DOP-C02 Incident and Event Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is a service that records the configuration state and changes of AWS resources, such as instance types, security groups, or tags, and evaluates those configurations against compliance rules. It captures control-plane metadata about resources but has no visibility into the guest OS, so it cannot report on running processes or their CPU consumption. At best, AWS Config might show that an instance type changed or a scaling policy was invoked, but it cannot help identify the specific process causing the high CPU utilization.

• ✗

  AWS CloudTrail

  Why it's wrong here

  AWS CloudTrail is an audit service that records management-plane API activity in your AWS account, such as who launched or terminated an EC2 instance, modified an Auto Scaling group, or changed IAM policies. It captures JSON-formatted event history with identity, source IP, and timestamps, but it has no access to the guest OS of your instances and cannot report on OS-level performance counters or which specific process is consuming CPU. While CloudTrail might reveal a recent infrastructure change that coincided with the CPU spike, it is not a diagnostic tool for process-level performance issues.

• ✓

  AWS Systems Manager Run Command

  Why this is correct

  AWS Systems Manager Run Command lets you securely execute commands on managed EC2 instances via the SSM Agent, without requiring SSH, RDP, or open inbound ports. To diagnose a high-CPU alarm, you can run an OS-level command such as `top -b -n1` or `ps aux --sort=-%cpu` to get a snapshot of per-process CPU and memory usage, and retrieve the output from the console, CLI, or an S3 bucket. This gives you process-level detail directly from the guest OS, making it the correct tool to determine the root cause of the CPU spike.

• ✗

  Amazon Inspector

  Why it's wrong here

  Amazon Inspector is a vulnerability management service that automatically scans workloads for software vulnerabilities (CVEs), unintended network exposure, and deviations from security best practices. It relies on a security agent and network reachability analysis to produce findings about security risks, not about runtime CPU utilization or process behavior. As a result, it cannot tell you why CPU usage is high or identify a misbehaving process like `top` or `ps`; its purpose is security assessment, not performance troubleshooting.

Go deeper

Related to this question