Using EC2Rescue to Collect Memory Dumps from Failing EC2 Instances
A DevOps engineer notices that an EC2 instance in an Auto Scaling group is repeatedly failing health checks and being terminated. The engineer needs to capture the root cause by collecting memory dumps and system logs before termination. What should the engineer do?
Quick Answer
The correct answer is to use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period. This works because EC2Rescue is purpose-built for capturing memory dumps and system logs from failing EC2 instances, and by running it at startup you collect diagnostics before the instance fails health checks and gets terminated. Extending the grace period gives EC2Rescue enough time to complete its data collection before Auto Scaling marks the instance unhealthy. On the DOP-C02 exam, this scenario tests your understanding of how to preserve forensic evidence from ephemeral instances in Auto Scaling groups—a common trap is trying to attach an IAM role after the instance is already failing, which is too late. Remember the memory tip: "Startup and Grace" — configure EC2Rescue to run at startup, then extend the grace period to buy time for the dump to complete.
⚠ Common exam trap
Test-takers frequently assume Systems Manager Run Command (Option C) can reliably execute scripts on failing instances, but they overlook that the instance must be in a running and reachable state, which is not guaranteed when health checks are repeatedly failing and termination is imminent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.
EC2Rescue is specifically designed to collect memory dumps and system logs from EC2 instances, and by configuring it to run at startup and extending the Auto Scaling health check grace period, the engineer ensures diagnostics are captured before the instance is terminated for failing health checks. This approach directly addresses the need to gather root cause data from a failing instance that is about to be replaced.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the CloudWatch Agent to collect memory and system logs and publish them to CloudWatch Logs.
Why it's wrong here
CloudWatch Agent collects metrics and logs, but not memory dumps.
- ✓
Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.
Why this is correct
EC2Rescue can run diagnostics at startup; extending the grace period gives time for the tool to collect data before termination.
- ✗
Use AWS Systems Manager Run Command to execute a script on the instance that collects diagnostics before it is terminated.
Why it's wrong here
Run Command requires the instance to be running and communicating; the instance may fail before the command executes.
- ✗
Enable EC2 instance metadata service (IMDS) to capture diagnostic data that persists after termination.
Why it's wrong here
Instance metadata is lost when the instance is terminated.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company experiences an EC2 instance failure in an Auto Scaling group. The instance is terminated and replaced automatically. The DevOps engineer needs to troubleshoot why the instance failed. Which AWS service should the engineer use to view the instance's console output and screenshots before termination?
medium- A.AWS CloudTrail
- ✓ B.Amazon CloudWatch Logs
- C.AWS Systems Manager Session Manager
- D.AWS Config
Why B: Amazon CloudWatch Logs can capture EC2 instance console output if the CloudWatch agent is configured to send system logs. After termination, these logs persist in CloudWatch Logs, allowing troubleshooting. However, CloudWatch Logs does not capture screenshots. Option A (AWS CloudTrail) records API calls, not console output. Option C (AWS Systems Manager Session Manager) provides interactive shell access but does not retrieve console output or screenshots after termination. Option D (AWS Config) tracks configuration changes, not instance failures.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.