DOP-C02 Monitoring and Logging Practice Test 6 — 15 Questions

Question 1

A company is running a production web application on Auto Scaling EC2 instances behind an ALB. They have enabled detailed CloudWatch metrics on the EC2 instances and enabled CloudTrail. Recently, users reported intermittent 503 errors. The operations team reviews CloudWatch dashboards but sees no spike in CPU or memory. What is the MOST likely cause of the 503 errors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The target group has an insufficient number of healthy instances due to health check failures. 503 errors from an ALB typically occur when the target group has no healthy instances to forward requests to. Health check failures can cause instances to be marked unhealthy without triggering CPU or memory spikes on the remaining instances, which explains why the operations team saw no resource spikes. Option A is wrong because CloudTrail records API calls, not HTTP response codes. Option C is wrong because the question states detailed monitoring is already enabled, and disabling it would affect metric availability, not directly cause 503 errors. Option D is wrong because a misconfigured security group would result in timeout errors (504) or connection failures, not 503s.

Answer

Insufficient CloudTrail logging trail configuration

Answer

Detailed monitoring is disabled for the EC2 instances

Answer

The security group for the ALB is misconfigured

Question 2

A company wants to monitor CPU utilization of its EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms are the appropriate service to monitor CPU utilization metrics and trigger an alert when utilization exceeds 80% for 5 consecutive minutes. CloudWatch Alarms can be set on the CPUUtilization metric of EC2 instances to take actions such as sending notifications. Option A (AWS CloudTrail) is incorrect because it logs API calls, not performance metrics. Option B (VPC Flow Logs) captures network traffic information, not CPU usage. Option D (AWS Config) tracks resource configuration changes, not real-time utilization.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 3

A company runs a containerized microservices application on Amazon ECS with Fargate. The operations team wants to collect custom application metrics (e.g., request latency, error counts) and send them to CloudWatch. The team wants to avoid managing any servers or agents. Which solution meets these requirements?

Accepted Answer

Use the CloudWatch Embedded Metric Format to emit metrics from the application code as structured logs. The CloudWatch Embedded Metric Format (EMF) allows applications to output structured JSON logs that CloudWatch automatically converts to metrics, and Fargate tasks can output logs to CloudWatch Logs without an agent. Option A is wrong because the CloudWatch Agent requires running on EC2 or on-premises, not Fargate. Option C is wrong because CloudTrail records API calls, not custom application metrics. Option D is wrong because while StatsD can collect custom metrics, running it in a sidecar container on Fargate would still require managing a container, and the requirement is to avoid managing any servers or agents.

Answer

Install the CloudWatch Agent in the container image and configure it to collect custom metrics

Answer

Enable AWS CloudTrail for the ECS service to capture API calls and derive metrics

Answer

Run a StatsD daemon in a sidecar container and configure it to forward metrics to CloudWatch

Question 4

A company runs a fleet of EC2 instances behind an Auto Scaling group. The DevOps team wants to detect and respond to memory leaks in their application. They have configured CloudWatch agent to collect memory metrics. However, the metric shows unpredictable spikes. The team needs to correlate these spikes with application logs to identify the root cause. Which solution provides the BEST correlation?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns around the time of memory spikes. CloudWatch Logs Insights allows you to query application logs directly in CloudWatch Logs using a purpose-built query language. By filtering logs around the timestamps of memory spikes, you can correlate specific error patterns or log entries with the metric data, enabling root cause analysis without moving data or adding complexity.

Answer

Export the memory metric and application logs to Amazon S3 and use Amazon Athena to join them

Answer

Enable AWS X-Ray on the application to trace requests and identify memory-heavy requests

Answer

Use Amazon EventBridge to capture EC2 instance state changes and correlate with memory spikes

Question 5

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an Auto Scaling policy to add more EC2 instances when the queue depth exceeds a threshold. Which CloudWatch metric should the alarm use?

Accepted Answer

ApproximateNumberOfMessagesVisible. (ApproximateNumberOfMessagesVisible) is the correct metric because it represents the number of messages available to be retrieved from the queue. When this number exceeds a threshold, it indicates that consumer EC2 instances are not keeping up, so an Auto Scaling policy can add more instances to handle the load. Option A (NumberOfMessagesSent) is a count of messages sent, not the current queue depth. Option B (ApproximateNumberOfMessagesNotVisible) represents messages that are in flight (being processed) and not available for retrieval. Option D (SentMessageSize) is the size of messages sent, not the count. Therefore, C is correct.

Answer

NumberOfMessagesSent

Answer

ApproximateNumberOfMessagesNotVisible

Answer

SentMessageSize

Question 6

A DevOps engineer executes the above CloudWatch Logs Insights query. What will the output contain?

Accepted Answer

The count of ERROR messages per 5-minute interval for the most recent 20 intervals. The CloudWatch Logs Insights query filters for log entries containing 'ERROR', then uses the `stats count() by bin(5m)` command to count the number of ERROR messages per 5-minute interval, orders the results by bin timestamp in descending order, and limits the output to 20 rows, thus returning the count of ERROR messages per 5-minute interval for the most recent 20 intervals. Option A is incorrect because the bin interval is 5 minutes, not 1 minute. Option C is incorrect because the query bins the counts into intervals rather than returning a single total count. Option D is incorrect because the query produces aggregated counts, not a list of individual log entries.

Answer

The count of ERROR messages per 1-minute interval for the most recent 20 intervals

Answer

The total count of ERROR messages in the log group

Answer

A list of the 20 most recent log entries that contain the word 'ERROR'

Question 7

A company is deploying a new microservice on AWS Lambda. The DevOps team needs to monitor the function for errors and performance issues. Which TWO steps should the team take to set up effective monitoring?

Accepted Answer

Enable active tracing with AWS X-Ray to trace requests through the function. AWS X-Ray provides end-to-end tracing for requests, allowing you to identify performance bottlenecks and errors in Lambda functions. Option D is correct because Lambda automatically sends logs to CloudWatch Logs, which capture application output, errors, and custom logging. Option A is incorrect: VPC Flow Logs monitor network traffic at the VPC level, not Lambda function internals. Option B is incorrect: AWS Config evaluates resource configurations for compliance, not for function monitoring. Option E is incorrect: The CloudWatch Agent is for EC2 or on-premises servers; Lambda already integrates with CloudWatch Logs natively.

Answer

Enable VPC Flow Logs to monitor network traffic to the function

Answer

Enable AWS Config rules to evaluate the function configuration

Answer

Install the CloudWatch Agent on the Lambda execution environment

Question 8

A company runs a critical application on Amazon ECS with Fargate. The application emits structured logs in JSON format. The DevOps team wants to monitor for specific error codes and receive near-real-time alerts. The team also needs to retain logs for 5 years for compliance. Which TWO steps should the team implement?

Accepted Answer

Create a CloudWatch Logs metric filter to count occurrences of specific error codes and create an alarm. CloudWatch Logs metric filters can parse JSON-structured logs to count occurrences of specific error codes, and you can create a CloudWatch alarm on that metric to trigger near-real-time notifications via SNS. This is a native, low-latency solution for monitoring specific patterns in ECS Fargate logs without additional infrastructure.

Answer

Use Amazon Kinesis Data Analytics to analyze logs in real-time and send alerts

Answer

Enable AWS CloudTrail to log the application's API calls

Answer

Stream logs to Amazon S3 via Amazon Kinesis Data Firehose and use S3 event notifications to trigger alerts

Question 9

A DevOps engineer is designing a monitoring solution for a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), EC2 instances, and an RDS database. The engineer needs to capture and analyze HTTP request logs from the ALB to understand client behavior and troubleshoot errors. Which THREE steps are necessary to achieve this?

Accepted Answer

Use Amazon Athena to query the access logs in S3. Options C, D, and E are correct because to capture and analyze HTTP request logs from an ALB, you must first enable access logs on the ALB (D), specify an S3 bucket to store them (E), and then you can use Amazon Athena to query the logs directly from S3 (C). Option A is wrong because the CloudWatch Agent is not needed; ALB access logs are stored directly in S3, not sent to CloudWatch. Option B is wrong because CloudTrail captures API calls to AWS services, not HTTP requests to the ALB.

Answer

Install the CloudWatch Agent on the ALB

Answer

Enable AWS CloudTrail for the ALB

Question 10

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances run a custom Java application that uses an RDS for MySQL database and an ElastiCache Redis cluster for session caching. The DevOps team has set up CloudWatch alarms for CPU utilization, memory, and database connections. Recently, customers have been reporting slow page load times and occasional timeouts. The team notices that during peak hours, the ALB's TargetResponseTime metric spikes, and the number of healthy hosts in the target group fluctuates. The CPU and memory metrics on the EC2 instances remain within normal ranges. The database CPU is also normal. The team suspects the issue is related to the application's session management. Which course of action should the DevOps team take to identify the root cause?

Accepted Answer

Monitor ElastiCache metrics such as CPUUtilization, CacheHits, and Evictions to determine if the Redis cluster is overloaded. The symptoms (increased latency, fluctuating healthy hosts) and the role of ElastiCache in session caching suggest that Redis performance may be degrading. Monitoring ElastiCache metrics like CPUUtilization, cache hits/misses, and evictions can confirm if Redis is the bottleneck. Option A is incorrect because RDS Performance Insights focuses on database queries, but the database CPU is normal and the issue is likely at the cache layer. Option B is incorrect because the CloudWatch Agent collects OS-level metrics (e.g., memory, disk), which would not directly reveal Redis overload; Redis metrics are available through ElastiCache. Option D is incorrect because increasing ALB targets and adjusting health check intervals does not address the root cause of session management issues; it only masks the symptom of fluctuating healthy hosts.

Answer

Enable RDS Performance Insights and look for slow queries or connection storms

Answer

Install the CloudWatch Agent on the EC2 instances to collect additional application-level metrics

Answer

Increase the number of ALB targets and adjust the target group health check interval

Question 11

A company runs a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is used by thousands of users. Recently, the operations team noticed an increase in 5xx errors from API Gateway. The team has enabled CloudWatch Logs for the Lambda functions and API Gateway. They see the errors are sporadic and not correlated with high traffic. The Lambda function's error count in CloudWatch is also increasing. The team wants to identify the specific requests that are failing and understand the error details. Which solution should the team implement?

Accepted Answer

Enable AWS X-Ray active tracing on the Lambda functions and API Gateway to capture detailed request traces and error details. AWS X-Ray provides end-to-end tracing for requests through API Gateway and Lambda, capturing error details and metadata for individual requests. This allows the team to identify specific failing requests and understand error causes. Option A is wrong because CloudWatch Logs Insights can query logs, but it lacks automated tracing and correlation for distributed requests, making it less efficient. Option B is wrong because VPC Flow Logs capture network traffic metadata, not application-level errors. Option D is wrong because CloudTrail logs API calls at the AWS account level, not application request details.

Answer

Use CloudWatch Logs Insights to query the Lambda logs for ERROR messages and correlate with API Gateway logs

Answer

Enable VPC Flow Logs for the Lambda function's VPC to capture network traffic

Answer

Enable AWS CloudTrail to log API Gateway API calls and analyze the logs

Question 12

A DevOps engineer is troubleshooting a production issue where an Application Load Balancer (ALB) is returning 503 errors. The ALB targets are EC2 instances in an Auto Scaling group behind the ALB. The engineer checks the ALB access logs in Amazon S3 and finds that the ALB is healthy. However, the 503 errors persist. Which configuration should the engineer check next?

Accepted Answer

Check the security groups for the EC2 instances to ensure they allow traffic from the ALB on the listener port.. 503 errors often indicate that the ALB cannot establish a connection to the targets. The most common cause is that the security groups attached to the EC2 instances are not allowing inbound traffic from the ALB on the listener port. Option A is incorrect because AWS Shield Advanced is a DDoS protection service; the ALB being healthy in logs suggests no DDoS attack is causing the 503 errors. Option B is incorrect because an expired SSL certificate would cause different errors (e.g., 502 or handshake failures), not 503. Option D is incorrect because checking health check settings is a valid troubleshooting step, but since the engineer already verified the ALB is healthy in access logs (meaning the ALB itself is operational), the immediate next step should be to verify security groups, which are a common cause of connectivity issues.

Answer

Enable AWS Shield Advanced to protect the ALB from DDoS attacks.

Answer

Verify that the SSL certificate associated with the ALB is not expired.

Answer

Check the ALB's target group health check settings and verify that the health check path is correct.

Question 13

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team wants to collect custom application metrics (e.g., request latency per service) and visualize them in CloudWatch dashboards. The team also needs to set CloudWatch alarms based on these metrics. Which solution requires the LEAST amount of code changes and operational overhead?

Accepted Answer

Use the CloudWatch Embedded Metric Format to emit custom metrics as JSON log entries.. The CloudWatch Embedded Metric Format allows applications to emit metrics as structured JSON logs, which CloudWatch automatically extracts into metrics and logs. This requires minimal code changes (just log format). Option B is wrong because publishing to CloudWatch via PutMetricData requires the AWS SDK and more code changes. Option C is wrong because CloudWatch Agent on Fargate is not supported (requires EC2). Option D is wrong because using a sidecar container for StatsD adds complexity and overhead.

Answer

Deploy a StatsD daemon as a sidecar container and configure the application to send metrics to StatsD, then forward to CloudWatch.

Answer

Modify the application code to use the AWS SDK to call PutMetricData API directly.

Answer

Install the CloudWatch Agent on each Fargate task as a sidecar container to collect custom metrics.

Question 14

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that any changes to CloudTrail configuration (such as disabling the trail or modifying the log file validation) are immediately detected and trigger an automated response. Which solution should the DevOps engineer implement?

Accepted Answer

Create an Amazon EventBridge rule that matches CloudTrail API calls like StopLogging or UpdateTrail and triggers an SNS topic.. AWS CloudTrail logs are delivered to an S3 bucket, and any API calls that modify CloudTrail (such as StopLogging or UpdateTrail) are recorded by CloudTrail itself. An Amazon EventBridge rule can be set to match these specific API call events and trigger an SNS topic for immediate notification or a Lambda function for automated response. Option A is wrong because GuardDuty is designed to detect security threats, not to monitor CloudTrail configuration changes in real time. Option C is wrong because AWS Config can detect configuration drift but its evaluations are periodic (e.g., every 10 minutes) and not real-time, whereas EventBridge provides immediate detection. Option D is wrong because Trusted Advisor checks best practices but does not monitor CloudTrail changes specifically.

Answer

Enable Amazon GuardDuty and configure it to monitor CloudTrail logs for suspicious activity.

Answer

Use AWS Config rules with remediation actions to detect and revert changes to CloudTrail.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration and send alerts via email.

Question 15

A company has a critical application running on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing intermittent latency spikes. The DevOps team has enabled detailed monitoring on the EC2 instances and is using CloudWatch metrics. They notice that CPU utilization and network traffic are normal during the spikes. Which additional diagnostic step should the team take to identify the root cause?

Accepted Answer

Instrument the application with AWS X-Ray to trace requests and identify bottlenecks.. AWS X-Ray provides end-to-end tracing of requests as they travel through the application. Since CPU and network metrics appear normal, the intermittent latency is likely caused by application-level bottlenecks such as slow database queries, external API calls, or inefficient code paths. X-Ray can trace each request end-to-end and identify the specific service or component introducing delay. Container Insights (B) is designed for monitoring containerized workloads (Amazon ECS/EKS), not EC2 instances directly. CloudWatch Synthetics (C) creates canaries that monitor external endpoint availability and response times, but it does not trace internal request paths. AWS Trusted Advisor (D) offers general best-practice recommendations but is not a diagnostic tool for real-time latency issues.

Answer

Use CloudWatch Container Insights to monitor the performance of the EC2 instances.

Answer

Enable CloudWatch Synthetics to create canaries that monitor the application endpoints.

Answer

Run an AWS Trusted Advisor check to identify performance-related recommendations.