DOP-C02 Incident and Event Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Modify the security group to allow SSH from the engineer's IP.

  Why it's wrong here

  Modifying the security group to permit SSH from the engineer's IP addresses only the network firewall layer, not the instance's guest OS health. If the OS has panicked, the network stack is hung, or memory/CPU is exhausted, sshd cannot accept connections even when traffic reaches the instance. Security group changes are enforced by the hypervisor's packet filtering and cannot revive or interact with a frozen operating system. An out-of-band access method is needed to inspect and recover the instance.

• ✗

  Use AWS Systems Manager Session Manager to start a session.

  Why it's wrong here

  AWS Systems Manager Session Manager is an agent-based, in-band service: the SSM agent must be installed, running, and able to reach Amazon SSM endpoints through the instance's network. If the instance is unresponsive because of an OS kernel issue, network failure, or the agent itself has stopped, it cannot authenticate or establish a WebSocket session. Session Manager also depends on an IAM instance profile with appropriate permissions and on the agent being up-to-date, so it will not function during kernel oopses or network partition events. It is therefore not a reliable path when the instance is completely unresponsive.

• ✗

  Check AWS Personal Health Dashboard for instance issues.

  Why it's wrong here

  AWS Personal Health Dashboard (now part of AWS Health) aggregates service health, account-level events, and scheduled maintenance windows across AWS services, not per-instance guest OS status. An OS-level hang, kernel panic, or resource exhaustion in a single EC2 instance will not surface as a Personal Health Dashboard event. It can alert you to AWS-side issues such as instance store retirement or degraded hardware, but it cannot provide the OS console needed to debug an unresponsive instance. For instance-level diagnostics, you should use the EC2 console, EC2 Serial Console, or system logs.

• ✓

  Use EC2 Serial Console to connect to the instance.

  Why this is correct

  The EC2 Serial Console provides out-of-band server access to the instance's serial port, independent of the network stack and the SSH daemon. It works even when the guest OS is severely degraded or network interfaces are down, making it the correct first step for troubleshooting boot, kernel, and configuration problems. Access is governed through IAM and requires enabling the feature and configuring SSH/RSA keys or a password via IAM policy. Unlike the other options, this is the only one that does not rely on in-band connectivity or a functioning OS network path.

Go deeper

Related to this question