DOP-C02 Mock Exam 95 — 25 Questions

Question 1

A company runs a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application processes financial transactions. The DevOps team needs to monitor for duplicate transactions that could occur due to retries. The team wants to set up an alert when the number of duplicate transaction attempts exceeds 10 in a 5-minute window. The application logs each transaction attempt with a unique transaction ID to CloudWatch Logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Logs metric filter that counts log events containing 'DuplicateTransaction' and set an alarm on the metric with a threshold of 10.. Option A is correct because a metric filter on CloudWatch Logs can count occurrences of a pattern (e.g., duplicate transaction ID) and create a custom metric, which can then trigger an alarm. Option B is wrong because Lambda sends logs to CloudWatch Logs, not directly to CloudWatch Metrics. Option C is wrong because Kinesis Data Analytics would add unnecessary complexity and cost. Option D is wrong because DynamoDB Streams and Lambda add latency and complexity for a simple counting task.

Answer

Use DynamoDB Streams to trigger a Lambda function that counts duplicates and publishes metrics.

Answer

Stream the CloudWatch Logs to Amazon Kinesis Data Analytics and use SQL queries to detect duplicates.

Answer

Modify the Lambda function to publish a custom metric to CloudWatch for each duplicate transaction, then set an alarm.

Question 2

A media company runs a video transcoding pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple Lambda functions that transcode video files stored in Amazon S3. The company wants to implement a monitoring solution to track the progress of each workflow execution, including which step is currently running, the duration of each step, and any errors. The solution should provide near real-time visibility and allow the team to troubleshoot failed executions quickly. Which solution meets these requirements?

Accepted Answer

Use Amazon EventBridge to capture Step Functions execution status changes and build a custom dashboard in CloudWatch.. Option D is correct because Step Functions natively emits execution history and CloudWatch Events (now Amazon EventBridge) for state changes. Using these events with a dashboard provides real-time visibility into step durations and errors. Option A is wrong because CloudWatch Logs from individual Lambda functions do not provide workflow-level context easily. Option B is wrong because X-Ray traces are for distributed tracing, not for workflow step tracking; also, it adds overhead. Option C is wrong because CloudWatch dashboards can be built from existing metrics, but custom metrics from each step would require significant instrumentation.

Answer

Create custom CloudWatch metrics from Lambda functions for each step, and build a CloudWatch dashboard.

Answer

Configure each Lambda function to write logs to CloudWatch Logs with the execution ID, and use CloudWatch Logs Insights to query and visualize.

Answer

Enable AWS X-Ray tracing on the Step Functions and Lambda functions to get a service map and trace details.

Question 3

A DevOps engineer is responsible for monitoring an AWS environment that includes multiple EC2 instances running a web application. The engineer needs to set up a solution that sends an email alert when the average CPU utilization across all instances exceeds 80% for 10 consecutive minutes. The engineer has created a CloudWatch alarm with the metric `CPUUtilization` aggregated across all instances using the statistic `Average` and a period of 5 minutes. The alarm is set to trigger when the metric exceeds 80% for 2 consecutive periods (10 minutes). The alarm's action is configured to send a notification to an Amazon SNS topic that has an email subscription. However, the engineer is not receiving the email alerts. The engineer verified that the SNS topic exists and the email subscription is confirmed. The CloudWatch alarm shows that the metric value exceeded the threshold for 2 periods, but the alarm state is still 'OK'. What is the MOST likely reason for this?

Accepted Answer

The CloudWatch alarm requires 2 consecutive evaluation periods with the metric exceeding the threshold, but the alarm is still evaluating because of insufficient data points.. Option A is correct because the alarm must be in the 'ALARM' state to send notifications. If the metric exceeds the threshold but the alarm does not transition to ALARM, it may be due to missing data points or insufficient data to evaluate. Option B is wrong because the SNS topic appears to be correctly configured. Option C is wrong because the email subscription is confirmed. Option D is wrong because the metric is being published; the alarm shows values.

Answer

The email subscription is not confirmed.

Answer

The metric `CPUUtilization` is not being published to CloudWatch.

Answer

The SNS topic is not configured to allow CloudWatch to publish to it.

Question 4

A company uses AWS Lambda functions to process streaming data from Amazon Kinesis Data Streams. The Lambda function processes records in batches and writes the results to an Amazon DynamoDB table. Recently, the operations team noticed that the Lambda function is experiencing a high number of throttling errors (HTTP 400) when writing to DynamoDB. The DynamoDB table has on-demand capacity mode enabled. The CloudWatch metrics show that the DynamoDB consumed write capacity is well below the provisioned limits, but the Lambda function's error rate is increasing. The Lambda function's reserved concurrency is set to 100, and the function's timeout is 1 minute. The Kinesis stream has 10 shards. What is the MOST likely cause of the throttling errors?

Accepted Answer

The DynamoDB table is experiencing hot partitions due to uneven access patterns.. Option C is correct because the DynamoDB table has on-demand capacity, but throttling can still occur due to per-partition throughput limits. When many writes target the same partition key, the partition can throttle even if overall capacity is not exceeded. Option A is wrong because the function's concurrency is not the issue; throttling is from DynamoDB. Option B is wrong because the function timeout is not causing throttling. Option D is wrong because the batch size affects the number of records per invocation but not DynamoDB throttling directly.

Answer

The Lambda function's timeout is too short, causing the function to retry and overload DynamoDB.

Answer

The Lambda function's reserved concurrency is too high, causing too many concurrent invocations.

Answer

The Kinesis stream's batch size is too large, causing the Lambda function to write too many records at once.

Question 5

A company runs a containerized application on Amazon ECS with Fargate launch type. The application consists of three microservices: frontend, backend, and database. The ECS cluster is in a VPC with public and private subnets. The frontend service is publicly accessible via an Application Load Balancer (ALB) in public subnets. The backend service communicates with the database service, which runs as a stateful service with persistent storage using Amazon EFS. The DevOps team is using CloudWatch Container Insights and has enabled Prometheus metrics for the ECS cluster. Recently, the team observed that the frontend service's response time has increased significantly, and some requests are timing out. The team checked the ALB metrics and saw an increase in 5xx errors. They also noticed that the backend service's CPU utilization is high, and the database service's disk I/O is high. The team suspects a bottleneck in the backend service. Which course of action should the team take FIRST to identify the root cause?

Accepted Answer

Check the backend service's application logs in CloudWatch Logs to identify errors or slow database queries.. Option B is correct. The first step is to analyze the backend service's application logs to identify any errors or slow operations. The high CPU and disk I/O could be symptoms of inefficient queries or code. Option A is incorrect because increasing capacity without understanding the root cause may not solve the issue and could increase costs. Option C is incorrect because switching to a different database does not address the immediate issue. Option D is incorrect because disabling health checks would hide the problem, not fix it.

Answer

Disable the health check for the backend service in the ALB target group.

Answer

Migrate the database service to Amazon RDS for better performance.

Answer

Increase the desired count of the backend service to reduce load per task.

Question 6

A company runs a containerized web application on Amazon ECS with AWS Fargate. The application is critical and requires high availability. The DevOps team has set up an Amazon CloudWatch alarm that triggers an auto scaling action when the average CPU utilization exceeds 75% for 5 minutes. However, during a recent traffic spike, the application became slow and some requests timed out, even though the CloudWatch alarm did not fire. The team checked the ECS service auto scaling configuration and found that the target tracking scaling policy based on average CPU utilization is set with a target value of 75%. The ECS service is configured with a minimum of 2 tasks and a maximum of 10 tasks. Upon investigation, they noticed that the CPU utilization metric for the service remained below 75% during the spike, but the memory utilization was high (over 90%). The application logs show that the tasks were running out of memory, causing garbage collection pauses and slow responses. Which course of action should the DevOps engineer take to prevent this issue in the future?

Accepted Answer

Add a second target tracking scaling policy based on average memory utilization with a target value of 75%.. Option B is correct because the issue is memory pressure, not CPU. Adding a target tracking scaling policy based on memory utilization will scale the service when memory is high. Option A is wrong because increasing the minimum number of tasks would not dynamically respond to memory spikes. Option C is wrong because the issue is not CPU. Option D is wrong because the application is already containerized; increasing task memory is a static change that may not handle dynamic spikes efficiently, and the best practice is to auto scale based on memory.

Answer

Decrease the CPU target value to 50% to trigger scaling earlier.

Answer

Increase the minimum number of tasks from 2 to 5 to provide more capacity upfront.

Answer

Increase the task memory limit in the task definition to 8 GB.

Question 7

A company runs a critical application on Amazon EKS. The DevOps team uses Prometheus for monitoring and Grafana for visualization. The team has set up a Prometheus server on an EC2 instance to scrape metrics from the EKS cluster. However, they are experiencing high memory usage on the Prometheus server, and some metrics are being dropped because of the retention period. The team wants to implement a scalable and managed monitoring solution that can store metrics for longer durations without the operational overhead of managing the Prometheus server. The team also wants to retain the ability to use PromQL queries and Grafana dashboards. What should the team do?

Accepted Answer

Migrate to Amazon Managed Service for Prometheus to ingest and store metrics, and use Amazon Managed Grafana for visualization.. Option D is correct because Amazon Managed Service for Prometheus is a scalable, managed service compatible with PromQL and can be used with Grafana. Option A is wrong because Amazon CloudWatch Container Insights provides metrics but not PromQL. Option B is wrong because moving Prometheus to a larger instance does not solve the scalability issue. Option C is wrong because Amazon Managed Grafana is a visualization service, not a metrics storage backend.

Answer

Use Amazon Managed Grafana to visualize metrics directly from the EKS cluster without a Prometheus server.

Answer

Increase the EC2 instance size for the Prometheus server and extend the retention period.

Answer

Set up Amazon CloudWatch Container Insights to collect metrics from the EKS cluster and store them in CloudWatch Logs.

Question 8

A company runs a web application on an Auto Scaling group of EC2 instances. The operations team uses CloudWatch alarms to monitor the application. They have set up a CPUUtilization alarm that triggers when the average CPU exceeds 70% for 5 minutes. The alarm triggers a scaling policy to add instances. Recently, the team noticed that the alarm frequently triggers during the day, but the application performance is acceptable. They suspect the alarm is too sensitive and want to reduce the number of false alarms. The team wants to keep the alarm responsive to real CPU spikes but avoid triggering on short bursts. What should the team change in the alarm configuration?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if CPU is high for 3 consecutive periods.. Option B is correct because increasing the evaluation periods requires sustained high CPU for a longer duration before triggering. Option A is wrong because reducing the period would increase sensitivity. Option C is wrong because lowering the threshold would make it more sensitive. Option D is wrong because a composite alarm is not needed; the issue is with the evaluation period.

Answer

Create a composite alarm that combines CPUUtilization with MemoryUtilization.

Answer

Reduce the metric period to 1 minute and keep evaluation periods at 1.

Answer

Lower the threshold to 60% to catch more CPU spikes.

Question 9

A company hosts a static website on Amazon S3 with CloudFront as the CDN. Users report that they see an old version of the website even after the DevOps team updated the S3 objects. The team verified that the new objects are in the S3 bucket and are publicly accessible. The CloudFront distribution has a default TTL of 24 hours. To immediately serve the new content to users, the team needs to invalidate the CloudFront cache. Which of the following is the CORRECT approach to achieve this with minimal impact?

Accepted Answer

Create a CloudFront invalidation request for the path '/*'.. Option D is correct because creating a CloudFront invalidation for the path '/*' will remove all cached objects and force CloudFront to fetch new content from S3. Option A is wrong because changing the origin path does not invalidate cache. Option B is wrong because updating TTL affects future caching, not existing cache. Option C is wrong because S3 does not control CloudFront cache.

Answer

Change the CloudFront origin path to point to a new S3 bucket.

Answer

Update the CloudFront distribution's default TTL to 0 and wait for the changes to propagate.

Answer

Delete the S3 objects and re-upload them with different names.

Question 10

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a large backlog of messages, and the Lambda function is processing them slowly. The DevOps team wants to increase throughput without making changes to the Lambda code. The team decides to increase the reserved concurrency to 10. However, after the change, the Lambda function starts to experience throttling errors (RateExceeded). The team also notices that other Lambda functions in the same account are also being throttled. What is the MOST likely cause?

Accepted Answer

The account's Lambda concurrency limit has been reached due to the increased reserved concurrency.. Option B is correct because the account-level Lambda concurrency limit may be reached. Increasing reserved concurrency for one function reduces the pool available for others. Option A is wrong because SQS batch size does not cause throttling. Option C is wrong because SQS polling interval is controlled by Lambda. Option D is wrong because IAM permissions would cause access denied errors, not throttling.

Answer

The SQS queue's polling interval is too high, causing Lambda to poll infrequently.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The SQS queue's visibility timeout is too short, causing messages to be processed multiple times.

Question 11

A company runs a critical web application on AWS. The application is deployed on EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group across multiple Availability Zones. The company uses Amazon Route 53 for DNS with a failover routing policy. Recently, the operations team noticed that during a regional outage, the failover did not trigger as expected, and users experienced downtime. The health checks in Route 53 are configured to check the ALB endpoint. The ALB's health checks are configured to check the instances. What is the MOST likely reason the failover did not work?

Accepted Answer

The ALB remained healthy during the regional outage, so Route 53 did not fail over.. Option B is correct because if the ALB itself is healthy but the instances are unhealthy, the ALB health check passes, so Route 53 considers the endpoint healthy. Option A is wrong because health checks are on the ALB. Option C is wrong because failover is automatic. Option D is wrong because Route 53 can check endpoints in another region.

Answer

The failover routing policy requires manual intervention to switch traffic.

Answer

Route 53 health checks were not configured for the instance IP addresses.

Answer

Route 53 cannot failover to a different region when the primary endpoint is still reachable.

Question 12

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to route traffic to the ECS service. Recently, the DevOps team noticed that the ECS service is failing to deploy new tasks during a rolling update. The CloudWatch Logs for the ECS service show that new tasks are failing to start because they cannot pull the container image from Amazon ECR. The error message indicates 'AccessDenied' when attempting to pull the image. The task execution role has the necessary permissions, and the image URI is correct. The VPC has a VPC endpoint for ECR configured. The security group for the tasks allows outbound traffic to the VPC endpoint. What is the MOST likely cause of the access denied error?

Accepted Answer

The VPC endpoint for ECR does not have 'Private DNS names enabled' selected.. Option D is correct because the VPC endpoint for ECR requires private DNS resolution to be enabled for the task to resolve the ECR repository endpoint to the private IP address. Without this, the task tries to connect via the public endpoint, which may be blocked by the security group or route table. Option A is wrong because the task execution role already has the required permissions (the error is not about IAM). Option B is wrong because the issue is not related to the ALB security group. Option C is wrong because the task role is for application-specific permissions, not for pulling images.

Answer

The task execution role does not have the 'ecr:GetAuthorizationToken' permission.

Answer

The security group for the ALB does not allow inbound traffic to the ECS tasks.

Answer

The task role does not have the 'ecr:BatchGetImage' permission.

Question 13

A DevOps engineer is responsible for monitoring a production environment that uses Amazon EC2 Auto Scaling. The engineer notices that the Auto Scaling group has been launching and terminating instances frequently over the past hour. The group uses a dynamic scaling policy based on average CPU utilization. The CloudWatch alarm that triggers scaling is set to a threshold of 70% CPU for scale-out and 30% for scale-in. The engineer checks the CloudWatch metrics and sees that CPU utilization is oscillating between 40% and 60%, never reaching the thresholds. The engineer suspects that the scaling policy is not working correctly. The engineer is considering the following actions: A) Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization. B) Increase the cooldown period for the scaling policy to 300 seconds. C) Disable the scale-in policy to prevent frequent terminations. D) Use a simple scaling policy instead of a dynamic scaling policy. Which action should the engineer take?

Accepted Answer

Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization.. Option A is correct because a target tracking policy automatically adjusts the desired capacity to maintain the target value, smoothing out oscillations. Option B is wrong because increasing cooldown may help but does not address the root cause of oscillations; target tracking is more effective. Option C is wrong because disabling scale-in could lead to over-provisioning. Option D is wrong because simple scaling policies are less responsive and can also cause oscillations.

Answer

Disable the scale-in policy to prevent frequent terminations.

Answer

Use a simple scaling policy instead of a dynamic scaling policy.

Answer

Increase the cooldown period for the scaling policy to 300 seconds.

Question 14

A company uses EC2 instances in an Auto Scaling group behind an ALB. The DevOps team receives alerts that the CPU utilization on the instances is consistently above 90% during peak hours. The Auto Scaling group is configured with a simple scaling policy that adds one instance when CPU exceeds 80% and removes one when below 30%. However, during sudden traffic spikes, the scaling policy reacts too slowly, causing performance degradation. The team wants to improve the scaling responsiveness without over-provisioning. What should the team do?

Accepted Answer

Replace the simple scaling policy with a target tracking scaling policy based on average CPU utilization with a target value of 70%.. Option D is correct because using a target tracking scaling policy with a lower target value (e.g., 70%) allows a more proactive scaling response, and the policy automatically adjusts based on the metric. Option A is wrong because scheduled scaling may not handle unpredictable spikes. Option B is wrong because increasing cooldown would slow down scaling. Option C is wrong because a step scaling policy can be more responsive than simple scaling, but target tracking is even simpler and more effective.

Answer

Increase the cooldown period for the simple scaling policy to allow more time for metrics to stabilize.

Answer

Replace the simple scaling policy with a step scaling policy that adds multiple instances when CPU exceeds 80%.

Answer

Create a scheduled scaling action to add instances before peak hours based on historical data.

Question 15

A company's DevOps team uses AWS Config to monitor resource compliance. They have created a custom AWS Config rule that triggers an AWS Lambda function to evaluate whether EC2 instances have the 'Environment' tag with value 'Production' or 'Staging'. The rule is set to evaluate resources on configuration changes. However, the team notices that the rule does not trigger when an EC2 instance is launched. The Lambda function's IAM role has the necessary permissions to describe EC2 instances. The CloudWatch Logs for the Lambda function show that it is not being invoked. What is the MOST likely reason?

Accepted Answer

The AWS Config rule is not configured to trigger on AWS::EC2::Instance resources.. Option A is correct because AWS Config rules need to be associated with the specific resource type (AWS::EC2::Instance) in the rule's scope; without this, the rule won't trigger on EC2 instance changes. Option B is wrong because the Lambda function's permissions are sufficient; the issue is before invocation. Option C is wrong because the rule is event-based; evaluation on configuration changes should work. Option D is wrong because a custom rule can be triggered by configuration changes.

Answer

The Lambda function's IAM role does not have permission to write to CloudWatch Logs.

Answer

The AWS Config rule is set to evaluate resources periodically, not on configuration changes.

Answer

The custom rule must be deployed using AWS CloudFormation to be active.

Question 16

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application is deployed across three Availability Zones. The DevOps team uses AWS CloudFormation to manage the infrastructure. During a recent deployment, a stack update failed, and the stack entered a ROLLBACK_IN_PROGRESS state. However, the rollback also failed, leaving the stack in UPDATE_ROLLBACK_FAILED state. The engineer needs to restore the application to a working state. The stack includes an Auto Scaling group, an ALB, security groups, and a DynamoDB table. The DynamoDB table is defined with deletion protection enabled. The engineer is considering the following actions: A) ContinueUpdateRollback to retry the rollback, fixing the resource that caused the failure. B) Delete the stack and recreate it from the last known good template. C) Use CloudFormation's 'SignalResource' to manually complete the rollback. D) Manually update the resources to match the previous template, then resume the rollback. Which action should the engineer take?

Accepted Answer

Use ContinueUpdateRollback to retry the rollback after fixing the resource that caused the failure.. Option A is correct because ContinueUpdateRollback is the designed method to resolve a rollback failure. The engineer can fix the underlying issue (e.g., DynamoDB deletion protection preventing table deletion) and then retry the rollback. Option B is wrong because deleting the stack would also delete the DynamoDB table (deletion protection may prevent deletion, causing further issues). Option C is wrong because SignalResource is for signaling creation of resources, not for rollback. Option D is wrong because manually updating resources is error-prone and not recommended; ContinueUpdateRollback automates the process.

Answer

Manually update the resources to match the previous template, then resume the rollback.

Answer

Use CloudFormation's 'SignalResource' to manually complete the rollback.

Answer

Delete the stack and recreate it from the last known good template.

Question 17

A company is using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is configured with a batch size of 10 and a maximum concurrency of 5. Recently, the function started experiencing high error rates and the SQS queue's ApproximateNumberOfMessagesVisible metric is increasing. The CloudWatch logs show that the function is timing out after 30 seconds. The function makes calls to an external API that sometimes takes more than 30 seconds to respond. The DevOps engineer needs to reduce the backlog and prevent message loss. The engineer is considering the following actions: A) Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds. B) Decrease the batch size to 1 to avoid processing multiple messages at once. C) Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions. D) Use a dead-letter queue to capture messages that fail processing after all retries. Which combination of actions should the engineer take?

Accepted Answer

Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds.. Option A is correct because increasing the timeout allows the function to wait longer for the external API, and increasing visibility timeout prevents messages from becoming visible again before the function completes. This reduces retries and backlog. Option B is wrong because decreasing batch size reduces throughput, worsening the backlog. Option C is wrong because increasing concurrency may cause more timeouts if the function still times out. Option D is good but alone does not reduce backlog; it only captures failed messages. The best approach is to fix the timeout first.

Answer

Use a dead-letter queue to capture messages that fail processing after all retries.

Answer

Decrease the batch size to 1 to avoid processing multiple messages at once.

Answer

Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions.

Question 18

A company uses AWS CloudTrail to log API activity in their AWS account. The DevOps engineer needs to ensure that all management events are logged and that the logs are delivered to an S3 bucket in another account for centralized auditing. The engineer has already created an S3 bucket in the central auditing account and applied a bucket policy that grants the CloudTrail service permission to write logs. However, logs are not being delivered. The engineer verifies that the CloudTrail trail is configured to point to the correct S3 bucket name and that the bucket exists. What is the MOST likely reason the logs are not being delivered?

Accepted Answer

The S3 bucket policy in the central account does not include the 's3:PutObject' action for the CloudTrail service.. Option B is correct because the S3 bucket policy must also grant the CloudTrail service the 's3:PutObject' permission for the bucket, not just allow write access generically. Option A is wrong because CloudTrail can deliver logs cross-account without a VPC peering connection. Option C is wrong because the bucket policy should be on the destination bucket, not the source account. Option D is wrong because the bucket is in another account, so the source account cannot set ACLs; bucket policy is the correct mechanism.

Answer

The S3 bucket must have ACLs enabled to allow cross-account writes.

Answer

The source account does not have a VPC peering connection to the central auditing account.

Answer

The CloudTrail trail must be created in the central auditing account, not the source account.

Question 19

A company uses AWS Lambda functions that are triggered by S3 events (object creation). The Lambda function processes the file and stores results in DynamoDB. Recently, the function started timing out after 15 seconds, causing some files to not be processed. The average file size has increased significantly. The DevOps engineer increases the Lambda function's timeout to 30 seconds and the memory to 512 MB, but the function still times out for large files. The CloudWatch Logs show that the timeout occurs during the 'dynamodb.put_item' call for a large item. The DynamoDB table's write capacity is set to on-demand, and there are no throttling errors. What should the engineer do to resolve the timeout issue?

Accepted Answer

Modify the Lambda function to split the large item into multiple smaller items before writing to DynamoDB.. Option B is correct because using DynamoDB's TransactWriteItems or increasing the timeout and memory may not help if the item size exceeds the 400 KB limit; splitting the item reduces the payload. Option A is wrong because increasing memory and timeout further may not help if the DynamoDB API call itself times out due to large item size. Option C is wrong because the issue is not related to SQS. Option D is wrong because the Lambda is not using EFS.

Answer

Configure the Lambda function to write to an SQS queue first, then have another Lambda process the queue.

Answer

Mount an EFS file system to the Lambda function and write the large item to a file instead of DynamoDB.

Answer

Increase the Lambda function's timeout to 5 minutes and memory to 1024 MB.

Question 20

A company has a multi-account AWS environment managed by AWS Organizations. The DevOps team uses AWS CloudFormation StackSets to deploy a standard VPC across all member accounts. The security team has noticed that in some accounts, the VPC is being modified after deployment, allowing inbound SSH access from the internet. The team wants to automatically detect and remediate these changes. The current setup includes: AWS Config enabled in all accounts with a rule that checks for unrestricted SSH access; an SNS topic in the management account that receives compliance change notifications; and a Lambda function in the management account that can remediate by updating the security group rules. However, the remediation is not working consistently. What is the most likely reason, and what is the best solution?

Accepted Answer

The Lambda function's IAM role does not have permissions to modify security groups in member accounts.. Option C is correct because AWS Config rules in member accounts cannot directly trigger cross-account remediation via SNS unless the Lambda function has permission to modify resources in those accounts. The most likely issue is that the Lambda function's IAM role does not have permissions to modify security groups in member accounts. The best solution is to use AWS Config conformance packs with remediation actions that are deployed to each member account, which can then execute remediation locally. Option A is wrong because the Config rule itself is working (it detects changes). Option B is wrong because the SNS topic is receiving notifications, but the Lambda function's role lacks cross-account permissions. Option D is wrong because StackSets are for initial deployment, not for ongoing compliance.

Answer

The AWS Config rule is not evaluating correctly in member accounts.

Answer

The SNS topic is not delivering messages to the Lambda function due to cross-account access issues.

Answer

CloudFormation StackSets is overriding the changes, causing a race condition.