DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Insufficient CloudTrail logging trail configuration

  Why it's wrong here

  CloudTrail is an audit service that records API calls made to the AWS control plane, such as EC2 RunInstances or ALB CreateListener; it has no visibility into application payloads or HTTP responses. A misconfigured or insufficient CloudTrail trail might delay or prevent audit log delivery for forensic analysis, but it does not alter ALB routing behavior, target health evaluation, or capacity management. Therefore, it is irrelevant to the generation of 503 responses and is purely a compliance/observability concern, not an operational cause.

• ✓

  The target group has an insufficient number of healthy instances due to health check failures

  Why this is correct

  The ALB routes requests only to targets that have successfully passed their configured health checks. If health check failures occur—due to an incorrect health check path, a timeout threshold being too low, or an application dependency failing—the corresponding instances are marked unhealthy and removed from the rotation. When the number of healthy targets drops below the minimum needed (typically zero healthy targets in a target group), the ALB returns HTTP 503 Service Unavailable. This can happen without CPU or memory utilization rising, because health checks validate application-level readiness, not just resource utilization.

• ✗

  Detailed monitoring is disabled for the EC2 instances

  Why it's wrong here

  Detailed monitoring only changes the frequency of CloudWatch metric collection from 5 minutes to 1 minute; it does not affect the data plane behavior of the Application Load Balancer or the EC2 instances' ability to accept traffic. Even with detailed monitoring enabled, the ALB would still return 503 if its target group contains zero healthy instances. Thus, while disabling detailed monitoring reduces observability and delays detection of bottlenecks, it is not a cause of 503 Service Unavailable errors.

• ✗

  The security group for the ALB is misconfigured

  Why it's wrong here

  A misconfigured security group on the ALB would block inbound traffic from clients or outbound traffic to the targets, leading to connection timeouts, connection resets, or HTTP 504 Gateway Timeout errors when the target fails to respond. It would not produce a 503, because a 503 specifically indicates that the ALB itself has accepted the connection and successfully routed to no target with healthy status. Since a security group misconfiguration prevents traffic from reaching the ALB or targets at the network layer, it manifests as a connectivity failure rather than a targeted HTTP status code.

Go deeper

Related to this question