DOP-C02 Monitoring and Logging Practice Test 9 — 15 Questions

Question 1

A DevOps engineer is setting up monitoring for an Amazon S3 bucket that stores sensitive data. The engineer needs to be notified whenever an object in the bucket is accessed by a user or application, including read and write operations. Which AWS service should the engineer use to capture these events and trigger notifications?

Accepted Answer

Configure S3 event notifications to send events to an SNS topic for object-level operations.. Option C is correct because Amazon S3 can be configured to send event notifications to SNS, SQS, or Lambda for object-level operations (e.g., PutObject, GetObject). This is the most direct way. Option A is wrong because CloudTrail logs API calls but does not trigger real-time notifications. Option B is wrong because CloudWatch Metrics track bucket metrics but not per-object access. Option D is wrong because Config records changes but does not provide real-time access notifications.

Answer

Enable AWS CloudTrail data events for the S3 bucket and configure CloudWatch alarms on the log group.

Answer

Use AWS Config to record S3 resource changes and trigger an SNS notification.

Answer

Use Amazon CloudWatch metrics for the S3 bucket and set an alarm on the NumberOfObjects metric.

Question 2

A company uses Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a web application. The DevOps team needs to create a metric filter that parses logs for HTTP status codes (e.g., 4xx and 5xx) and increment a metric. Additionally, they need to create a CloudWatch alarm on the error count. Which of the following are required to achieve this? (Select TWO.)

Accepted Answer

Define the metric filter pattern to match HTTP status codes in the log entries.. Option A is correct because a metric filter is defined on a log group to extract metrics. Option C is correct because the metric filter pattern must match the log format to extract the status code. Option B (IAM role) is not required because the CloudWatch Logs agent uses credentials from the instance profile. Option D (subscription filter) is for streaming logs to other destinations, not for metric filters. Option E (CloudWatch Agent) is not required; the default CloudWatch Logs agent can send logs.

Answer

Create an IAM role that allows CloudWatch Logs to read the log data and publish metrics.

Answer

Configure a subscription filter to forward the logs to a Lambda function that creates the metric.

Answer

Install the CloudWatch Agent on the EC2 instances to send the logs.

Question 3

A DevOps engineer is designing a monitoring solution for a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS database. The engineer needs to monitor the health of each component and receive alerts when any component becomes unhealthy. Which of the following CloudWatch metrics should the engineer monitor? (Select THREE.)

Accepted Answer

EC2's StatusCheckFailed metric.. Option A is correct because ALB's HealthyHostCount indicates how many targets are healthy. Option B is correct because EC2's StatusCheckFailed (instance status) detects underlying issues. Option D is correct because RDS's DatabaseConnections can indicate if the database is overwhelmed. Option C (ALB's RequestCount) measures traffic, not health. Option E (RDS's ReadLatency) is a performance metric, not a direct health indicator.

Answer

RDS's ReadLatency metric.

Answer

Application Load Balancer's RequestCount metric.

Question 4

A company uses Amazon CloudWatch Logs to store application logs. They have a requirement to retain logs for 90 days for operational analysis and then archive them to Amazon S3 for compliance purposes for an additional 5 years. Which of the following steps are necessary to meet this requirement? (Select TWO.)

Accepted Answer

Set the CloudWatch Logs retention policy on the log group to 90 days.. Option D is correct because you can set a retention policy on the log group to expire logs after 90 days (e.g., 90 days). Option E is correct because to archive logs to S3, you can use CloudWatch Logs export task to S3 (manual or automated). Option A is wrong because CloudWatch Logs does not have a lifecycle policy directly to S3; export is needed. Option B is wrong because S3 lifecycle transitions are for objects already in S3, not for logs in CloudWatch. Option C is wrong because CloudWatch does not automatically archive; you must export.

Answer

Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.

Answer

Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.

Answer

Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.

Question 5

Refer to the exhibit. A DevOps engineer runs the above CloudWatch Logs Insights query on a log group containing application logs. The query returns an empty result set. The engineer knows that the application logs contain ERROR entries. Which of the following is the most likely cause?

Accepted Answer

The filter pattern is case-sensitive and the log entries use lowercase 'error'.. Option B is correct because the query uses 'like /ERROR/' which is case-sensitive. If the logs contain 'error' in lowercase, the filter will not match. Option A is wrong because the timestamp field is present. Option C is wrong because the stats function is valid. Option D is wrong because the limit is fine.

Answer

The stats function cannot be used with the filter command.

Answer

The log group does not have any log streams.

Answer

The limit of 20 results is too low and the query times out.

Question 6

A company runs a critical e-commerce application on AWS. The architecture includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server, and an Amazon RDS MySQL Multi-AZ database. The DevOps team has implemented CloudWatch dashboards to monitor key metrics. Recently, customers have reported that the website becomes unresponsive for a few minutes during peak traffic hours. The team reviews the CloudWatch metrics and observes that during the incidents, the ALB's 'TargetResponseTime' metric spikes, and the RDS 'ReadLatency' and 'WriteLatency' metrics also spike. However, the EC2 CPU utilization and memory usage remain normal. The ALB health check shows 'Healthy' for all targets. The team needs to identify the root cause. Which course of action should the team take?

Accepted Answer

Enable Performance Insights on the RDS instance to analyze database performance and identify slow queries.. Option C is correct because the symptoms point to database contention (spikes in read/write latency) while the application servers are healthy. Enabling Performance Insights on RDS will help identify the specific queries causing the latency, such as slow queries or locks. Option A is wrong because adding more EC2 instances doesn't address the database bottleneck. Option B is wrong because the issue is not related to ALB configuration. Option D is wrong because scaling the ALB is not the issue.

Answer

Configure the ALB to add a second listener and distribute traffic across multiple target groups.

Answer

Review the ALB access logs to identify if there are any unusual request patterns causing the latency.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances to handle the load.

Question 7

A DevOps engineer is tasked with setting up monitoring for a serverless application that uses AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The engineer needs to create a centralized dashboard that displays the number of Lambda invocations, API Gateway request counts, and DynamoDB consumed read/write capacity units. The dashboard should be accessible to the operations team without requiring AWS Management Console login. The engineer also wants to set up email alerts when the DynamoDB consumed capacity exceeds 80% of the provisioned capacity. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create a CloudWatch dashboard with the relevant metrics and set CloudWatch alarms on DynamoDB consumed capacity. Share the dashboard as a public read-only dashboard.. Option D is correct because CloudWatch Dashboards can be shared publicly as a read-only dashboard without AWS credentials. The metrics for Lambda, API Gateway, and DynamoDB are automatically available in CloudWatch. Alarms can be set on DynamoDB's ConsumedReadCapacityUnits and ConsumedWriteCapacityUnits metrics. Option A is wrong because CloudWatch Logs Insights is for log analysis, not metrics. Option B is wrong because sharing CloudWatch dashboards does not require Cognito; dashboards can be shared via a public URL. Option C is wrong because QuickSight requires additional setup and cost.

Answer

Use Amazon QuickSight to connect to CloudWatch metrics and create a dashboard with email alerts.

Answer

Use CloudWatch Logs Insights to query the logs of each service and create a dashboard from the results.

Answer

Create a CloudWatch dashboard and share it using Amazon Cognito to grant access to the operations team.

Question 8

A company has deployed a containerized application on Amazon ECS with Fargate. The application is fronted by an Application Load Balancer (ALB). The DevOps team is using CloudWatch Container Insights to monitor the ECS cluster. They notice that the 'MemoryUtilized' metric for the service is consistently above 80%, and the 'CPUUtilized' is around 50%. The ALB's 'TargetResponseTime' is increasing over time. The team wants to resolve the performance issue. Which action should the team take?

Accepted Answer

Increase the memory limit for the ECS task definition to allow the container to use more memory.. Option B is correct because the high memory utilization (above 80%) is likely causing performance degradation. Increasing the memory limit for the task definition will allow the container to handle more load. Option A is wrong because CPU is not the bottleneck. Option C is wrong because scaling the ALB does not address the container's resource limits. Option D is wrong because increasing the desired count without fixing the memory limit may not help if each task is memory-constrained.

Answer

Increase the CPU limit for the ECS task definition to improve performance.

Answer

Increase the number of ALB targets by adding more availability zones.

Answer

Increase the desired count of the ECS service to distribute the load across more tasks.

Question 9

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to monitor the CloudFormation stack events to detect when stack creation or updates fail, and automatically send notifications to a Slack channel. The team has set up an Amazon SNS topic that sends messages to a Slack webhook via a Lambda function. Which solution should the team implement to trigger the SNS topic when a CloudFormation stack fails?

Accepted Answer

Configure the CloudFormation stack to send events to an SNS topic by specifying the topic ARN in the stack's notification options.. Option D is correct because CloudFormation publishes stack events to an SNS topic when specified as a notification ARN in the stack. The team can create an SNS topic and subscribe the Slack webhook Lambda function to it, then specify that topic as the notification ARN when creating or updating the stack. This will send events directly to SNS. Option A is wrong because CloudFormation does not send events to EventBridge by default; you would need to create a rule. Option B is wrong because CloudTrail logs API calls, but you would need additional setup. Option C is wrong because CloudWatch Logs Insights is for querying logs, not real-time events.

Answer

Use CloudWatch Logs Insights to query CloudFormation logs and set up a scheduled query to send results to SNS.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and create a CloudWatch metric filter that detects failure messages, then trigger an alarm to SNS.

Answer

Create an Amazon EventBridge rule that matches CloudFormation API calls for CreateStack and UpdateStack with a status of CREATE_FAILED or UPDATE_FAILED, and set the target to the SNS topic.

Question 10

A company runs a critical e-commerce application on AWS. The application is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The instances store session data in an ElastiCache for Redis cluster. Recently, users have reported intermittent session timeouts during peak traffic hours. The operations team notices that CloudWatch alarms for the Redis cluster's CPUUtilization and Evictions metrics are frequently breaching thresholds. The team wants to resolve the issue without incurring unnecessary costs. Which solution should the team implement?

Accepted Answer

Enable auto scaling for the ElastiCache Redis cluster to add replicas or shards based on CPU and memory utilization.. Option B is correct because enabling auto scaling with a larger instance type or adding shards (clustering) directly addresses the resource contention causing evictions and high CPU. Option A is wrong because memory-optimized instances may not solve CPU issues; also, increasing memory without scaling CPU may not help. Option C is wrong because increasing tRANSIT_ENCRYPTION_ENABLED does not affect performance. Option D is wrong because Lambda integration adds complexity and latency without scaling the cache.

Answer

Configure a Lambda function to offload session data to Amazon DynamoDB and use DAX for caching.

Answer

Enable encryption in transit (TLS) for the Redis cluster to reduce overhead.

Answer

Migrate the Redis cluster to a memory-optimized instance type like r6g.large.

Question 11

A DevOps engineer is responsible for monitoring a set of microservices running on Amazon ECS with Fargate. The services are fronted by an Application Load Balancer (ALB). The engineer needs to collect and analyze application logs centrally with minimal latency and operational overhead. The logs should be searchable and retainable for 90 days. Which solution meets these requirements?

Accepted Answer

Deploy the CloudWatch agent as a Daemon service on the ECS cluster to collect logs from all tasks and forward them to CloudWatch Logs.. Option C is correct because the CloudWatch agent can collect logs from ECS tasks and send them to CloudWatch Logs, which provides near real-time search and configurable retention. Option A is wrong because S3 is not searchable natively and would require additional services like Athena. Option B is wrong because FireLens is a log router, but not all containers have it configured; also, it adds overhead. Option D is wrong because putting a sidecar for every task increases cost and complexity, and Kinesis Data Firehose adds latency.

Answer

Use the FireLens log driver in the ECS task definition to send logs to Amazon CloudWatch Logs.

Answer

Configure the ECS tasks to write logs to Amazon S3 and use Amazon Athena to query the logs.

Answer

Add a sidecar container to each ECS task that streams logs to Amazon Kinesis Data Firehose, which delivers to Amazon OpenSearch Service.

Question 12

A company runs a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application processes financial transactions. The DevOps team needs to monitor for duplicate transactions that could occur due to retries. The team wants to set up an alert when the number of duplicate transaction attempts exceeds 10 in a 5-minute window. The application logs each transaction attempt with a unique transaction ID to CloudWatch Logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Logs metric filter that counts log events containing 'DuplicateTransaction' and set an alarm on the metric with a threshold of 10.. Option A is correct because a metric filter on CloudWatch Logs can count occurrences of a pattern (e.g., duplicate transaction ID) and create a custom metric, which can then trigger an alarm. Option B is wrong because Lambda sends logs to CloudWatch Logs, not directly to CloudWatch Metrics. Option C is wrong because Kinesis Data Analytics would add unnecessary complexity and cost. Option D is wrong because DynamoDB Streams and Lambda add latency and complexity for a simple counting task.

Answer

Use DynamoDB Streams to trigger a Lambda function that counts duplicates and publishes metrics.

Answer

Stream the CloudWatch Logs to Amazon Kinesis Data Analytics and use SQL queries to detect duplicates.

Answer

Modify the Lambda function to publish a custom metric to CloudWatch for each duplicate transaction, then set an alarm.

Question 13

A media company runs a video transcoding pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple Lambda functions that transcode video files stored in Amazon S3. The company wants to implement a monitoring solution to track the progress of each workflow execution, including which step is currently running, the duration of each step, and any errors. The solution should provide near real-time visibility and allow the team to troubleshoot failed executions quickly. Which solution meets these requirements?

Accepted Answer

Use Amazon EventBridge to capture Step Functions execution status changes and build a custom dashboard in CloudWatch.. Option D is correct because Step Functions natively emits execution history and CloudWatch Events (now Amazon EventBridge) for state changes. Using these events with a dashboard provides real-time visibility into step durations and errors. Option A is wrong because CloudWatch Logs from individual Lambda functions do not provide workflow-level context easily. Option B is wrong because X-Ray traces are for distributed tracing, not for workflow step tracking; also, it adds overhead. Option C is wrong because CloudWatch dashboards can be built from existing metrics, but custom metrics from each step would require significant instrumentation.

Answer

Create custom CloudWatch metrics from Lambda functions for each step, and build a CloudWatch dashboard.

Answer

Configure each Lambda function to write logs to CloudWatch Logs with the execution ID, and use CloudWatch Logs Insights to query and visualize.

Answer

Enable AWS X-Ray tracing on the Step Functions and Lambda functions to get a service map and trace details.

Question 14

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team wants to set up real-time monitoring for specific error patterns and trigger remediation actions. Which TWO services can process the log events in real time and invoke an AWS Lambda function for remediation? (Choose two.)

Accepted Answer

Stream log events to Amazon Kinesis Data Streams and configure a Lambda function to process the stream.. Option A and Option C are correct. CloudWatch Logs can stream to Lambda via subscription filters (Option A) and also to Kinesis Data Streams which can then be processed by Lambda (Option C). Option B is wrong because EventBridge does not directly subscribe to log streams; it can receive events from other sources but not directly from CloudWatch Logs in real time. Option D (SQS) would require a Lambda to poll, but real-time streaming is not native. Option E (SNS) is for push notifications, but cannot directly receive log events from CloudWatch Logs without a subscription filter.

Answer

Create an Amazon EventBridge rule that matches on CloudWatch Logs log group events.

Answer

Configure the log group to send log events to an Amazon SQS queue, and have the Lambda function poll the queue.

Answer

Publish log events to an Amazon SNS topic and subscribe the Lambda function.

Question 15

A DevOps team is designing a centralized logging solution for multiple AWS accounts. The team needs to collect logs from EC2 instances, Lambda functions, and VPC Flow Logs, and store them in a central account for analysis. The solution must be cost-effective and support near real-time log aggregation. Which THREE steps should the team take? (Choose three.)

Accepted Answer

Deliver logs from the central account's CloudWatch Logs to Amazon Kinesis Data Firehose, which writes to Amazon S3.. Options B, C, and D are correct. CloudWatch cross-account subscription allows sending logs from source accounts to a central account (Option B). Kinesis Data Firehose can buffer and deliver logs to S3 at low cost (Option C). Athena can query logs in S3 efficiently (Option D). Option A (direct delivery to S3) does not support near real-time aggregation; VPC Flow Logs can be delivered to S3, but not Lambda directly. Option E (OpenSearch) is more expensive and not necessary for cost-effective storage and analysis.

Answer

Configure VPC Flow Logs to deliver to a Lambda function in each account, which forwards logs to the central account.

Answer

Use Amazon OpenSearch Service to index and search the logs in near real time.