Overview
Incident and Event Response has three task statements. The first covers integrating event sources such as AWS Health, Amazon EventBridge and AWS CloudTrail, and building processing workflows with Amazon SQS, Kinesis, Amazon SNS, Lambda and Step Functions. The second covers changing configuration in response to events: applying changes to systems, modifying infrastructure and returning resources from an undesired state to the expected one.
The third task statement is about troubleshooting. You analyze failed deployments in CodePipeline, CodeBuild, CodeDeploy and CloudFormation, use CloudWatch synthetic monitoring to catch broken user journeys, and investigate failed processes in auto scaling, Amazon ECS and Amazon EKS. Questions expect you to read symptoms and find the root cause quickly.
How it's tested
Domain 5 questions present an event to react to or a failure to diagnose. Event questions ask which source, routing and processing services build a reliable automated response. Troubleshooting questions give logs, statuses or error messages and ask for the most likely cause or the next diagnostic step.
-
Build the event flow
An event must trigger action, and you choose EventBridge, SNS, SQS, Lambda or Step Functions in the right order.
-
Self-heal the system
A resource drifts into a bad state, and you choose automated remediation through Config, Systems Manager or IaC.
-
Find the root cause
A deployment, scaling action or container task fails, and you read the symptoms to pick the cause.
An EC2 instance in an Auto Scaling group keeps launching and terminating. Activity history shows instances marked unhealthy shortly after launch by ELB health checks. The application takes four minutes to start, but the health check grace period is 60 seconds. Increasing the grace period, or adding a lifecycle hook, lets instances finish starting before checks count, which stops the replacement loop.
Task statements 3
Official task statements from the Amazon Web Services outline, in outline order.
5.1 Manage event sources to process, notify, and take action in response to eventsEvent sources such as AWS Health, EventBridge and CloudTrail plus processing workflows.
- What it means
- This task covers integrating AWS event sources, including AWS Health, EventBridge and CloudTrail, and building processing workflows with Amazon SQS, Kinesis, Amazon SNS, Lambda and Step Functions that notify people and take automatic action.
- What to understand
- AWS Health events reach EventBridge and can be aggregated across an organization. CloudTrail management events also appear in EventBridge, so rules can match specific API calls. SNS fans out to many subscribers, SQS buffers and decouples consumers with dead-letter queues for failures, Kinesis preserves ordering for high-volume streams, and Step Functions coordinates multi-step responses with error handling.
- How it shows up
- An event must notify or trigger work reliably, and you choose the source, router and processor.
- Common confusion
- Sending events straight to Lambda without a queue or dead-letter handling when bursts or failures are expected.
5.2 Implement configuration changes in response to eventsApplying changes, modifying infrastructure and remediating undesired state.
- What it means
- This task covers applying configuration changes to systems when events occur, modifying infrastructure in response, and returning resources from a non-desired state to the expected configuration using services such as Systems Manager Automation, AWS Config remediation, Lambda and CloudFormation.
- What to understand
- Typical patterns pair a detector with an actor: a Config rule flags noncompliance and runs an Automation document, or an EventBridge rule catches an API call and invokes Lambda to reverse it. Changes made by automation should be traceable and idempotent. When infrastructure is defined in CloudFormation, fixing the template and updating the stack avoids new drift.
- How it shows up
- A bad state is detected, and you choose the automated fix that restores the desired configuration.
- Common confusion
- Fixing resources manually in the console, which creates drift from the IaC definition and repeats next time.
5.3 Troubleshoot system and application failuresFailed deployments, synthetic monitoring and failed scaling or container processes.
- What it means
- This task covers analyzing failed deployments in CodePipeline, CodeBuild, CodeDeploy and CloudFormation, using CloudWatch Synthetics canaries to spot broken endpoints, and investigating incidents involving auto scaling, Amazon ECS and Amazon EKS processes.
- What to understand
- CloudFormation stack events show the first resource that failed, which is usually the real cause behind a rollback. CodeDeploy logs on the instance and lifecycle event status reveal hook failures. ECS tasks stuck in PENDING often lack cluster capacity or cannot pull images, while stopped tasks show a stopped reason. Auto Scaling activity history explains failed launches, such as missing instance profile permissions or capacity limits.
- How it shows up
- Symptoms or error messages are given, and you identify the cause or the next diagnostic step.
- Common confusion
- Reading only the last CloudFormation error, which is often a cascade, instead of the first failed resource.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Amazon EventBridge
Serverless event bus for AWS, custom and partner events.
- Remember
- Rules match patterns and route to many targets.
- Tested as
- Central to event-driven responses.
- Trap
- Building custom polling instead of a rule.
-
AWS Health events
Notifications about AWS service issues and scheduled changes.
- Remember
- Organizational view aggregates across accounts.
- Tested as
- Proactive incident questions.
- Trap
- Relying on the dashboard without automation.
-
Amazon SQS
Message queue that buffers and decouples work.
- Remember
- Dead-letter queues catch repeated failures.
- Tested as
- Burst and retry scenarios.
- Trap
- Using SNS when durable buffering is needed.
-
Amazon SNS
Pub/sub fan-out to many subscribers.
- Remember
- Can fan out to several SQS queues.
- Tested as
- Notification scenarios.
- Trap
- Expecting SNS to store messages for later processing.
-
AWS Step Functions
Workflow orchestration with retries and branching.
- Remember
- Good for multi-step incident runbooks.
- Tested as
- Complex response flows.
- Trap
- Chaining many Lambda functions by hand.
-
Systems Manager Automation
Runbooks that perform operational changes.
- Remember
- AWS-provided runbooks cover common fixes.
- Tested as
- Remediation questions.
- Trap
- Writing scripts for tasks a runbook already does.
-
CloudWatch Synthetics
Canaries that script endpoint and user-flow checks.
- Remember
- Detect failures before users report them.
- Tested as
- Proactive failure detection.
- Trap
- Relying only on backend metrics.
-
CloudFormation stack events
Ordered log of resource operations.
- Remember
- The first failure explains the rollback.
- Tested as
- Deployment troubleshooting.
- Trap
- Reading only the final rollback message.
-
Auto Scaling activity history
Record of launches, terminations and failures.
- Remember
- Shows reasons such as invalid profiles.
- Tested as
- Scaling incident questions.
- Trap
- Checking application logs first.
-
ECS stopped reasons
Messages explaining why tasks stopped or failed to start.
- Remember
- Common causes are image pulls and capacity.
- Tested as
- Container troubleshooting.
- Trap
- Assuming PENDING tasks mean an application bug.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Messaging services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| EventBridge | Routes events by pattern | Content-based routing to targets | Expecting it to queue for days |
| SNS | Pushes to many subscribers | Fan-out notifications | Expecting durable storage |
| SQS | Holds messages for consumers | Buffering and retries | Expecting push fan-out |
| Kinesis Data Streams | Ordered, replayable stream | High-volume ordered events | Choosing it for simple alerts |
Remediation approaches
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Config remediation | Fixes noncompliant resources | Rule-driven, uses Automation runbooks | Expecting it to act on every API call |
| EventBridge plus Lambda | Reacts to specific events | Immediate, custom logic | Writing code a runbook already covers |
| Stack update | Changes the IaC source | Keeps templates as truth | Fixing live resources and causing drift |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Last error is the cause
- What candidates pick
- Act on the final ROLLBACK_IN_PROGRESS message.
- Why it looks right
- It is the most visible error.
- Why it's wrong
- Later errors are often cascades; the first CREATE_FAILED event usually names the true cause.
Clue to watch for Stack events list several failures.
-
SNS for buffering
- What candidates pick
- Use SNS so failed messages can be retried later.
- Why it looks right
- SNS delivers to many endpoints.
- Why it's wrong
- SNS does not hold messages for consumers; SQS queues with dead-letter queues provide durable retry.
Clue to watch for Downstream processor is slow or fails intermittently.
-
Polling for health issues
- What candidates pick
- Write a Lambda that polls the AWS Health API every minute.
- Why it looks right
- It gives control over checks.
- Why it's wrong
- EventBridge receives AWS Health events directly, so polling adds cost and code for no benefit.
Clue to watch for Automate response to AWS Health notifications.
-
Bug behind PENDING tasks
- What candidates pick
- Debug the application code when tasks stay PENDING.
- Why it looks right
- Failures usually point to code.
- Why it's wrong
- Tasks that never start usually lack capacity, ENIs or image access, not application logic.
Clue to watch for Tasks never reach RUNNING.
-
Grace period ignored
- What candidates pick
- Replace the AMI because instances keep cycling.
- Why it looks right
- Repeated terminations look like a broken image.
- Why it's wrong
- A short health check grace period marks slow-starting instances unhealthy before they are ready.
Clue to watch for Instances terminate minutes after launch.
-
Manual fix during incident
- What candidates pick
- Change the security group in the console and close the ticket.
- Why it looks right
- It restores service fastest.
- Why it's wrong
- The next stack update reverts the fix; automate the remediation or update the template.
Clue to watch for Resource is managed by CloudFormation.
Answer framework
Follow these steps when a question describes an event to handle or a failure to diagnose.
- Classify the question as event handling, automated remediation or troubleshooting, because each calls for a different set of services and a different reading of the stem.
- For events, identify the source, such as AWS Health, CloudTrail through EventBridge, or an application, and the latency needed.
- Choose routing and processing: EventBridge to route, SNS to fan out, SQS to buffer, Step Functions for multi-step flows.
- For failures, find the earliest error in stack events, deployment logs, activity history or stopped reasons before choosing a fix.
- Prefer fixes that are automated and keep IaC as the source of truth, so the same incident does not repeat.
Practice question
Want more like this? The DOP-C02 practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This domain rewards practice with failures more than reading. Build a small environment with CloudFormation, an Auto Scaling group behind an ALB, and an ECS service. Then break it in controlled ways: give the stack an invalid parameter, shorten the health check grace period, remove ECR pull permissions from the task execution role, and add a CodeDeploy hook that exits with an error. For each break, record where the evidence appeared and how long it took you to find it.
For the event side, create EventBridge rules for an AWS Health test event, an EC2 state change and a CloudTrail API call such as a security group change. Route them through SNS, SQS with a dead-letter queue, a Lambda function and a Step Functions workflow. Add one Config rule with automatic remediation.
At 14% of the exam, this domain deserves less time than SDLC Automation, but review it after Domains 1, 3 and 4 because it builds directly on them.
FAQ
How much of DOP-C02 is Incident and Event Response?
Incident and Event Response is 14% of scored content, the smallest of the six domains, or about 9 of the 65 scored questions.
Is AWS Systems Manager Incident Manager tested?
The task statements do not name Incident Manager. Focus on EventBridge, AWS Health, the messaging services and Systems Manager Automation, which the guide lists directly.
How detailed are troubleshooting questions?
They often include status names, error text or log excerpts. Know where each service records failures and which message usually indicates the root cause.
What is CloudWatch synthetic monitoring?
CloudWatch Synthetics runs canary scripts that test endpoints and user flows on a schedule. Failed canaries reveal broken deployments before customers notice.
Should I learn Kubernetes troubleshooting for EKS?
Know common EKS failure areas such as node capacity, IAM roles for service accounts and image pulls. Deep kubectl debugging is beyond what the guide describes.
Why does SQS come up in incident questions?
Queues absorb bursts and keep failed messages for retry, so they make automated responses reliable when processors are slow or broken.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have covered event sources, automated remediation and troubleshooting. Test whether you can find root causes quickly in timed scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the DOP-C02 AI tutor Get any concept explained your way