DOP-C02 Monitoring and Logging Practice Test 6 — 15 Questions

Question 1

A company is running a critical application on Amazon ECS with Fargate launch type. The application experiences periodic performance degradation. The DevOps team needs to set up monitoring to capture detailed metrics at a 1-second granularity. Which solution should be used?

Accepted Answer

Use Amazon CloudWatch Container Insights with high-resolution metrics.. Option B is correct because CloudWatch Container Insights with high-resolution metrics can provide 1-second granularity. Option A is wrong because CloudWatch default metrics are at 1-minute granularity. Option C is wrong because Prometheus is not a managed AWS service for this purpose. Option D is wrong because VPC Flow Logs capture network traffic, not application performance metrics.

Answer

Deploy a Prometheus server on Amazon EC2 and scrape metrics from the ECS tasks.

Answer

Enable CloudWatch detailed monitoring on the ECS service.

Answer

Enable VPC Flow Logs and analyze the logs with Amazon Athena.

Question 2

A DevOps engineer needs to audit changes to IAM policies over the past 90 days. The engineer wants to see who made the change, what the change was, and when it occurred. Which AWS tool should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct choice because it records all API calls made to the AWS environment, including IAM policy changes, and stores them as events with details such as the identity of the caller (IAM user or role), the time of the request, and the request parameters. By querying CloudTrail logs over the past 90 days, the DevOps engineer can audit who made the change, what the change was (e.g., the specific IAM policy document modification), and when it occurred.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

IAM Access Analyzer

Question 3

A company is using Amazon RDS for MySQL and wants to monitor database connections. They need to set up an alarm when the number of connections exceeds 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric and statistic should be used?

Accepted Answer

DatabaseConnections metric with Average statistic. Option B is correct because the Average statistic of the DatabaseConnections metric over a 5-minute period provides a smoothed representation of connection usage, which is appropriate for detecting sustained breaches of the 80% threshold. Using Average reduces sensitivity to transient spikes, ensuring the alarm triggers only when the average number of connections remains above the threshold for the entire evaluation period, aligning with the requirement of 'more than 5 minutes'.

Answer

DatabaseConnections metric with Maximum statistic

Answer

DatabaseConnections metric with Sum and then divide by the number of data points

Answer

DatabaseConnections metric with Sum statistic

Question 4

A company runs a web application on EC2 instances behind an Application Load Balancer. They use Amazon CloudFront for content delivery. The DevOps team notices that some requests are returning HTTP 503 errors intermittently. After checking the CloudFront and ALB logs, they find that the errors originate from the ALB. What is the most likely cause?

Accepted Answer

The ALB is experiencing a surge in traffic and is scaling up, but during the scaling activity, some requests are rejected.. Option D is correct because when an Application Load Balancer (ALB) experiences a sudden surge in traffic that exceeds its current capacity, it may temporarily reject requests with HTTP 503 errors while it scales up. During the scaling activity, the ALB's target group might not have enough healthy registered targets to handle the load, causing the ALB to return 503 responses until new instances are provisioned and pass health checks. This matches the intermittent nature of the errors described in the scenario.

Answer

The SSL certificate on the ALB is expired.

Answer

The security group for the ALB is blocking traffic from CloudFront.

Answer

CloudFront is configured to forward an HTTP method that the ALB does not support.

Question 5

A company wants to collect and analyze logs from on-premises servers and send them to AWS for centralized monitoring. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Agent on the on-premises servers to send logs to Amazon CloudWatch Logs.. Option A is correct: CloudWatch Agent collects logs from on-prem servers and sends to CloudWatch Logs. Option B is wrong because Kinesis Agent is for streaming data to Kinesis, not CloudWatch Logs directly. Option C is wrong because the unified CloudWatch Agent is the recommended tool. Option D is wrong because SSM Agent does not collect logs.

Answer

Amazon Kinesis Agent on the on-premises servers to send logs to Amazon Kinesis Data Firehose, then to Amazon S3.

Answer

Amazon CloudWatch Agent with the awslogs configuration to send logs to Amazon CloudWatch Logs.

Answer

AWS Systems Manager Agent to collect logs and send to Amazon CloudWatch Logs.

Question 6

A DevOps engineer is troubleshooting a slow-running Lambda function. The function processes messages from an SQS queue. Which CloudWatch metric should be examined first to determine if the function is experiencing throttling?

Accepted Answer

Throttles. The Throttles metric directly indicates when Lambda is rejecting invocation requests due to concurrency limits being reached. Since the question asks specifically about throttling, this is the first metric to examine to confirm whether the function is being rate-limited by AWS.

Answer

Invocations

Answer

ConcurrentExecutions

Answer

Duration

Question 7

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Which TWO steps must be taken to achieve this?

Accepted Answer

Add a statement to the KMS key policy that allows CloudWatch Logs to use the key.. B and C are correct: You must associate the KMS key with the log group using the associate-kms-key API, and the CloudWatch Logs service must have permissions to use the KMS key via a key policy. A is wrong because CloudWatch Logs does not require a grant; it uses key policies. D is wrong because you do not need to specify the key ARN in the log stream. E is wrong because the log group already exists.

Answer

Recreate the log group after associating the key.

Answer

Create a KMS grant to allow CloudWatch Logs to use the key.

Answer

Specify the KMS key ARN when creating each log stream.

Question 8

A DevOps team is troubleshooting a slow website that uses Amazon CloudFront with an Application Load Balancer as the origin. The team notices that cache hit ratio is low. Which THREE actions are most likely to improve the cache hit ratio?

Accepted Answer

Enable CloudFront Origin Shield to reduce load on the origin and increase cache effectiveness.. Option B is correct because CloudFront Origin Shield acts as an additional caching layer that consolidates requests from multiple edge locations, reducing the load on the origin and increasing the likelihood of cache hits by serving cached content from the Origin Shield regional cache. This improves cache effectiveness, especially for origins with high latency or limited capacity.

Answer

Configure CloudFront to forward all cookies to the origin.

Answer

Decrease the default TTL for objects.

Question 9

A company is using Amazon CloudWatch Logs to collect application logs. They need to search and analyze the logs in near real-time. Which TWO AWS services can be used to achieve this?

Accepted Answer

Amazon CloudWatch Logs Insights. A and D are correct: CloudWatch Logs Insights allows querying logs directly, and Amazon OpenSearch Service can ingest logs via a subscription filter for analysis. B is wrong because Athena queries data in S3, not directly from CloudWatch Logs. C is wrong because Kinesis Data Analytics processes streaming data, but not directly from CloudWatch Logs. E is wrong because CloudWatch Synthetics is for canaries, not log analysis.

Answer

Amazon CloudWatch Synthetics

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Athena

Question 10

A company is running a production application on Amazon ECS with AWS Fargate. The application has unpredictable traffic patterns and occasionally experiences increased latency. The DevOps team needs to configure scaling based on a custom metric that tracks the number of active user sessions in real time. Which solution will allow the team to scale the ECS service based on this custom metric?

Accepted Answer

Publish the custom metric to Amazon CloudWatch, then create a target tracking scaling policy in Application Auto Scaling for the ECS service.. Option B is correct because CloudWatch custom metrics can be used with ECS Service Auto Scaling. Option A is wrong because Application Auto Scaling is the correct service, but it is not direct. Option C is wrong because Lambda cannot directly scale ECS services. Option D is wrong because CloudWatch dashboards are for visualization only.

Answer

Use AWS Auto Scaling to scale the ECS service based on the custom metric.

Answer

Create a CloudWatch dashboard to visualize the metric and manually adjust the service count.

Answer

Use an AWS Lambda function to directly update the desired count of the ECS service based on the metric.

Question 11

A DevOps team is implementing a comprehensive logging strategy for a microservices architecture running on Amazon EKS. They need to collect logs from all containers and send them to a centralized log analytics platform. The solution must be agentless and support multi-line log events. Which approach should the team use?

Accepted Answer

Deploy a Fluent Bit DaemonSet on the EKS cluster and configure it to send logs to Amazon CloudWatch Logs.. Option A is correct because Fluent Bit is a lightweight, CNCF-graduated log processor that can be deployed as a DaemonSet on EKS to collect logs from all nodes without requiring sidecar containers. It supports multi-line log events natively via its multiline filter plugin, and it can output directly to Amazon CloudWatch Logs using the cloudwatch_logs output plugin, meeting the agentless requirement since it runs as a Kubernetes DaemonSet rather than as a per-pod sidecar.

Answer

Use the Amazon CloudWatch agent as a sidecar container in each pod to forward logs to CloudWatch Logs.

Answer

Install the Amazon Kinesis Agent on each EC2 instance and configure it to stream logs to Amazon Kinesis Data Firehose.

Answer

Deploy a Fluentd DaemonSet on the EKS cluster and configure it to send logs to Amazon S3.

Question 12

A company uses AWS CloudTrail to log API activity in their AWS account. They need to ensure that any changes to CloudTrail configuration itself are detected and alerted upon in real time. Which service should they use?

Accepted Answer

Use Amazon CloudWatch Events (EventBridge) to create a rule matching the StopLogging or UpdateTrail API calls.. Amazon CloudWatch Events (EventBridge) can monitor CloudTrail API calls in real time by creating a rule that matches specific API calls such as StopLogging or UpdateTrail. When these calls are made, the rule triggers an action (e.g., SNS notification or Lambda function) to alert administrators immediately. This provides the real-time detection required for changes to CloudTrail configuration itself.

Answer

Enable AWS Config rules to monitor CloudTrail configuration changes.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs for changes.

Answer

Enable Amazon GuardDuty to detect changes to CloudTrail.

Question 13

A company is using Amazon RDS for PostgreSQL and wants to monitor the database for performance issues. They need to capture slow queries and analyze them over time. Which combination of AWS services should they use?

Accepted Answer

Enable RDS Performance Insights and Enhanced Monitoring.. Option B is correct because RDS Performance Insights provides a database performance schema with detailed wait events and SQL-level metrics to identify slow queries, while Enhanced Monitoring offers OS-level metrics (CPU, memory, disk I/O) at sub-minute granularity. Together, they allow you to capture and analyze slow queries over time without additional log parsing or export overhead.

Answer

Enable RDS Event notifications to send alerts for performance issues.

Answer

Enable CloudWatch Logs for PostgreSQL and export logs to Amazon S3.

Answer

Use CloudWatch Metrics to monitor database connections and CPU utilization.

Question 14

A company has a multi-account AWS environment using AWS Organizations. The security team needs to centrally monitor and analyze VPC Flow Logs from all accounts. The solution must be cost-effective and allow querying across accounts. Which approach should they take?

Accepted Answer

Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.. Option C is correct because it uses a centralized Amazon S3 bucket to aggregate VPC Flow Logs from all accounts, which is cost-effective (S3 storage costs are low) and enables cross-account querying via Amazon Athena using standard SQL. This approach avoids per-ingestion costs of services like CloudWatch Logs or Kinesis and provides a serverless, scalable query engine for analyzing logs across accounts.

Answer

Use Amazon Elasticsearch Service (Amazon OpenSearch Service) with a cross-account ingestion pipeline.

Answer

Stream VPC Flow Logs from each account to Amazon Kinesis Data Analytics for real-time analysis.

Answer

Configure each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription.

Question 15

A DevOps engineer needs to set up a monitoring solution for an AWS Lambda function that processes messages from an Amazon SQS queue. The engineer wants to be alerted if the function fails to process a message (i.e., the message ends up in the dead-letter queue). Which approach should they use?

Accepted Answer

Create a CloudWatch alarm on the ApproximateNumberOfMessagesVisible metric of the dead-letter queue.. Option A is correct because the `ApproximateNumberOfMessagesVisible` metric on the dead-letter queue (DLQ) directly reflects the number of messages that have failed processing and been moved there. By creating a CloudWatch alarm on this metric (e.g., when it exceeds 0 for a period), the engineer receives an alert precisely when messages are failing, without needing to parse logs or rely on indirect indicators.

Answer

Enable CloudTrail to log SQS API calls and create a metric filter for SendMessage to the DLQ.

Answer

Create a CloudWatch Events rule to monitor the Lambda function errors.

Answer

Configure the Lambda function's dead-letter queue to send notifications via Amazon SNS.