Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Container restart failures require detailed observability into pod-level, node-level, and container-level metrics and logs. CloudWatch Container Insights is purpose-built for Kubernetes operational diagnostics and provides granular visibility into CPU, memory, network I/O, disk I/O, container restarts, OOM kills, throttling, pod lifecycle issues, and Kubernetes control plane behaviors.

The CloudWatch Observability add-on deploys Fluent Bit and the CloudWatch Agent directly into the EKS cluster as DaemonSets. These components automatically collect:

Container logs

Pod metrics

Node metrics

Cluster events

OOM errors

CrashLoopBackOff restart cycles

Control plane request anomalies

With this data, the DevOps engineer can easily identify misconfigurations, resource bottlenecks, unhealthy nodes, failing containers, or image pull issues.

Option A (dashboards only) lacks per-container diagnostic data.

Option B (CloudTrail) only logs API calls — not useful for restart debugging.

Option C (CloudTrail Insights) only detects anomalous API usage, not container failures.

Therefore, CloudWatch Container Insights is the correct and AWS-recommended solution for diagnosing container restart failures in EKS.

To ensure that CloudTrail cannot be disabled in any member account, the control must be enforced above the individual accounts, at the organization level , and must not be overridable by local administrators. AWS Service Control Policies (SCPs) provide exactly this capability: they define permission guardrails that apply to all IAM users, roles, and even the root user in accounts within an AWS Organizations OU.

By applying an SCP that explicitly denies cloudtrail:StopLogging and cloudtrail:DeleteTrail , the organization prevents any principal in the affected accounts from disabling logging or deleting the trails, regardless of their IAM permissions. This provides strong, centralized enforcement of audit logging.

Option B uses IAM policies in each account. Local administrators with sufficient privileges could modify or detach those policies, defeating the control. Option C only sends notifications and does not prevent the action. Option D with AWS Config auto-remediation still allows a window where CloudTrail is disabled and also can be disabled or modified itself.

Therefore, the most robust and least bypassable approach is to use an SCP at the OU level to deny CloudTrail stop and delete actions.