DOP-C02 Incident and Event Response Practice Question
A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check ALB access logs for target response times.
A 504 error indicates the load balancer did not receive a response from the target within the idle timeout period. Checking ALB access logs for target response times is the first step to determine if the backend is slow or unresponsive. Option A is wrong because scaling policies affect the number of instances, not response times. Option B is wrong because health checks verify instance availability, but intermittent slow responses may not cause health check failures. Option C is wrong because security group rules would cause different errors (e.g., connection timeouts) rather than 504s.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Review the Auto Scaling group scaling policies.
Why it's wrong here
Auto Scaling group scaling policies govern capacity changes and instance lifecycle actions; they do not participate in the ALB's per-request idle timeout mechanism. A 504 Gateway Timeout is emitted by the ALB when it has successfully forwarded a request to a healthy target but the target fails to return a response before the timeout expires, which can happen even when the group's desired capacity is perfectly sized. Troubleshooting scaling policies would only be relevant if the symptom were insufficient capacity causing connection failures or increased latency, not a timeout already being generated by the ALB.
- ✗
Verify the target group health checks are passing.
Why it's wrong here
Target group health checks are pass/fail probes that control whether a target is placed in service; a target that fails health checks is deregistered and typically causes a 503 Service Unavailable response from the ALB, not a 504. A 504 specifically requires the target to have accepted the TCP connection and be considered healthy enough to receive traffic, yet fail to complete the HTTP response within the ALB's idle timeout. Therefore, verifying health checks confirms availability but does not diagnose slow application responses, which is the actual cause of 504s.
- ✗
Check security group rules for the ALB.
Why it's wrong here
Security group rules govern which hosts can initiate connections to the ALB or to the target instances; a misconfiguration would result in connection timeouts, refused connections, or health-check failures, usually surfacing as 502 or 503 errors. A 504 is not a connection-level rejection — it means the ALB successfully established a connection and forwarded the request, but the target did not send response headers before the ALB's idle timeout expired. Checking security groups only validates network reachability, not the backend application's time-to-response, so it would not reveal the hanging request or slow target.
- ✓
Check ALB access logs for target response times.
Why this is correct
ALB access logs are the authoritative source for diagnosing 504 timeouts because they record the HTTP status code and three timing dimensions: request_processing_time, target_processing_time, and response_processing_time. The target_processing_time field directly measures how long the ALB waited for the target to begin sending a response; values at or near the idle timeout threshold precisely identify the request and target instance responsible for the 504. This option provides concrete, per-request evidence of backend latency, unlike health checks or security group rules, which only indicate availability and reachability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,487 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.