DOP-C02 Monitoring and Logging Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. A network engineer reviews VPC Flow Logs. Which statement about the traffic is correct?

Accepted Answer

Outbound HTTP traffic to the internet is blocked.. The VPC Flow Logs show that outbound traffic from the internal network to the internet on port 80 (HTTP) is being explicitly rejected (REJECT). This indicates that outbound HTTP traffic is blocked, while other traffic (such as HTTPS on port 443) may be accepted or handled differently. The logs do not show any accepted traffic on port 80, confirming the block.

Answer

Internal traffic on port 80 is allowed.

Answer

Outbound HTTPS traffic is being rejected.

Answer

All traffic is accepted.

Question 2

Refer to the exhibit. A user from IP 10.0.0.50 receives a 403 error when accessing https://d123.cloudfront.net/secret.pdf. The S3 bucket policy is as shown. What is the most likely cause of the error?

Accepted Answer

The CloudFront distribution does not have an Origin Access Control (OAC) configured.. The S3 bucket policy restricts access to requests originating from IP range 10.0.0.0/24. However, when using CloudFront to serve S3 content, the IP address seen by S3 is the CloudFront origin IP, not the viewer's IP. Therefore, the condition fails unless CloudFront's IP is within the range, which it is not. The correct fix is to use CloudFront's Origin Access Control (OAC) and remove the IP condition or use CloudFront functions to forward the viewer IP.

Answer

The S3 bucket policy should use 'Principal": { "AWS": "cloudfront.amazonaws.com" }'.

Answer

The S3 bucket policy does not allow s3:GetObject from CloudFront.

Answer

The user's IP address is not in the allowed range.

Question 3

Refer to the exhibit. The AWS Config advanced query is intended to find EC2 instances that are not using a registered AMI. However, it returns zero rows. Which is the most likely reason?

Accepted Answer

The resource relationship table does not contain AMI-to-instance relationships.. The AWS Config advanced query uses the resource relationship table 'aws_config_resource_relationship' to find relationships. However, this table does not contain AMI-to-instance relationships; 'IsAttachedTo' is used for other resource types like EBS volumes. Consequently, the subquery may return rows with NULL imageId values (or no rows), and when NULL is involved in a NOT IN clause, SQL evaluates the condition as UNKNOWN for all rows, resulting in zero rows returned. This makes option A the most likely reason.

Answer

All instances are using registered AMIs, so the condition is never met.

Answer

The query syntax is incorrect; the subquery must use 'EXISTS' instead of 'IN'.

Answer

The 'configuration.imageId' field is not available in the resource configuration.

Question 4

A financial services company uses AWS Lambda functions to process transactions. The security team requires that all Lambda function logs be retained for 7 years and that any attempt to delete or modify log data be detected and alerted on. The DevOps team has configured Lambda to send logs to Amazon CloudWatch Logs. Which solution meets these requirements?

Accepted Answer

Export the Lambda logs to Amazon S3 with a 7-year lifecycle policy, enable S3 Object Lock in compliance mode, and use AWS CloudTrail to monitor S3 data events for delete or overwrite attempts.. The combination of exporting logs to S3, applying S3 Object Lock in compliance mode for immutability, and using CloudTrail data events to monitor delete or overwrite attempts directly addresses both the 7-year retention and the detection of any tampering. Other options either protect only API logs, lack immutability, or do not monitor the actual log data.

Answer

Create a CloudWatch Logs log group with a 7-year retention policy, enable CloudTrail log file validation, and create an EventBridge rule to alert on DeleteLogGroup and PutRetentionPolicy API calls.

Answer

Use AWS CloudTrail to log all Lambda API calls, store the logs in an S3 bucket with versioning enabled, and set a 7-year retention policy on the bucket.

Answer

Configure CloudWatch Logs to stream to Amazon Kinesis Data Firehose, which delivers to an S3 bucket with a 7-year retention policy, and enable AWS Config rules to monitor for changes to the log group.

Question 5

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The DevOps team wants to monitor HTTP 5xx errors and receive alerts when the error rate exceeds 5% over a 5-minute period. Which combination of services and configurations should be used to meet these requirements?

Accepted Answer

Use CloudWatch ALB metrics (HTTPCode_ELB_5XX_Count) and create a CloudWatch Alarm on the Sum statistic with a threshold based on total request count.. ALB automatically publishes the `HTTPCode_ELB_5XX_Count` metric to CloudWatch, and you can create a CloudWatch alarm using the `Sum` statistic over a 5-minute period. To detect when the error rate exceeds 5%, you need to combine this metric with the `RequestCount` metric in a math expression (e.g., `m1/m2*100 > 5`) or use a composite alarm, as the alarm threshold must be based on the ratio of 5xx errors to total requests, not just the raw count.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query 5xx logs, then create a metric filter and alarm.

Answer

Configure AWS Config rules to check ALB 5xx error counts and trigger alarms.

Answer

Use AWS X-Ray to trace requests and create a CloudWatch alarm based on X-Ray error rate.

Question 6

A company wants to monitor the number of messages in an Amazon SQS queue and send an alert if the queue depth exceeds 1000 for more than 5 minutes. Which AWS service should be used to create the alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it can monitor SQS queue metrics (such as ApproximateNumberOfMessagesVisible) and trigger an alarm when the metric exceeds a threshold (e.g., 1000) for a specified evaluation period (e.g., 5 minutes). CloudWatch Alarms directly integrate with SQS via the AWS/SQS namespace and support actions like sending notifications through Amazon SNS.

Answer

Amazon EventBridge

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Question 7

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are deployed in multiple AWS regions. The team wants to aggregate the canary results into a single dashboard in the US East (N. Virginia) region. What is the MOST efficient way to achieve this?

Accepted Answer

Create a cross-region CloudWatch dashboard and add metrics from each region using metric math.. CloudWatch cross-region dashboards allow you to aggregate metrics from multiple regions into a single dashboard without data movement. By using metric math, you can reference metric IDs from different regions directly in the dashboard widget, enabling real-time aggregation of Synthetics canary success/failure rates and latency metrics from all regions into a unified view in US East (N. Virginia). This approach avoids unnecessary data replication, reduces latency, and minimizes operational overhead.

Answer

Replicate the canaries to US East (N. Virginia) and run them from there.

Answer

Set up a Lambda function in each region to push canary results to a central S3 bucket, then create a dashboard from S3.

Answer

Create a CloudWatch Logs Insights query across all regions and visualize results.

Question 8

A DevOps team is troubleshooting a slow application. They enabled AWS X-Ray tracing and see that one of the downstream services has a high average response time. However, the traces show that the service itself is fast; the delay is in the network call from the upstream service. Which X-Ray feature should the team use to identify the root cause?

Accepted Answer

Examine the trace map to see the connection between services.. The trace map in AWS X-Ray provides a visual representation of the service graph, showing the connections and latency between services. Since the delay is in the network call from the upstream service to the downstream service, the trace map can highlight the specific edge where the high latency occurs, allowing the team to pinpoint whether the issue is due to network congestion, DNS resolution, or a slow HTTP connection. This is the most direct way to identify the root cause of the inter-service communication delay.

Answer

Add annotations to the traces for better filtering.

Answer

View the raw segments of the upstream service.

Answer

Adjust the sampling rules to capture more traces.

Question 9

A company needs to monitor the CPU utilization of its Amazon RDS for PostgreSQL instance. The metric should be available in Amazon CloudWatch with a granularity of 1 minute. Which action should the team take?

Accepted Answer

No additional configuration is needed; RDS automatically sends metrics to CloudWatch.. Amazon RDS for PostgreSQL automatically publishes metrics, including CPU utilization, to CloudWatch with a default granularity of 1 minute for standard instances. No additional configuration is required to enable this basic monitoring. The metrics are collected by the RDS hypervisor layer and sent to CloudWatch without needing an agent or extra setup.

Answer

Install the CloudWatch agent on the RDS instance.

Answer

Enable Enhanced Monitoring for the RDS instance.

Answer

Enable Performance Insights for the RDS instance.

Question 10

A company runs a containerized application on Amazon ECS Fargate. The DevOps team wants to collect custom application metrics (e.g., request count, error rate) and send them to Amazon CloudWatch. The team wants to minimize changes to the application code. Which solution should be used?

Accepted Answer

Run the CloudWatch agent as a sidecar container in the ECS task definition, configured to collect StatsD metrics from the application container.. The CloudWatch agent can run as a sidecar container in the same ECS task definition and listen for StatsD metrics (over UDP port 8125) from the application container. This approach requires zero changes to the application code—the application simply emits StatsD-formatted metrics, and the CloudWatch agent forwards them to CloudWatch via the PutMetricData API. It minimizes operational overhead while enabling custom metric collection from containerized workloads on Fargate.

Answer

Have the application call the CloudWatch PutMetricData API directly.

Answer

Use the ECS agent's built-in metric collection feature.

Answer

Modify the application to send logs using the embedded metric format.

Question 11

A DevOps engineer is designing a monitoring solution for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The team needs to monitor for errors and latency. Which TWO actions should the engineer take to implement comprehensive monitoring? (Choose TWO.)

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. AWS X-Ray provides end-to-end tracing for requests as they travel through API Gateway, Lambda, and DynamoDB, enabling the team to identify latency bottlenecks and errors across the entire serverless application. This is essential for comprehensive monitoring of distributed applications, as it captures detailed timing and error data for each component.

Answer

Enable DynamoDB Accelerator (DAX) to reduce latency.

Answer

Enable detailed billing metrics for cost analysis.

Answer

Configure CloudWatch Logs for DynamoDB.

Question 12

A company runs a production web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is deployed across three Availability Zones. The DevOps team recently noticed that the application's error rate is spiking periodically, but they cannot correlate the spikes with any known deployments or changes. The team has enabled detailed CloudWatch metrics for the ALB and EC2, and they are using CloudWatch Logs for application logs. They also have AWS X-Ray enabled for tracing.

The team observes that during error spikes, the ALB's 5XX count increases, but the EC2 instance-level CPU and memory metrics remain normal. The application logs show 'Connection timed out' errors. The team suspects the issue is related to network connectivity but is not sure.

Which course of action should the DevOps team take to identify the root cause of the periodic error spikes?

Accepted Answer

Enable VPC Flow Logs for the subnets and analyze the logs to identify dropped connections during the error spikes.. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including whether the traffic was accepted or rejected. Since the application logs show 'Connection timed out' errors and instance-level metrics are normal, the issue likely lies in the network path (e.g., security groups, NACLs, or subnet routing) rather than the application or compute layer. Analyzing VPC Flow Logs during the error spikes will reveal if connections are being dropped or rejected, pinpointing the root cause of the timeouts.

Answer

Increase the EC2 instance size to handle higher traffic and reduce timeouts.

Answer

Configure a step scaling policy for the Auto Scaling group based on ALB 5XX count.

Answer

Enable ALB access logs and analyze the 5xx response patterns.

Question 13

A company runs a critical application on Amazon ECS with Fargate. The application experiences intermittent slow responses. The DevOps team enabled Container Insights and CloudWatch ServiceLens. However, traces from the application do not appear in ServiceLens. The application uses the AWS X-Ray SDK for tracing. What is the MOST likely cause?

Accepted Answer

The X-Ray daemon is not running in the task definition.. The X-Ray daemon is required to act as a local intermediary that receives trace segments from the X-Ray SDK and forwards them to the AWS X-Ray API. In Amazon ECS with Fargate, the daemon must be explicitly included as a sidecar container in the task definition. Without it, the SDK cannot send traces, which explains why traces are missing from ServiceLens despite the SDK being integrated.

Answer

The X-Ray SDK cannot send traces to AWS X-Ray from Fargate tasks.

Answer

ServiceLens does not support Amazon ECS with Fargate launch type.

Answer

The application is not sending metrics to CloudWatch Container Insights.

Question 14

A DevOps team has set up centralized logging for multiple AWS accounts using Amazon OpenSearch Service. The team uses CloudWatch cross-account observability to collect logs from various accounts into a monitoring account. Recently, logs from one source account stopped appearing in the monitoring account's OpenSearch dashboard. Other source accounts continue to send logs successfully. Which step should the team take to troubleshoot this issue?

Accepted Answer

Check the source account's CloudWatch Logs subscription filter for the OpenSearch destination.. The most likely cause of logs from a single source account failing to appear is a misconfigured or broken CloudWatch Logs subscription filter. This filter is responsible for forwarding log events from the source account to the OpenSearch destination in the monitoring account. If the filter is missing, misconfigured, or has been accidentally deleted, logs will not be sent, while other accounts continue to work normally.

Answer

Verify that the monitoring account's CloudWatch cross-account observability is enabled.

Answer

Review the source account's CloudWatch Logs retention policy to confirm logs are not expired.

Answer

Ensure the IAM role in the source account has the correct trust policy for the monitoring account.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack fails to create or update. What is the MOST efficient way to achieve this?

Accepted Answer

Configure an SNS topic in the stack's notification options.. AWS CloudFormation natively supports specifying Amazon SNS topic ARNs in the stack's notification options. When a stack operation (create, update, or delete) fails, CloudFormation automatically publishes a notification to the configured SNS topic without requiring any custom code, additional resources, or external event processing. This is the most efficient approach as it leverages built-in functionality with zero maintenance overhead.

Answer

Create a custom resource in the stack that publishes to Amazon SNS.

Answer

Create a CloudWatch alarm on the StackStatus metric.

Answer

Use Amazon EventBridge to capture CloudFormation events and publish to SNS.