DOP-C02 Monitoring and Logging Practice Test 5 — 15 Questions

Question 1

A company wants to collect and analyze logs from on-premises servers and send them to AWS for centralized monitoring. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Agent on the on-premises servers to send logs to Amazon CloudWatch Logs.. CloudWatch Agent collects logs from on-prem servers and sends to CloudWatch Logs. Option B is wrong because Kinesis Agent is for streaming data to Kinesis, not CloudWatch Logs directly. Option C is wrong because the unified CloudWatch Agent is the recommended tool. Option D is wrong because SSM Agent does not collect logs.

Answer

Amazon Kinesis Agent on the on-premises servers to send logs to Amazon Kinesis Data Firehose, then to Amazon S3.

Answer

Amazon CloudWatch Agent with the awslogs configuration to send logs to Amazon CloudWatch Logs.

Answer

AWS Systems Manager Agent to collect logs and send to Amazon CloudWatch Logs.

Question 2

A DevOps engineer is troubleshooting a slow-running Lambda function. The function processes messages from an SQS queue. Which CloudWatch metric should be examined first to determine if the function is experiencing throttling?

Accepted Answer

Throttles. The Throttles metric directly indicates when Lambda is rejecting invocation requests due to concurrency limits being reached. Since the question asks specifically about throttling, this is the first metric to examine to confirm whether the function is being rate-limited by AWS.

Answer

Invocations

Answer

ConcurrentExecutions

Answer

Duration

Question 3

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Which TWO steps must be taken to achieve this?

Accepted Answer

Add a statement to the KMS key policy that allows CloudWatch Logs to use the key.. To encrypt CloudWatch Logs at rest with a customer-managed KMS key, you must add a statement to the KMS key policy granting CloudWatch Logs permission to use the key (option B). Then, use the put-log-group-encryption API to associate the KMS key with the log group (option E). Option C is incorrect because CloudWatch Logs uses key policies, not grants. Option D is incorrect because you specify the key ARN at the log group level, not per log stream. Option A is incorrect because you do not need to recreate the log group; you can associate the key with an existing log group.

Answer

Recreate the log group after associating the key.

Answer

Create a KMS grant to allow CloudWatch Logs to use the key.

Answer

Specify the KMS key ARN when creating each log stream.

Question 4

A DevOps team is troubleshooting a slow website that uses Amazon CloudFront with an Application Load Balancer as the origin. The team notices that cache hit ratio is low. Which THREE actions are most likely to improve the cache hit ratio?

Accepted Answer

Enable CloudFront Origin Shield to reduce load on the origin and increase cache effectiveness.. CloudFront Origin Shield acts as an additional caching layer that consolidates requests from multiple edge locations, reducing the load on the origin and increasing the likelihood of cache hits by serving cached content from the Origin Shield regional cache. This improves cache effectiveness, especially for origins with high latency or limited capacity.

Answer

Configure CloudFront to forward all cookies to the origin.

Answer

Decrease the default TTL for objects.

Question 5

A company is using Amazon CloudWatch Logs to collect application logs. They need to search and analyze the logs in near real-time. Which TWO AWS services can be used to achieve this?

Accepted Answer

Amazon CloudWatch Logs Insights. A and E are correct: CloudWatch Logs Insights allows querying logs directly in CloudWatch Logs, and Amazon OpenSearch Service can ingest logs via a subscription filter for near real-time search and analysis. B (Synthetics) is for synthetic monitoring, not log analysis. C (Kinesis Data Analytics) processes streaming data but not directly from CloudWatch Logs without additional setup; it can analyze data from Kinesis streams but not directly query CloudWatch Logs. D (Athena) queries data in S3, not directly from CloudWatch Logs, so it is not suitable for near real-time analysis.

Answer

Amazon CloudWatch Synthetics

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Athena

Question 6

A company is running a production application on Amazon ECS with AWS Fargate. The application has unpredictable traffic patterns and occasionally experiences increased latency. The DevOps team needs to configure scaling based on a custom metric that tracks the number of active user sessions in real time. Which solution will allow the team to scale the ECS service based on this custom metric?

Accepted Answer

Publish the custom metric to Amazon CloudWatch, then create a target tracking scaling policy in Application Auto Scaling for the ECS service.. To scale an ECS service based on a custom metric like active user sessions, you can publish the metric to Amazon CloudWatch and then create a target tracking scaling policy in Application Auto Scaling for the ECS service. Application Auto Scaling uses the CloudWatch metric to automatically adjust the desired count. Option A is incorrect because AWS Auto Scaling is for EC2 Auto Scaling, not for ECS services; Application Auto Scaling is the correct service. Option B is incorrect because manual adjustment based on a dashboard does not provide automated scaling. Option D is incorrect because while a Lambda function could be used to update the desired count, it introduces unnecessary complexity and is not the recommended approach; using Application Auto Scaling with CloudWatch is the standard solution.

Answer

Use AWS Auto Scaling to scale the ECS service based on the custom metric.

Answer

Create a CloudWatch dashboard to visualize the metric and manually adjust the service count.

Answer

Use an AWS Lambda function to directly update the desired count of the ECS service based on the metric.

Question 7

A company is using Amazon RDS for PostgreSQL and wants to monitor the database for performance issues. They need to capture slow queries and analyze them over time. Which combination of AWS services should they use?

Accepted Answer

Enable RDS Performance Insights and Enhanced Monitoring.. RDS Performance Insights provides a database performance schema with detailed wait events and SQL-level metrics to identify slow queries, while Enhanced Monitoring offers OS-level metrics (CPU, memory, disk I/O) at sub-minute granularity. Together, they allow you to capture and analyze slow queries over time without additional log parsing or export overhead.

Answer

Enable RDS Event notifications to send alerts for performance issues.

Answer

Enable CloudWatch Logs for PostgreSQL and export logs to Amazon S3.

Answer

Use CloudWatch Metrics to monitor database connections and CPU utilization.

Question 8

A company uses AWS Lambda with an Amazon DynamoDB table to process high-volume clickstream data. The Lambda function writes the data to DynamoDB. Recently, the function has been experiencing throttling and timeouts during peak traffic. The DevOps team needs to set up monitoring to identify the root cause. Which combination of metrics should they analyze?

Accepted Answer

DynamoDB throttled write events and Lambda concurrent executions.. DynamoDB throttled write events and Lambda concurrent executions are directly related to the throttling and timeout issues. The throttled write events metric shows when DynamoDB is limiting write capacity, and Lambda concurrent executions indicate if the function is hitting its concurrency limit. Option B is wrong because read/write capacity metrics show provisioned vs consumed capacity but not throttling directly, and Lambda error count doesn't distinguish between timeout and other errors. Option C is wrong because Lambda invocations and duration don't reveal throttling causes. Option D is wrong because CloudWatch Logs and memory utilization are not primary indicators for throttling and timeouts.

Answer

DynamoDB read and write capacity metrics and Lambda error count.

Answer

CloudWatch metrics for Lambda invocations and duration.

Answer

CloudWatch Logs for Lambda function logs and Lambda memory utilization.

Question 9

A DevOps engineer is tasked with ensuring that all Amazon S3 buckets in the account have server access logging enabled. The engineer needs to be automatically notified when a new bucket is created without logging enabled. Which AWS service should they use?

Accepted Answer

Use AWS Config with a managed rule to check if S3 bucket logging is enabled, and configure an SNS topic for notifications.. AWS Config provides continuous monitoring and evaluation of your AWS resource configurations. By using the managed rule 's3-bucket-server-access-logging-enabled', AWS Config can automatically check all S3 buckets (including newly created ones) for server access logging. When a bucket is non-compliant, AWS Config can trigger an SNS notification to alert the DevOps engineer, meeting the requirement for automatic notification without custom code.

Answer

Use AWS CloudTrail to detect CreateBucket API calls and trigger a Lambda function to check logging.

Answer

Use AWS Trusted Advisor to check S3 bucket logging and send notifications via Amazon SNS.

Answer

Use Amazon S3 Event Notifications to trigger a Lambda function when a new bucket is created.

Question 10

A company is using Amazon CloudWatch Logs to collect logs from multiple EC2 instances. They need to filter logs in real time and send specific log events to a custom application for processing. Which TWO services can they use to achieve this?

Accepted Answer

Configure a CloudWatch Logs subscription filter that invokes an AWS Lambda function.. Correct: B (CloudWatch Logs subscription filter that invokes an AWS Lambda function) and D (CloudWatch Logs subscription filter that sends data to Amazon Kinesis Data Firehose). Both allow real-time filtering and forwarding of log events to a custom application. Option A is wrong because Kinesis Data Analytics is for analyzing streams, not forwarding. Option C is wrong because CloudWatch Events is for events and cannot directly filter log events from CloudWatch Logs. Option E is wrong because S3 event notifications are for object-level events, not real-time log filtering; also, logs are not automatically sent to S3 in real time.

Answer

Use Amazon Kinesis Data Analytics to process the log stream.

Answer

Create a CloudWatch Events rule to capture log events and send them to Amazon SQS.

Answer

Use Amazon S3 event notifications to trigger a Lambda function on new log files.

Question 11

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). They need to implement a monitoring strategy that provides detailed visibility into application performance, including request-level latency and error codes. Which THREE actions should they take?

Accepted Answer

Enable ALB access logs and store them in Amazon S3.. The correct actions are B, C, and E. Option B (ALB access logs) provides request-level latency and error codes. Option C (CloudWatch agent on EC2) captures application logs and custom metrics for deeper visibility. Option E (detailed CloudWatch metrics for ALB) includes RequestCount and TargetResponseTime, which are key for performance monitoring. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not application performance. Option D is incorrect because CloudTrail logs API calls to the ALB, not application metrics.

Answer

Enable VPC Flow Logs to capture traffic patterns.

Answer

Enable AWS CloudTrail to log API calls made to the load balancer.

Question 12

A DevOps engineer is setting up centralized logging for a multi-account environment using AWS Organizations. The engineer needs to aggregate logs from all accounts into a single Amazon S3 bucket. Which TWO steps are necessary?

Accepted Answer

Create a bucket policy on the central S3 bucket that grants permissions to the source accounts.. A bucket policy on the central S3 bucket can grant cross-account permissions to source accounts to write logs. This allows services like CloudTrail and VPC Flow Logs from member accounts to deliver logs directly to the central bucket without requiring IAM roles in each account for reading logs.

Answer

Create IAM roles in each account to allow the central bucket to read logs.

Answer

Enable CloudTrail organization trail in the management account to deliver logs to the central bucket.

Answer

Set up a cross-account subscription in CloudWatch Logs to forward logs to the central account.

Question 13

A company uses Amazon CloudWatch Synthetics canaries to monitor endpoint availability. The canaries are failing intermittently with timeout errors. The DevOps team needs to diagnose the issue. Which THREE aspects should they investigate?

Accepted Answer

The canary script execution time and memory usage.. Canary scripts have a maximum execution time of 5 minutes (300 seconds) and a memory limit of 1 GB. If the script execution time or memory usage exceeds these limits, the canary will fail with a timeout error. Investigating these metrics in CloudWatch can reveal whether the script is too resource-intensive or slow, causing the intermittent failures.

Answer

The canary schedule and frequency.

Answer

CloudWatch Logs retention policy for the canary logs.

Question 14

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance is unable to send logs to CloudWatch Logs. The log group 'MyAppLogs' exists in the same account and region. What is the most likely reason for the failure?

Accepted Answer

The policy is missing permissions to create log streams.. The policy only allows the logs:PutLogEvents action, but the application also needs permissions to create log streams (logs:CreateLogStream) and possibly describe them (logs:DescribeLogStreams). Since the log group exists, the first log delivery attempt requires creating a log stream, which is not allowed by the policy. Therefore, the most likely reason is that the policy is missing permissions to create log streams, making option D correct.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The log group does not exist in the specified region.

Answer

The policy does not allow the logs:PutLogEvents action.

Question 15

Refer to the exhibit. A DevOps engineer runs the AWS CLI command to get the average TargetResponseTime for an ALB over a 1-hour period. The output shows only three datapoints. What is the most likely reason?

Accepted Answer

The ALB did not receive any requests during most of the 5-minute periods.. The command uses a period of 300 seconds (5 minutes), so over a 1-hour period we expect 12 data points if the metric is consistently reported. However, TargetResponseTime is only emitted when the ALB receives at least one request in that interval. The output shows only three data points, indicating that for the majority of the 5-minute periods, the ALB received no requests, so no metric data was published. Option A correctly identifies this. Option B is incorrect because TargetResponseTime is a valid metric for Application Load Balancers. Option C is incorrect because the command appears to include the necessary parameters to retrieve the average. Option D is incorrect because a 300-second period is standard; using a smaller period would not produce more data points if there are no requests.

Answer

The metric TargetResponseTime is not available for Application Load Balancers.

Answer

The command is missing the 'Statistics' parameter with 'Average'.

Answer

The period of 300 seconds is too large; a smaller period should be used.