DOP-C02 Monitoring and Logging Practice Test 4 — 15 Questions

Question 1

A DevOps engineer needs to set up centralized logging for an application running on multiple EC2 instances across different AWS accounts. The logs must be aggregated in a single S3 bucket and also be analyzed in near real-time. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon Kinesis Data Firehose. Option B (CloudWatch Logs subscription) and Option D (Kinesis Data Firehose) are correct. CloudWatch Logs subscription can forward logs to Kinesis Data Firehose, which can then deliver to S3 in near real-time. Option A is wrong because CloudTrail is for API logs. Option C is wrong because Lambda alone cannot efficiently aggregate logs from multiple accounts. Option E is wrong because SQS is for decoupling, not for log aggregation.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Answer

AWS Lambda

Question 2

A company uses Amazon CloudWatch to monitor a fleet of EC2 instances. The DevOps team wants to receive notifications when the CPU utilization exceeds 90% for 5 minutes and also when the status check fails. Which THREE steps should be taken to set up these alerts?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 300 seconds and threshold 90. Options A, B, and D are correct. A creates an alarm for CPU utilization with a period of 300 seconds. B creates an alarm for StatusCheckFailed. D creates an SNS topic for notifications. Option C is wrong because you should create one alarm per metric. Option E is wrong because period of 60 seconds with 5 evaluation periods would trigger after 5 minutes only if each period is above threshold, but the requirement says 5 consecutive minutes, not necessarily 5 data points.

Answer

Set the CPUUtilization alarm with a period of 60 seconds and 5 evaluation periods

Answer

Create a single composite alarm that combines both conditions

Question 3

A company wants to ensure that all changes to its Amazon S3 bucket policies are logged for auditing purposes. Which TWO AWS services should be enabled to capture these changes?

Accepted Answer

AWS Config. Options B and D are correct. AWS Config records resource configuration changes, including bucket policies. CloudTrail records API calls like PutBucketPolicy. Option A is wrong because CloudWatch is not for auditing. Option C is wrong because VPC Flow Logs capture network traffic. Option E is wrong because GuardDuty is for threat detection.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 4

A company is using Amazon CloudWatch Logs to monitor application logs from EC2 instances. The DevOps engineer notices that some log entries are missing. The CloudWatch agent is installed and configured. What is the most likely cause of the missing log entries?

Accepted Answer

The CloudWatch agent's rate limit is set too low, causing log entries to be dropped.. If the CloudWatch agent cannot keep up with the log generation rate, it may drop entries. Option A is correct because the agent has a configurable rate limit. Option B is incorrect as CloudWatch Logs has no size limit on log events. Option C is incorrect because the default log group retention never expires. Option D is incorrect because the agent does not compress logs by default.

Answer

The CloudWatch agent is compressing logs before sending, causing some entries to be lost.

Answer

The log group retention policy is set to 1 day, and logs older than that are automatically deleted.

Answer

The log group's maximum size limit has been exceeded.

Question 5

A DevOps engineer is tasked with setting up a centralized logging solution for a multi-account AWS environment. Which service should be used to aggregate logs from multiple accounts?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription. Amazon CloudWatch Logs can aggregate logs across accounts using cross-account subscriptions with a central destination (e.g., Kinesis or Lambda). Option C is correct. Option A is incorrect because S3 is a storage service, not for real-time aggregation. Option B is incorrect as CloudTrail is for API activity, not application logs. Option D is incorrect because AWS Config is for configuration compliance.

Answer

Amazon S3 with cross-region replication

Answer

AWS CloudTrail with organization trails

Answer

AWS Config with aggregated compliance rules

Question 6

A company runs a critical application on Amazon ECS with Fargate. The DevOps engineer wants to receive alerts when the application's error rate exceeds 5% over a 5-minute period. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch Logs metric filter to count errors, then a CloudWatch alarm.. Amazon CloudWatch Logs can use metric filters to extract error counts from logs and create a custom metric. A CloudWatch alarm can then be set on the metric. Option B is correct. Option A is incorrect because CloudWatch Synthetics is for synthetic monitoring, not logs. Option C is incorrect because CloudWatch Contributor Insights analyzes top contributors, not error rate. Option D is incorrect because CloudWatch Logs Insights is a query tool, not for real-time alarms.

Answer

Amazon CloudWatch Synthetics to monitor the application endpoint and create an alarm.

Answer

Amazon CloudWatch Logs Insights to query logs every 5 minutes and trigger a Lambda function.

Answer

Amazon CloudWatch Contributor Insights to detect error patterns, then an alarm.

Question 7

A DevOps engineer is designing a monitoring solution for an application that runs on Amazon EC2 instances in an Auto Scaling group. The engineer needs to collect memory utilization metrics and visualize them in a dashboard. What should the engineer do?

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. Memory utilization is not available by default in CloudWatch. The CloudWatch agent must be installed to collect custom metrics. Option C is correct. Option A is incorrect because CloudWatch by default does not collect memory metrics. Option B is incorrect as a custom CloudWatch metric is needed, not a custom namespace without agent. Option D is incorrect because AWS CloudTrail does not capture memory metrics.

Answer

Create a custom CloudWatch metric namespace and publish memory data using the AWS CLI.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics.

Answer

Use AWS CloudTrail to capture memory utilization events from the EC2 instances.

Question 8

A company uses AWS X-Ray to trace requests through its microservices application. The DevOps engineer notices that some traces are incomplete. What is a possible reason?

Accepted Answer

The X-Ray SDK sampling rate is configured too low, causing many requests to be skipped.. Option C is correct because the X-Ray SDK uses a sampling rate to decide which requests to record. If the sampling rate is set too low, a large percentage of requests are skipped, leading to incomplete traces. The DevOps engineer would observe missing segments for requests that were not sampled, even though the daemon and SDK are functioning correctly.

Answer

The X-Ray daemon is not running on the application servers.

Answer

X-Ray cannot trace requests that cross multiple AWS services.

Answer

X-Ray requires the CloudWatch agent to be installed on all EC2 instances.

Question 9

A company is using Amazon CloudWatch Logs to store application logs. The DevOps engineer needs to ensure that log data is encrypted at rest using a customer-managed KMS key. What step must be taken?

Accepted Answer

Create a new KMS customer-managed key and associate it with the CloudWatch Logs log group.. Option C is correct because CloudWatch Logs supports encryption at rest using a customer-managed KMS key, which must be explicitly associated with the log group. When you create or update a log group, you can specify a KMS key ID (via the AWS CLI, SDK, or console) to encrypt all log data stored in that group. This ensures that the log data is encrypted using a key you control, not the default AWS-managed key.

Answer

Use AWS CloudTrail to encrypt the log data before it is sent to CloudWatch Logs.

Answer

Create a KMS key and apply it to the IAM role used by the application.

Answer

Enable server-side encryption on the log group using the default CloudWatch Logs key.

Question 10

A DevOps engineer is troubleshooting a production issue where an application's response time has increased. The application is deployed on Amazon ECS with Fargate. The engineer wants to identify which microservice is causing the latency. Which AWS service should be used?

Accepted Answer

AWS X-Ray to trace requests and analyze service latency.. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, allowing the engineer to pinpoint which service is introducing latency. By analyzing trace segments and subsegments, X-Ray can break down response times for each component in the application, directly addressing the need to identify the specific microservice causing the delay.

Answer

Amazon CloudWatch Synthetics canary to monitor the application endpoint.

Answer

Amazon CloudWatch Logs Insights to query application logs for errors.

Answer

Amazon CloudWatch ServiceLens to visualize service maps and traces.

Question 11

A company wants to receive notifications when an EC2 instance's CPU utilization exceeds 90% for 10 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch alarm. CloudWatch alarms monitor metrics and trigger actions like SNS notifications. Option A is correct. Option B is incorrect because Amazon Inspector is for security. Option C is incorrect because AWS Config tracks configuration changes. Option D is incorrect because CloudTrail records API activity.

Answer

AWS Config rule

Answer

AWS CloudTrail event

Answer

Amazon Inspector

Question 12

A company runs a containerized application on Amazon EKS. The DevOps engineer needs to collect application metrics and make them available in Amazon CloudWatch. Which solution should be used?

Accepted Answer

Install the Amazon CloudWatch agent as a DaemonSet on the EKS cluster.. The CloudWatch agent with the EKS add-on can collect container and application metrics and send them to CloudWatch. Option B is correct. Option A is incorrect because AWS Distro for OpenTelemetry can also send metrics but requires additional setup; CloudWatch agent is the recommended approach. Option C is incorrect because CloudWatch Container Insights requires the CloudWatch agent or a sidecar. Option D is incorrect because AWS X-Ray is for tracing, not metrics.

Answer

Use AWS X-Ray daemon to collect metrics and send them to CloudWatch.

Answer

Deploy the AWS Distro for OpenTelemetry collector on the EKS cluster.

Answer

Enable Amazon CloudWatch Container Insights using the AWS Management Console.

Question 13

A DevOps engineer needs to set up a monitoring solution that can detect and alert on unusual patterns in application metrics. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Anomaly Detection creates a model of expected metric behavior and alerts on anomalies. CloudWatch alarms can then trigger actions. Option A and D are correct. Option B is incorrect because AWS Config is for configuration compliance. Option C is incorrect because AWS CloudTrail is for API auditing. Option E is incorrect because Amazon GuardDuty is for security threats.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 14

A company wants to centralize logging from multiple AWS accounts and regions. The logs should be stored in a central S3 bucket for compliance. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Create an S3 bucket in the central account with appropriate bucket policy granting permissions to CloudTrail.. Option B is correct because to centralize logs from multiple accounts into a single S3 bucket, the bucket in the central account must have a bucket policy that explicitly grants the necessary permissions (e.g., `s3:PutObject`) to the CloudTrail service principal (`cloudtrail.amazonaws.com`) from each source account. This policy allows CloudTrail in the source accounts to write log files directly into the central bucket, enabling centralized storage for compliance.

Answer

Create a cross-account subscription in Amazon CloudWatch Logs to stream logs to the central account.

Answer

Turn on CloudTrail data events for all S3 and Lambda resources.

Question 15

A DevOps engineer is investigating a performance issue in a serverless application using AWS Lambda. The engineer wants to view the duration of each invocation and identify cold starts. Which TWO AWS services should be used? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Metrics for Lambda (duration, invocations). Amazon CloudWatch Metrics for Lambda (option A) provides built-in metrics such as duration and invocations, which are essential for analyzing performance trends and identifying slow invocations. AWS X-Ray (option B) traces individual requests through the Lambda function and can explicitly detect cold starts by showing the initialization phase duration, making it the correct complementary service.

Answer

AWS X-Ray to trace invocations and detect cold starts

Answer

AWS CloudTrail to record Lambda API calls

Answer

AWS Config to track Lambda configuration changes