DOP-C02 Monitoring and Logging Practice Test 9 — 15 Questions

Question 1

A DevOps engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must collect logs from all accounts into a centralized Amazon S3 bucket for analysis. Which THREE steps are required to set up this centralized logging?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an S3 bucket in the central logging account with bucket policies allowing cross-account writes. Options B, C, and E are correct. To set up centralized logging across multiple AWS accounts using AWS Organizations: B) Create an S3 bucket in the central logging account with a bucket policy that allows cross-account writes from other accounts. C) Enable AWS CloudTrail in each account and configure it to deliver logs to the centralized S3 bucket. This captures API activity. E) Configure Amazon CloudWatch Logs subscription filters in each account to stream logs (e.g., from applications or services) to the centralized S3 bucket via Kinesis Data Firehose. Option A (VPC Flow Logs) is not required for all accounts—it can be selectively enabled. Option D (Kinesis Data Streams) is not necessary; logs can be delivered directly to S3 via Firehose or CloudTrail.

Answer

Enable VPC Flow Logs for all VPCs in every account and send them to the centralized bucket

Answer

Set up Amazon Kinesis Data Streams in the central account to ingest logs from all accounts

Question 2

A company is running a critical application on Amazon ECS with Fargate launch type. The application writes logs to Amazon CloudWatch Logs. The DevOps team needs to set up an alert when the application generates more than 100 error logs in any 5-minute window. Which configuration should be used?

Accepted Answer

Create a CloudWatch Logs metric filter for 'ERROR' and a CloudWatch alarm on the resulting metric with a period of 5 minutes. A CloudWatch Logs metric filter can be configured to count occurrences of the word 'ERROR' in log streams. This filter creates a custom metric that can be monitored by a CloudWatch alarm with a period of 5 minutes. When the metric exceeds the threshold of 100, the alarm triggers an action such as an SNS notification. Option A is incorrect because CloudWatch Logs Insights is a query tool for interactive analysis, not for continuous real-time alerting. Option B is incorrect because EventBridge events are not generated from log content directly; you would need a metric filter or subscription filter to turn log data into events. Option D is incorrect because AWS CloudTrail logs API activities, not application error logs written to CloudWatch Logs.

Answer

Create a CloudWatch Logs Insights query that runs every 5 minutes and triggers an SNS notification

Answer

Create an Amazon EventBridge rule that matches CloudWatch Logs events for the word 'ERROR' and triggers an alarm

Answer

Enable AWS CloudTrail logging for the ECS task and create a metric filter on CloudTrail logs

Question 3

A DevOps engineer is troubleshooting an issue where an Amazon RDS for MySQL instance is experiencing high latency. The engineer wants to identify which queries are causing the problem. Which AWS service should be used?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights, is correct because it provides a database performance tuning and monitoring feature that allows you to assess the load on your database and identify specific queries causing high latency. Option B, AWS CloudTrail, is incorrect because it records API calls made to AWS services, not database queries. Option C, Amazon CloudWatch Metrics, is incorrect because it provides aggregate performance metrics (e.g., CPU, memory, disk I/O) but does not show per-query details. Option D, VPC Flow Logs, is incorrect because they capture IP traffic information for network interfaces, not database query performance.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Metrics

Answer

VPC Flow Logs

Question 4

A company uses AWS Lambda functions to process data from an Amazon SQS queue. The Lambda function sometimes fails due to timeouts. The DevOps team wants to monitor the number of function timeouts and receive alerts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure a CloudWatch alarm on the 'Timeouts' metric from AWS/Lambda namespace. Lambda automatically publishes a 'Timeouts' metric to CloudWatch, and a CloudWatch alarm can be configured directly on that metric for efficient monitoring and alerting. Option A is wrong because EventBridge rules capture raw execution results but do not specifically isolate timeouts without additional logic; using the metric is more direct. Option B is wrong because AWS X-Ray is designed for tracing individual requests, not for aggregate metric-based alerting, making it inefficient for monitoring timeout rates. Option C is wrong because running a CloudWatch Logs Insights query periodically is reactive and not real-time; it depends on log ingestion and is less efficient than using a pre-existing metric.

Answer

Create an Amazon EventBridge rule that captures Lambda execution results and triggers an SNS topic

Answer

Enable AWS X-Ray on the Lambda function and analyze traces for timeouts

Answer

Create a CloudWatch Logs Insights query to search for 'Task timed out' and run it periodically

Question 5

A DevOps team is using Amazon CloudWatch Synthetics canaries to monitor the availability of a web application. The canary is configured to run every 5 minutes. The team notices that the canary fails occasionally but the application is healthy. Which action will help identify if the failures are due to network issues between the canary and the application?

Accepted Answer

Configure the canary to run inside the same VPC as the application using a VPC endpoint. Configuring the canary to run inside the same VPC as the application (e.g., using a VPC endpoint) ensures that the canary's network path is within the VPC, eliminating external network variables. This allows the team to isolate whether failures are due to application issues rather than network connectivity between the canary and the application. Option A: VPC Flow Logs can provide network metadata but are not directly correlated with canary failures to determine the root cause. Option B: X-Ray tracing would need to be instrumented on both the canary and application to trace the request path; it is not automatically enabled and may not isolate network issues specifically. Option C: Increasing memory and timeout may reduce false positives caused by resource constraints but does not help identify network issues.

Answer

Enable VPC Flow Logs for the canary's VPC and analyze the logs for dropped packets

Answer

Enable AWS X-Ray tracing on the canary to trace the request path

Answer

Increase the canary's memory and timeout settings to reduce false positives

Question 6

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an auto scaling action when the queue depth exceeds a threshold. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Amazon CloudWatch monitors the ApproximateNumberOfMessagesVisible metric from SQS, and a CloudWatch alarm can trigger an Amazon EC2 Auto Scaling scaling policy when the queue depth exceeds a threshold. Option A is incorrect because CloudWatch Logs does not directly provide a metric for queue depth. Option C is incorrect because while EventBridge can capture SQS events, the standard method to trigger auto scaling based on queue depth is via CloudWatch alarms. Option D is incorrect because SQS and Lambda are used for processing messages, not for triggering auto scaling directly.

Answer

Amazon CloudWatch Logs and Amazon EC2 Auto Scaling

Answer

Amazon EventBridge and Amazon EC2 Auto Scaling

Answer

Amazon SQS and AWS Lambda

Question 7

A company is using AWS CloudFormation to manage infrastructure. The DevOps team wants to receive notifications when CloudFormation stack creation fails. Which AWS service should be used to capture the stack failure event and send a notification?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture CloudFormation stack events (such as CREATE_FAILED) using event rules and route them to targets like Amazon SNS for notifications. Option A is wrong because Amazon SQS is a message queue service and does not directly send notifications; it requires a consumer. Option B is wrong because Amazon CloudWatch Logs stores log data but does not capture CloudFormation events or send notifications. Option C is wrong because AWS CloudTrail records API calls but is not designed for real-time event-driven notifications; it is better suited for auditing.

Answer

Amazon SQS

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 8

A company is running a production application on Amazon ECS with Fargate. The DevOps team needs to monitor the application's performance and set up alerts for high memory usage. Which THREE steps should the team take to achieve this?

Accepted Answer

Create a custom CloudWatch metric and publish memory usage data from the application. Options B, C, and D are correct. To monitor memory usage in ECS Fargate, you must enable the ECS task metadata endpoint (option D), which allows the container to access task metadata and publish custom memory metrics to CloudWatch. Then create a custom CloudWatch metric (option B) and set up a CloudWatch alarm on that metric (option C). Option A is incorrect because CloudWatch does not automatically collect memory metrics from Fargate tasks; custom metrics are required. Option E is incorrect because CloudWatch Container Insights provides visibility into container-level metrics but does not collect memory metrics from Fargate tasks without additional configuration; custom metrics are still needed for memory monitoring.

Answer

Configure CloudWatch to automatically collect memory metrics from Fargate tasks

Answer

Enable Amazon CloudWatch Container Insights for the ECS cluster

Question 9

A DevOps engineer is troubleshooting an application that runs on Amazon EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. CloudWatch metrics for the ALB show an increase in 'HTTPCode_ELB_5XX_Count' but the backend 'HealthyHostCount' remains stable. Which action should the engineer take to identify the root cause?

Accepted Answer

Enable and review the ALB access logs stored in Amazon S3 to analyze the HTTP response codes and request patterns.. ALB access logs capture detailed information about each request, including HTTP status codes, request processing times, and target response times. By analyzing these logs in Amazon S3, the engineer can identify which specific requests are resulting in 503 errors, examine if there are patterns such as high latency or target unavailability, and determine the root cause. Option A is incorrect because increasing instance size does not address the intermittent 503 errors; if the instances are healthy (HealthyHostCount stable), the issue is likely not capacity but something else like configuration or request handling. Option B is incorrect because detailed CloudWatch metrics on instances, while useful for performance, would not directly reveal why the ALB is returning 503 errors; the backend might be healthy but returning errors or timing out. Option D is incorrect because increasing the idle timeout would only help if requests are being dropped due to idle connections, but 503 errors typically indicate that the targets are not responding or are returning errors, not idle timeouts.

Answer

Increase the size of the EC2 instances to handle more requests.

Answer

Enable detailed CloudWatch metrics on the EC2 instances to monitor CPU and memory.

Answer

Increase the idle timeout setting on the ALB.

Question 10

A company uses AWS CloudTrail to monitor API activity. The DevOps team needs to ensure that any deletion of an S3 bucket is detected in real time and triggers an automated response. Which combination of AWS services should be used to meet these requirements?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a CloudWatch Events rule matching the DeleteBucket event, and target a Lambda function.. CloudTrail logs can be sent to CloudWatch Logs, and a CloudWatch Events rule (now Amazon EventBridge) can be created to match the DeleteBucket event and trigger a Lambda function for automated response in real time. Option A is incorrect because CloudWatch Logs monitors log data, but a metric filter on DeleteBucket events in CloudTrail logs can trigger an alarm, but that is not as direct as EventBridge. More importantly, CloudWatch Logs metric filters have latency and are not the best for real-time response. Option B is incorrect because S3 event notifications are for operations on objects, not for bucket-level operations like deletion. Option C is incorrect because while CloudTrail can deliver logs to S3, S3 event notifications are not triggered by CloudTrail log file delivery; they are for object-level events. Using EventBridge directly with CloudTrail is the correct real-time approach.

Answer

Use CloudWatch Logs to monitor the logs, and create a metric filter to trigger an alarm when the DeleteBucket event appears.

Answer

Configure S3 event notifications to send to an SQS queue, and poll the queue with a Lambda function.

Answer

Configure CloudTrail to deliver logs to an S3 bucket, and use S3 event notifications to invoke a Lambda function.

Question 11

A company is running a critical application on Amazon RDS for PostgreSQL. The DevOps team needs to set up monitoring to detect when database connections exceed 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric should be used to create an alarm?

Accepted Answer

DatabaseConnections. The DatabaseConnections metric shows the number of connections to the DB instance. Option B is wrong because FreeableMemory measures available memory, not connections. Option C is wrong because CPUUtilization measures CPU usage, not connections. Option D is wrong because DiskQueueDepth measures disk I/O.

Answer

FreeableMemory

Answer

CPUUtilization

Answer

DiskQueueDepth

Question 12

A company uses Amazon ECS with Fargate for containerized applications. The DevOps team notices that some tasks are failing with 'OutOfMemoryError' but the CloudWatch metric 'MemoryUtilization' for the service shows values well below the task memory limit. What is the most likely cause of this discrepancy?

Accepted Answer

The container's memory usage is hitting the kernel's memory cgroup limit before the Docker-reported usage reaches the task memory limit.. The MemoryUtilization metric reported by CloudWatch for ECS on Fargate is based on the Docker-reported memory usage, but the Linux kernel's out-of-memory (OOM) killer terminates the container when it exceeds the hard memory limit defined at the container level in the task definition. This can happen even if the task-level metric appears below the limit, as the metric may smooth out spikes or not reflect the container's actual memory cgroup limit. Option B is wrong because averaging across tasks does not cause a discrepancy for individual tasks; the metric is per-task. Option C is wrong because in Fargate, the task definition specifies both memory reservation (soft limit) and memory limit (hard limit), and the issue is with the hard limit. Option D is wrong because Fargate does not support swap space.

Answer

The CloudWatch metric 'MemoryUtilization' is aggregated across all tasks in the service, so individual task spikes are averaged out.

Answer

The task definition has a memory reservation but no hard limit, causing ECS to overcommit memory.

Answer

The container is using swap space, which is not included in the MemoryUtilization metric.

Question 13

A DevOps engineer sets up a CloudWatch dashboard to monitor an application's performance. The application runs on EC2 instances in an Auto Scaling group. The engineer wants to display the average CPU utilization across all instances in the group. Which CloudWatch metric and statistic should be used?

Accepted Answer

CPUUtilization metric with the Average statistic, filtered by Auto Scaling group.. The CPUUtilization metric with the Average statistic across the Auto Scaling group provides the desired average. Option A is wrong because the Sum statistic would total the CPU across instances, not average. Option C is wrong because NetworkOut is not CPU-related. Option D is wrong because StatusCheckFailed is a different metric.

Answer

CPUUtilization metric with the Sum statistic, filtered by Auto Scaling group.

Answer

StatusCheckFailed metric with the Average statistic, filtered by Auto Scaling group.

Answer

NetworkOut metric with the Average statistic, filtered by Auto Scaling group.

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team needs to receive notifications when stack creation fails. Which approach should be used to automate this monitoring?

Accepted Answer

Create a CloudWatch Events rule that matches CloudFormation 'CREATE_FAILED' stack events and targets an SNS topic.. CloudFormation emits stack events (including 'CREATE_FAILED') to CloudWatch Events (Amazon EventBridge), which can be used to create a rule that triggers an SNS topic for notifications. Option B is incorrect because AWS Config evaluates resource configurations, not CloudFormation stack events. Option C is incorrect because CloudTrail logs API calls; a metric filter for 'CreateStack' would detect when a stack creation is initiated, not when it fails. Option D is incorrect because CloudFormation does not automatically stream logs to CloudWatch Logs; it emits events to CloudWatch Events, not logs.

Answer

Use AWS Config rules to detect failed stack creations.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' API calls.

Answer

Stream CloudFormation logs to CloudWatch Logs and create a metric filter for 'CREATE_FAILED'.

Question 15

An application running on Amazon EKS generates logs that need to be sent to CloudWatch Logs for central monitoring. The DevOps team deploys the CloudWatch agent as a DaemonSet in the cluster. However, logs from some pods are not appearing in CloudWatch. Which configuration issue is most likely causing this?

Accepted Answer

The IAM role associated with the worker nodes does not have the necessary permissions to write to CloudWatch Logs.. The CloudWatch agent running on the worker nodes needs IAM permissions to write logs to CloudWatch Logs. If the IAM role assigned to the worker nodes lacks the necessary permissions (e.g., logs:PutLogEvents, logs:CreateLogStream, logs:DescribeLogStreams), the agent cannot send logs. Option B is incorrect because although using a Fluentd sidecar is an alternative, the question specifically states the CloudWatch agent is deployed as a DaemonSet, so the sidecar approach is not the cause. Option C is incorrect because the CloudWatch agent can be configured to collect logs from files, not just stdout; the issue is not about the log source but about permissions. Option D is incorrect because taints and tolerations could cause the DaemonSet not to schedule on some nodes, but that would affect entire nodes, not 'some pods' across nodes, and the most likely cause is IAM permissions.

Answer

The pods are using the fluentd sidecar instead of the CloudWatch agent.

Answer

The CloudWatch agent is configured to collect logs from stdout, but the application writes logs to files.

Answer

The DaemonSet is not scheduled on all nodes due to taints and tolerations.