CoStudy

Home › Certifications › AWS Certified DevOps Engineer DOP-C02 › Incident and Event Response

Incident and Event Response — AWS Certified DevOps Engineer DOP-C02 practice questions

14 multiple-choice questions and 11 flashcards on Incident and Event Response, about 9% of the AWS Certified DevOps Engineer DOP-C02 bank. Every one carries a written rationale.

Written and maintained by Nick Burton · last updated 2026-08-22 · how we write and review questions

What this chapter covers

Incident and Event Response is one of 6 chapters in CoStudy's AWS Certified DevOps Engineer — Professional (DOP-C02) bank, and it holds 14 of the bank's 150 multiple-choice questions — roughly 9% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.

Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.

Free Incident and Event Response practice questions

7 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.

A team needs cross-region failover automation triggered by a regional impairment. The trigger is an AWS Health PHD event for the affected region. Which approach is BEST?

  1. Rely on Route 53 health checks alone, since they can independently confirm a regional impairment
  2. Poll the affected region's own EventBridge bus for the Health event, which may be unavailable during an impairment
  3. Use AWS Health Organizational View aggregated in a healthy region, combined with EventBridge rules there, to trigger Route 53 ARC routing controls for failover
  4. Wait for CloudWatch composite alarms in the impaired region to fire before failing over

Answer: C — Use AWS Health Organizational View aggregated in a healthy region, combined with EventBridge rules there, to trigger Route 53 ARC routing controls for failover

EventBridge for region impairment must be cross-region. ARC routing controls are dataplane-isolated. B fails when region is impaired. C/D wrong.

When a Security Hub finding indicates a public RDS instance, the team wants auto-remediation via a custom action. Which BEST describes the integration?

  1. Security Hub Custom Action → EventBridge rule on aws
  2. It is a purely detective control with no remediation
  3. It only replicates data during scheduled maintenance
  4. It bypasses IAM policies when invoked via EventBridge

Answer: A — Security Hub Custom Action → EventBridge rule on aws

Custom Actions emit events to EventBridge for automation. B/C/D wrong.

An EventBridge rule should match GuardDuty findings of HIGH severity and trigger SSM Automation to isolate the affected EC2 instance. Which rule pattern is CORRECT?

  1. Source 'aws within the DevOps workflow — the canonical
  2. It only functions when all resources are in a single AZ zone
  3. It writes findings to S3 only and cannot notify EventBridge for th
  4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: A — Source 'aws within the DevOps workflow — the canonical

GuardDuty severities map 7+ to High. The event source/detail-type are documented. B/C/D are wrong sources for GuardDuty.

An on-call escalation should page primary, then secondary after 10 minutes if not acknowledged. Which service BEST implements this?

  1. AWS Systems Manager Incident Manager with engagement plans
  2. It only functions when all resources are in a single AZ zone
  3. It writes findings to S3 only and cannot notify EventBridge
  4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: A — AWS Systems Manager Incident Manager with engagement plans

Incident Manager engagement plans handle escalation with ack windows. SNS fan-outs to everyone immediately.

An EventBridge rule fires on every CloudTrail RootAccountUsage event but the SSM Automation target receives no events. The rule shows InvokeTargetsFailures > 0. What is the MOST LIKELY cause?

  1. It only functions when all resources are in a single AZ zone
  2. It writes findings to S3 only and cannot notify EventBridge
  3. The EventBridge rule's IAM role lacks ssm:StartAutomationExecutio
  4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — The EventBridge rule's IAM role lacks ssm:StartAutomationExecutio

InvokeTargetsFailures plus 'no events received' is classic missing target IAM. B/C/D wrong.

A team wants to schedule a one-time event 90 minutes in the future to expire a temporary firewall rule. Which AWS service is the BEST fit?

  1. AWS Config, which is a purely detective control with no scheduling capability
  2. CodeBuild, which only supports Amazon Linux 2 build environments and has no scheduling feature
  3. EventBridge Scheduler with a one-time schedule (an at() expression) targeting the Lambda function that expires the firewall rule
  4. DynamoDB Global Tables, which only replicate data during scheduled maintenance windows

Answer: C — EventBridge Scheduler with a one-time schedule (an at() expression) targeting the Lambda function that expires the firewall rule

EventBridge Scheduler is the AWS-native scheduler with one-time and recurring. C works but is a heavier hammer. A is the right primitive.

Which AWS service AUTOMATES incident response based on CloudWatch alarms or EventBridge events?

  1. It only functions when all resources are in a single AZ zone
  2. It writes findings to S3 only and cannot notify EventBridge
  3. AWS Systems Manager Automation runbooks + Lambda + Step Functions
  4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — AWS Systems Manager Automation runbooks + Lambda + Step Functions

Automated remediation: EventBridge routes events (alarms, GuardDuty findings) → SSM Automation runbook or Lambda → executes response. Common: isolate suspicious EC2, rotate IAM keys, snapshot for forensics. Critical DOP domain 5 topic.

Incident and Event Response flashcards

4 cards from the 11 in this chapter.

EventBridge archive and replay?

Archive events; replay later for debugging or migration.

AWS Health Dashboard?

Personalized AWS service health for your account. Affecting events.

AWS Health API?

Programmatic access to health events. Build automation.

Need: automated security finding response?

Security Hub → EventBridge → Lambda + SSM Automation.

Practise the full chapter

These are a sample. The full Incident and Event Response chapter runs 25 items with per-chapter progress tracking, on the web and in the iOS app.

Open AWS Certified DevOps Engineer DOP-C02 in CoStudy →

Other AWS Certified DevOps Engineer DOP-C02 chapters

All AWS Certified DevOps Engineer DOP-C02 practice questions →