DOP-C02 Incident and Event Response Practice Question
A company's DevOps team is designing an automated incident response workflow using AWS Systems Manager Incident Manager and AWS Lambda. The workflow should automatically acknowledge incidents and send notifications to the appropriate response team. Which TWO actions should the team take to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Have the Lambda function publish a message to an SNS topic that the response team subscribes to.
The Lambda function can publish a message to an SNS topic, which sends notifications to the response team. Option E is correct because an Amazon EventBridge rule can match Incident Manager events (e.g., incident creation) and trigger the Lambda function to acknowledge the incident and initiate notifications. Option B is incorrect because CloudWatch alarms do not directly invoke Incident Manager; incidents are created through response plans or EventBridge. Option C is incorrect because Incident Manager's built-in 'Acknowledge' and 'Notify' actions are not independent actions; they are part of a response plan, and the question asks for actions to implement the workflow using Lambda. Option D is incorrect because AWS Step Functions is unnecessary overhead for this simple workflow; a direct integration between EventBridge, Lambda, and SNS suffices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Have the Lambda function publish a message to an SNS topic that the response team subscribes to.
Why this is correct
This approach is correct because SNS is a fully managed pub/sub service that reliably fans out notifications to the response team via email, SMS, or push notifications. The Lambda function, when triggered by an Incident Manager event through EventBridge, can publish the incident details to an SNS topic, decoupling notification delivery from the incident lifecycle. This pattern scales to multiple subscription channels and integrates with AWS Chatbot for chat-based alerts.
- ✗
Configure the CloudWatch alarm to directly invoke the Lambda function for incident creation.
Why it's wrong here
This is wrong because a CloudWatch alarm directly invoking the Lambda bypasses AWS Incident Manager entirely, so no formal incident record is created. Incident Manager is designed to consume CloudWatch alarms as inputs to generate incidents, and then emit events to EventBridge for downstream automation. The Lambda should be triggered by the Incident Manager event, not by the raw alarm, to ensure the incident exists in the system with necessary metadata such as severity and response plan.
- ✗
Use Incident Manager's built-in 'Acknowledge' and 'Notify' actions in a response plan.
Why it's wrong here
This is incorrect because Incident Manager response plans do not include a 'Notify' action; they rely on engagement plans that sequence SNS topics and contact methods to reach the on-call team. 'Acknowledge' is a user-driven action performed on the incident console or API, not a configurable step in a response plan. Confusing these can lead to designing an invalid response plan that fails to actually notify anyone or track incident acknowledgment.
- ✗
Use AWS Step Functions to orchestrate the Lambda function and SNS topic.
Why it's wrong here
This is wrong because Step Functions adds unnecessary orchestration overhead, cost, and complexity for a simple notification task. The Lambda function can directly call the SNS Publish API with minimal code, making the state machine redundant. Step Functions would be justified only if there were multiple branching decisions, retries with manual approvals, or complex human-in-the-loop workflows, which are not present here.
- ✓
Create an EventBridge rule that matches Incident Manager events and triggers a Lambda function.
Why this is correct
This is correct because EventBridge is the native event bus for AWS service events, and Incident Manager emits events such as incident creation, updates, and resolution. A rule can match these events and invoke a Lambda function, enabling event-driven automation that is decoupled and scalable. This is the recommended pattern for incident response because it allows multiple separate rules to react independently to the same incident event for different purposes.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.