DOP-C02 Monitoring and Logging Practice Test 7 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a production AWS Lambda function that occasionally times out. The function has a timeout of 30 seconds and uses a synchronous invocation. The engineer wants to capture invocation logs to identify the cause. Which approach will provide the MOST detailed diagnostic information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS X-Ray tracing on the Lambda function.. AWS X-Ray provides end-to-end tracing for Lambda functions, capturing detailed timing information for each invocation, including subsegments for downstream calls, function initialization, and execution phases. This allows the engineer to pinpoint exactly where time is being spent, which is essential for diagnosing intermittent timeouts in synchronous invocations.

Answer

Enable AWS CloudTrail data events for Lambda.

Answer

Create a CloudWatch dashboard with function duration metrics.

Answer

Add more logging statements to the function code and check CloudWatch Logs.

Question 2

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics for the ALB and is using CloudWatch Logs for the EC2 instances. Recently, users report intermittent 503 errors. The team notices that the ALB's 'RequestCount' metric shows a sudden drop during error periods, while the 'ActiveConnectionCount' remains steady. Which TWO steps should the team take to diagnose the issue? (Choose two.)

Accepted Answer

Enable and analyze the ALB access logs to see the HTTP response codes and target processing time.. ALB access logs contain detailed per-request data, including HTTP response codes (e.g., 503) and target processing time. Analyzing these logs will reveal whether the 503 errors are coming from the ALB itself (e.g., due to request queue overflow) or from the targets, and whether the sudden drop in RequestCount is due to clients aborting or the ALB throttling requests.

Answer

Check the Amazon Route 53 health checks for the ALB DNS name.

Answer

Review the EC2 instances' CloudWatch metrics for CPU utilization and network traffic.

Answer

Inspect AWS CloudTrail logs for the ALB to see if there are any configuration changes.

Question 3

Your company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running a web server. The web servers write access logs to a shared Amazon EFS filesystem. The operations team needs to monitor the web server logs in real-time to detect and alert on 5xx error spikes. Currently, the team manually SSHes into instances to tail logs, which is inefficient and doesn't provide real-time alerting. The team wants a centralized, near-real-time logging solution with minimal operational overhead. They have asked you to design a solution that ingests logs from the EFS filesystem into a centralized log analytics platform. Which solution would you recommend?

Accepted Answer

Install and configure the Amazon CloudWatch Logs agent on each EC2 instance to tail the log files from the EFS mount and send them to CloudWatch Logs. Create a metric filter and alarm for 5xx errors.. Installing the CloudWatch Logs agent on each EC2 instance allows it to tail the log files from the shared EFS mount point and stream them to CloudWatch Logs in near real-time. This provides centralized log ingestion with minimal operational overhead, and you can create a metric filter and alarm to detect and alert on 5xx error spikes without manual SSH access.

Answer

Enable AWS CloudTrail data events for the EC2 instances to capture log file modifications.

Answer

Configure an Amazon EventBridge scheduled rule to invoke an AWS Lambda function that reads new log lines from EFS and publishes them to Amazon CloudWatch Logs.

Answer

Stream the log files to Amazon Kinesis Data Streams using a custom producer, then use a Lambda function to analyze and alert on 5xx errors.

Question 4

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

Accepted Answer

Use AWS X-Ray to instrument the application and collect trace data.. AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Answer

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Answer

Enable CloudWatch Logs Insights to query API logs for slow requests.

Answer

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Answer

Set up VPC Flow Logs to analyze network latency between services.

Question 5

A company is using AWS CloudTrail to log API activity in their AWS account. They want to ensure that any modification to CloudTrail configuration itself is logged and that the logs are immutable. Which combination of actions should they take? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the destination S3 bucket in governance mode.. Enabling S3 Object Lock in governance mode on the destination S3 bucket prevents any user, including the root user, from overwriting or deleting CloudTrail log objects during the retention period, ensuring immutability. Option B is correct because enabling log file validation creates a digest file that uses SHA-256 hashing to verify that log files have not been modified, deleted, or tampered with after delivery, providing integrity assurance.

Answer

Disable log file validation to reduce overhead.

Answer

Store CloudTrail logs in a CloudWatch Logs log group with a retention policy.

Answer

Enable CloudTrail Insights to detect configuration changes.

Question 6

Drag and drop the steps to configure an AWS Auto Scaling group with a launch template and scaling policies.

Accepted Answer

Create launch template, then Auto Scaling group, then configure network, then set capacities, then add scaling policy. First create the launch template, then create the Auto Scaling group, then configure network, then set capacities, then add scaling policy.

Answer

Auto Scaling group, then launch template, then configure network, then set capacities, then add scaling policy

Answer

Configure network, then launch template, then Auto Scaling group, then set capacities, then add scaling policy

Answer

Create launch template, then Auto Scaling group, then configure network, then add scaling policy, then set capacities

Question 7

Drag and drop the steps to set up an AWS CodeBuild project to build a Docker image and push it to Amazon ECR.

Accepted Answer

Create ECR repository, then Write buildspec.yml, then Create CodeBuild project with privileged mode, then Start build. The correct order to set up an AWS CodeBuild project for building a Docker image and pushing to Amazon ECR is: first create the ECR repository, then write the buildspec.yml file, then create the CodeBuild project with privileged mode enabled, and finally start the build. This sequence ensures the repository exists, the build specification is ready, and the project has the necessary permissions to build and push the Docker image.

Answer

Create CodeBuild project, then Create ECR repository, then Write buildspec.yml, then Start build

Answer

Write buildspec.yml, then Create ECR repository, then Create CodeBuild project without privileged mode, then Start build

Answer

Create ECR repository, then Start build, then Create CodeBuild project, then Write buildspec.yml

Question 8

Match each AWS service health or performance concept to its meaning.

Accepted Answer

Amazon CloudWatch: Monitors AWS resources and applications in real-time.. The correct matches are: Amazon CloudWatch monitors resources in real-time; AWS Trusted Advisor optimizes cost, security, and performance; AWS Health Dashboard provides personalized health alerts. Common confusions involve swapping monitoring (CloudWatch) with auditing (CloudTrail) and recommendations (Trusted Advisor) with monitoring.

Answer

Amazon CloudWatch: Audits API calls for governance and compliance.

Answer

AWS Trusted Advisor: Provides real-time monitoring of application performance.

Question 9

A company uses AWS CloudTrail to log API activity across multiple accounts in AWS Organizations. The security team wants to receive near-real-time notifications for specific high-risk API calls, such as IAM policy changes or S3 bucket policy modifications. What is the MOST efficient and scalable solution?

Accepted Answer

Deliver CloudTrail logs to an S3 bucket, enable S3 Event Notifications to trigger a Lambda function that filters and publishes to SNS.. It uses S3 Event Notifications to trigger a Lambda function in near-real-time when CloudTrail logs are delivered to S3. The Lambda function can filter for specific high-risk API calls (e.g., IAM policy changes, S3 bucket policy modifications) and publish only relevant events to an SNS topic, providing a scalable and cost-effective solution that avoids polling or complex querying.

Answer

Create a CloudWatch Events rule that matches the specific API calls and publishes to an SNS topic.

Answer

Use CloudWatch Logs Insights to query CloudTrail logs and set up a metric filter with an alarm.

Answer

Enable AWS Config rules to detect changes and trigger an SNS notification.

Question 10

A DevOps engineer manages a production environment with EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 5xx errors from the ALB. The engineer needs to identify whether the errors originate from the targets or the ALB itself. Which CloudWatch metric should be examined to differentiate between these two sources?

Accepted Answer

HTTPCode_Target_5XX_Count. HTTPCode_Target_5XX_Count, is the correct metric to identify 5xx errors originating from the targets (EC2 instances). The ALB has separate metrics for target errors (HTTPCode_Target_5XX_Count) and ALB errors (HTTPCode_ELB_5XX_Count). Option A (TargetResponseTime) measures latency, not error codes. Option B (UnhealthyHostCount) counts unhealthy targets based on health checks, not specific HTTP errors. Option D (RequestCount) is total requests, not error codes.

Answer

TargetResponseTime

Answer

UnhealthyHostCount

Answer

RequestCount

Question 11

A company uses Amazon RDS for PostgreSQL and wants to monitor database performance metrics such as CPU utilization, memory, and disk I/O. Which AWS service should be used to set up custom dashboards and alarms for these metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (Option D) is the correct service for monitoring Amazon RDS performance metrics such as CPU utilization, memory, and disk I/O. CloudWatch provides built-in metrics for RDS, allows creation of custom dashboards to visualize these metrics, and supports setting alarms for proactive notifications. Option A (AWS X-Ray) is used for tracing and analyzing requests through applications, not for infrastructure metrics. Option B (Amazon VPC Flow Logs) captures IP traffic information for network troubleshooting, not database performance. Option C (AWS CloudTrail) logs API calls for auditing, not performance monitoring. Therefore, CloudWatch is the appropriate choice for this use case.

Answer

AWS X-Ray

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 12

A company wants to monitor network traffic to and from its VPC for security analysis. It needs to capture IP traffic information, including accepted and rejected connection attempts, and store the data in S3 for long-term analysis. Which AWS service should be used?

Accepted Answer

Amazon VPC Flow Logs. Amazon VPC Flow Logs capture IP traffic metadata for ENIs, subnets, or VPCs, including ACCEPT and REJECT records, and can be published directly to Amazon S3 for long-term retention and Athena analysis. This matches the requirement to capture accepted and rejected connection attempts and store them in S3. Flow Logs are the standard DOP-C02 answer for VPC-level network traffic visibility.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 13

A DevOps team uses AWS Lambda functions to process events from an SQS queue. The Lambda function occasionally fails due to transient errors, and the team wants to capture and analyze the full error details, including stack traces, for debugging. The errors are not always related to invocation failures (e.g., timeouts) but include exceptions thrown within the function code. Which approach will capture the MOST comprehensive error information?

Accepted Answer

Ensure the Lambda function code returns a meaningful error object (e.g., throws an exception) so that the error is logged in CloudWatch Logs with a stack trace.. When a Lambda function throws an exception or returns an error object, AWS Lambda automatically logs the error details, including the stack trace, to CloudWatch Logs. This captures the full error information necessary for debugging transient errors. Option A is incorrect because a Dead Letter Queue (DLQ) on SQS captures the failed messages themselves, not the error details or stack traces of the function execution. Option B is incorrect because CloudWatch Logs automatic invocation logging provides only basic information such as invocation time, duration, and status; it does not include the function's stack trace unless explicitly logged by the code. Option D is incorrect because AWS X-Ray provides tracing of requests and can show service maps and latency, but it does not necessarily capture the full stack trace of application-level exceptions; it focuses on request flow rather than detailed error logs.

Answer

Configure a DLQ on the SQS queue to capture failed messages and inspect them.

Answer

Enable CloudWatch Logs and rely on the automatic logging of invocation results.

Answer

Use AWS X-Ray to trace the function execution and analyze the traces.

Question 14

A company uses Amazon CloudWatch to monitor its EC2 instances. A DevOps engineer notices that some metrics (e.g., memory utilization) are not available in the CloudWatch console. The engineer wants to collect these metrics. What should the engineer do?

Accepted Answer

Install and configure the CloudWatch Agent on the EC2 instances.. Memory utilization and disk space metrics are not available by default in CloudWatch because they are OS-level metrics, not hypervisor-level. The CloudWatch Agent must be installed on EC2 instances to collect these custom metrics and publish them to CloudWatch.

Answer

Enable VPC Flow Logs for the instance's subnet.

Answer

Send the metrics to CloudWatch Logs and create a metric filter.

Answer

Enable detailed monitoring on the EC2 instances.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to be notified whenever a stack is created, updated, or deleted. They also want to track who made the change. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events (now Events) with SNS. CloudTrail captures CloudFormation API calls (CreateStack, UpdateStack, DeleteStack) and CloudWatch Events can trigger SNS notifications based on those API calls. Option A is wrong because Config rules evaluate resource compliance, not API events. Option C is wrong because S3 event notifications are for S3 objects. Option D is wrong because Lambda alone cannot capture who made the change without CloudTrail integration.

Answer

AWS Config rules and Amazon SNS

Answer

Amazon S3 event notifications and AWS Lambda

Answer

AWS Lambda and Amazon DynamoDB