DOP-C02 Monitoring and Logging — Timed 10 Questions

Question 1

A DevOps team is using Amazon CloudWatch Logs to collect application logs from multiple EC2 instances. They notice that some log entries are missing and that the CloudWatch agent is consuming high CPU. The log group has a retention policy of 30 days. Which action should the team take to reduce CPU usage without losing log data?

10 minute time limit — choose an answer to begin.

Accepted Answer

Increase the batch size in the CloudWatch agent configuration.. Increasing the batch size in the CloudWatch agent configuration reduces the number of HTTP API calls made to CloudWatch Logs, which lowers CPU overhead from frequent network I/O and serialization. The agent buffers log events and sends them in larger, less frequent batches, directly addressing high CPU consumption without discarding any log data.

Answer

Use JSON format for logs instead of plain text.

Answer

Set the agent's timezone to UTC.

Answer

Change the log group retention policy to 7 days.

Question 2

A company uses Amazon CloudWatch Logs to store logs from multiple applications. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Additionally, logs must be retained for 7 years for compliance. Which THREE steps should the DevOps engineer take to meet these requirements? (Choose THREE.)

Accepted Answer

Set the log group retention policy to 2557 days (7 years).. CloudWatch Logs retention accepts a fixed set of values, and the maximum supported retentionInDays is 3653 days (approximately 10 years), not 3650 days. 2557 days (7 years) is still a valid supported value within that maximum.

Answer

Modify the existing log group to use the KMS key by updating the log group settings.

Answer

Set the log group retention policy to 'Never expire' and use lifecycle policies to transition logs to Amazon S3 Glacier after 30 days.

Question 3

A DevOps engineer is monitoring an Amazon EC2 Auto Scaling group. The engineer wants to receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Amazon CloudTrail captures API calls made to the EC2 Auto Scaling service, including RunInstances and TerminateInstances events. CloudTrail can be configured to deliver these events directly to an Amazon SNS topic, enabling real-time notifications when instances are launched or terminated. This makes CloudTrail and SNS a valid combination. Amazon CloudWatch Alarms (option C) are not required for this purpose, as CloudTrail's direct integration with SNS provides the notification capability without additional services.

Answer

AWS X-Ray

Answer

AWS Config

Answer

Amazon CloudWatch Alarms

Question 4

A DevOps team is designing a monitoring strategy for a microservices application deployed on Amazon EKS. The application emits custom metrics, and the team needs to collect them with minimal latency and at high resolution. The team also needs to retain logs for 90 days for compliance. Which THREE steps should the team take to meet these requirements? (Choose three.)

Accepted Answer

Use Fluent Bit daemonset to send application logs to CloudWatch Logs.. Fluent Bit is a lightweight, high-performance log processor that can be deployed as a DaemonSet on Amazon EKS to collect application logs with minimal latency. It sends logs directly to CloudWatch Logs, which supports a retention policy of up to 10 years, easily meeting the 90-day compliance requirement. Fluent Bit's low resource footprint and efficient data pipeline ensure high-resolution log collection without impacting application performance.

Answer

Stream logs to Amazon Kinesis Data Firehose for transformation before landing in CloudWatch Logs.

Answer

Enable CloudWatch Container Insights for the EKS cluster.

Question 5

Match each AWS monitoring or logging tool to its purpose.

Accepted Answer

Amazon CloudWatch: Monitors AWS resources and applications by collecting metrics, logs, and setting alarms.. Correctly match each tool to its core purpose. CloudWatch is for metrics and alarms; CloudTrail for API auditing; AWS Config for configuration compliance. Common confusions involve swapping their descriptions.

Answer

Amazon CloudWatch: Records API calls for auditing and compliance.

Answer

AWS CloudTrail: Monitors performance metrics and sets alarms.

Question 6

A company runs a microservices application on Amazon ECS with Fargate. The application logs are sent to CloudWatch Logs. Recently, the operations team noticed that logs from one service are missing for certain time periods. The service is very chatty and produces a high volume of logs. The CloudWatch Logs agent is configured with default settings. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent is dropping logs due to the default batch size and timeout settings.. On ECS Fargate, container logs are shipped by the awslogs log driver (or FireLens), not a configurable host-based CloudWatch Logs agent — there are no local batch_size/batch_timeout knobs to tune on Fargate. A more accurate cause for a single chatty service losing logs for periods is hitting the CloudWatch Logs PutLogEvents throttle, which is enforced per log stream (5 requests/second, 1 MB/second per account per Region as of documented limits) — a high-volume single service can exceed the per-stream rate and experience throttled/dropped delivery. As written, this question's premise (a tunable 'CloudWatch Logs agent' on Fargate) does not match how ECS Fargate logging actually works.

Answer

CloudWatch Logs has a throttling limit on log ingestion per log group.

Answer

The log group has reached its maximum size and stopped accepting new logs.

Answer

The log retention policy is set to 1 day, so older logs are automatically deleted.

Question 7

A company wants to be alerted when the root user signs in to the AWS Management Console. Which service should be used to create a monitoring rule for this event?

Accepted Answer

Amazon CloudWatch Events (now Events) with a rule for the 'RootSignIn' event from CloudTrail. CloudWatch Events (now part of Amazon EventBridge) can create a rule that matches CloudTrail's 'ConsoleLogin' event, filtering on userIdentity.type == "Root" to identify a root user sign-in specifically. The rule can then target an SNS topic, Lambda function, or other destination to send an alert, making this the correct and native service combination for real-time root sign-in monitoring.

Answer

AWS Config

Answer

Amazon S3

Answer

AWS IAM

Question 8

A DevOps engineer needs to collect and analyze logs from multiple AWS services, including EC2, Lambda, and API Gateway. The logs must be stored in a central location for long-term retention and analyzed using SQL queries. Which TWO services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon Athena is an interactive query service that runs standard SQL directly against log data stored in Amazon S3. While CloudWatch Logs collects the logs from EC2, Lambda, and API Gateway and can export them to S3 for long-term retention, Athena is what actually provides the SQL query capability the requirement asks for. Combined, CloudWatch Logs (collection/central storage) and Athena (SQL analysis) satisfy both halves of the requirement, which is why Athena is one of the two correct services here.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Question 9

A DevOps engineer is setting up an alarm to notify the team when the average CPU utilization of an EC2 instance exceeds 80% for 5 consecutive minutes. Which CloudWatch alarm configuration should be used?

Accepted Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1. It configures a CloudWatch alarm with a 300-second (5-minute) period and 1 evaluation period, meaning the alarm triggers when the average CPU utilization exceeds 80% for a single 5-minute data point. This directly matches the requirement of 'exceeds 80% for 5 consecutive minutes' since the metric is evaluated over a 5-minute window.

Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1, Comparison: LessThanThreshold

Answer

Metric: CPUUtilization, Statistic: Average, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Answer

Metric: CPUUtilization, Statistic: Sum, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Question 10

A company uses Amazon CloudWatch to monitor a fleet of EC2 instances. The DevOps team wants to receive notifications when the CPU utilization exceeds 90% for 5 minutes and also when the status check fails. Which THREE steps should be taken to set up these alerts?

Accepted Answer

Set the CPUUtilization alarm with a period of 60 seconds and 5 evaluation periods. The correct steps are B, C, and E. Option B creates a CloudWatch alarm on CPUUtilization with a period of 60 seconds and 5 evaluation periods, which triggers when CPU utilization exceeds 90% for 5 consecutive minutes. Option C creates an alarm on the StatusCheckFailed metric. Option E creates an SNS topic and email subscription for notifications. Option A is incorrect because a period of 300 seconds evaluates a single 5-minute aggregate (e.g., average), which does not guarantee that the metric exceeded the threshold for the entire 5 minutes; it could trigger if a few high minutes raise the average above 90 even if the threshold wasn't exceeded for the full duration. Option D is incorrect because a composite alarm would require underlying alarms and is not a standalone step; separate alarms for different conditions are standard practice.

Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 300 seconds and threshold 90

Answer

Create a single composite alarm that combines both conditions