PAS-C01 Operations and Maintenance — 50 Questions

Question 1

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

Accepted Answer

Review CloudWatch metrics for the instance and the ALB target group. Reviewing CloudWatch metrics for the instance and the ALB target group is the correct first step because it provides immediate visibility into the root cause of intermittent connectivity issues. Metrics such as TargetResponseTime, RequestCount, and HealthyHostCount can reveal whether the problem is due to high latency, request failures, or the instance being marked unhealthy by the ALB health checks. This data-driven approach avoids unnecessary changes and aligns with the AWS Well-Architected Framework's principle of observability.

Answer

Modify the security group to allow all traffic temporarily

Answer

Terminate the instance and let Auto Scaling launch a new one

Answer

Attach an additional Elastic Network Interface (ENI) to the instance

Question 2

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

Accepted Answer

The VPC endpoint for SSM does not have a security group that allows HTTPS outbound to the endpoint. The error 'Unable to retrieve patch baseline' indicates that the EC2 instances cannot communicate with the AWS Systems Manager service to fetch the patch baseline configuration. Since the instances are in a private subnet with a VPC endpoint for SSM, the most likely cause is that the VPC endpoint's security group does not allow HTTPS outbound traffic (port 443) to the endpoint itself. Without this outbound rule, the SSM Agent on the instance cannot establish the TLS connection required to retrieve the patch baseline from the SSM API.

Answer

The CodeDeploy agent on the instances is outdated

Answer

The instances are not registered as managed instances with the SSM ManagedInstance role

Answer

The instances do not have an IAM instance profile attached

Question 3

A company runs a critical application on an EC2 instance that uses a large EBS volume for database storage. The volume is not encrypted at rest. To meet compliance requirements, the company must enable encryption on the volume with minimal downtime. Which solution meets these requirements?

Accepted Answer

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume. Option A is correct because taking a snapshot of the unencrypted volume with encryption enabled creates an encrypted snapshot. From that snapshot, you can create a new encrypted EBS volume. Detaching the original volume and attaching the new encrypted volume to the same EC2 instance achieves encryption with minimal downtime—only the brief period required for the detach/attach operations. This approach does not require copying the snapshot, which would add unnecessary time.

Answer

Use the AWS Management Console to modify the volume and enable encryption in place

Answer

Take a snapshot of the volume, copy the snapshot with encryption enabled, then restore to a new volume and attach it to the instance

Answer

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Question 4

A DevOps engineer needs to automatically restart a specific service on an EC2 instance whenever the service crashes. The instance is running Amazon Linux 2. Which approach is the MOST operationally efficient?

Accepted Answer

Configure the service as a systemd unit with Restart=on-failure. Option C is correct because systemd, the default init system on Amazon Linux 2, provides a built-in `Restart=` directive that can be set to `on-failure`. This instructs systemd to automatically restart the service unit when it exits with a non-zero exit code or is terminated by a signal, without requiring any external monitoring or additional infrastructure. This is the most operationally efficient approach as it leverages the native service manager functionality with zero external dependencies.

Answer

Set up a CloudWatch alarm that triggers an SSM Run Command to restart the service

Answer

Write a cron job that checks the service status every minute and restarts it if needed

Answer

Use an AWS Lambda function that polls the service status and calls the EC2 reboot API

Question 5

A company has a CloudFormation stack that creates an EC2 instance with a custom AMI. The stack fails with the error 'Resource creation cancelled' during creation. The engineer checks the stack events and sees that the EC2 instance creation succeeded, but the subsequent creation of an EBS volume failed. What is the MOST likely reason for the failure?

Accepted Answer

The EBS volume creation failed, causing the stack to roll back and cancel the instance. Option C is correct because when an EBS volume creation fails in a CloudFormation stack, the stack initiates a rollback of all previously created resources, including the EC2 instance. The 'Resource creation cancelled' error appears for the EC2 instance because its creation was successful but then undone during the rollback, not because it failed initially.

Answer

The EC2 instance creation failed and then was cancelled

Answer

The EC2 instance had a DeletionPolicy of Retain, which prevented rollback

Answer

The EC2 instance depended on the EBS volume, and the dependency caused a timeout

Question 6

A company is designing a disaster recovery strategy for a critical application that runs on EC2 instances with data stored on EBS volumes. The application requires RPO of 15 minutes and RTO of 1 hour. Which TWO approaches meet these requirements?

Accepted Answer

Use EBS Snapshots taken every 15 minutes and copy them to the DR region. Option A is correct because EBS Snapshots can be taken as frequently as every 15 minutes, and copying them to a DR region ensures that the most recent snapshot is available for recovery. When a disaster occurs, you can create a new EBS volume from the latest snapshot in the DR region, attach it to an EC2 instance, and achieve an RPO of 15 minutes and an RTO of under 1 hour (assuming the instance is pre-provisioned or launched quickly). This approach directly satisfies the stated recovery objectives without relying on instance-level operations.

Answer

Use AWS Backup with a backup plan that takes cross-region backups every 15 minutes

Answer

Use Amazon Machine Images (AMIs) backed by EBS snapshots, taken hourly

Answer

Use EBS Multi-Attach volumes to allow the DR instance to access the same volumes

Question 7

A company is migrating a legacy application to AWS. The application requires a static IP address that does not change during instance stop/start. The application also needs to be highly available across two Availability Zones. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use a Network Load Balancer with an Elastic IP address. A Network Load Balancer (NLB) supports static IP addresses by allowing you to associate an Elastic IP address with each of its Availability Zone subnets. This provides a fixed entry point that does not change when backend instances are stopped or started, meeting the requirement for a static IP. Combined with an Auto Scaling group spanning two Availability Zones, the NLB ensures high availability by distributing traffic across healthy instances in both zones.

Answer

Place the instances in a placement group to ensure high availability

Answer

Use an Application Load Balancer to distribute traffic to the instances

Question 8

A company manages a multi-account AWS environment using AWS Organizations. The operations team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket. What is the MOST efficient way to enforce this configuration?

Accepted Answer

Deploy an AWS CloudFormation StackSet with a template that enables CloudTrail and configures the S3 bucket in every account and region.. Option B is correct because AWS CloudFormation StackSets allow you to deploy a CloudTrail configuration template across multiple accounts and regions in a single, automated operation. This approach ensures consistent enforcement of the policy without manual intervention, leveraging the centralized management capabilities of AWS Organizations.

Answer

Configure CloudTrail in the management account with an S3 bucket policy that grants access to all member accounts.

Answer

Create a custom script using AWS CLI to enable CloudTrail in each account and region.

Answer

Use AWS Service Catalog to publish a CloudTrail product and require each account to launch it.

Question 9

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

Accepted Answer

Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.. AWS CloudTrail captures all API calls made to AWS services, including S3 bucket policy modifications via the PutBucketPolicy API. By searching the CloudTrail event history for PutBucketPolicy events filtered by the specific S3 bucket ARN, you can directly identify the IAM user or role that made the change, along with the exact timestamp. This is the most efficient method because it provides a complete audit trail of API activity without requiring additional logging setup or parsing.

Answer

Examine the S3 server access logs for the bucket.

Answer

Review the configuration timeline in AWS Config for the S3 bucket.

Answer

Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.

Question 10

Solutions Architect needs to automate the patching of Amazon EC2 instances running Amazon Linux 2. The instances are in an Auto Scaling group and must be patched without downtime. Which approach is BEST?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window and update the Auto Scaling group launch configuration to use a patched AMI for new instances.. Option C is correct because AWS Systems Manager Patch Manager automates patching of existing EC2 instances without downtime by using a maintenance window to schedule patch installation, and updating the Auto Scaling group launch configuration ensures new instances launched by the group use a patched AMI, maintaining consistency. This approach avoids terminating all instances at once (which would cause downtime) and leverages AWS-native automation for ongoing compliance.

Answer

Use Amazon Inspector to scan for vulnerabilities and automatically apply patches.

Answer

Terminate all instances and let the Auto Scaling group launch new instances from a patched AMI.

Answer

Create a custom AMI with latest patches and update the Auto Scaling group manually during a maintenance window.

Question 11

A company wants to centralize monitoring of EC2 instance metrics across multiple AWS accounts. Which solution is MOST scalable and cost-effective?

Accepted Answer

Set up CloudWatch cross-account observability with a monitoring account.. CloudWatch cross-account observability allows you to centralize monitoring by designating a monitoring account that can view metrics, logs, and traces from multiple source accounts. This approach is scalable because it uses a single monitoring account without requiring manual logins or complex data pipelines, and it is cost-effective because you only pay for the metrics you ingest and store in the monitoring account, avoiding redundant data transfers or storage costs.

Answer

Log in to each account and view CloudWatch metrics individually.

Answer

Use CloudWatch cross-region metrics to aggregate metrics in a single account.

Answer

Configure each account to publish metrics to an S3 bucket and use Athena to query.

Question 12

A company uses AWS Lambda functions with reserved concurrency to process messages from an SQS queue. The operations team notices that the Lambda function sometimes throttles, causing messages to remain in the queue. What is the MOST likely cause and solution?

Accepted Answer

The reserved concurrency is set too low; increase the reserved concurrency for the function.. Option D is correct because Lambda throttling occurs when the reserved concurrency limit is reached, preventing the function from processing new invocations. Since the function uses reserved concurrency, setting it too low restricts the number of concurrent executions, causing SQS messages to remain in the queue until concurrency becomes available. Increasing the reserved concurrency allows more parallel invocations, reducing throttling and improving message processing throughput.

Answer

The SQS visibility timeout is too short; increase it.

Answer

The Lambda function's dead-letter queue (DLQ) is not configured; set up a DLQ.

Answer

The SQS queue's redrive policy is too aggressive; reduce the maxReceiveCount.

Question 13

A company is designing a disaster recovery plan for a critical application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses an RDS Multi-AZ database. Which TWO actions should the operations team take to minimize recovery time and data loss?

Accepted Answer

Configure automated EBS snapshots for EC2 instances and copy them to a secondary region.. Option A is correct because automated EBS snapshots, when copied to a secondary region, provide a mechanism to restore EC2 instances and their data in the event of a regional failure. This minimizes recovery time by having the snapshots available in the DR region, and minimizes data loss by ensuring point-in-time backups are replicated off-site. The snapshots can be used to launch new instances or create AMIs in the secondary region, supporting the recovery of the Auto Scaling group.

Answer

Create an AMI from a running instance and share it with the secondary region.

Answer

Use Route53 health checks to automatically failover traffic to a standby environment.

Question 14

A company runs a production web application on EC2 instances behind an ALB. The operations team receives an alert that the application is returning HTTP 503 errors. Which THREE steps should be taken to diagnose the issue?

Accepted Answer

Check the ALB's HealthyHostCount metric in CloudWatch.. The ALB's HealthyHostCount metric in CloudWatch shows the number of healthy targets registered to the target group. A value of zero or a persistent drop indicates that all EC2 instances are failing health checks, which directly causes HTTP 503 errors because the ALB has no healthy targets to forward traffic to. This metric is the first place to check when diagnosing 503 errors, as it pinpoints whether the issue is with target health rather than network connectivity or load.

Answer

Review VPC Flow Logs to identify if traffic is reaching the ALB.

Question 15

A company runs a production application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across three Availability Zones. The operations team notices that during a recent deployment, a small percentage of instances failed health checks and were replaced, causing a brief increase in error rates. What is the MOST effective way to reduce deployment-related errors?

Accepted Answer

Configure the Auto Scaling group with a warm-up time in the instance refresh settings.. Option C is correct because configuring a warm-up time in the Auto Scaling group's instance refresh settings ensures that newly launched instances are fully initialized and pass health checks before they start receiving traffic. This prevents brief error spikes during deployments by allowing instances to stabilize before being marked as healthy and added to the ALB target group.

Answer

Use a lifecycle hook to delay instance registration until a script completes.

Answer

Increase the health check interval on the ALB to reduce rapid replacements.

Answer

Increase the desired capacity of the Auto Scaling group to absorb failures.

Question 16

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

Accepted Answer

Use the ContinueUpdateRollback API to resume the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Answer

Manually delete the DynamoDB table and then retry the stack update.

Answer

Delete the stack and recreate it from the template.

Answer

Update the stack again with a different change set to bypass the failed resource.

Question 17

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

Accepted Answer

A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.. The CodePipeline service role needs permissions to write objects to the S3 bucket and list its contents to verify the upload. A custom policy with s3:PutObject and s3:ListBucket on the target bucket grants exactly these required actions, resolving the 'Access Denied' error during the Deploy stage.

Answer

CloudFrontFullAccess

Answer

AdministratorAccess

Answer

AmazonS3ReadOnlyAccess

Question 18

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution requires the least operational overhead?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag.. Option A is correct because a Service Control Policy (SCP) that denies s3:CreateBucket unless the request includes the CostCenter tag enforces tagging at the organization level, preventing any bucket creation without the required tag. This approach requires no ongoing maintenance, no additional services, and no per-account configuration, making it the least operational overhead solution.

Answer

Use AWS Config rules to detect untagged buckets and trigger a Lambda function to add tags.

Answer

Configure each account's S3 bucket creation process to include tagging.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Question 19

A company runs a critical workload on Amazon RDS for PostgreSQL with Multi-AZ. The operations team notices that during a recent failover test, the DNS record updated in about 60 seconds. However, the application experienced a 2-minute downtime because some connections were not re-established quickly. What should the team do to reduce downtime during failover?

Accepted Answer

Configure the application's connection string to use the RDS read-replica endpoint with a retry mechanism.. Option C is correct because configuring the application's connection string to use the RDS read-replica endpoint with a retry mechanism allows the application to quickly fail over to the read replica during a Multi-AZ failover. The read-replica endpoint remains constant and does not rely on DNS propagation, reducing downtime from DNS TTL delays. Combined with a retry mechanism, this ensures connections are re-established immediately after the failover completes, rather than waiting for the DNS record to update.

Answer

Enable automated backups with a short retention period.

Answer

Increase the TTL of the RDS DNS record to 300 seconds.

Answer

Place a Network Load Balancer in front of the RDS instance.

Question 20

A company uses AWS CloudTrail to log API calls. The security team wants to detect unauthorized attempts to modify security group rules and send real-time alerts. Which TWO AWS services should be used together to achieve this?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Events (or EventBridge) can capture CloudTrail API calls related to security group modifications (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress) and route them to an SNS topic. SNS then sends real-time alerts (e.g., email, SMS) to the security team. This combination provides event-driven, near-instantaneous notification without polling or custom code.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon GuardDuty