DOP-C02 Monitoring and Logging Practice Question
A DevOps engineer receives an alarm that an EC2 instance's StatusCheckFailed metric has been in ALARM state for 10 minutes. Which action should the engineer take first to investigate?
⚠ Common exam trap
The trap is treating a remediation action (restart the instance) as the first step — the exam tests whether you know to investigate and gather diagnostic evidence from logs before taking any corrective action that could destroy the evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the instance's system log and application logs in CloudWatch Logs
When StatusCheckFailed is in ALARM, the first investigative step is to examine the instance's system log and application logs in CloudWatch Logs, because these reveal whether the failure is an OS-level crash, kernel panic, or application error causing the instance to fail its status checks. Reviewing logs is non-destructive and provides the diagnostic evidence needed before taking any remediation action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review the instance's system log and application logs in CloudWatch Logs
Why this is correct
Instance status checks detect OS-level problems such as failed system boot, kernel panic, or filesystem corruption. The instance's system log (console output) shows the boot sequence and kernel messages, while application logs streamed to CloudWatch Logs reveal software-level errors that may have caused the failure. Reviewing both gives the evidence needed to identify the root cause before taking any corrective action.
- ✗
Use AWS Config to check the instance's configuration compliance
Why it's wrong here
AWS Config evaluates your instance's configuration against compliance rules—such as instance type, tagging, EBS encryption, or AMI age—and records configuration changes over time. It does not capture runtime health signals, kernel messages, or application-level crashes, so it cannot explain why an instance status check is currently failing. The alarm is about operational health, not configuration compliance.
- ✗
Check AWS CloudTrail for any API calls that modified the instance
Why it's wrong here
AWS CloudTrail logs management-plane API calls like RunInstances, StopInstances, RebootInstances, or ModifyInstanceAttribute, which is useful for auditing who changed a resource. However, it contains no OS-level telemetry such as kernel panics, memory exhaustion, or failed services. An EC2 status check failure is a data-plane health signal, not an API audit event, so CloudTrail won't show the underlying cause.
- ✗
Restart the EC2 instance to clear the alarm
Why it's wrong here
Restarting the instance might temporarily clear a status-check alarm if the issue is transient, but it does not reveal why the OS became unresponsive. If the underlying root cause—such as corrupted disk, kernel panic, or misconfigured service—persists, the instance will fail the status check again after reboot, and you may incur downtime without any diagnostic information. Best practice is to capture system and application logs before considering any reboot.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.