a CloudWatch alarm for high CPU utilization on an EC2 instance is not triggering despite the CPU consistently above the threshold. The instance is in a VPC with a public subnet and has internet access. What is the most likely cause?

Accepted Answer

The instance is using basic monitoring (5-minute intervals) which delays the alarm.. Basic monitoring in CloudWatch publishes EC2 metrics at 5-minute intervals, which means an alarm evaluating CPU utilization may take up to 5 minutes (or longer, depending on the evaluation period) to detect a breach. If the CPU spike is shorter than the evaluation window or the alarm's period is set to 5 minutes with multiple evaluation periods, the alarm may not trigger promptly. Detailed monitoring (1-minute intervals) is required for faster alarm response.

Answer

The EC2 instance does not have a public IP address.

Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.

Answer

The CloudWatch alarm is in the 'INSUFFICIENT_DATA' state because the instance is stopped.

Question 4

An application running on Amazon ECS Fargate writes logs to CloudWatch Logs. The logs include sensitive data such as credit card numbers, which must be masked before storage. What is the most cost-effective solution that requires the least operational overhead?

Accepted Answer

Use a CloudWatch Logs subscription filter to invoke an AWS Lambda function that masks sensitive data and writes the sanitized logs to a different log group.. A CloudWatch Logs subscription filter delivers each log event, in near real time, to a Lambda function that can mask sensitive fields and write the sanitized version to a separate log group. Note that this does not remove the original unmasked event from the source log group - the raw event is already persisted there by the ECS awslogs driver before the subscription filter fires - so for true masking-before-storage you must also apply a short retention policy (or restrict access) on the original log group, or mask within the application before it ever writes to stdout.

Answer

Stream logs to Amazon Kinesis Data Firehose with a Lambda transformation, then deliver to CloudWatch Logs.

Answer

Configure a CloudWatch Logs subscription to stream logs to Amazon S3, and use S3 Object Lambda to mask data on retrieval.

Answer

Deploy a sidecar container in the ECS task that reads logs from stdout, masks data, and sends to CloudWatch Logs.

Question 5

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The DevOps team wants to detect and alert on any IAM user who creates an access key and then uses it to make API calls within 24 hours, as this may indicate a compromised account. Which combination of actions should be taken to achieve this with minimal latency?

Accepted Answer

Enable S3 Event Notifications on the CloudTrail S3 bucket to invoke a Lambda function that processes new log files and checks for the pattern.. S3 Event Notifications on the CloudTrail bucket trigger a Lambda function as soon as a new log file is delivered, which is typically within minutes of the API activity. The Lambda function can parse the log, correlate CreateAccessKey with subsequent API calls from the same IAM user within a 24-hour window, and send an alert. This event-driven approach provides the lowest latency compared to polling or batch queries, and it scales automatically with log volume.

Answer

Use Amazon Athena to query CloudTrail logs in S3 every hour and send alerts for matches.

Answer

Create an Amazon EventBridge rule that matches CreateAccessKey and any subsequent API call from the same user within 24 hours.

Answer

Stream CloudTrail logs to CloudWatch Logs and create a metric filter to detect the pattern, then set an alarm.

Question 6

A DevOps engineer needs to monitor the memory utilization of an Amazon RDS for MySQL instance. Which AWS service should be used to collect and visualize this metric?

Accepted Answer

Enhanced Monitoring for RDS.. Default CloudWatch metrics for RDS do include FreeableMemory (available RAM in bytes), but that is only a single coarse figure. Enhanced Monitoring is the better choice here because it delivers much more detailed, OS-level memory statistics (active, free, cached, and buffered memory, plus swap usage) at up to 1-second granularity by running an agent on the DB instance's host and streaming the data to CloudWatch Logs -- giving far deeper visibility into memory utilization than the single default FreeableMemory metric.

Answer

CloudWatch default metrics for RDS.

Answer

AWS Systems Manager Inventory.

Answer

AWS Trusted Advisor.

Question 7

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search across multiple log groups and visualize trends. Which TWO services can be used together to achieve this?

Accepted Answer

CloudWatch Logs Insights.. CloudWatch Logs Insights (A) is correct because it is the purpose-built query engine for CloudWatch Logs that lets you run interactive queries across multiple log groups simultaneously using its own query syntax, and it can aggregate and visualize results as time-series charts, directly satisfying the 'search across multiple log groups and visualize trends' requirement. CloudWatch Dashboards (E) is correct because it is the visualization layer that can display Logs Insights query results (and other CloudWatch metrics) as widgets on a single dashboard, so the two services are designed to be used together for cross-log-group searching plus trend visualization. Amazon Elasticsearch Service with Kibana (B) can search and visualize logs, but it requires exporting/streaming logs to a separate cluster rather than querying CloudWatch Logs directly, so it is not the intended pairing here. Amazon Athena (C) queries data in Amazon S3 via the Glue Data Catalog, not CloudWatch Logs, and Amazon QuickSight (D) is a BI tool for datasets/dashboards rather than a CloudWatch Logs search engine, so neither belongs.

Answer

Amazon Elasticsearch Service with Kibana.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Question 8

A DevOps engineer is designing a centralized logging solution for 10 AWS accounts. Logs must be stored in a central S3 bucket with encryption and access logging. Which THREE services/resources are required to meet these requirements?

Accepted Answer

AWS CloudTrail.. Option B (AWS CloudTrail) is correct because CloudTrail is the service that records API activity and account events across all 10 AWS accounts, and it can be configured with an organization trail to deliver log files to a central S3 bucket. Option C (AWS KMS customer managed key) is correct because the requirement for encryption of the centralized S3 bucket is satisfied by SSE-KMS using a customer managed key, which gives control over key policies and rotation. Option E (Amazon S3 server access logs) is correct because the requirement for access logging on the central bucket is met by enabling S3 server access logging, which records requests made to the bucket. Option A (AWS Config) is not required because it evaluates resource compliance and configuration history, not centralized log storage. Option D (Amazon CloudWatch Logs) is not required because the scenario specifies S3 as the storage destination, and CloudWatch Logs is a separate log storage and monitoring service.

Answer

AWS Config.

Answer

Amazon CloudWatch Logs.

Question 9

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance fails to write logs to CloudWatch Logs in the log group 'MyAppLogs'. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on the log stream resource.. To write logs to CloudWatch Logs, the IAM policy must grant permissions on both the log group and the log stream resources. The policy likely specifies only the log group ARN (e.g., 'arn:aws:logs:region:account-id:log-group:MyAppLogs') but omits the log stream ARN (e.g., 'arn:aws:logs:region:account-id:log-group:MyAppLogs:log-stream:*'). CloudWatch Logs requires permissions on the log stream for actions like PutLogEvents. Option B is incorrect because the CloudWatch agent is not mandatory; the AWS SDK can be used directly. Option C is incorrect because the region in the resource ARN is specified correctly (assuming it matches the actual region). Option D is incorrect because 'logs:DescribeLogGroups' is not required for writing logs; the necessary action is 'logs:PutLogEvents' and related actions.

Answer

The CloudWatch agent is not installed on the instance.

Answer

The policy specifies the wrong region in the resource ARN.

Answer

The policy does not include the 'logs:DescribeLogGroups' action.

Question 10

Refer to the exhibit. A CloudFormation template deploys a Lambda function with X-Ray tracing enabled. However, traces are not appearing in the X-Ray console. What is the most likely missing configuration?

Accepted Answer

The Lambda execution role does not have permissions to upload trace data to X-Ray.. For Lambda to send trace data to X-Ray, the function's execution role must include IAM permissions for the X-Ray daemon API calls (xray:PutTraceSegments and xray:PutTelemetryRecords). Even with TracingConfig set to Active and the X-Ray SDK in code, traces won't appear if the execution role lacks these permissions. This is the most common cause of 'tracing enabled but no traces' in Lambda.

Answer

The Lambda runtime (nodejs18.x) does not support X-Ray tracing.

Answer

The TracingConfig mode is set to 'Active' but should be 'PassThrough'.

Answer

The Lambda function code does not use the AWS X-Ray SDK.

Question 11

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The operations team notices that the application's error rate spiked for 10 minutes last night, but no CloudWatch alarm was triggered. The team has a CloudWatch alarm on the ALB's 'HTTPCode_Target_5XX_Count' metric with a threshold of 100 over 5 consecutive periods of 1 minute. What is the MOST likely reason the alarm did not trigger?

Accepted Answer

The alarm's period is set to 5 minutes instead of 1 minute.. The alarm is configured to evaluate 'HTTPCode_Target_5XX_Count' over 5 consecutive periods of 1 minute, meaning it requires 5 minutes of data above the threshold to trigger. The spike lasted 10 minutes, which should have met this condition. However, if the alarm's period is set to 5 minutes instead of 1 minute, the alarm would evaluate 5 consecutive periods of 5 minutes each, requiring 25 minutes of sustained errors. A 10-minute spike would not be enough to trigger the alarm. Therefore, option C is correct. Option A is incorrect because ALB metrics are published at 1-minute granularity. Option B is incorrect because ALB sends metrics to CloudWatch Metrics, not CloudWatch Logs. Option D is incorrect because the metric 'HTTPCode_Target_5XX_Count' is in the correct namespace (AWS/ApplicationELB) and is specific to target groups.

Answer

The ALB publishes metrics only at 5-minute granularity.

Answer

The ALB sends metrics to CloudWatch Logs instead of CloudWatch Metrics.

Answer

The alarm is configured on the wrong metric namespace.

Question 12

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5 and a batch size of 10. The SQS queue has a visibility timeout of 30 seconds, and the Lambda function typically completes processing each batch in 10 seconds. Recently, the engineer noticed that messages are repeatedly processed, causing duplicates. The CloudWatch Logs show that the function is experiencing throttling errors. What is the MOST likely cause of the duplicate processing?

Accepted Answer

Lambda is throttling the function, and the visibility timeout expires before the function can process the messages.. With a reserved concurrency of 5 and batch size of 10, Lambda can process at most 5 concurrent batches. When SQS delivers more messages than Lambda can handle, Lambda throttles the function, and messages remain in the queue. If the visibility timeout (30 seconds) expires before the function successfully processes and deletes the messages, SQS makes them visible again, causing duplicate processing. The throttling errors in CloudWatch confirm this bottleneck.

Answer

The SQS queue's dead-letter queue (DLQ) is not configured, causing messages to be reprocessed.

Answer

The function's batch size is too large, causing timeouts.

Answer

The function's reserved concurrency is too high, causing overloading.

Question 13

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket for long-term storage and analysis. The logs include AWS CloudTrail, VPC Flow Logs, and Amazon RDS audit logs. Which solution is the MOST operationally efficient?

Accepted Answer

Configure each account to deliver logs directly to a central S3 bucket using a bucket policy that allows cross-account writes.. Configuring each account to deliver logs directly to a central S3 bucket using a cross-account bucket policy is the most operationally efficient because it eliminates intermediate services, extra storage, and replication overhead. CloudTrail, VPC Flow Logs, and RDS audit logs all natively support direct S3 delivery, and a single bucket policy with the appropriate PutObject permissions (plus ACL bucket-owner-full-control) allows writes from any account. This minimizes moving parts, cost, and latency while centralizing storage in one location.

Answer

Configure each account to send logs to a central CloudWatch Logs account, then export to S3.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to the central bucket.

Question 14

An e-commerce platform uses Amazon DynamoDB as its primary database. During a flash sale, the application experienced high read latency. The DevOps team wants to set up CloudWatch alarms to detect high read latency proactively. The team has enabled DynamoDB Accelerator (DAX) for caching. Which metric should the team use to create a CloudWatch alarm for read latency?

Accepted Answer

DAX's CacheHitLatency metric.. DAX does not publish any request-latency metric to CloudWatch (AWS/DAX namespace metrics are counts and resource-utilization only: ItemCacheHits, ItemCacheMisses, TotalRequestCount, CPUUtilization, etc.). To monitor DAX-layer read latency you must instrument the client application (e.g., using the DAX client SDK's local statistics, or AWS X-Ray tracing) rather than create a CloudWatch alarm on a nonexistent 'CacheHitLatency' metric. This question needs to be rewritten around metrics that actually exist, or reframed to ask about DAX hit-ratio metrics (ItemCacheHits/ItemCacheMisses) instead of a fabricated latency metric.

Answer

DAX's CacheHitCount metric.

Answer

DynamoDB's ConsumedReadCapacityUnits metric.

Answer

DynamoDB's SuccessfulRequestLatency metric for GetItem operations.

Question 15

A company runs a microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. The DevOps team wants to monitor the number of HTTP 5xx errors returned by each service. They configure the ALB to send access logs to an S3 bucket and enable CloudWatch Container Insights. However, the team cannot view 5xx errors per service. What should the team do to achieve this?

Accepted Answer

Enable ALB access logging and parse the logs to filter by target group, then correlate with the ECS service name.. ALB access logs include the target group ARN. By parsing the logs and filtering for HTTP 5xx errors, you can group by target group. Then, you can correlate the target group with the ECS service name (e.g., via target group tags or by looking at the ALB listener rules). This allows you to view 5xx errors per service. Option A is incorrect because CloudWatch Logs Insights cannot query logs directly from S3; the logs would need to be in CloudWatch Logs. Option B is incorrect because Container Insights provides metrics at the task level, not per service, and does not directly expose HTTP 5xx errors from the ALB. Option D is incorrect because adding a custom header does not automatically create a metric; you would need additional logging or parsing to extract that header.

Answer

Use CloudWatch Logs Insights to query the ALB access logs directly from S3.

Answer

Enable Container Insights and create a CloudWatch dashboard to view HTTP 5xx errors per ECS service.

Answer

Configure the ALB to add a custom header with the service name and use CloudWatch metrics.