DOP-C02 Monitoring and Logging Practice Test 8 — 15 Questions

Question 1

A company is using a centralized logging solution with Amazon OpenSearch Service. The DevOps team notices that logs from some EC2 instances are missing. The CloudWatch agent is installed and configured on all instances. What should the team do to troubleshoot the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the CloudWatch agent log file located at /var/log/amazon/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log.. The CloudWatch agent writes detailed operational logs to /var/log/amazon/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log. This file contains errors, warnings, and debug messages that can reveal why logs from specific EC2 instances are not being delivered to Amazon OpenSearch Service. Checking this log is the first and most direct troubleshooting step because it captures agent-level issues such as configuration errors, network connectivity failures, or permission problems.

Answer

Check the CloudWatch agent status using the CloudWatch agent status command.

Answer

Configure a Lambda function to poll the CloudWatch agent for logs.

Answer

Verify that the EC2 instances have an SQS queue configured for log delivery.

Question 2

A company is running a critical application on Amazon ECS with Fargate. The application generates custom metrics that are published to CloudWatch using the PutMetricData API. Recently, the metrics have been delayed by up to 5 minutes. The DevOps team needs to reduce the latency. What should the team do?

Accepted Answer

Set the StorageResolution parameter to 1 when calling PutMetricData.. Setting the StorageResolution parameter to 1 when calling PutMetricData enables high-resolution metrics with a 1-second granularity. This reduces the latency of metric ingestion and retrieval because CloudWatch processes high-resolution metrics more quickly than standard 60-second resolution metrics, addressing the 5-minute delay.

Answer

Install the CloudWatch agent on the Fargate tasks to collect metrics.

Answer

Publish the metrics as structured logs to CloudWatch Logs and use metric filters.

Answer

Increase the frequency of PutMetricData calls to every 5 seconds.

Question 3

A DevOps engineer needs to set up an alert for when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which CloudWatch features should be used?

Accepted Answer

CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and threshold of 90.. CloudWatch alarms can be configured on the `CPUUtilization` metric (a standard EC2 metric emitted every 5 minutes by default) with a threshold of 90 and an evaluation period of 1 (since the period is set to 5 minutes, one evaluation period covers the 5 consecutive minutes). This directly meets the requirement without additional setup.

Answer

CloudWatch Logs with a metric filter on CPU utilization logs.

Answer

CloudTrail to monitor EC2 instance CPU usage.

Answer

Amazon S3 server access logs to check CPU utilization.

Question 4

A company is using AWS X-Ray to trace requests through a microservices application. Some traces are incomplete, showing only the root segment without any subsegments. The application uses the X-Ray SDK for Java. What is the most likely cause?

Accepted Answer

The sampling rate is set to a low value, causing many requests to be dropped.. A low sampling rate in the X-Ray SDK causes the SDK to drop many requests before they are sent to the daemon. When the sampling rate is too low, the SDK may decide not to record subsegments for a given request, resulting in traces that contain only the root segment without any subsegments. This is a common misconfiguration where the sampling decision is made at the segment level, and subsegments are only generated if the segment is sampled in.

Option A is incorrect because the x-amzn-trace-id header is not required for tracing; the SDK can generate its own trace ID.

Option B is incorrect because segment documents that exceed the maximum size are rejected by the API, not silently ignored.

Option C is incorrect because the X-Ray daemon is required for the SDK to send traces to the X-Ray API. If the daemon is not running, the SDK cannot send segments, resulting in no traces at all, not incomplete traces with only root segments. The incomplete traces described are typically due to sampling issues.

Answer

The application is missing the x-amzn-trace-id header in incoming requests.

Answer

The segment document size exceeds the maximum allowed size.

Answer

The X-Ray daemon is not running on the EC2 instances.

Question 5

A DevOps team needs to monitor failed API calls in their AWS account. They want to receive notifications when specific IAM actions, such as DeleteBucket, fail. Which service should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge.. AWS CloudTrail captures API calls, and Amazon EventBridge (formerly CloudWatch Events) can be used to create rules that match specific failed API calls (e.g., DeleteBucket) and trigger notifications. Option B is incorrect because AWS Config rules monitor resource configuration compliance, not API call failures. Option C is incorrect because S3 server access logs log requests made to an S3 bucket, not IAM API calls. Option D is incorrect because CloudWatch Logs and metric filters are used to monitor log data, but they are not the primary service for capturing API calls; CloudTrail is needed for that.

Answer

AWS Config rules.

Answer

Amazon S3 server access logs.

Answer

CloudWatch Logs and metric filters.

Question 6

A company wants to visualize the performance of their application running on EC2. They need to create a dashboard that shows CPU utilization, memory usage, and disk I/O. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch Dashboards.. Amazon CloudWatch Dashboards can display metrics from EC2 and the CloudWatch agent, including memory and disk metrics. Option B is wrong because AWS CloudTrail is for auditing API calls, not for visualization. Option C is wrong because AWS Systems Manager is for management and automation, not for creating dashboards. Option D is wrong because Amazon QuickSight is for business intelligence, not infrastructure monitoring.

Answer

AWS CloudTrail.

Answer

AWS Systems Manager.

Answer

Amazon QuickSight.

Question 7

A company is using Amazon RDS for MySQL and needs to monitor the number of slow queries. They have enabled slow query logs. How can they effectively monitor and alert on the number of slow queries per minute?

Accepted Answer

Publish slow query logs to CloudWatch Logs, create a metric filter, and set an alarm.. Slow query logs from RDS MySQL can be published to CloudWatch Logs. Once the logs are in CloudWatch Logs, you can create a metric filter to count the number of slow queries per minute and set a CloudWatch alarm on that metric to alert when the count exceeds a threshold. Option A is incorrect because RDS Events provide notifications about instance events (e.g., failover, maintenance), not slow query metrics. Option B is incorrect because Enhanced Monitoring provides OS-level metrics (e.g., CPU, memory) but not slow query log data. Option C is incorrect because CloudTrail records API calls made to AWS services, not SQL queries executed within RDS.

Answer

Use RDS Events to send slow query metrics to CloudWatch.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Use AWS CloudTrail to monitor SQL queries.

Question 8

A DevOps engineer is setting up centralized logging for multiple AWS accounts. They need to collect VPC Flow Logs, CloudTrail logs, and application logs into a single Amazon S3 bucket. What is the most efficient approach?

Accepted Answer

Use an S3 bucket in a centralized logging account with a bucket policy that grants write access from all other accounts.. It uses a centralized logging account with a single S3 bucket configured with a bucket policy that grants write access (s3:PutObject) to all other accounts. This approach avoids data duplication, eliminates the need for replication or intermediate compute resources, and is the most efficient and cost-effective method for aggregating logs from multiple accounts into a single destination.

Answer

Configure a Lambda function in each account to copy logs to a central S3 bucket.

Answer

Create an S3 bucket in each account and use S3 replication.

Answer

Use Amazon Kinesis Data Firehose to stream logs from all accounts to a central S3 bucket.

Question 9

A company wants to receive real-time notifications when their Auto Scaling group launches or terminates EC2 instances. Which AWS service should they use?

Accepted Answer

Amazon SNS notifications from the Auto Scaling group.. Auto Scaling groups can send lifecycle notifications directly to Amazon SNS topics, enabling real-time notifications via email, SMS, or Lambda functions. Option A is wrong because the GroupTotalInstances metric is a CloudWatch metric that reflects the total number of instances, but it does not provide real-time lifecycle event notifications; CloudWatch alarms would only alert based on threshold breaches. Option B is wrong because AWS Config rules evaluate resource configurations and compliance, not real-time instance launch/terminate events. Option C is wrong because AWS CloudTrail records API calls for auditing and governance, but it does not provide real-time event-driven notifications.

Answer

Amazon CloudWatch alarm on the GroupTotalInstances metric.

Answer

AWS Config rules to detect changes in Auto Scaling groups.

Answer

AWS CloudTrail to monitor Auto Scaling API calls.

Question 10

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search and analyze logs from multiple EC2 instances in real time. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

Amazon OpenSearch Service.. CloudWatch Logs can stream logs to Amazon OpenSearch Service for real-time search and analytics. Option E is correct because CloudWatch Logs Insights allows real-time querying of log groups directly within CloudWatch. Option B is incorrect: Amazon Athena is designed for querying data in S3, not for real-time log search from EC2 instances. Option C is incorrect: Amazon QuickSight is a business intelligence service for visualization, not real-time log search. Option D is incorrect: Amazon Kinesis Data Analytics is for analyzing streaming data, not directly searching CloudWatch Logs.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Answer

Amazon Kinesis Data Analytics.

Question 11

A company runs a containerized application on Amazon ECS with Fargate. They want to monitor the application logs and metrics. Which THREE steps should they take to collect and visualize this data? (Choose THREE.)

Accepted Answer

Create a CloudWatch Dashboard to display logs and metrics.. CloudWatch Dashboards can display both logs and metrics, allowing visualization of application data collected from ECS tasks. Option C is correct because the awslogs log driver sends container logs to CloudWatch Logs directly from the ECS task definition. Option E is correct because the CloudWatch agent can be deployed as a sidecar container to collect custom metrics and logs from the application. Option B is incorrect because AWS CloudFormation is used for infrastructure provisioning and management, not for monitoring resource metrics. Option D is incorrect because AWS X-Ray is designed for tracing and analyzing requests, not for collecting logs or application metrics.

Answer

Use AWS CloudFormation to monitor resource metrics.

Answer

Use AWS X-Ray to trace requests and collect logs.

Question 12

A DevOps engineer needs to monitor the health of a web application running on EC2 instances behind an Application Load Balancer (ALB). Which TWO metrics from ALB should be monitored to detect application errors? (Choose TWO.)

Accepted Answer

HTTPCode_Target_5XX_Count.. (HTTPCode_Target_5XX_Count) is correct because it counts HTTP 5XX errors returned by the target (EC2 instances), indicating application errors. Option E (TargetResponseTime) is correct because elevated response times can indicate application performance issues or errors, and is a key metric for detecting application problems. Option A (RequestCount) is incorrect because it simply counts total requests, not errors. Option B (HTTPCode_ELB_5XX_Count) is incorrect because it counts 5XX errors generated by the ALB itself (e.g., due to configuration issues), not application errors. Option D (HealthyHostCount) is incorrect because it indicates the number of healthy targets, not application-level errors.

Answer

RequestCount.

Answer

HTTPCode_ELB_5XX_Count.

Answer

HealthyHostCount.

Question 13

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing intermittent errors. The DevOps engineer needs to identify if the errors are caused by the application or the underlying infrastructure. Which solution provides the MOST detailed visibility into the application's behavior?

Accepted Answer

Instrument the application with AWS X-Ray SDK and analyze traces. AWS X-Ray provides end-to-end tracing of requests as they travel through the application, allowing the engineer to pinpoint where errors occur. Option A is wrong because CloudWatch metrics only show aggregate data, not per-request details. Option B is wrong because VPC Flow Logs capture network traffic metadata, not application-level errors. Option D is wrong because CloudTrail records API calls, not application errors.

Answer

Enable VPC Flow Logs and analyze traffic patterns

Answer

Enable AWS CloudTrail and monitor for API errors

Answer

Enable detailed CloudWatch metrics on the EC2 instances and ALB

Question 14

A DevOps team is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a custom application. The team notices that logs are missing from some instances intermittently. The CloudWatch agent configuration is identical across all instances. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent's state file has become corrupted due to disk full condition. The CloudWatch Logs agent uses a state file to track which log events have been sent. If the disk becomes full, the state file can become corrupted, causing the agent to lose track of progress and intermittently skip or re-send logs. The identical agent configuration suggests an environmental issue like disk full. Options B, C, and D are incorrect: VPC Flow Logs do not interfere with CloudWatch Logs; CPU credits do not directly cause log loss; IAM role rotation would cause consistent failure, not intermittent issues.

Answer

The VPC Flow Logs are consuming all available network bandwidth

Answer

The EC2 instances are running out of CPU credits, causing the agent to skip log batches

Answer

The IAM role attached to the instances has been rotated incorrectly

Question 15

A company is using AWS CloudFormation to deploy a microservices architecture. The operations team wants to receive real-time notifications when any stack operation fails. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack state changes, including failures, and trigger an Amazon SNS topic to send real-time notifications. Therefore, options D (CloudWatch Events/EventBridge) and E (SNS) are correct. Option A is incorrect because AWS Lambda alone does not provide notification capabilities; it would need to be triggered by another service. Option B is incorrect because CloudWatch Logs stores logs but does not natively trigger notifications for stack failures. Option C is incorrect because AWS CloudTrail records API activity for auditing, not real-time stack event notifications.

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail