DOP-C02 practice question: OpsCenter, Incident Manager and root cause analysis
Incident and Event Response A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital network runs its scheduling platform on EC2 and RDS in two Regions. Alarms, AWS Health events and failed Systems Manager Automation runs currently send emails to a shared mailbox, and the on-call team loses track of which alert belongs to which incident.
The operations team wants each event to create one tracked work item that lists the affected resources, links to the runbook that handles it, and stays open until someone resolves it. The team also wants the same item to show the root cause once it is found, and to group repeat alerts for the same resource.
The team wants to use the managed Systems Manager capability for this rather than a ticketing system it would integrate and maintain.
Which approach meets these requirements?
Choose one answer.
AA. Send every alarm and event to a shared SNS topic that emails the mailbox, and create a runbook that the on-call team opens when a message arrives.
BB. Use AWS Config to record each alarm as a resource, and attach the runbooks as remediation actions, so that the compliance dashboard shows which resources are affected.
CC. Configure EventBridge rules for alarms, Health events and failed Automation runs to create OpsItems in OpsCenter, with related resources and runbooks, and deduplication strings for repeat alerts.
DD. Create an Incident Manager response plan for each alarm, with escalation to the on-call team, and let the response plan store the root cause in its incident record.
B. Wrong: Config tracks configuration compliance, not operational work items. Its dashboard does not provide a lifecycle for each incident or a place to record the root cause. Learn more: What is AWS Config? (opens in a new tab)
C. Right: Correct. OpsCenter creates OpsItems from EventBridge events and CloudWatch alarms, records related resources and runbooks on each one, and uses deduplication to avoid duplicate OpsItems. The OpsItem stays open until someone resolves it. Learn more: AWS Systems Manager OpsCenter (opens in a new tab)
D. Wrong: Incident Manager handles engagement and escalation, but it is no longer open to new customers, and per-alarm response plans multiply the setup. The requirement was one tracked work item per event with runbooks and grouping. Learn more: What is AWS Systems Manager Incident Manager? (opens in a new tab)
Explanation
OpsCenter creates OpsItems from events and records related resources, runbooks and root-cause notes on each item. Repeat alerts for the same resource can be grouped, and the item stays open until it is resolved. Email, Config tracking and per-alarm response plans each lose one of the tracking, linking or grouping features.
Want more on OpsCenter, Incident Manager and root cause analysis? The 5 full-length practice sets have 7 more OpsCenter, Incident Manager and root cause analysis questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →