DOP-C02 Monitoring and Logging Practice Test 8 — 15 Questions

Question 1

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CloudWatch Logs Insights to run queries across multiple log groups.. Option A is correct because CloudWatch Logs Insights natively supports querying across multiple log groups in a single query — you can select up to 50 log groups in the console or specify multiple log group ARNs/names in the StartQuery API, and use the query syntax (fields, filter, stats, parse) to search for a specific error pattern. Option B is correct because exporting CloudWatch Logs to Amazon S3 (via CreateExportTask or subscription filters) and then querying the exported data with Amazon Athena lets you run SQL across many log groups' data at once, which is a standard approach for cross-log-group searching and analysis. Option C is not correct because installing the CloudWatch Logs agent and tailing logs only reads logs on a single EC2 instance and does not provide cross-log-group search capability. Option D is not correct because a custom Lambda function reading each log group would be a bespoke, inefficient workaround rather than a supported cross-log-group search feature, and it is not the intended solution. Option E is not correct because Kinesis Data Analytics processes streaming data for real-time analytics, not for searching historical log data across multiple CloudWatch log groups.

Answer

Install the CloudWatch Logs agent on an EC2 instance and tail the logs.

Answer

Create a Lambda function that reads logs from each log group and searches for the pattern.

Answer

Use Amazon Kinesis Data Analytics to process the log streams.

Question 2

A company runs a critical application on Amazon EKS. The operations team needs to monitor the health of the Kubernetes cluster and the applications running on it. Which THREE services can be used together to achieve comprehensive monitoring? (Choose THREE.)

Accepted Answer

AWS X-Ray. AWS X-Ray (A) is correct because it provides distributed tracing for applications running on EKS, letting the team follow requests across microservices and pinpoint latency or errors in the application layer. Amazon CloudWatch Container Insights (D) is correct because it collects and aggregates container-level metrics and logs (CPU, memory, disk, network) from EKS nodes and pods, giving cluster and workload health visibility. Amazon Managed Service for Prometheus (E) is correct because it is a Prometheus-compatible managed service that scrapes and stores Kubernetes metrics and supports alerting, complementing Container Insights for deeper, PromQL-based monitoring. Amazon VPC Flow Logs (B) only captures IP traffic metadata at the network interface level and does not provide application or Kubernetes-level health insight. AWS CloudTrail (C) records AWS API activity for auditing and governance, not runtime health or performance monitoring of the cluster or its applications.

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 3

A DevOps engineer needs to monitor the memory utilization of an Amazon EC2 instance running a critical application. Which AWS service should be used to collect and track this metric?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service for monitoring memory utilization of EC2 instances. CloudWatch can collect custom metrics like memory utilization via the CloudWatch Agent. AWS CloudTrail (A) records API calls, not memory metrics. AWS X-Ray (B) traces application requests, not system metrics. AWS Config (C) records resource configuration changes, not utilization metrics.

Answer

AWS CloudTrail

Answer

AWS X-Ray

Answer

AWS Config

Question 4

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the KMS key with the CloudWatch log group using the console or CLI. CloudWatch Logs supports encryption at rest with a customer-managed KMS key by associating that key with the log group. This is done via the console or CLI (e.g., aws logs associate-kms-key), and once set, all log data in that group is encrypted with the specified CMK. This directly satisfies the security team's requirement for customer-managed key encryption.

Answer

Configure the CloudWatch agent to encrypt logs before sending

Answer

Create a KMS key and attach a policy allowing CloudWatch Logs to use it

Answer

Enable default encryption on the S3 bucket that stores logs

Question 5

An e-commerce application runs on Amazon ECS with Fargate. The operations team notices that the application's latency increases during peak hours. The engineer needs to correlate high CPU usage with increased request latency to identify the root cause. Which approach should be used?

Accepted Answer

Enable Container Insights and ServiceLens to correlate metrics and traces. Amazon CloudWatch Container Insights collects, aggregates, and summarizes metrics and logs from containerized applications on ECS/Fargate, including CPU utilization. ServiceLens integrates CloudWatch with AWS X-Ray traces, allowing you to correlate metrics with request traces and latency. Together they provide the end-to-end visibility needed to link high CPU usage with increased request latency.

Answer

Use CloudWatch Logs Insights to query container logs

Answer

Configure CloudWatch Synthetics canaries to measure latency

Answer

Set up a Prometheus server on an EC2 instance to scrape container metrics

Question 6

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team needs to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the audit account, and that any log file validation failures trigger an immediate notification. What should the engineer do to meet this requirement?

Accepted Answer

Enable CloudTrail log file validation and create a CloudWatch alarm on the DigestDeliveryFailed metric. Enabling CloudTrail log file validation triggers the generation of digest files that contain hash values for verifying log file integrity. CloudTrail also emits the DigestDeliveryFailed metric to CloudWatch when a digest file delivery fails. Creating a CloudWatch alarm on this metric allows you to send immediate notifications via SNS when a validation failure occurs. Option B (Lambda function) is unnecessary because CloudTrail already provides the necessary metrics for this alerting. Option C (SNS notifications for all events) would generate excessive notifications and does not directly address log file validation failures. Option D (CloudWatch Logs and metric filter) is not the standard approach; CloudTrail directly emits the DigestDeliveryFailed metric, which is simpler and more reliable.

Answer

Create a Lambda function that checks the integrity of logs and publishes to SNS

Answer

Configure CloudTrail to deliver logs to the S3 bucket and enable SNS notifications for all events

Answer

Send CloudTrail logs to CloudWatch Logs and create a metric filter for validation errors

Question 7

A company runs a microservices application on Amazon EKS. The DevOps team wants to collect and visualize metrics such as pod CPU and memory usage, and set up alerts. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Container Insights and CloudWatch Alarms. Amazon CloudWatch Container Insights and CloudWatch Alarms. Container Insights collects, aggregates, and summarizes metrics and logs from containerized applications and microservices running on Amazon EKS. It provides pre-built dashboards for pod CPU, memory, network, and disk metrics. CloudWatch Alarms can be set on these metrics to trigger notifications or automated actions. Option A (Prometheus and Grafana on EC2) is possible but not an AWS service combination; it requires manual setup and maintenance. Option B (AWS X-Ray and Amazon CloudWatch ServiceLens) is for distributed tracing and service maps, not for collecting CPU/memory metrics. Option C (AWS CloudTrail and Amazon CloudWatch Logs) is for auditing API calls and storing log data, not for metrics visualization and alerting.

Answer

Prometheus and Grafana on EC2

Answer

AWS X-Ray and Amazon CloudWatch ServiceLens

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 8

A DevOps engineer needs to centralize logs from multiple AWS accounts into a single CloudWatch Logs account. Which feature should be used?

Accepted Answer

CloudWatch Logs cross-account subscription. CloudWatch Logs cross-account subscription (Option D) allows you to stream log data from multiple source AWS accounts to a single destination account's CloudWatch Logs log group. This is the native, managed feature designed specifically for centralizing logs across accounts without needing additional infrastructure or data transformation.

Answer

CloudWatch Logs Insights

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 9

A company uses Amazon RDS for MySQL. The database performance has degraded, and the engineer suspects that slow queries are the cause. Which service should be used to identify and analyze the slow queries?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct service because it provides a database-specific performance schema that visualizes database load and identifies the exact SQL queries causing performance degradation. It integrates directly with RDS for MySQL, offering a dashboard that breaks down wait events, SQL text, and host-level metrics, making it the ideal tool for analyzing slow queries.

Answer

Amazon CloudWatch Metrics

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 10

A company is using AWS Lambda to process streaming data from Amazon Kinesis. The processing rate is slower than expected, and the engineer needs to monitor the number of records that are failing processing. Which metric should be used to create a CloudWatch alarm?

Accepted Answer

IteratorAge. The IteratorAge metric measures the age of the last record in the Lambda function's iterator, indicating how far behind real-time the processing is. A high or increasing IteratorAge suggests that records are being retried or stuck due to processing failures, making it the correct metric to monitor for records failing processing in a Kinesis-triggered Lambda.

Answer

Invocations

Answer

Errors

Answer

Throttles

Question 11

A DevOps engineer needs to set up centralized logging for an application running on multiple EC2 instances across different AWS accounts. The logs must be aggregated in a single S3 bucket and also be analyzed in near real-time. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon Kinesis Data Firehose. Option B, Amazon Kinesis Data Firehose, is correct because it can ingest streaming log data and reliably deliver it to a single S3 bucket, with optional near real-time transformation and buffering, satisfying both the aggregation and near real-time analysis requirements. Option D, Amazon CloudWatch Logs subscription, is correct because a subscription filter on a CloudWatch log group can stream log events in near real time to Kinesis Data Firehose, enabling centralized collection from EC2 instances across multiple AWS accounts. Together, CloudWatch Logs subscriptions feed Firehose, which delivers the aggregated logs to S3. Option A, Amazon SQS, is not appropriate because it is a message queue, not a log ingestion or delivery service to S3. Option C, AWS CloudTrail, records API activity rather than application logs, so it does not meet the application logging requirement. Option E, AWS Lambda, is compute for processing events and is not the primary service for aggregating logs into S3.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Answer

AWS Lambda

Question 12

A company wants to ensure that all changes to its Amazon S3 bucket policies are logged for auditing purposes. Which TWO AWS services should be enabled to capture these changes?

Accepted Answer

AWS Config. Options B and E are correct because AWS Config records resource configuration changes, including S3 bucket policies, and AWS CloudTrail logs API calls such as PutBucketPolicy. Option A is incorrect because Amazon CloudWatch monitors operational metrics and logs, not auditing of policy changes. Option C is incorrect because Amazon GuardDuty provides threat detection, not audit logging. Option D is incorrect because VPC Flow Logs capture network traffic, not configuration changes.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 13

A DevOps engineer is tasked with setting up a centralized logging solution for a multi-account AWS environment. Which service should be used to aggregate logs from multiple accounts?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription. Amazon CloudWatch Logs can aggregate logs across accounts using cross-account subscriptions with a central destination (e.g., Kinesis or Lambda). Option C is correct. Option A is incorrect because S3 is a storage service, not for real-time aggregation. Option B is incorrect as CloudTrail is for API activity, not application logs. Option D is incorrect because AWS Config is for configuration compliance.

Answer

Amazon S3 with cross-region replication

Answer

AWS CloudTrail with organization trails

Answer

AWS Config with aggregated compliance rules

Question 14

A company runs a critical application on Amazon ECS with Fargate. The DevOps engineer wants to receive alerts when the application's error rate exceeds 5% over a 5-minute period. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch Logs metric filter to count errors, then a CloudWatch alarm.. The correct solution is to use Amazon CloudWatch Logs metric filter to count errors from application logs, which creates a custom metric representing the error count or rate. Then, a CloudWatch alarm can be configured on that metric to trigger when the error rate exceeds 5% over a 5-minute period. Option C is correct. Option A is incorrect because CloudWatch Synthetics is for synthetic monitoring (endpoint health checks), not for analyzing logs for error rates. Option B is incorrect because CloudWatch Logs Insights is an interactive query tool for ad-hoc analysis, not designed for real-time alarming. Option D is incorrect because CloudWatch Contributor Insights analyzes top contributors (e.g., error sources), but does not directly count error rates for alarms.

Answer

Amazon CloudWatch Synthetics to monitor the application endpoint and create an alarm.

Answer

Amazon CloudWatch Logs Insights to query logs every 5 minutes and trigger a Lambda function.

Answer

Amazon CloudWatch Contributor Insights to detect error patterns, then an alarm.

Question 15

A DevOps engineer is designing a monitoring solution for an application that runs on Amazon EC2 instances in an Auto Scaling group. The engineer needs to collect memory utilization metrics and visualize them in a dashboard. What should the engineer do?

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. The Amazon CloudWatch agent is required to collect memory utilization metrics from EC2 instances because memory usage is not a default metric provided by CloudWatch. By installing the CloudWatch agent on the instances, it can gather memory metrics (and other custom metrics) and publish them to CloudWatch, where they can be visualized in dashboards. This is the standard AWS-recommended approach.

Answer

Create a custom CloudWatch metric namespace and publish memory data using the AWS CLI.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics.

Answer

Use AWS CloudTrail to capture memory utilization events from the EC2 instances.