DOP-C02 - Incident and Event Response (14% of the exam) - Section 5.5

Perform root-cause analysis of system and application failures using Amazon CloudWatch, AWS X-Ray, AWS CloudTrail and VPC Flow Logs.

Correlate CloudWatch Logs Insights queries, AWS X-Ray service maps, and AWS CloudTrail API history to trace the origin of an application or infrastructure failure. Use VPC Flow Logs to identify unexpected network traffic patterns that may indicate the root cause of connectivity or security incidents.

CloudWatch Logs InsightsAWS X-RayAWS CloudTrailVPC Flow Logs

Practice question for this objective

Free sampleIncident and Event Responsehard

An Amazon EC2 application in a private subnet intermittently fails to reach an external payment provider, returning connection timeouts, while traffic to other endpoints succeeds. The team suspects packets to the provider are being dropped somewhere in the VPC configuration rather than failing at the application, and they need evidence of whether the traffic is being accepted or rejected and at which point. VPC Flow Logs are already enabled on the relevant network interfaces and delivered to Amazon CloudWatch Logs. Which approach MOST directly confirms where the packets are being dropped?

AEnable AWS X-Ray on the application and inspect the trace for the outbound call to the payment provider, reading the error annotation on the external segment to confirm the packets are being dropped in the VPC.
BSearch AWS CloudTrail for any RevokeSecurityGroupEgress or network ACL change events during the failures, treating a recent configuration change as proof that those packets to the provider are now being rejected.
CCreate an Amazon CloudWatch alarm on the EC2 instance NetworkPacketsOut metric and watch whether it drops during the failures, taking a decline as evidence that the provider traffic is being blocked in the VPC.
DRun a CloudWatch Logs Insights query over the VPC Flow Logs filtering on the provider destination address and port, then read the action field to see whether records show ACCEPT or REJECT for those flows. Correct

Use the ACCEPT or REJECT action field in VPC Flow Logs to confirm whether VPC controls are dropping a specific flow during a connectivity failure. Each VPC Flow Log record includes an action field set to ACCEPT or REJECT, indicating whether security groups and network ACLs permitted the flow. Filtering the flow logs to the destination address and port and reading that field directly confirms whether the provider traffic is being rejected inside the VPC rather than failing at the application.

Why A is wrong: X-Ray records that the application call timed out but has no visibility into VPC packet acceptance or rejection, so it confirms a failure without showing whether a security group or ACL dropped the traffic.

Why B is wrong: CloudTrail can reveal a configuration change but not whether individual packets are accepted or rejected, and the timeouts may stem from an existing rule rather than a recent change, so it does not confirm the drop.

Why C is wrong: The NetworkPacketsOut metric is a coarse aggregate of all interface traffic and cannot isolate the flow to one destination or show an ACCEPT or REJECT decision, so it cannot localise where the packets are dropped.

Why D is correct: VPC Flow Log records carry an action field of ACCEPT or REJECT per flow, so filtering the logs to the provider address and port and reading that field directly shows whether a security group or ACL is dropping the packets.

See more DOP-C02 practice questions, answers explained.

Exam traps in Incident and Event Response

Answers that look right on this material and are not. Each one is a distractor from a different question in the DOP-C02 bank for this domain.

Enable AWS X-Ray active tracing on the application and read the trace segments to see whether the payment provider call is the segment that times out during the failing requests.
Why it is wrong: X-Ray tracing can show an application stalling on a downstream call and is tempting, but it does not reveal who changed the configuration nor whether the VPC is rejecting the packets at the network layer.
Configure an X-Ray sampling rule that captures every request so the complete trace set guarantees the faulty node appears, then have the automation read each captured trace to locate the errors.
Why it is wrong: Sampling at full rate only increases captured volume and cost; it provides no aggregation, so the automation would still have to scan every trace itself to find the faulty node, which the team wants to avoid.
Open the CloudTrail event history console and scroll the recent activity for RDS events, since event history retains the full trail and supports the same SQL filtering across the whole stored period.
Why it is wrong: CloudTrail event history retains only the last ninety days of management events and offers attribute filters rather than SQL, so it cannot search months of trail logs as the requirement demands.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.