DOP-C02 Monitoring and Logging Practice Test 4 — 15 Questions

Question 1

A company wants to receive notifications when an EC2 instance's CPU utilization exceeds 90% for 10 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch alarm. Amazon CloudWatch alarms monitor specified metrics (like CPU utilization) and trigger actions (e.g., SNS notification) when a threshold is breached for a given period. Option A is correct. Option B is incorrect because AWS Config rules evaluate configuration compliance, not metric thresholds. Option C is incorrect because AWS CloudTrail records API activity, not metric monitoring. Option D is incorrect because Amazon Inspector assesses security vulnerabilities, not performance metrics.

Answer

AWS Config rule

Answer

AWS CloudTrail event

Answer

Amazon Inspector

Question 2

A company runs a containerized application on Amazon EKS. The DevOps engineer needs to collect application metrics and make them available in Amazon CloudWatch. Which solution should be used?

Accepted Answer

Install the Amazon CloudWatch agent as a DaemonSet on the EKS cluster.. The CloudWatch agent installed as a DaemonSet on the EKS cluster can collect container and application metrics and send them to CloudWatch. Option B is correct. Option A is incorrect because AWS X-Ray is for tracing, not metrics. Option C is incorrect because AWS Distro for OpenTelemetry can also collect metrics but requires additional setup; the CloudWatch agent is the recommended approach. Option D is incorrect because enabling Container Insights via the console alone does not automatically collect application metrics; it requires the CloudWatch agent or a sidecar.

Answer

Use AWS X-Ray daemon to collect metrics and send them to CloudWatch.

Answer

Deploy the AWS Distro for OpenTelemetry collector on the EKS cluster.

Answer

Enable Amazon CloudWatch Container Insights using the AWS Management Console.

Question 3

A DevOps engineer needs to set up a monitoring solution that can detect and alert on unusual patterns in application metrics. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Anomaly Detection uses machine learning to model expected metric behavior and detect anomalies. CloudWatch Alarms can then be configured to trigger actions (e.g., SNS notifications) when an anomaly is detected. Together, these two services provide a solution for alerting on unusual patterns in application metrics. Amazon GuardDuty is a threat detection service for security threats, not application metrics. AWS CloudTrail is used for auditing API calls, not metric monitoring. AWS Config is for configuration compliance and resource inventory, not real-time metric anomaly detection.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 4

A company wants to centralize logging from multiple AWS accounts and regions. The logs should be stored in a central S3 bucket for compliance. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Create an S3 bucket in the central account with appropriate bucket policy granting permissions to CloudTrail.. To centralize logs from multiple accounts into a single S3 bucket, the bucket in the central account must have a bucket policy that explicitly grants the necessary permissions (e.g., `s3:PutObject`) to the CloudTrail service principal (`cloudtrail.amazonaws.com`) from each source account. This policy allows CloudTrail in the source accounts to write log files directly into the central bucket, enabling centralized storage for compliance.

Answer

Create a cross-account subscription in Amazon CloudWatch Logs to stream logs to the central account.

Answer

Turn on CloudTrail data events for all S3 and Lambda resources.

Question 5

A DevOps engineer is investigating a performance issue in a serverless application using AWS Lambda. The engineer wants to view the duration of each invocation and identify cold starts. Which TWO AWS services should be used? (Choose TWO.)

Accepted Answer

AWS X-Ray to trace invocations and detect cold starts. To view the duration of each invocation and identify cold starts, a DevOps engineer should use AWS X-Ray (option B) and Amazon CloudWatch Logs (option D). AWS X-Ray traces every Lambda invocation and includes a segment for initialization time, which directly identifies cold starts. CloudWatch Logs contains per-invocation REPORT statements with exact duration and INIT_START/INIT_END messages for cold starts. Together, these services provide both detailed tracing and log-based investigation. CloudWatch Metrics (option A) only provides aggregate metrics such as total duration and invocations, not per-invocation data, so it is not suitable for viewing the duration of each invocation.

Answer

Amazon CloudWatch Metrics for Lambda (duration, invocations)

Answer

AWS CloudTrail to record Lambda API calls

Answer

AWS Config to track Lambda configuration changes

Question 6

A company is using Amazon CloudWatch Logs to collect logs from its containerized applications running on Amazon ECS Fargate. The DevOps engineer wants to centralize logs from multiple services into a single CloudWatch Logs log group. They currently have a log group per service. Which approach minimizes operational overhead and cost?

Accepted Answer

Create a CloudWatch Logs subscription filter on each service log group to stream matching log events to a central log group.. The correct approach because CloudWatch Logs subscription filters can be used to forward log events from multiple source log groups to a central destination. Although subscription filters cannot send logs directly to another CloudWatch Logs group, they can deliver to a Lambda function, which then writes the logs into the central log group. This pattern uses native CloudWatch and Lambda, avoiding the overhead and cost of additional services like Kinesis or S3. It is a common minimal-overhead solution for centralizing logs from multiple ECS services.

Answer

Use Amazon Kinesis Data Firehose to stream logs from each log group to Amazon S3 and then to a central CloudWatch Logs group.

Answer

Export each log group to Amazon S3 and use Amazon Athena to query across all exported logs.

Answer

Modify the application logging configuration in each container to send logs to a single log group and log stream per container.

Question 7

A DevOps engineer needs to monitor the number of 4xx and 5xx HTTP errors returned by an Application Load Balancer (ALB). They want to set up a dashboard that shows the error count over the last 24 hours. Which CloudWatch metrics should they use?

Accepted Answer

Use the 'HTTPCode_Target_4XX_Count' and 'HTTPCode_Target_5XX_Count' metrics.. The correct metrics are 'HTTPCode_Target_4XX_Count' and 'HTTPCode_Target_5XX_Count', which track HTTP errors returned by the targets behind the Application Load Balancer. Option B is incorrect because 'RequestCount' does not have an 'ErrorCount' statistic. Option C is incorrect because 'HTTPCode_ELB_4XX_Count' and 'HTTPCode_ELB_5XX_Count' are load balancer-level metrics that track errors generated by the ALB itself (e.g., due to misconfiguration), not the errors returned by targets. Option D is incorrect because 'TargetResponseTime' measures latency, not error counts.

Answer

Use the 'RequestCount' metric with a statistic of 'ErrorCount'.

Answer

Use the 'HTTPCode_ELB_4XX_Count' and 'HTTPCode_ELB_5XX_Count' metrics.

Answer

Use the 'TargetResponseTime' metric and count the number of responses above 4 seconds.

Question 8

A company uses AWS Lambda functions to process incoming events. The DevOps team notices that some functions are timing out after 30 seconds, but the configured timeout is 1 minute. They want to capture the actual invocation duration for all invocations to analyze performance. What is the most efficient way to achieve this?

Accepted Answer

Enable detailed CloudWatch Logs for the Lambda functions and parse the 'REPORT' log entries to extract the 'Duration' value.. Lambda automatically writes a REPORT log entry to CloudWatch Logs at the end of each invocation, which includes the exact 'Duration' in milliseconds. Parsing these logs is the most efficient approach since it requires no code changes, no additional infrastructure, and leverages existing logging with no extra cost beyond standard CloudWatch Logs ingestion.

Answer

Add custom metrics using the AWS SDK within the Lambda function code to record the duration.

Answer

Configure Amazon Kinesis Data Streams to receive Lambda invocation records and compute duration using a consumer application.

Answer

Use AWS CloudTrail to capture Lambda execution events and analyze the 'duration' field.

Question 9

A company is running a production microservices architecture on Amazon ECS with Fargate. The operations team wants to set up centralized logging across all services, including the ability to search logs in near real-time and retain them for 3 years. The logs are currently sent to CloudWatch Logs. Which combination of services would meet these requirements with the least operational overhead?

Accepted Answer

Set a retention policy of 3 years on the CloudWatch Logs log groups and use CloudWatch Logs Insights for searching.. CloudWatch Logs supports near real-time search via CloudWatch Logs Insights and allows setting a retention policy of up to 10 years, which meets the 3-year retention requirement with minimal operational overhead since it's a managed service within AWS. Option A is wrong because Amazon OpenSearch Service adds operational overhead for cluster management and is not necessary for simple log search. Option C is wrong because exporting logs to S3 and querying with Athena introduces latency and is not near real-time. Option D is wrong because Kinesis Firehose to S3 lacks built-in search capabilities and would require additional services for querying, increasing complexity.

Answer

Stream logs to Amazon OpenSearch Service (Elasticsearch) using a CloudWatch Logs subscription filter.

Answer

Export logs to Amazon S3 and use Amazon Athena to query them.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon S3 with a 3-year lifecycle policy.

Question 10

A DevOps engineer is troubleshooting a slow API response. They suspect that the issue is related to database queries. The application runs on EC2 instances behind an ALB and uses Amazon RDS for MySQL. Which monitoring approach will provide the most granular insight into database query performance?

Accepted Answer

Enable Enhanced Monitoring and Performance Insights for the RDS instance.. Enhanced Monitoring provides OS-level metrics for the RDS instance, and Performance Insights offers detailed query-level performance data, enabling granular analysis of database query performance. Option A is incorrect because CloudWatch Logs for RDS captures logs (e.g., error log, slow query log) but does not provide real-time, query-level performance insights. Option B is incorrect because the CloudWatch agent on EC2 collects OS metrics (e.g., CPU, memory) but not database query-specific data. Option D is incorrect because 'TargetResponseTime' from the ALB measures overall application latency, not database query performance, and correlating it with 'CPUUtilization' only gives broad resource usage, not query-level details.

Answer

Enable CloudWatch Logs for the RDS instance and query the error log.

Answer

Install the CloudWatch agent on the EC2 instances to collect database performance counters.

Answer

Monitor the ALB's 'TargetResponseTime' metric and correlate with RDS 'CPUUtilization'.

Question 11

A DevOps team is deploying a new web application on AWS Elastic Beanstalk. They want to monitor the application's health and receive notifications when the environment's health status changes to 'Degraded' or 'Severe'. What is the simplest way to achieve this?

Accepted Answer

Create a CloudWatch alarm on the 'EnvironmentHealth' metric published by the Elastic Beanstalk environment.. The simplest way is to create a CloudWatch alarm on the 'EnvironmentHealth' metric that Elastic Beanstalk automatically publishes to CloudWatch (Option B). This allows you to receive notifications when health status changes to 'Degraded' or 'Severe'. Option A is not automated; manual checking is not effective. Option C adds unnecessary complexity with custom scripts and SES. Option D is incorrect because CloudTrail monitors API calls, not health status.

Answer

Use the Elastic Beanstalk management console to manually check the health status twice a day.

Answer

Write a custom script that polls the Elastic Beanstalk DescribeEnvironmentHealth API and sends an email using Amazon SES.

Answer

Configure an AWS CloudTrail trail to monitor Elastic Beanstalk API calls and create a CloudWatch alarm on the trail.

Question 12

A company wants to set up centralized logging for its multi-account AWS environment. The logs include CloudTrail, VPC Flow Logs, and Amazon Route 53 resolver query logs. Which TWO services should they use to achieve this with minimal operational overhead? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs. (CloudWatch Logs) and Option B (S3) are correct. CloudWatch Logs can aggregate logs from multiple AWS accounts using subscription filters or cross-account log grouping. S3 can serve as a central archive for all log types, including CloudTrail, VPC Flow Logs, and Route 53 resolver query logs, with minimal operational overhead. Option C (Kinesis Data Streams) is unnecessary because it adds complexity as an intermediate stream for this use case. Option D (OpenSearch Service) would require additional setup and management for indexing and visualization, increasing overhead. Option E (CloudTrail) only captures API activity and cannot centralize VPC Flow Logs or Route 53 resolver query logs.

Answer

Amazon Kinesis Data Streams

Answer

Amazon OpenSearch Service

Answer

AWS CloudTrail

Question 13

A DevOps engineer is setting up monitoring for an Amazon DynamoDB table that experiences high read traffic. They want to monitor the read capacity consumption and be alerted when the consumed read capacity exceeds 80% of the provisioned capacity for 5 consecutive minutes. Which TWO steps should they take? (Select TWO.)

Accepted Answer

Use CloudWatch to monitor the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics.. CloudWatch directly exposes the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics for DynamoDB, which are the exact metrics needed to calculate read capacity utilization. Monitoring these metrics allows the engineer to track how much of the provisioned capacity is being consumed over time, which is the foundation for setting up the desired alert.

Answer

Enable AWS CloudTrail to log DynamoDB read requests.

Answer

Set up an AWS Lambda function to monitor the DynamoDB ReadThrottleEvents metric.

Answer

Configure DynamoDB to stream all read events to CloudWatch Logs.

Question 14

A company uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team notices that some instances are failing health checks but are not being terminated by Auto Scaling. What should be investigated to resolve this issue?

Accepted Answer

Check the health check grace period setting in the Auto Scaling group. If it is too long, instances failing health checks may not be terminated quickly.. The health check grace period in an Auto Scaling group controls how long Auto Scaling waits before checking the health of a newly launched instance. If this grace period is set too long, instances that fail health checks before the grace period expires will not be terminated promptly, leading to the observed behavior where unhealthy instances remain in service even though they are failing health checks. The default grace period is 300 seconds, but if it is excessively long, it delays the termination of instances that fail health checks during that period.

Answer

Confirm that the load balancer's health check target is pointing to the correct port and path on the instances.

Answer

Ensure the instances are sending health check requests to the load balancer.

Answer

Verify that the security group for the instances allows inbound traffic from the load balancer on the health check port.

Question 15

A company is running a critical application on Amazon ECS with Fargate launch type. The application experiences periodic performance degradation. The DevOps team needs to set up monitoring to capture detailed metrics at a 1-second granularity. Which solution should be used?

Accepted Answer

Use Amazon CloudWatch Container Insights with high-resolution metrics.. Amazon CloudWatch Container Insights with high-resolution metrics provides detailed, 1-second granularity metrics for ECS tasks running on Fargate. Option A is incorrect because deploying a Prometheus server on EC2 to scrape metrics from ECS tasks is more complex and not a fully managed AWS solution; it would require additional setup and does not natively provide 1-second granularity out of the box. Option B is incorrect because CloudWatch detailed monitoring is typically used for EC2 instances and provides metrics at 1-minute granularity, not 1-second; for ECS, Container Insights is the appropriate service for high-resolution metrics. Option D is incorrect because VPC Flow Logs capture network traffic metadata, not application performance metrics, and thus cannot be used to monitor performance degradation.

Answer

Deploy a Prometheus server on Amazon EC2 and scrape metrics from the ECS tasks.

Answer

Enable CloudWatch detailed monitoring on the ECS service.

Answer

Enable VPC Flow Logs and analyze the logs with Amazon Athena.