DOP-C02 Monitoring and Logging Practice Test 5 — 15 Questions

Question 1

A DevOps engineer is setting up monitoring for an Amazon RDS for PostgreSQL instance. The engineer wants to track the number of active database connections over time to plan for scaling. Which approach should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Enhanced Monitoring and view the 'DatabaseConnections' metric in CloudWatch.. The DatabaseConnections metric is a default CloudWatch metric that RDS publishes automatically for every instance (visible under the RDS namespace) at 1- or 5-minute granularity, with no need to enable Enhanced Monitoring. Enhanced Monitoring is a separate feature that installs an OS-level agent to report metrics like CPU, memory, swap, and process list from the underlying host -- it does not provide the DatabaseConnections metric. To track active connections over time for capacity planning, the engineer should simply view the existing DatabaseConnections metric in CloudWatch (optionally with an alarm or dashboard), which requires no additional configuration.

Answer

Configure CloudWatch Logs to monitor the PostgreSQL error log for connection entries.

Answer

Enable RDS event subscriptions to receive notifications about connection changes.

Answer

Use Performance Insights to view the number of active connections.

Question 2

A company is using AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when stack operations fail. They create an Amazon SNS topic and subscribe the team's email. Then they configure CloudFormation to send notifications to the SNS topic. However, no notifications are received when a stack creation fails. What is the MOST likely reason?

Accepted Answer

The CloudFormation stack was created without specifying the SNS topic ARN in the 'NotificationARNs' parameter.. CloudFormation sends notifications to the SNS topic only if the topic ARN is specified in the stack's 'NotificationARNs' parameter. Option A is incorrect because CloudFormation can send notifications to any SNS topic. Option B is incorrect because email subscriptions must be confirmed, but that is done when subscribing. Option C is incorrect because SNS does not require IAM roles for CloudFormation to publish.

Answer

The SNS topic does not have an IAM policy allowing CloudFormation to publish.

Answer

The email subscription to the SNS topic has not been confirmed.

Answer

The SNS topic is in a different AWS Region.

Question 3

A DevOps engineer is investigating a performance issue with an Amazon RDS for MySQL instance. The engineer has enabled Performance Insights and CloudWatch Enhanced Monitoring. Which THREE metrics should the engineer examine to identify whether the issue is due to a resource bottleneck? (Choose THREE.)

Accepted Answer

FreeableMemory from Enhanced Monitoring.. Option B, FreeableMemory from Enhanced Monitoring, is correct because it shows the amount of available RAM on the DB instance; a steadily shrinking value indicates memory pressure that can force swapping or excessive buffer pool eviction, a classic resource bottleneck. Option C, CPUUtilization from Enhanced Monitoring, is correct because sustained high CPU usage on the RDS instance points to compute saturation from query processing, sorting, or connection overhead. Option D, ReadIOPS from Enhanced Monitoring, is correct because elevated read I/O operations per second reveal storage throughput pressure that can throttle query performance. Option A, ReadLatency from CloudWatch, is not among the marked answers because it measures the symptom (slow reads) rather than directly identifying which underlying resource is bottlenecked. Option E, DatabaseConnections from Enhanced Monitoring, is not marked because connection count indicates workload/concurrency level, not a specific resource bottleneck like CPU, memory, or disk I/O.

Answer

ReadLatency from CloudWatch.

Answer

DatabaseConnections from Enhanced Monitoring.

Question 4

A company runs a critical application on Amazon ECS with Fargate. The DevOps team wants to set up a metric to track the number of tasks running. Which TWO steps are required to achieve this? (Choose TWO.)

Accepted Answer

Create a CloudWatch alarm on the 'RunningTaskCount' metric.. Option C is correct because enabling Container Insights on the ECS cluster is what causes ECS to publish the task-level metrics, including RunningTaskCount, to CloudWatch under the ECS/ContainerInsights namespace; without it those metrics are not emitted for Fargate tasks. Option A is correct because once the RunningTaskCount metric is available, you create a CloudWatch alarm on that metric to monitor and alert on the number of running tasks, which is the stated goal of tracking the task count. Option B is not needed because Container Insights metrics are collected by the ECS/Fargate platform itself, not by installing the CloudWatch agent inside the task containers. Option D is wrong because a CloudWatch Logs subscription filter processes log events, not task counts, and cannot produce a running-task metric. Option E is wrong because service auto scaling adjusts desired task count based on a scaling policy; it does not create the metric used to track running tasks.

Answer

Install the CloudWatch agent on the task containers.

Answer

Configure a CloudWatch Logs subscription filter to count tasks.

Answer

Create a service auto scaling target for the ECS service.

Question 5

A DevOps engineer is troubleshooting why an AWS Lambda function is not writing logs to the CloudWatch Logs log group 'MyAppLogs'. The Lambda function's execution role includes the IAM policy shown in the exhibit. What is the MOST likely reason the logs are not being written?

Accepted Answer

The policy does not grant permission to create the log group or put log events to the log group itself.. The most likely reason is that the execution role's policy does not include the permissions needed to create the log group or write log events to it — specifically logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents scoped to the correct log group ARN. Without these, Lambda cannot emit logs even though the function runs. The exhibit's policy evidently omits or mis-scopes these actions.

Answer

The log group is in a different AWS Region.

Answer

The policy has an incorrect action name.

Answer

The policy is missing the 'logs:CreateLogGroup' action.

Question 6

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The operations team notices that the application's error rate has increased significantly in the last 30 minutes, but they are unable to identify the root cause because the metrics are aggregated across all instances. Which solution would provide the MOST granular visibility into individual instance performance?

Accepted Answer

Enable ALB access logs and store them in Amazon S3 for analysis.. Detailed monitoring on EC2 instances provides 1-minute CloudWatch metrics per instance, enabling granular visibility into individual instance performance, which is essential for identifying the root cause of increased error rates. Option A is incorrect because a CloudWatch dashboard aggregates metrics across all instances and does not provide per-instance granularity. Option C is incorrect because VPC Flow Logs capture network traffic metadata (source/destination IPs, ports, etc.) and not application error metrics. Option D is incorrect because ALB access logs provide request-level data but require additional analysis to extract per-instance error rates and are not real-time.

Answer

Create a CloudWatch dashboard to visualize the error metrics across all instances.

Answer

Enable detailed monitoring on the EC2 instances to get 1-minute CloudWatch metrics.

Answer

Enable VPC Flow Logs to capture traffic to each instance.

Question 7

Refer to the exhibit. An AWS Lambda function has the IAM policy shown. The function is intended to write logs to CloudWatch Logs and publish custom metrics to CloudWatch. However, the function is failing to publish custom metrics. What is the MOST likely cause?

Accepted Answer

The function's execution role is missing the necessary trust policy to allow Lambda to assume the role.. Given the exhibit's identity-based policy already grants cloudwatch:PutMetricData with Resource '*', and the stem states logging succeeds while only metrics publishing fails, a missing trust policy (option D) cannot be the cause -- that would break log writes too. As written, none of the four options is consistent with both the exhibit and the stem's selective-failure premise; the question needs either a different exhibit (showing a trust policy problem) or a stem that doesn't claim logging already works, or a correct option addressing something metrics-specific (e.g. a service control policy, a missing PutMetricData scoped condition, or a region/account mismatch) that isn't currently offered.

Answer

The function does not have permission to perform logs:PutLogEvents for the specific log stream.

Answer

The function does not have permission to perform cloudwatch:PutMetricData.

Answer

The function is trying to put metrics to a CloudWatch namespace that is not allowed by the resource constraint.

Question 8

A DevOps engineer needs to set up a centralized logging solution for multiple AWS accounts. The logs must be stored in a central Amazon S3 bucket for long-term retention and analysis. Which combination of services should the engineer use?

Accepted Answer

Use Amazon CloudWatch Logs and Amazon Kinesis Data Firehose to deliver logs to the central S3 bucket.. Amazon CloudWatch Logs centralizes log data from multiple accounts, and Amazon Kinesis Data Firehose can deliver that data to a central Amazon S3 bucket for long-term retention. This combination supports cross-account log aggregation, where CloudWatch Logs from each account are streamed via subscription filters to a Firehose delivery stream in the central account, which then writes to S3. This is the standard pattern for centralized logging with S3 as the destination.

Answer

Use AWS CloudTrail to deliver logs to the central S3 bucket.

Answer

Use Amazon Athena and Amazon QuickSight to query logs across accounts.

Answer

Use Amazon VPC Flow Logs to send logs to the central S3 bucket.

Question 9

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team wants to collect and visualize metrics such as CPU, memory, and network utilization at the task level. Which TWO services should the team use to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. (Amazon CloudWatch) and Option E (Amazon CloudWatch Container Insights) are correct. Container Insights collects metrics from ECS tasks running on Fargate, and CloudWatch stores and visualizes them via dashboards. Option A (Amazon Managed Service for Prometheus) is a monitoring service but not the standard integrated solution for ECS Fargate metrics; Container Insights is the recommended approach. Option B (Amazon CloudWatch Logs) is for logs, not metrics. Option D (AWS X-Ray) is for tracing.

Answer

Amazon Managed Service for Prometheus

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 10

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that all logs be encrypted at rest using a customer-managed AWS KMS key. Which THREE steps are necessary to meet this requirement? (Choose THREE.)

Accepted Answer

Grant the IAM role used by the application to write logs permission to use the KMS key (kms:Encrypt, kms:Decrypt).. Option C is correct because a customer-managed KMS key must be created in the same AWS Region as the CloudWatch Logs log group to be usable for encrypting that log group's data at rest. Option B is correct because CloudWatch Logs encryption is configured at the log group level by associating the KMS key ARN with the log group (via the AWS CLI associate-kms-key command or console setting), which causes log data to be encrypted with that key. Option A is correct because the IAM principal (such as the application's role) that writes log events must have kms:Encrypt and kms:Decrypt permissions on the key, otherwise CloudWatch Logs cannot encrypt or decrypt the log data on its behalf. Option D is incorrect because encryption is applied at the log group level, not per log stream, so there is no separate per-stream encryption setting. Option E is incorrect because server-side encryption on an S3 bucket only protects logs exported to S3 and does not encrypt the logs stored in CloudWatch Logs itself.

Answer

Enable encryption on each log stream individually.

Answer

Enable server-side encryption on the Amazon S3 bucket where logs are exported.

Question 11

A company is using AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that all CloudTrail logs are delivered to a central Amazon S3 bucket and that the logs are encrypted and cannot be deleted. Which THREE steps should the team take to meet these requirements? (Choose THREE.)

Accepted Answer

Enable default encryption (SSE-S3) on the central S3 bucket.. Option B is correct because enabling default encryption with SSE-S3 on the central S3 bucket ensures every CloudTrail log object delivered to that bucket is automatically encrypted at rest without requiring per-object encryption headers. Option C is correct because S3 Object Lock, typically in compliance mode with a retention period, provides WORM protection that prevents CloudTrail log files from being deleted or overwritten, directly satisfying the requirement that logs cannot be deleted. Option E is correct because CloudTrail log file validation generates digest files that let the security team verify that log files have not been altered or tampered with after delivery, ensuring log integrity across the multi-account trail. Option A is not among the marked correct answers and, while MFA Delete adds protection against unauthorized deletion, it does not by itself guarantee logs cannot be deleted and is not required by the stated scenario. Option D is not marked correct because CloudTrail log file integrity is enabled through log file validation, not by using AWS KMS; KMS is used for SSE-KMS encryption of logs, which is a separate concern.

Answer

Enable MFA Delete on the central S3 bucket to require multi-factor authentication for deletions.

Answer

Enable CloudTrail log file integrity by using AWS KMS.

Question 12

A DevOps engineer is responsible for monitoring an AWS environment that includes multiple EC2 instances running a web application. The engineer needs to set up a solution that sends an email alert when the average CPU utilization across all instances exceeds 80% for 10 consecutive minutes. The engineer has created a CloudWatch alarm with the metric `CPUUtilization` aggregated across all instances using the statistic `Average` and a period of 5 minutes. The alarm is set to trigger when the metric exceeds 80% for 2 consecutive periods (10 minutes). The alarm's action is configured to send a notification to an Amazon SNS topic that has an email subscription. However, the engineer is not receiving the email alerts. The engineer verified that the SNS topic exists and the email subscription is confirmed. The CloudWatch alarm shows that the metric value exceeded the threshold for 2 periods, but the alarm state is still 'OK'. What is the MOST likely reason for this?

Accepted Answer

The CloudWatch alarm requires 2 consecutive evaluation periods with the metric exceeding the threshold, but the alarm is still evaluating because of insufficient data points.. The most likely reason is that the alarm is still evaluating because of insufficient data points — CloudWatch alarms require a minimum number of data points before they can transition to ALARM state. Even though the metric exceeded the threshold for 2 periods, if some periods had missing data (e.g., due to instances not publishing metrics consistently), the alarm may not have enough data points to evaluate the 2 consecutive periods. The alarm remains in OK state until it has sufficient data to confirm the breach.

Answer

The email subscription is not confirmed.

Answer

The metric `CPUUtilization` is not being published to CloudWatch.

Answer

The SNS topic is not configured to allow CloudWatch to publish to it.

Question 13

A DevOps engineer notices that a critical Lambda function occasionally times out. The engineer wants to monitor the function's duration and log the timeout errors for analysis. Which TWO steps should the engineer take to achieve this? (Select TWO.)

Accepted Answer

Enable CloudWatch Logs for the Lambda function to capture logs.. Option A is correct because Lambda automatically sends function logs (including timeout errors reported as "Task timed out after X seconds") to a CloudWatch Logs log group, so enabling/using CloudWatch Logs is the way to capture those timeout errors for analysis. Option D is correct because AWS X-Ray traces Lambda invocations end-to-end, recording subsegment timings and the function's duration so the engineer can pinpoint where the function spends time and why it occasionally exceeds its timeout. Option B is wrong because Lambda does not natively stream logs to S3; S3 storage would require an export or subscription pipeline and is not a monitoring step. Option C is wrong because the Duration metric is already emitted by Lambda to CloudWatch, so a metric filter is unnecessary (metric filters are for extracting values from log events), and an alarm alone does not log timeout errors. Option E is wrong because CloudTrail records control-plane API activity (e.g., UpdateFunctionConfiguration), not per-invocation execution details or timeout errors.

Answer

Store Lambda logs in an Amazon S3 bucket for analysis.

Answer

Create a CloudWatch metric filter to monitor the Duration metric and set an alarm.

Answer

Enable AWS CloudTrail to log all Lambda function invocations.

Question 14

A company has a microservices architecture running on Amazon ECS with Fargate. The operations team uses Amazon CloudWatch Container Insights to monitor the cluster. They notice that one of the services is experiencing high memory utilization, causing occasional task failures. The team wants to set up proactive monitoring to receive alerts when memory utilization exceeds 80% for more than 5 minutes. They also want to automate the response by replacing the failing tasks. The team has already created a CloudWatch alarm on the MemoryUtilized metric. Which additional steps should the team take to achieve the desired proactive monitoring and automated response?

Accepted Answer

Configure the CloudWatch alarm to trigger an Auto Scaling action that increases the desired count of the service to replace failing tasks.. The team already has a CloudWatch alarm on MemoryUtilized, so the remaining step is to wire that alarm to an automated scaling action. Configuring the alarm to trigger an Application Auto Scaling action that increases the service's desired count replaces failing tasks and adds capacity. This is the standard proactive response for ECS Fargate memory pressure.

Answer

Use CloudWatch Logs Insights to run queries on the task logs to identify the cause of high memory.

Answer

Create a CloudWatch Events rule that triggers an AWS Lambda function to restart the tasks when the alarm state changes.

Answer

Enable AWS CloudTrail to log all ECS API calls to audit the task failures.

Question 15

Refer to the exhibit. A security engineer runs this AWS Config query. What is the intended purpose?

Accepted Answer

Find all t2 instances that are not using approved AMIs.. The AWS Config query shown uses a SQL-like syntax to select resources where resourceType = 'AWS::EC2::Instance' and includes a filter on instanceType = 't2.micro' and a check for approved AMIs. The query likely uses a NOT IN or similar clause to find t2 instances that are not using approved AMIs. The intended purpose is to identify non-compliant t2 instances.

Answer

Find all resources that are not approved.

Answer

Find all t2 instances that are using approved AMIs.

Answer

Find all instances regardless of type that are not using approved AMIs.