DOP-C02 Monitoring and Logging Practice Question
A company runs a production web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is deployed across three Availability Zones. The DevOps team recently noticed that the application's error rate is spiking periodically, but they cannot correlate the spikes with any known deployments or changes. The team has enabled detailed CloudWatch metrics for the ALB and EC2, and they are using CloudWatch Logs for application logs. They also have AWS X-Ray enabled for tracing.
The team observes that during error spikes, the ALB's 5XX count increases, but the EC2 instance-level CPU and memory metrics remain normal. The application logs show 'Connection timed out' errors. The team suspects the issue is related to network connectivity but is not sure.
Which course of action should the DevOps team take to identify the root cause of the periodic error spikes?
⚠ Common exam trap
The trap here is that candidates often jump to scaling or access logs (options C or D) because they focus on the 5XX error symptom, but the question specifically points to network-level timeouts, making VPC Flow Logs the only diagnostic tool that can reveal dropped or rejected packets at the network layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs for the subnets and analyze the logs to identify dropped connections during the error spikes.
VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including whether the traffic was accepted or rejected. Since the application logs show 'Connection timed out' errors and instance-level metrics are normal, the issue likely lies in the network path (e.g., security groups, NACLs, or subnet routing) rather than the application or compute layer. Analyzing VPC Flow Logs during the error spikes will reveal if connections are being dropped or rejected, pinpointing the root cause of the timeouts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable VPC Flow Logs for the subnets and analyze the logs to identify dropped connections during the error spikes.
Why this is correct
VPC Flow Logs capture interface-level metadata for all IP traffic, including source and destination IPs, ports, protocol, and whether the action was accepted or rejected. During error spikes, analyzing Flow Logs via CloudWatch Logs Insights or Athena can reveal if connections to the instances are being blocked by security group rules or network ACLs, or if packets are being dropped before reaching the target. This directly identifies the root cause of ALB 5xx errors caused by network connectivity failures, rather than application-level issues.
- ✗
Increase the EC2 instance size to handle higher traffic and reduce timeouts.
Why it's wrong here
Increasing the EC2 instance size assumes the errors are due to resource exhaustion, but the described monitoring shows CPU and memory at normal levels, indicating sufficient capacity. ALB 5xx errors can stem from network-level unreachability, such as security group denials or misconfigured network ACLs, which a larger instance would not fix. Moreover, vertical scaling adds cost and does not address the actual cause of connection timeouts or dropped packets, making this a misguided remediation.
- ✗
Configure a step scaling policy for the Auto Scaling group based on ALB 5XX count.
Why it's wrong here
A step scaling policy based on ALB 5XX count would only add or remove instances in response to error rates, but it does not prevent the underlying connectivity issue that causes those errors. If the ALB cannot reach targets due to VPC network configuration or security group rules, newly launched instances will exhibit the same failure, so scaling out cannot resolve the problem. It also risks creating a false sense of resolution while masking the true root cause and could rapidly increase compute costs without benefit.
- ✗
Enable ALB access logs and analyze the 5xx response patterns.
Why it's wrong here
ALB access logs capture detailed HTTP request/response data, including the 5xx status code, but they do not provide information about network-layer packet drops or connection rejections. If the ALB is experiencing failures connecting to targets because of security group or NACL rules, the access log may show an error code without revealing the underlying network blockage. This limitation makes access logs insufficient for diagnosing the dropped connections, unlike VPC Flow Logs which explicitly record whether traffic was accepted or rejected at the network interface.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.