OpsCenter, Incident Manager and root cause analysis: DOP-C02 study notes and practice questions
What to know about OpsCenter, Incident Manager and root cause analysis for the DOP-C02 exam, from the Incident and Event Response domain (14% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.
These questions ask how to track, investigate and learn from operational issues with as much automation as possible.
Systems Manager OpsCenter
OpsItems are created automatically from EventBridge events, CloudWatch alarms, Config findings, Security Hub CSPM findings and more.
Each OpsItem holds related resources, recent changes, CloudTrail and Config data, and suggested Automation runbooks you can run from the item.
Deduplication groups repeat alerts for the same resource into one item.
Items stay open until resolved, with root cause notes and operational data for audits.
Explorer summarizes OpsItems across accounts and Regions.
Investigation
CloudWatch investigations use generative AI to look across metrics, logs, traces, deployments and changes and suggest hypotheses and root causes.
CloudWatch Application Signals and Container Insights show service health and dependencies.
CloudTrail and Config timelines show what changed just before the problem.
Incident Manager
AWS Systems Manager Incident Manager is closed to new customers. Existing users can keep using it; new designs should use OpsCenter, CloudWatch alarms with SNS or chat notifications, and on-call tools.
Root cause analysis practice
Write a post-incident analysis: timeline, impact, root cause (use the “five whys”), what went well and action items.
Turn action items into automation: alarms, runbooks, tests and guardrails.
AWS Fault Injection Service game days test that alarms and runbooks work.
Notifications
AWS User Notifications, SNS and Amazon Q Developer in chat applications (Slack, Microsoft Teams) deliver alerts where teams work.
Common traps
Recommending Incident Manager for a new setup.
Email-only alerts with no tracking or ownership.
Root cause notes in chat threads that nobody can find later.
A hospital network runs its scheduling platform on EC2 and RDS in two Regions. Alarms, AWS Health events and failed Systems Manager Automation runs currently send emails to a shared mailbox, and the on-call team loses track of which alert belongs to which incident.
The operations team wants each event to create one tracked work item that lists the affected resources, links to the runbook that handles it, and stays open until someone resolves it. The team also wants the same item to show the root cause once it is found, and to group repeat alerts for the same resource.
The team wants to use the managed Systems Manager capability for this rather than a ticketing system it would integrate and maintain.
Which approach meets these requirements?
Choose one answer.
AA. Send every alarm and event to a shared SNS topic that emails the mailbox, and create a runbook that the on-call team opens when a message arrives.
BB. Use AWS Config to record each alarm as a resource, and attach the runbooks as remediation actions, so that the compliance dashboard shows which resources are affected.
CC. Configure EventBridge rules for alarms, Health events and failed Automation runs to create OpsItems in OpsCenter, with related resources and runbooks, and deduplication strings for repeat alerts.
DD. Create an Incident Manager response plan for each alarm, with escalation to the on-call team, and let the response plan store the root cause in its incident record.
B. Wrong: Config tracks configuration compliance, not operational work items. Its dashboard does not provide a lifecycle for each incident or a place to record the root cause. Learn more: What is AWS Config? (opens in a new tab)
C. Right: Correct. OpsCenter creates OpsItems from EventBridge events and CloudWatch alarms, records related resources and runbooks on each one, and uses deduplication to avoid duplicate OpsItems. The OpsItem stays open until someone resolves it. Learn more: AWS Systems Manager OpsCenter (opens in a new tab)
D. Wrong: Incident Manager handles engagement and escalation, but it is no longer open to new customers, and per-alarm response plans multiply the setup. The requirement was one tracked work item per event with runbooks and grouping. Learn more: What is AWS Systems Manager Incident Manager? (opens in a new tab)
Explanation
OpsCenter creates OpsItems from events and records related resources, runbooks and root-cause notes on each item. Repeat alerts for the same resource can be grouped, and the item stays open until it is resolved. Email, Config tracking and per-alarm response plans each lose one of the tracking, linking or grouping features.
Want more on OpsCenter, Incident Manager and root cause analysis? The 5 full-length practice sets have 7 more OpsCenter, Incident Manager and root cause analysis questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study OpsCenter, Incident Manager and root cause analysis