DOP-C02 Monitoring and Logging Practice Question
A company runs a production web application on Amazon EC2 instances that are part of an Auto Scaling group. The instances are behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics and set up a CloudWatch dashboard to monitor the application. Recently, the team noticed that the CPU Utilization metric for the Auto Scaling group shows a spike every day at 2:00 PM, but the application performance remains normal. The team wants to investigate the cause of the CPU spike. What should the team do FIRST to identify the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CloudWatch Logs Insights to query the application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM.
The correct first step is to use CloudWatch Logs Insights to query application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM. This allows the team to investigate the root cause of the CPU spike by analyzing log data, such as cron jobs or batch processes. Option A (CloudTrail) logs API calls, not CPU usage or instance-level processes. Option C (disabling scheduled tasks) would modify the environment without understanding the cause. Option D (increasing instance size) is a reactive measure, not an investigative step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS CloudTrail to log all API calls to the instances.
Why it's wrong here
AWS CloudTrail records management events such as RunInstances, StartInstances, and StopInstances, plus optional data events for supported services like S3, but it has no visibility into guest OS processes, cron jobs, or CPU utilization inside an EC2 instance. Enabling it would provide an audit trail of control-plane actions, not the diagnostic information needed to correlate a 2:00 PM CPU spike with scheduled tasks. Therefore, CloudTrail cannot help identify the root cause.
- ✓
Use CloudWatch Logs Insights to query the application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM.
Why this is correct
CloudWatch Logs Insights enables you to run SQL-like queries across log groups that receive application and system logs from EC2 instances via the unified CloudWatch agent. By filtering for messages between 1:55 PM and 2:05 PM and searching for terms such as 'cron,' 'schedule,' or the job name, you can identify a recurring batch process that coincides with the spike. This is a non-invasive, first-step diagnostic that directly associates application behavior with the CPU metric.
- ✗
Disable any scheduled tasks on the instances to see if the spike stops.
Why it's wrong here
Blindly disabling all scheduled tasks on production instances is a high-risk action that may stop critical business processes, such as log rotation, backups, or order processing, and it does not tell you which task actually triggered the spike. Even if the spike disappears after disabling a task, you have only removed the symptom while potentially breaking functionality. The correct first step is to observe and identify the specific scheduled job via logs before making any changes.
- ✗
Increase the instance size to provide more CPU capacity to handle the spike.
Why it's wrong here
Scaling up the instance type adds vCPUs and memory but does not reveal why CPU usage spikes at 2:00 PM, so the underlying condition remains and may recur with greater cost. A racy scheduled job that spawns a short-lived CPU burst might not be resolved by adding capacity, especially if the issue is from a runaway loop or contention. This eliminates no failure modes and is not the initial troubleshooting step.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.