DOP-C02 Monitoring and Logging Practice Question
A company uses Amazon CloudWatch Synthetics canaries to monitor endpoint availability. The canaries are failing intermittently with timeout errors. The DevOps team needs to diagnose the issue. Which THREE aspects should they investigate?
⚠ Common exam trap
It's easy for candidates to confuse canary schedule frequency with execution timeout, thinking that running the canary less often will fix timeout errors, when the root cause is actually script performance or network latency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The canary script execution time and memory usage.
Canary scripts have a maximum execution time of 5 minutes (300 seconds) and a memory limit of 1 GB. If the script execution time or memory usage exceeds these limits, the canary will fail with a timeout error. Investigating these metrics in CloudWatch can reveal whether the script is too resource-intensive or slow, causing the intermittent failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The canary schedule and frequency.
Why it's wrong here
The schedule determines how often the canary runs, but each run is an independent invocation with its own timeout budget. A more frequent schedule does not alter the per-run timeout threshold or exhaust resources; the canary's execution duration is constrained by the configured timeout value, not by the schedule frequency. Therefore, schedule and frequency are not indicators of why a specific canary run is timing out.
- ✓
The canary script execution time and memory usage.
Why this is correct
CloudWatch Synthetics enforces a maximum execution time per canary run (default 2 minutes, configurable up to 14 minutes). If the script's code, including any synchronous HTTP requests or Puppeteer operations, exceeds this limit, the run is terminated with a timeout error. Similarly, if the memory allocated to the canary's Lambda function is exceeded, the process can be killed, which also surfaces as a timeout or failure. Monitoring these metrics directly identifies whether the script itself is the bottleneck.
- ✓
Network connectivity and routing from the canary's VPC to the target endpoint.
Why this is correct
When a canary runs inside a VPC, it must be able to route to the target endpoint through security groups, network ACLs, and route tables. A missing route, an incorrectly configured security group rule, or a NAT gateway failure can cause the canary's requests to hang until the request timeout, leading to a timeout error. This is a distinct cause from script inefficiency because the network path itself is broken, often affecting all requests regardless of code complexity.
- ✓
CloudWatch Synthetics canary logs for error messages.
Why this is correct
The canary stores execution logs in CloudWatch Logs, including console output, request failures, and stack traces generated by the script. Examining these logs reveals whether the timeout originated from a specific unresolved promise, a hung network request, or an unhandled exception that prevented the script from completing. Logs are the primary diagnostic tool to differentiate between client-side script bugs and infrastructure-level connectivity problems, as they capture the exact point where execution stalled or aborted.
- ✗
CloudWatch Logs retention policy for the canary logs.
Why it's wrong here
The retention policy dictates how long log events are kept in CloudWatch Logs before they are automatically deleted, which is purely a data lifecycle setting. It does not influence the runtime behavior of the canary, its execution timeout, or the success or failure of individual runs. While deleting logs could hinder post-hoc investigation, it cannot cause the timeout error itself or change the canary's operational status.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps team is using Amazon CloudWatch Synthetics canaries to monitor the availability of a web application. The canary is configured to run every 5 minutes. The team notices that the canary fails occasionally but the application is healthy. Which action will help identify if the failures are due to network issues between the canary and the application?
hard- A.Enable VPC Flow Logs for the canary's VPC and analyze the logs for dropped packets
- B.Enable AWS X-Ray tracing on the canary to trace the request path
- C.Increase the canary's memory and timeout settings to reduce false positives
- ✓ D.Configure the canary to run inside the same VPC as the application using a VPC endpoint
Why D: Configuring the canary to run inside the same VPC as the application (e.g., using a VPC endpoint) ensures that the canary's network path is within the VPC, eliminating external network variables. This allows the team to isolate whether failures are due to application issues rather than network connectivity between the canary and the application. Option A: VPC Flow Logs can provide network metadata but are not directly correlated with canary failures to determine the root cause. Option B: X-Ray tracing would need to be instrumented on both the canary and application to trace the request path; it is not automatically enabled and may not isolate network issues specifically. Option C: Increasing memory and timeout may reduce false positives caused by resource constraints but does not help identify network issues.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.