DOP-C02 Monitoring and Logging Practice Test 9 — 15 Questions

Question 1

A company uses AWS X-Ray to trace requests through its microservices application. The DevOps engineer notices that some traces are incomplete. What is a possible reason?

Accepted Answer

The X-Ray SDK sampling rate is configured too low, causing many requests to be skipped.. The X-Ray SDK uses a sampling rate to decide which requests to record. If the sampling rate is set too low, a large percentage of requests are skipped, leading to incomplete traces. The DevOps engineer would observe missing segments for requests that were not sampled, even though the daemon and SDK are functioning correctly.

Answer

The X-Ray daemon is not running on the application servers.

Answer

X-Ray cannot trace requests that cross multiple AWS services.

Answer

X-Ray requires the CloudWatch agent to be installed on all EC2 instances.

Question 2

A company is using Amazon CloudWatch Logs to store application logs. The DevOps engineer needs to ensure that log data is encrypted at rest using a customer-managed KMS key. What step must be taken?

Accepted Answer

Create a new KMS customer-managed key and associate it with the CloudWatch Logs log group.. CloudWatch Logs supports encryption at rest using a customer-managed KMS key, which must be explicitly associated with the log group. When you create or update a log group, you can specify a KMS key ID (via the AWS CLI, SDK, or console) to encrypt all log data stored in that group. This ensures that the log data is encrypted using a key you control, not the default AWS-managed key.

Answer

Use AWS CloudTrail to encrypt the log data before it is sent to CloudWatch Logs.

Answer

Create a KMS key and apply it to the IAM role used by the application.

Answer

Enable server-side encryption on the log group using the default CloudWatch Logs key.

Question 3

A company wants to receive notifications when an EC2 instance's CPU utilization exceeds 90% for 10 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch alarm. Amazon CloudWatch alarms monitor specified metrics (like CPU utilization) and trigger actions (e.g., SNS notification) when a threshold is breached for a given period. Option A is correct. Option B is incorrect because AWS Config rules evaluate configuration compliance, not metric thresholds. Option C is incorrect because AWS CloudTrail records API activity, not metric monitoring. Option D is incorrect because Amazon Inspector assesses security vulnerabilities, not performance metrics.

Answer

AWS Config rule

Answer

AWS CloudTrail event

Answer

Amazon Inspector

Question 4

A DevOps engineer needs to set up a monitoring solution that can detect and alert on unusual patterns in application metrics. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Anomaly Detection [CORRECT] is correct because it applies machine-learning algorithms to a metric's historical baseline and creates an expected-value band, so it can flag unusual patterns in application metrics without requiring manually tuned static thresholds. Amazon CloudWatch Alarms [CORRECT] is correct because it evaluates a metric or an anomaly-detection band against a defined condition and triggers actions such as Amazon SNS notifications, making it the alerting mechanism that works together with anomaly detection. Used together, Anomaly Detection identifies the deviation and CloudWatch Alarms fires the alert, which directly satisfies the requirement to detect and alert on unusual metric patterns. Amazon GuardDuty is a threat-detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, not application metric patterns. AWS CloudTrail records API activity for auditing and governance, and AWS Config evaluates resource configuration compliance, so neither detects anomalies in application metrics or sends metric-based alerts.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 5

A company wants to centralize logging from multiple AWS accounts and regions. The logs should be stored in a central S3 bucket for compliance. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Create an S3 bucket in the central account with appropriate bucket policy granting permissions to CloudTrail.. To centralize logs from multiple accounts into a single S3 bucket, the bucket in the central account must have a bucket policy that explicitly grants the necessary permissions (e.g., `s3:PutObject`) to the CloudTrail service principal (`cloudtrail.amazonaws.com`) from each source account. This policy allows CloudTrail in the source accounts to write log files directly into the central bucket, enabling centralized storage for compliance.

Answer

Create a cross-account subscription in Amazon CloudWatch Logs to stream logs to the central account.

Answer

Turn on CloudTrail data events for all S3 and Lambda resources.

Question 6

A DevOps engineer is investigating a performance issue in a serverless application using AWS Lambda. The engineer wants to view the duration of each invocation and identify cold starts. Which TWO AWS services should be used? (Choose TWO.)

Accepted Answer

AWS X-Ray to trace invocations and detect cold starts. Option B (AWS X-Ray) is correct because X-Ray traces individual Lambda invocations end-to-end, showing per-invocation duration via subsegments and explicitly flagging cold starts with an 'Initialization' subsegment, which is exactly what the engineer needs to identify cold starts. Option D (Amazon CloudWatch Logs) is correct because Lambda automatically streams each invocation's execution logs, including the REPORT line with Duration, Billed Duration, Memory Size, and Init Duration (the latter indicating a cold start), so per-invocation duration and cold-start evidence can be extracted from these logs. Option A (CloudWatch Metrics) is not correct here because Lambda metrics such as Duration and Invocations are aggregated at one-minute granularity and do not expose per-invocation duration or cold-start identification. Option C (AWS CloudTrail) is not correct because it only records control-plane API calls (e.g., CreateFunction, Invoke via management events) and does not provide invocation duration or cold-start data. Option E (AWS Config) is not correct because it tracks Lambda configuration/resource changes for compliance, not runtime performance or invocation timing.

Answer

Amazon CloudWatch Metrics for Lambda (duration, invocations)

Answer

AWS CloudTrail to record Lambda API calls

Answer

AWS Config to track Lambda configuration changes

Question 7

A company's DevOps team notices that their Amazon RDS for PostgreSQL instance's CPU utilization spikes to 90% every day at 10:00 AM, causing application latency. They want to be notified when the CPU utilization exceeds 80% for more than 5 minutes to investigate the cause. Which solution should they implement?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and a threshold of 80, and set the alarm action to send a notification to an Amazon SNS topic.. Amazon CloudWatch natively collects the CPUUtilization metric for RDS, and an alarm with a 5-minute period and an 80% threshold directly matches the requirement to alert when CPU exceeds 80% for more than 5 minutes. Configuring the alarm action to publish to an Amazon SNS topic delivers the notification to the DevOps team, which is the standard, lowest-effort solution.

Answer

Use Amazon CloudWatch Logs Insights to query the RDS logs and trigger an SNS notification when CPU utilization is high.

Answer

Enable AWS Trusted Advisor to automatically create a CloudWatch alarm on the CPU utilization metric.

Answer

Create an AWS CloudTrail trail to monitor CPU utilization and trigger an AWS Lambda function to send an email notification.

Question 8

A DevOps engineer needs to monitor the number of 4xx and 5xx HTTP errors returned by an Application Load Balancer (ALB). They want to set up a dashboard that shows the error count over the last 24 hours. Which CloudWatch metrics should they use?

Accepted Answer

Use the 'HTTPCode_Target_4XX_Count' and 'HTTPCode_Target_5XX_Count' metrics.. The correct metrics are 'HTTPCode_Target_4XX_Count' and 'HTTPCode_Target_5XX_Count', which track HTTP errors returned by the targets behind the Application Load Balancer. Option B is incorrect because 'RequestCount' does not have an 'ErrorCount' statistic. Option C is incorrect because 'HTTPCode_ELB_4XX_Count' and 'HTTPCode_ELB_5XX_Count' are load balancer-level metrics that track errors generated by the ALB itself (e.g., due to misconfiguration), not the errors returned by targets. Option D is incorrect because 'TargetResponseTime' measures latency, not error counts.

Answer

Use the 'RequestCount' metric with a statistic of 'ErrorCount'.

Answer

Use the 'HTTPCode_ELB_4XX_Count' and 'HTTPCode_ELB_5XX_Count' metrics.

Answer

Use the 'TargetResponseTime' metric and count the number of responses above 4 seconds.

Question 9

A company uses AWS Lambda functions to process incoming events. The DevOps team notices that some functions are timing out after 30 seconds, but the configured timeout is 1 minute. They want to capture the actual invocation duration for all invocations to analyze performance. What is the most efficient way to achieve this?

Accepted Answer

Enable detailed CloudWatch Logs for the Lambda functions and parse the 'REPORT' log entries to extract the 'Duration' value.. Lambda automatically writes a REPORT log entry to CloudWatch Logs at the end of each invocation, which includes the exact 'Duration' in milliseconds. Parsing these logs is the most efficient approach since it requires no code changes, no additional infrastructure, and leverages existing logging with no extra cost beyond standard CloudWatch Logs ingestion.

Answer

Add custom metrics using the AWS SDK within the Lambda function code to record the duration.

Answer

Configure Amazon Kinesis Data Streams to receive Lambda invocation records and compute duration using a consumer application.

Answer

Use AWS CloudTrail to capture Lambda execution events and analyze the 'duration' field.

Question 10

A DevOps engineer is troubleshooting a slow API response. They suspect that the issue is related to database queries. The application runs on EC2 instances behind an ALB and uses Amazon RDS for MySQL. Which monitoring approach will provide the most granular insight into database query performance?

Accepted Answer

Enable Enhanced Monitoring and Performance Insights for the RDS instance.. Amazon RDS Performance Insights provides a database load view that breaks down wait events by SQL statement, user, host, and database, which is the most granular way to identify slow queries. Enhanced Monitoring complements this with OS-level metrics at up to one-second granularity. Together they give the DevOps engineer the query-level and host-level detail needed to pinpoint the slow API's database bottleneck.

Answer

Enable CloudWatch Logs for the RDS instance and query the error log.

Answer

Install the CloudWatch agent on the EC2 instances to collect database performance counters.

Answer

Monitor the ALB's 'TargetResponseTime' metric and correlate with RDS 'CPUUtilization'.

Question 11

A company is using AWS CloudFormation to deploy infrastructure. They want to receive notifications when a stack operation fails, including the specific resource that caused the failure. Which approach should they use?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack and subscribe to receive stack events.. CloudFormation allows you to specify an SNS topic ARN as a notification option when creating or updating a stack. When a stack operation fails, CloudFormation publishes a notification to that SNS topic, and the notification includes the logical resource ID and the status reason for the failure. This provides real-time, event-driven notifications without requiring polling or additional services.

Answer

Create a CloudWatch alarm on the 'StackFailure' metric.

Answer

Create an AWS Lambda function that polls the CloudFormation DescribeStackEvents API every minute and sends an email on failure.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and configure an SNS notification on the trail.

Question 12

A company is migrating its on-premises applications to AWS and wants to maintain the same level of monitoring for its Linux-based EC2 instances. They currently use Nagios for monitoring. They want a managed AWS service that can monitor instance health, system metrics, and application logs. Which solution should they use?

Accepted Answer

Install the Amazon CloudWatch agent on each EC2 instance to collect system metrics and logs, and send them to CloudWatch.. The CloudWatch agent is the managed AWS solution for collecting guest-level system metrics (memory, disk, swap) and application/system logs from EC2 instances and delivering them to CloudWatch. It replaces the need for a self-managed Nagios server by providing native metric and log ingestion, alarms, and dashboards. Installing it on each instance satisfies the requirement for instance health, system metrics, and application logs in a managed service.

Answer

Use AWS CloudTrail to monitor instance activity and capture log files.

Answer

Use AWS Systems Manager Inventory to collect system configuration and log files.

Answer

Use AWS Config to track instance configuration changes and trigger alerts.

Question 13

A DevOps team is deploying a new web application on AWS Elastic Beanstalk. They want to monitor the application's health and receive notifications when the environment's health status changes to 'Degraded' or 'Severe'. What is the simplest way to achieve this?

Accepted Answer

Create a CloudWatch alarm on the 'EnvironmentHealth' metric published by the Elastic Beanstalk environment.. Elastic Beanstalk automatically publishes environment health metrics to Amazon CloudWatch, including the 'EnvironmentHealth' metric which reports values like 0 (Ok), 1 (Info), 5 (Unknown), 10 (NoData), 15 (Warning), 20 (Degraded), and 25 (Severe). Creating a CloudWatch alarm on this metric with a threshold of >= 20 (or specifically for Degraded/Severe) and configuring an SNS notification is the simplest, most direct, and fully managed solution. This requires no custom code, no polling infrastructure, and leverages native AWS integration.

Answer

Use the Elastic Beanstalk management console to manually check the health status twice a day.

Answer

Write a custom script that polls the Elastic Beanstalk DescribeEnvironmentHealth API and sends an email using Amazon SES.

Answer

Configure an AWS CloudTrail trail to monitor Elastic Beanstalk API calls and create a CloudWatch alarm on the trail.

Question 14

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with timeout errors. The DevOps team needs to troubleshoot the root cause. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Increase the canary timeout configuration to allow more time for the endpoint to respond.. Option B is correct because CloudWatch Synthetics canaries have a configurable timeout setting, and if the endpoint legitimately needs more time to respond, raising the timeout prevents intermittent timeout failures. Option D is correct because canaries can run inside a VPC, and VPC Flow Logs capture ACCEPT/REJECT records for traffic to and from the canary's ENIs, revealing whether security groups, NACLs, or routing are dropping the requests. Option E is correct because each canary writes execution logs, screenshots, and HAR files to CloudWatch Logs under /aws/lambda/cwsyn-* log groups, and these logs contain the exact error messages and timing data needed to diagnose the timeout. Option A is not appropriate because CloudTrail records control-plane API calls (e.g., CreateCanary, UpdateCanary), not the canary's runtime HTTP request behavior. Option C is not appropriate because canaries run as Lambda functions managed by the Synthetics service, not on customer EC2 instances, so EC2 CPU utilization in the VPC is irrelevant to canary timeouts.

Answer

Use AWS CloudTrail to review Canary API calls.

Answer

Check the EC2 instance CPU utilization in the VPC where the canaries run.

Question 15

A DevOps engineer is setting up monitoring for an Amazon DynamoDB table that experiences high read traffic. They want to monitor the read capacity consumption and be alerted when the consumed read capacity exceeds 80% of the provisioned capacity for 5 consecutive minutes. Which TWO steps should they take? (Select TWO.)

Accepted Answer

Use CloudWatch to monitor the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics.. CloudWatch directly exposes the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics for DynamoDB, which are the exact metrics needed to calculate read capacity utilization. Monitoring these metrics allows the engineer to track how much of the provisioned capacity is being consumed over time, which is the foundation for setting up the desired alert.

Answer

Enable AWS CloudTrail to log DynamoDB read requests.

Answer

Set up an AWS Lambda function to monitor the DynamoDB ReadThrottleEvents metric.

Answer

Configure DynamoDB to stream all read events to CloudWatch Logs.