5.0 Incident and Event Response DOP-C02 Practice Quiz

• A. Use an EventBridge rule that matches GuardDuty finding events and targets an incident workflow
• B. Schedule a daily script that searches for new findings
• C. Ask analysts to refresh the GuardDuty console manually
• D. Store the finding ID in a static parameter and wait for a deployment

GuardDuty findings are emitted as events, and EventBridge can route matching events directly to response automation or notification targets. This is the correct answer.

• A. Narrow the event pattern to specific sources, detail types, resources, or event names
• B. Increase the number of responders on every alert
• C. Delete all event rules and rely on memory
• D. Match on random request IDs instead of event meaning

Specific event patterns reduce noise and make incident response events actionable. This is the correct answer.

• A. Only successful stack creation events
• B. CloudFormation stack status change events for failed or rollback states
• C. Only monthly billing events
• D. Only S3 object lifecycle transition events

Stack status events identify failed infrastructure changes and can be routed to the correct owner for response. This is the correct answer.

• A. A target that ignores event account identity
• B. Account or environment filtering in the event pattern or routing layer
• C. A response that treats all sandbox events as critical production incidents
• D. A rule that matches only the event timestamp format

Filtering by account or environment prevents nonproduction events from triggering production response workflows. This is the correct answer.

• A. Remove the alarm name as well
• B. Notification context and escalation metadata
• C. Send the same empty message to more channels
• D. Add credentials to the message body

Responders need affected service, scope, severity, owner, and runbook details to take timely action. This is the correct answer.

• A. Send every event to one generic target with no classification
• B. Disable event matching and rely on a shared mailbox
• C. Create separate event rules that match each event type and route to different targets
• D. Use the EC2 instance name as the only event selector for IAM events

Different operational and security events need different owners, severity, and remediation paths. This is the correct answer.

• A. Low-priority ticket for the next planning meeting
• B. Silent remediation with no communication record
• C. High-severity incident with immediate escalation to service owners and leadership communications
• D. Developer-only notification with no service owner involvement

Customer-impacting global checkout failure requires urgent response, clear ownership, and coordinated communication. This is the correct answer.

• A. Put the entire event meaning only in a free-form message string
• B. Use a different field schema for every service release
• C. Include deployment secrets as event fields for convenience
• D. Include stable detail fields such as service, environment, version, status, and owner

Structured event detail fields allow rules, dashboards, and incident tooling to route and correlate release events. This is the correct answer.