DOP-C02 Incident and Event Response Practice Question
A company uses CloudWatch Synthetics canaries to monitor a critical API endpoint. Recently, a canary started failing with a '403 Forbidden' error. The DevOps engineer verifies that the canary's IAM role has the necessary permissions to invoke the API and that the API endpoint is publicly accessible. What should the engineer check NEXT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check if the API requires an API key or other authentication that the canary is not providing.
A 403 Forbidden error typically indicates that the API endpoint requires authentication (such as an API key) that the canary is not providing. Since the IAM role permissions and public accessibility are verified, the next logical step is to check if the API requires an API key or other authentication headers. Option A is wrong because CloudWatch Logs would show runtime errors, but the 403 is a response from the API, not a runtime error. Option B is wrong because increasing memory does not address authentication issues. Option D is wrong because the API endpoint is publicly accessible, so VPC configuration is irrelevant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Review the canary's CloudWatch Logs for any runtime errors.
Why it's wrong here
Reviewing CloudWatch Logs may show the HTTP 403 response and any stack trace, but it will only confirm the symptom; the root cause is typically an authorization configuration dispute between the canary's request and the API's requirements. Logs are useful for debugging but do not read the API's required authentication policy for you, so they cannot directly reveal a missing API key or invalid signature.
- ✗
Increase the canary's memory to 512 MB to prevent timeout-related issues.
Why it's wrong here
Increasing the canary's memory to 512 MB affects the runtime resources for Puppeteer/Playwright scripts and prevents out-of-memory or execution-time throttling, but a 403 Forbidden status is returned by the API after the request reaches it, not because the canary crashed or timed out. The HTTP status code is generated by the API's authorization layer, so memory upgrade cannot change the outcome of an unauthorized request.
- ✓
Check if the API requires an API key or other authentication that the canary is not providing.
Why this is correct
A 403 Forbidden response from an API means the server understood the request but refused to authorize it; public APIs commonly require an API key, an Authorization header, or a signed payload, and the canary's HTTP request may be missing those credentials. Verify the canary script attaches the API key (e.g., x-api-key header) or uses the same authentication mechanism as your test client; also ensure the key is valid and not expired.
- ✗
Verify that the canary is attached to the correct VPC and subnet.
Why it's wrong here
Synthetics canaries run in AWS-managed infrastructure; for public endpoints, they use an AWS-owned VPC and can reach the internet without any user-supplied VPC configuration. Attaching the canary to a specific VPC and subnet is only necessary for testing private API endpoints (e.g., a REST API inside a VPC), and a 403 is an application-level response that the network path is not even involved.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.