DOP-C02 Monitoring and Logging Practice Test 7 — 15 Questions

Question 1

A company runs a web application behind an Application Load Balancer (ALB) in a production AWS account. The DevOps team needs to analyze HTTP request patterns and identify the top IP addresses generating errors. They want to store the data cost-effectively for querying with SQL. Which solution meets these requirements?

Accepted Answer

Enable ALB access logs and store them in Amazon S3, then use Amazon Athena to query the logs with SQL.. Option D is correct because ALB access logs provide detailed HTTP request data (including source IP, request URI, response code, etc.) and are stored in Amazon S3, which is cost-effective for long-term storage. Amazon Athena allows querying these logs directly with standard SQL without needing to load data into a database, meeting the requirement for SQL-based analysis of top IP addresses generating errors.

Answer

Use CloudWatch Metrics to monitor error rates and top IPs via custom metrics.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query the logs.

Answer

Stream the ALB logs to Amazon Kinesis Data Analytics and use SQL applications.

Question 2

A company uses AWS Lambda with an Amazon DynamoDB table to process high-volume clickstream data. The Lambda function writes the data to DynamoDB. Recently, the function has been experiencing throttling and timeouts during peak traffic. The DevOps team needs to set up monitoring to identify the root cause. Which combination of metrics should they analyze?

Accepted Answer

DynamoDB throttled write events and Lambda concurrent executions.. Option C is correct because DynamoDB throttling metrics and Lambda concurrency metrics directly indicate the issue. Option A is wrong because Lambda invocations and duration don't show throttling. Option B is wrong because DynamoDB read/write capacity and Lambda errors don't pinpoint the cause. Option D is wrong because CloudWatch Logs and Lambda memory are not the primary indicators.

Answer

DynamoDB read and write capacity metrics and Lambda error count.

Answer

CloudWatch metrics for Lambda invocations and duration.

Answer

CloudWatch Logs for Lambda function logs and Lambda memory utilization.

Question 3

A DevOps engineer is tasked with ensuring that all Amazon S3 buckets in the account have server access logging enabled. The engineer needs to be automatically notified when a new bucket is created without logging enabled. Which AWS service should they use?

Accepted Answer

Use AWS Config with a managed rule to check if S3 bucket logging is enabled, and configure an SNS topic for notifications.. Option D is correct because AWS Config provides continuous monitoring and evaluation of your AWS resource configurations. By using the managed rule 's3-bucket-server-access-logging-enabled', AWS Config can automatically check all S3 buckets (including newly created ones) for server access logging. When a bucket is non-compliant, AWS Config can trigger an SNS notification to alert the DevOps engineer, meeting the requirement for automatic notification without custom code.

Answer

Use AWS CloudTrail to detect CreateBucket API calls and trigger a Lambda function to check logging.

Answer

Use AWS Trusted Advisor to check S3 bucket logging and send notifications via Amazon SNS.

Answer

Use Amazon S3 Event Notifications to trigger a Lambda function when a new bucket is created.

Question 4

A company is using Amazon CloudWatch Logs to collect logs from multiple EC2 instances. They need to filter logs in real time and send specific log events to a custom application for processing. Which TWO services can they use to achieve this?

Accepted Answer

Configure a CloudWatch Logs subscription filter that invokes an AWS Lambda function.. Correct: A (CloudWatch Logs subscription filter with Lambda) and D (CloudWatch Logs subscription filter with Kinesis Data Firehose). Option B is wrong because Kinesis Data Analytics is for analytics, not forwarding. Option C is wrong because CloudWatch Events is for events, not log filtering. Option E is wrong because S3 is a destination, not a real-time processing service.

Answer

Use Amazon Kinesis Data Analytics to process the log stream.

Answer

Create a CloudWatch Events rule to capture log events and send them to Amazon SQS.

Answer

Use Amazon S3 event notifications to trigger a Lambda function on new log files.

Question 5

A company is running a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). They need to implement a monitoring strategy that provides detailed visibility into application performance, including request-level latency and error codes. Which THREE actions should they take?

Accepted Answer

Enable ALB access logs and store them in Amazon S3.. Correct: A (Enable ALB access logs), C (Enable detailed CloudWatch metrics for the ALB), and D (Enable CloudWatch agent on EC2 instances for application logs). Option B is wrong because VPC Flow Logs are for network traffic, not application performance. Option E is wrong because CloudTrail is for API calls, not application metrics.

Answer

Enable VPC Flow Logs to capture traffic patterns.

Answer

Enable AWS CloudTrail to log API calls made to the load balancer.

Question 6

A DevOps engineer is setting up centralized logging for a multi-account environment using AWS Organizations. The engineer needs to aggregate logs from all accounts into a single Amazon S3 bucket. Which TWO steps are necessary?

Accepted Answer

Create a bucket policy on the central S3 bucket that grants permissions to the source accounts.. Option B is correct because a bucket policy on the central S3 bucket can grant cross-account permissions to source accounts to write logs. This allows services like CloudTrail and VPC Flow Logs from member accounts to deliver logs directly to the central bucket without requiring IAM roles in each account for reading logs.

Answer

Create IAM roles in each account to allow the central bucket to read logs.

Answer

Enable CloudTrail organization trail in the management account to deliver logs to the central bucket.

Answer

Set up a cross-account subscription in CloudWatch Logs to forward logs to the central account.

Question 7

A company uses Amazon CloudWatch Synthetics canaries to monitor endpoint availability. The canaries are failing intermittently with timeout errors. The DevOps team needs to diagnose the issue. Which THREE aspects should they investigate?

Accepted Answer

The canary script execution time and memory usage.. Option B is correct because canary scripts have a maximum execution time of 5 minutes (300 seconds) and a memory limit of 1 GB. If the script execution time or memory usage exceeds these limits, the canary will fail with a timeout error. Investigating these metrics in CloudWatch can reveal whether the script is too resource-intensive or slow, causing the intermittent failures.

Answer

The canary schedule and frequency.

Answer

CloudWatch Logs retention policy for the canary logs.

Question 8

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance is unable to send logs to CloudWatch Logs. The log group 'MyAppLogs' exists in the same account and region. What is the most likely reason for the failure?

Accepted Answer

The policy is missing permissions to create log streams.. Option B is correct because the policy only allows PutLogEvents, but the instance needs permissions for CreateLogStream and DescribeLogStreams as well. Option A is wrong because the log group exists. Option C is wrong because the resource ARN includes log-stream wildcard, which is correct. Option D is wrong because the policy explicitly allows the action.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The log group does not exist in the specified region.

Answer

The policy does not allow the logs:PutLogEvents action.

Question 9

Refer to the exhibit. A DevOps engineer runs the AWS CLI command to get the average TargetResponseTime for an ALB over a 1-hour period. The output shows only three datapoints. What is the most likely reason?

Accepted Answer

The ALB did not receive any requests during most of the 5-minute periods.. Option C is correct because the period is 300 seconds (5 minutes), so there should be 12 datapoints in an hour. However, the output shows only 3, which suggests that data is missing for most intervals, likely because the ALB did not receive any requests during those periods (the metric is only emitted when there are requests). Option A is wrong because the metric is available. Option B is wrong because the command includes the TargetGroup dimension. Option D is wrong because the period is set to 300.

Answer

The metric TargetResponseTime is not available for Application Load Balancers.

Answer

The command is missing the 'Statistics' parameter with 'Average'.

Answer

The period of 300 seconds is too large; a smaller period should be used.

Question 10

A company is running a production web application on Auto Scaling EC2 instances behind an ALB. They have enabled detailed CloudWatch metrics on the EC2 instances and enabled CloudTrail. Recently, users reported intermittent 503 errors. The operations team reviews CloudWatch dashboards but sees no spike in CPU or memory. What is the MOST likely cause of the 503 errors?

Accepted Answer

The target group has an insufficient number of healthy instances due to health check failures. Option D is correct because ALB 503 errors often indicate that the target group health checks are failing due to insufficient healthy instances, which may not cause CPU/memory spikes. Option A is wrong because CloudTrail logs API calls, not HTTP responses. Option B is wrong because if detailed monitoring were disabled, metrics would be missing, but the question says they are enabled. Option C is wrong because a misconfigured security group would cause connection timeouts, not 503 errors.

Answer

Insufficient CloudTrail logging trail configuration

Answer

Detailed monitoring is disabled for the EC2 instances

Answer

The security group for the ALB is misconfigured

Question 11

A DevOps engineer is tasked with centralizing logs from multiple AWS accounts into a single Amazon OpenSearch Service domain. The engineer sets up Amazon Kinesis Data Firehose to deliver logs from each account to the OpenSearch domain. However, some accounts show failed deliveries in the Firehose console. Which configuration is MOST likely causing the failures?

Accepted Answer

The IAM role assumed by Firehose in each account does not have permissions to write to the cross-account OpenSearch domain. Option B is correct because each account must have an IAM role that grants Firehose cross-account access to the OpenSearch domain's destination. Option A is wrong because CloudWatch Logs subscription is not required. Option C is wrong because Kinesis Data Streams is not needed. Option D is wrong because S3 bucket permissions are not relevant for direct Firehose-to-OpenSearch delivery.

Answer

The source accounts do not have a CloudWatch Logs subscription filter to send logs to Firehose

Answer

The Kinesis Data Streams used as the Firehose source is not encrypted

Answer

The OpenSearch domain's access policy does not allow access from the S3 bucket used by Firehose

Question 12

A company wants to monitor CPU utilization of its EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Option A is correct because CloudWatch Alarms can monitor metrics like CPUUtilization and trigger actions. Option B is wrong because CloudTrail tracks API calls. Option C is wrong because AWS Config tracks resource configurations. Option D is wrong because VPC Flow Logs capture network traffic.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 13

A DevOps engineer notices that an Amazon RDS for MySQL instance's CPU is consistently high during business hours. The engineer wants to identify the specific queries causing the high CPU. Which combination of services should be used to capture and analyze the queries? (Choose the best answer.)

Accepted Answer

Enable RDS Performance Insights and analyze the top SQL queries. Option C is correct because RDS Performance Insights provides a dashboard to identify top SQL queries consuming CPU. Option A is wrong because CloudWatch Logs alone doesn't capture queries. Option B is wrong because RDS Enhanced Monitoring provides OS-level metrics, not query-level. Option D is wrong because AWS X-Ray traces requests, not database queries.

Answer

Enable RDS Enhanced Monitoring and view metrics in CloudWatch

Answer

Enable AWS X-Ray tracing on the application and database

Answer

Enable RDS audit logs and stream them to Amazon CloudWatch Logs

Question 14

A company runs a containerized microservices application on Amazon ECS with Fargate. The operations team wants to collect custom application metrics (e.g., request latency, error counts) and send them to CloudWatch. The team wants to avoid managing any servers or agents. Which solution meets these requirements?

Accepted Answer

Use the CloudWatch Embedded Metric Format to emit metrics from the application code as structured logs. Option B is correct because the CloudWatch Embedded Metric Format (EMF) allows applications to output structured JSON logs that CloudWatch automatically converts to metrics, and Fargate tasks can output logs to CloudWatch Logs without an agent. Option A is wrong because the CloudWatch Agent requires running on EC2 or on-premises, not Fargate. Option C is wrong because StatsD requires a server or sidecar agent. Option D is wrong because CloudTrail does not capture custom application metrics.

Answer

Install the CloudWatch Agent in the container image and configure it to collect custom metrics

Answer

Enable AWS CloudTrail for the ECS service to capture API calls and derive metrics

Answer

Run a StatsD daemon in a sidecar container and configure it to forward metrics to CloudWatch

Question 15

An organization wants to ensure that all API calls made in their AWS account are logged for security analysis. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records all API calls made in the account. Option B is wrong because CloudWatch Logs stores logs but does not capture API calls. Option C is wrong because VPC Flow Logs capture network traffic. Option D is wrong because AWS Config tracks resource configuration changes.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs