DOP-C02 Incident and Event Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS CloudTrail

  Why it's wrong here

  AWS CloudTrail is an audit service that records API activity within your AWS account, such as CreateDBInstance, ModifyDBInstance, or DeletionProtection changes. It does not collect or expose runtime database metrics like CPU load, free memory, or replication lag, which are telemetry published per-instance from the RDS engine. Therefore, CloudTrail cannot provide the performance or replication health data the engineer needs.

• ✓

  Amazon CloudWatch

  Why this is correct

  Amazon CloudWatch is the native monitoring service for Amazon RDS, automatically collecting and storing database metrics such as CPU utilization, free memory, read/write throughput, and ReplicaLag for MySQL read replicas. These metrics are published as time-ordered data points and can be visualized on dashboards, trigger alarms via Amazon CloudWatch Alarms, and feed AWS Auto Scaling. With Enhanced Monitoring, it can also expose OS-level metrics, making it the correct source for diagnosing load and replication issues.

• ✗

  VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture information about IP traffic arriving at and leaving the network interfaces of resources, including RDS instances. The captured fields include source/destination IP, ports, protocol, and packet/byte counts, which are useful for security analysis and troubleshooting network connectivity or security group rules. Flow Logs do not expose database-engine metrics such as active connections, InnoDB buffer pool usage, or replica lag, so they are not a valid tool for the described monitoring task.

• ✗

  AWS Trusted Advisor

  Why it's wrong here

  AWS Trusted Advisor is a recommendation engine that evaluates your AWS environment against best practices for cost optimization, security, fault tolerance, performance, and service limites. Its checks are static or quasi-real-time evaluations (for example, whether RDS Multi-AZ is enabled or if you are nearing storage limits), but it does not track dynamic telemetry like current CPU load or replication lag over time. Thus, Trusted Advisor is inappropriate for ongoing monitoring, though it may suggest improving architecture after a problem is identified.

Go deeper

Related to this question