DOP-C02 Monitoring and Logging Practice Test 7 — 15 Questions

Question 1

A company is using AWS Lambda functions for data processing. The operations team needs to monitor the number of invocations, duration, and error counts for each function. They also want to set alarms when the error rate exceeds 5% in a 5-minute period. Which combination of AWS services should the team use to achieve this with minimal effort?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CloudWatch metrics published by Lambda and create a CloudWatch alarm on the ErrorCount metric with a math expression to calculate error rate.. Lambda automatically publishes invocations, duration, and error metrics to CloudWatch. You can create a CloudWatch alarm with a math expression that divides the ErrorCount by the Invocations metric to calculate the error rate, then set a threshold of 5% over a 5-minute period. This requires minimal effort as the metrics are built-in. Option A is incorrect because CloudTrail logs API calls to Lambda, not function execution metrics. Option B is incorrect because Lambda Insights is an optional feature for detailed performance monitoring, but it is not required for basic metrics and alarms. Option C is incorrect because while Lambda logs are sent to CloudWatch Logs, using Logs Insights to query error rates is more complex than using the pre-existing CloudWatch metrics; moreover, creating alarms on log events requires additional configuration and is not as straightforward as using metric math on the standard ErrorCount metric.

Answer

Use AWS CloudTrail to log Lambda invocations and configure CloudWatch alarms on the log events.

Answer

Enable Lambda Insights to collect detailed metrics and use CloudWatch dashboards to monitor error rates.

Answer

Stream Lambda logs to CloudWatch Logs and use CloudWatch Logs Insights to query error rates, then create alarms.

Question 2

A DevOps engineer is setting up monitoring for an Amazon S3 bucket that stores sensitive data. The engineer needs to be notified whenever an object in the bucket is accessed by a user or application, including read and write operations. Which AWS service should the engineer use to capture these events and trigger notifications?

Accepted Answer

Configure S3 event notifications to send events to an SNS topic for object-level operations.. Amazon S3 can be configured to send event notifications to SNS, SQS, or Lambda for object-level operations (e.g., PutObject, GetObject). This provides real-time notifications for read and write access. Option B is incorrect because CloudTrail data events capture object-level API calls but do not provide real-time notifications; they require additional setup with CloudWatch Logs and alarms. Option C is incorrect because AWS Config records configuration changes, not individual object access events. Option D is incorrect because CloudWatch metrics track bucket-level statistics, not per-object access, and cannot trigger notifications for individual object access.

Answer

Enable AWS CloudTrail data events for the S3 bucket and configure CloudWatch alarms on the log group.

Answer

Use AWS Config to record S3 resource changes and trigger an SNS notification.

Answer

Use Amazon CloudWatch metrics for the S3 bucket and set an alarm on the NumberOfObjects metric.

Question 3

A company uses Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a web application. The DevOps team needs to create a metric filter that parses logs for HTTP status codes (e.g., 4xx and 5xx) and increment a metric. Additionally, they need to create a CloudWatch alarm on the error count. Which of the following are required to achieve this? (Select TWO.)

Accepted Answer

Define the metric filter pattern to match HTTP status codes in the log entries.. The correct answers are B and C. A metric filter must be defined on a log group (option C) to extract metrics, and the filter pattern must match the HTTP status codes in the log entries (option B). Option A is not required because CloudWatch Logs can publish metrics without an additional IAM role; the log group already has sufficient permissions. Option D is incorrect because subscription filters are for streaming logs to other destinations, not for creating metrics. Option E is not required because the CloudWatch Logs agent or the unified CloudWatch agent can send logs, but the question does not specify which agent; the default agent suffices.

Answer

Create an IAM role that allows CloudWatch Logs to read the log data and publish metrics.

Answer

Configure a subscription filter to forward the logs to a Lambda function that creates the metric.

Answer

Install the CloudWatch Agent on the EC2 instances to send the logs.

Question 4

A DevOps engineer is designing a monitoring solution for a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS database. The engineer needs to monitor the health of each component and receive alerts when any component becomes unhealthy. Which of the following CloudWatch metrics should the engineer monitor? (Select THREE.)

Accepted Answer

EC2's StatusCheckFailed metric.. (EC2's StatusCheckFailed metric) is correct because it directly indicates whether an EC2 instance is healthy (e.g., hardware or OS issues). Option D (ALB's HealthyHostCount metric) is correct because it shows the number of registered targets that are considered healthy. Option E (RDS's DatabaseConnections metric) is correct because it can indicate if the database is overwhelmed or unavailable (e.g., reaching max connections). Option A (RDS's ReadLatency) is incorrect because it measures performance, not health directly; a database can have high read latency but still be operational. Option B (ALB's RequestCount metric) is incorrect because it measures traffic volume, not the health of targets.

Answer

RDS's ReadLatency metric.

Answer

Application Load Balancer's RequestCount metric.

Question 5

Refer to the exhibit. A DevOps engineer runs the above CloudWatch Logs Insights query on a log group containing application logs. The query returns an empty result set. The engineer knows that the application logs contain ERROR entries. Which of the following is the most likely cause?

Accepted Answer

The filter pattern is case-sensitive and the log entries use lowercase 'error'.. The filter pattern 'like /ERROR/' is case-sensitive. If the log entries contain 'error' in lowercase, the filter will not match and the query returns an empty result set. Option A is incorrect because the stats function can be used with the filter command in CloudWatch Logs Insights. Option B is incorrect because the scenario states that the application logs are present, so the log group must have log streams. Option D is incorrect because the limit of 20 results does not cause a timeout; it simply limits the number of results returned.

Answer

The stats function cannot be used with the filter command.

Answer

The log group does not have any log streams.

Answer

The limit of 20 results is too low and the query times out.

Question 6

A company runs a critical e-commerce application on AWS. The architecture includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server, and an Amazon RDS MySQL Multi-AZ database. The DevOps team has implemented CloudWatch dashboards to monitor key metrics. Recently, customers have reported that the website becomes unresponsive for a few minutes during peak traffic hours. The team reviews the CloudWatch metrics and observes that during the incidents, the ALB's 'TargetResponseTime' metric spikes, and the RDS 'ReadLatency' and 'WriteLatency' metrics also spike. However, the EC2 CPU utilization and memory usage remain normal. The ALB health check shows 'Healthy' for all targets. The team needs to identify the root cause. Which course of action should the team take?

Accepted Answer

Enable Performance Insights on the RDS instance to analyze database performance and identify slow queries.. The symptoms point to database contention (spikes in read/write latency) while the application servers are healthy. Enabling Performance Insights on RDS will help identify the specific queries causing the latency, such as slow queries or locks. Option A is wrong because adding more EC2 instances doesn't address the database bottleneck. Option B is wrong because the issue is not related to ALB configuration. Option D is wrong because scaling the ALB is not the issue.

Answer

Configure the ALB to add a second listener and distribute traffic across multiple target groups.

Answer

Review the ALB access logs to identify if there are any unusual request patterns causing the latency.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances to handle the load.

Question 7

A DevOps engineer is tasked with setting up monitoring for a serverless application that uses AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The engineer needs to create a centralized dashboard that displays the number of Lambda invocations, API Gateway request counts, and DynamoDB consumed read/write capacity units. The dashboard should be accessible to the operations team without requiring AWS Management Console login. The engineer also wants to set up email alerts when the DynamoDB consumed capacity exceeds 80% of the provisioned capacity. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create a CloudWatch dashboard with the relevant metrics and set CloudWatch alarms on DynamoDB consumed capacity. Share the dashboard as a public read-only dashboard.. CloudWatch Dashboards can be shared publicly as a read-only dashboard without requiring AWS credentials. The metrics for Lambda, API Gateway, and DynamoDB are automatically available in CloudWatch, and no additional setup is needed. Alarms can be set on DynamoDB's ConsumedReadCapacityUnits and ConsumedWriteCapacityUnits metrics to trigger email alerts via SNS. Option A (QuickSight) is incorrect because it requires additional setup and cost, and is not the simplest approach for this use case. Option B (CloudWatch Logs Insights) is incorrect because it is designed for querying log data, not for creating a metrics dashboard; it would not directly display the required metrics. Option C is incorrect because sharing a CloudWatch dashboard does not require Amazon Cognito; dashboards can be shared via a public URL without additional authentication mechanisms.

Answer

Use Amazon QuickSight to connect to CloudWatch metrics and create a dashboard with email alerts.

Answer

Use CloudWatch Logs Insights to query the logs of each service and create a dashboard from the results.

Answer

Create a CloudWatch dashboard and share it using Amazon Cognito to grant access to the operations team.

Question 8

A company has deployed a containerized application on Amazon ECS with Fargate. The application is fronted by an Application Load Balancer (ALB). The DevOps team is using CloudWatch Container Insights to monitor the ECS cluster. They notice that the 'MemoryUtilized' metric for the service is consistently above 80%, and the 'CPUUtilized' is around 50%. The ALB's 'TargetResponseTime' is increasing over time. The team wants to resolve the performance issue. Which action should the team take?

Accepted Answer

Increase the memory limit for the ECS task definition to allow the container to use more memory.. The high memory utilization (above 80%) is likely causing performance degradation due to memory pressure. Increasing the memory limit for the ECS task definition allows the container to use more memory, which can reduce swapping and improve response times. Option B (increase CPU) is not the best action because CPU utilization is only 50%, so CPU is not the bottleneck. Option C (increase ALB targets) does not address the container's memory constraints. Option D (increase desired count) may distribute load but each task is still memory-constrained; fixing the memory limit is more direct.

Answer

Increase the CPU limit for the ECS task definition to improve performance.

Answer

Increase the number of ALB targets by adding more availability zones.

Answer

Increase the desired count of the ECS service to distribute the load across more tasks.

Question 9

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to monitor the CloudFormation stack events to detect when stack creation or updates fail, and automatically send notifications to a Slack channel. The team has set up an Amazon SNS topic that sends messages to a Slack webhook via a Lambda function. Which solution should the team implement to trigger the SNS topic when a CloudFormation stack fails?

Accepted Answer

Configure the CloudFormation stack to send events to an SNS topic by specifying the topic ARN in the stack's notification options.. CloudFormation allows you to specify an SNS topic ARN in the stack's notification options (using the `--notification-arns` parameter or the `NotificationARNs` property in the template). When you specify a topic, CloudFormation publishes all stack events (including failures) to that topic. This provides a direct, real-time notification mechanism. Option A is incorrect because CloudFormation logs are not automatically streamed to CloudWatch Logs; you would need to enable logging, and Logs Insights queries are not designed for real-time event-driven notifications. Option C (CloudTrail + metric filter) is a viable but more complex approach, requiring additional setup and incurring extra costs. Option D (EventBridge rule targeting SNS) could work but requires creating a rule that matches CloudFormation API calls recorded by CloudTrail; this is an indirect method and not as straightforward as specifying the SNS topic directly in the stack.

Answer

Use CloudWatch Logs Insights to query CloudFormation logs and set up a scheduled query to send results to SNS.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and create a CloudWatch metric filter that detects failure messages, then trigger an alarm to SNS.

Answer

Create an Amazon EventBridge rule that matches CloudFormation API calls for CreateStack and UpdateStack with a status of CREATE_FAILED or UPDATE_FAILED, and set the target to the SNS topic.

Question 10

A company runs a critical e-commerce application on AWS. The application is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The instances store session data in an ElastiCache for Redis cluster. Recently, users have reported intermittent session timeouts during peak traffic hours. The operations team notices that CloudWatch alarms for the Redis cluster's CPUUtilization and Evictions metrics are frequently breaching thresholds. The team wants to resolve the issue without incurring unnecessary costs. Which solution should the team implement?

Accepted Answer

Enable auto scaling for the ElastiCache Redis cluster to add replicas or shards based on CPU and memory utilization.. Enabling auto scaling for the ElastiCache Redis cluster (with automatic scaling of replicas or shards based on CPU and memory utilization) directly addresses the root cause of session timeouts: resource contention (high CPU and evictions) during peak traffic. Auto scaling ensures the cluster has sufficient capacity to handle load without manual intervention, optimizing cost by scaling only when needed. Option A is incorrect because offloading session data to DynamoDB with DAX adds complexity and latency; it does not directly resolve the existing Redis resource constraints and may introduce consistency issues. Option C is incorrect because enabling encryption in transit (TLS) adds CPU overhead for encryption/decryption, which could exacerbate CPU utilization rather than reduce it. Option D is incorrect because migrating to a memory-optimized instance type (e.g., r6g.large) increases memory capacity but does not guarantee CPU improvement; the issue involves high CPU and evictions, which may require scaling horizontally or vertically with balanced resources, and auto scaling is more cost-effective than a static upgrade.

Answer

Configure a Lambda function to offload session data to Amazon DynamoDB and use DAX for caching.

Answer

Enable encryption in transit (TLS) for the Redis cluster to reduce overhead.

Answer

Migrate the Redis cluster to a memory-optimized instance type like r6g.large.

Question 11

A DevOps engineer is responsible for monitoring a set of microservices running on Amazon ECS with Fargate. The services are fronted by an Application Load Balancer (ALB). The engineer needs to collect and analyze application logs centrally with minimal latency and operational overhead. The logs should be searchable and retainable for 90 days. Which solution meets these requirements?

Accepted Answer

Deploy the CloudWatch agent as a Daemon service on the ECS cluster to collect logs from all tasks and forward them to CloudWatch Logs.. The CloudWatch agent can be deployed as a Daemon service on the ECS cluster to collect logs from all tasks and forward them to CloudWatch Logs. This provides near real-time search, configurable retention (up to 90 days), and minimal latency with low operational overhead. Option B is wrong because FireLens is a container log driver that sends logs directly to a destination; while it can send to CloudWatch Logs, it requires per-task configuration and does not aggregate logs from all tasks as seamlessly as a Daemon service. Option C is wrong because storing logs in S3 introduces latency and requires additional services like Athena for querying, increasing operational overhead and not meeting the minimal latency requirement. Option D is wrong because using a sidecar container for every task increases cost and complexity, and Kinesis Data Firehose adds latency compared to direct CloudWatch Logs ingestion.

Answer

Use the FireLens log driver in the ECS task definition to send logs to Amazon CloudWatch Logs.

Answer

Configure the ECS tasks to write logs to Amazon S3 and use Amazon Athena to query the logs.

Answer

Add a sidecar container to each ECS task that streams logs to Amazon Kinesis Data Firehose, which delivers to Amazon OpenSearch Service.

Question 12

A company runs a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application processes financial transactions. The DevOps team needs to monitor for duplicate transactions that could occur due to retries. The team wants to set up an alert when the number of duplicate transaction attempts exceeds 10 in a 5-minute window. The application logs each transaction attempt with a unique transaction ID to CloudWatch Logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Logs metric filter that counts log events containing 'DuplicateTransaction' and set an alarm on the metric with a threshold of 10.. A CloudWatch Logs metric filter can parse log events for the pattern 'DuplicateTransaction' and create a custom metric, which can then trigger a CloudWatch alarm when the count exceeds 10 in a 5-minute window. This approach leverages existing logs without requiring code changes or additional services, making it the most efficient.

Answer

Use DynamoDB Streams to trigger a Lambda function that counts duplicates and publishes metrics.

Answer

Stream the CloudWatch Logs to Amazon Kinesis Data Analytics and use SQL queries to detect duplicates.

Answer

Modify the Lambda function to publish a custom metric to CloudWatch for each duplicate transaction, then set an alarm.

Question 13

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team wants to set up real-time monitoring for specific error patterns and trigger remediation actions. Which TWO services can process the log events in real time and invoke an AWS Lambda function for remediation? (Choose two.)

Accepted Answer

Stream log events to Amazon Kinesis Data Streams and configure a Lambda function to process the stream.. Options A and B are correct. CloudWatch Logs can stream log events in real time using subscription filters. These filters can deliver log events directly to a Lambda function (Option B) or to Amazon Kinesis Data Streams, which can then be processed by a Lambda function (Option A). Option C is incorrect because Amazon EventBridge cannot directly subscribe to CloudWatch Logs log groups; it can receive events from other services but not process log streams in real time. Option D (SQS) introduces latency due to polling and is not designed for real-time streaming. Option E (SNS) is a push notification service and does not natively receive log events from CloudWatch Logs.

Answer

Create an Amazon EventBridge rule that matches on CloudWatch Logs log group events.

Answer

Configure the log group to send log events to an Amazon SQS queue, and have the Lambda function poll the queue.

Answer

Publish log events to an Amazon SNS topic and subscribe the Lambda function.

Question 14

A company runs a microservices architecture on Amazon EKS. The DevOps team wants to monitor application performance and detect anomalies in request latency. They need to collect metrics, logs, and traces from all services. Which THREE AWS services should the team use together to implement a complete observability solution? (Choose three.)

Accepted Answer

AWS X-Ray. Options A, B, and E are correct. AWS X-Ray (Option A) provides distributed tracing to trace requests across microservices. Amazon CloudWatch Container Insights (Option E) collects, aggregates, and summarizes metrics and logs from containerized applications on EKS. AWS CloudWatch ServiceLens (Option B) unifies CloudWatch metrics and logs with X-Ray traces to provide a single view for observability. Option C (AWS CloudTrail) is for auditing API calls, not application performance. Option D (Amazon Managed Service for Prometheus) is a separate monitoring service but is not part of the native AWS observability stack as described; the combination of X-Ray, Container Insights, and ServiceLens provides a complete solution.

Answer

AWS CloudTrail

Answer

Amazon Managed Service for Prometheus

Question 15

A company is using Amazon CloudWatch to monitor its production environment. The operations team receives alerts for the same underlying issue from multiple alarms, causing alert fatigue. The team wants to reduce noise and consolidate alerts into actionable notifications. Which TWO steps should the team take? (Choose two.)

Accepted Answer

Configure the CloudWatch alarms to publish to an SNS topic, and use SNS subscription filter policies to route only critical notifications.. You can configure CloudWatch alarms to publish to an SNS topic and use SNS subscription filter policies to route only critical notifications, thereby reducing noise. Option C is correct because CloudWatch composite alarms allow you to combine multiple alarms into a single alarm that triggers only when specific conditions (e.g., AND/OR logic) are met, consolidating alerts for the same underlying issue. Option B is incorrect because CloudWatch Evidently is used for running experiments and feature flags, not for alert consolidation. Option D is incorrect because CloudWatch Logs Insights is a tool for querying log data, not for combining alarms. Option E is incorrect because AWS Config rules are designed to evaluate resource compliance, not to suppress alarms.

Answer

Use CloudWatch Evidently to run experiments and filter out false alarms.

Answer

Use CloudWatch Logs Insights to query logs and create alarms based on the query results.

Answer

Use AWS Config rules to automatically suppress alarms that are not compliant.