PAS-C01 Operations and Maintenance Practice Test 2 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

Accepted Answer

Use the ContinueUpdateRollback API to resume the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Answer

Manually delete the DynamoDB table and then retry the stack update.

Answer

Delete the stack and recreate it from the template.

Answer

Update the stack again with a different change set to bypass the failed resource.

Question 2

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

Accepted Answer

A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.. The CodePipeline service role needs permissions to write objects to the S3 bucket and list its contents to verify the upload. A custom policy with s3:PutObject and s3:ListBucket on the target bucket grants exactly these required actions, resolving the 'Access Denied' error during the Deploy stage.

Answer

CloudFrontFullAccess

Answer

AdministratorAccess

Answer

AmazonS3ReadOnlyAccess

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution requires the least operational overhead?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag.. Option A is correct because a Service Control Policy (SCP) that denies s3:CreateBucket unless the request includes the CostCenter tag enforces tagging at the organization level, preventing any bucket creation without the required tag. This approach requires no ongoing maintenance, no additional services, and no per-account configuration, making it the least operational overhead solution.

Answer

Use AWS Config rules to detect untagged buckets and trigger a Lambda function to add tags.

Answer

Configure each account's S3 bucket creation process to include tagging.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Question 4

A company runs a critical workload on Amazon RDS for PostgreSQL with Multi-AZ. The operations team notices that during a recent failover test, the DNS record updated in about 60 seconds. However, the application experienced a 2-minute downtime because some connections were not re-established quickly. What should the team do to reduce downtime during failover?

Accepted Answer

Configure the application's connection string to use the RDS read-replica endpoint with a retry mechanism.. Option C is correct because configuring the application's connection string to use the RDS read-replica endpoint with a retry mechanism allows the application to quickly fail over to the read replica during a Multi-AZ failover. The read-replica endpoint remains constant and does not rely on DNS propagation, reducing downtime from DNS TTL delays. Combined with a retry mechanism, this ensures connections are re-established immediately after the failover completes, rather than waiting for the DNS record to update.

Answer

Enable automated backups with a short retention period.

Answer

Increase the TTL of the RDS DNS record to 300 seconds.

Answer

Place a Network Load Balancer in front of the RDS instance.

Question 5

A company uses AWS CloudTrail to log API calls. The security team wants to detect unauthorized attempts to modify security group rules and send real-time alerts. Which TWO AWS services should be used together to achieve this?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Events (or EventBridge) can capture CloudTrail API calls related to security group modifications (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress) and route them to an SNS topic. SNS then sends real-time alerts (e.g., email, SMS) to the security team. This combination provides event-driven, near-instantaneous notification without polling or custom code.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

A company runs a web application on Amazon ECS with Fargate launch type. The application's memory utilization spikes periodically, causing tasks to be killed. The operations team wants to automatically scale the service based on memory usage. Which THREE steps are necessary to implement this?

Accepted Answer

Create an Application Auto Scaling target tracking scaling policy based on memory utilization.. Option B is correct because Application Auto Scaling with a target tracking scaling policy allows the ECS service to automatically adjust its desired count based on a CloudWatch metric, such as memory utilization. This ensures the service scales out when memory usage spikes and scales in when it drops, preventing tasks from being killed due to OOM (out-of-memory) errors.

Answer

Attach an EC2 Auto Scaling group to the ECS service to handle capacity.

Answer

Configure step scaling policies to add multiple tasks at once.

Question 7

A company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances running a web server. The web servers write logs to an Amazon EFS file system mounted across all instances. The operations team reports that the web application is experiencing intermittent high latency and timeouts. Monitoring shows that the ALB's target response time is normal, but the application's internal processing time is high. Further investigation reveals that the EFS performance metrics show high 'BurstCreditBalance' and 'PercentIOLimit' during the latency spikes. The EFS file system is configured with 'Bursting' throughput mode. The team needs to resolve the latency issue with minimal cost. What should they do?

Accepted Answer

Increase the size of the EFS file system to increase the baseline throughput and burst credits.. Option D is correct because increasing the size of an EFS file system in Bursting mode raises its baseline throughput and burst credit accumulation rate. The high BurstCreditBalance and PercentIOLimit indicate the file system is exhausting its burst credits and hitting its I/O limit, causing throttling and latency. A larger EFS volume provides a higher baseline throughput, reducing reliance on burst credits and smoothing performance without additional cost for Provisioned Throughput.

Answer

Migrate the log files to Amazon S3 and use S3 Transfer Acceleration for writes.

Answer

Switch the EFS throughput mode to Provisioned Throughput to guarantee higher performance.

Answer

Add more EC2 instances to the Auto Scaling group to distribute the I/O load.

Question 8

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application stores session state in an ElastiCache Redis cluster (Cluster Mode disabled). The operations team receives alerts that the application is experiencing intermittent timeouts and high error rates. Upon investigation, they find that the Redis cluster's CPU utilization is consistently above 90%, and there are frequent 'MAXMEMORY' evictions. The application team confirms that they recently increased the number of concurrent users and added more session data per user. The current Redis cluster is a single cache.r5.large node with 13.37 GB of memory. Which of the following should the operations team do FIRST to address the performance issues?

Accepted Answer

Enable Cluster Mode and add multiple shards to distribute the data across nodes.. The correct first step is to enable Cluster Mode and add multiple shards because the performance issue stems from CPU saturation and memory pressure on a single Redis node. Cluster Mode distributes data across multiple shards, reducing per-node CPU load and memory usage, which directly addresses the high CPU utilization and 'MAXMEMORY' evictions caused by increased concurrent users and session data.

Answer

Upgrade the instance type to cache.r5.2xlarge to double the memory and compute capacity.

Answer

Create a read replica in a different Availability Zone and redirect read traffic to it.

Answer

Change the eviction policy to 'allkeys-lru' to maximize memory utilization.

Question 9

A company has a production AWS account that contains an Amazon RDS for MySQL DB instance. The database is critical and must have automated backups enabled with a retention period of 30 days. The company also requires point-in-time recovery to any second within the retention period. The operations team has configured automated backups with a retention period of 30 days, but they notice that the automated backups are not being taken consistently. The DB instance is in a Multi-AZ deployment and has a storage size of 500 GB. The team checks the backup window and finds that it is set to 02:00-03:00 UTC. The backup window is non-overlapping with the maintenance window. The DB instance is actively used during the backup window with heavy write traffic. Which of the following is the MOST likely reason for the inconsistent automated backups?

Accepted Answer

The heavy write traffic during the backup window causes I/O suspension and backup failures.. The heavy write traffic during the backup window causes I/O suspension, which can lead to backup failures. When an RDS for MySQL DB instance experiences high write activity during a backup, the backup process may be delayed or fail due to I/O suspension, especially if the instance is under heavy load. This is because automated backups require a consistent snapshot, and excessive write I/O can prevent the snapshot from completing within the backup window.

Answer

The storage size of 500 GB exceeds the maximum backup size limit.

Answer

The Multi-AZ deployment does not support automated backups.

Answer

The backup window overlaps with the maintenance window.

Question 10

A company is running a critical web application on EC2 instances behind an Application Load Balancer. During a recent deployment, a new version of the application was released, and within minutes, the error rate spiked. The operations team rolled back the deployment, but the error rate remained high. The team suspects that the ALB is still routing traffic to unhealthy instances. Which step should the team take to immediately stop routing traffic to the problematic instances?

Accepted Answer

Deregister the instances from the target group.. Option D is correct because deregistering the problematic EC2 instances from the target group immediately stops the Application Load Balancer from routing any new traffic to them. The ALB performs health checks on registered targets, but if an instance is unhealthy, it still remains in the target group and can receive traffic if the health check logic is misconfigured or if the instance is in a 'draining' state. Deregistration forces the ALB to complete any in-flight requests and then remove the instance from the routing table, providing an immediate stop to traffic.

Answer

Modify the ALB listener rules to point to a different target group.

Answer

Modify the health check interval to 5 seconds and the unhealthy threshold to 2.

Answer

Stop the EC2 instances from the AWS Management Console.

Question 11

A company is using AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. The instances are in a patch group and have the SSM Agent installed. After a patching operation, the operations team notices that some instances did not apply the patches. The instances show a status of 'Failed' in the Patch Manager console. Which TWO steps should the team take to troubleshoot and resolve the issue? (Choose TWO.)

Accepted Answer

Verify that the SSM Agent on the failed instances is running and is able to communicate with the Systems Manager service.. Option C is correct because if the SSM Agent is not running or cannot communicate with the AWS Systems Manager service, Patch Manager cannot execute the patching commands. The agent must be in a healthy state and have network connectivity (e.g., via VPC endpoints or internet gateway) to receive the patch baseline and report status. Option D is correct because the AWS-RunPatchBashelline SSM document execution history in Run Command provides detailed logs and error messages for each instance, allowing the team to identify why the patching failed, such as missing dependencies or timeout issues.

Answer

Assign the patch baseline to the instance IDs directly.

Answer

Ensure that the instances have the appropriate IAM role that allows them to be patched.

Answer

Configure a Maintenance Window for the patching operation.

Question 12

An IAM policy is attached to a user. The user attempts to upload a file to s3://my-bucket/restricted/data.txt. What is the outcome?

Accepted Answer

The upload fails because the explicit Deny overrides the Allow.. C is correct because IAM policy evaluation follows a default-deny model where an explicit Deny always overrides any Allow. Even though the user has an Allow for s3:GetObject on all resources, the explicit Deny for the specific object path s3://my-bucket/restricted/* takes precedence, causing the upload (which requires s3:PutObject) to fail.

Answer

The upload succeeds because there is no explicit Deny for the specific object.

Answer

The upload succeeds because the Allow statement for s3:GetObject implies PutObject.

Answer

The upload succeeds because the Allow for s3:GetObject is on all resources.

Question 13

A financial services company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances for the web tier, and an Amazon RDS for MySQL database for the backend. The operations team uses AWS CloudFormation to manage infrastructure. During a recent deployment, a change to the database security group caused an outage because the web tier lost connectivity to the database. The team wants to prevent similar incidents in the future. They need a solution that allows them to review and approve changes to critical resources before deployment, while still enabling rapid deployment for non-critical changes. The team uses AWS CodePipeline for CI/CD. Which approach should the team implement?

Accepted Answer

Use CloudFormation Change Sets in the pipeline and add a manual approval step for any change that modifies the database security group.. Option B is correct because CloudFormation Change Sets allow you to preview how proposed changes will affect your resources before execution. By integrating a manual approval step in the CodePipeline that triggers specifically when the change set modifies the database security group, the team can review and approve critical changes while allowing non-critical changes to proceed automatically. This directly addresses the requirement to prevent outages from unapproved security group modifications.

Answer

Use AWS Config rules to automatically remediate non-compliant changes before they are applied.

Answer

Use AWS Service Catalog to create a portfolio of approved stacks and require all deployments to use the portfolio.

Answer

Use AWS CloudTrail to monitor changes to the security group and trigger a rollback if unauthorized changes are detected.

Question 14

Drag and drop the steps to troubleshoot an SAP HANA database connection failure from an SAP application in AWS into the correct order.

Question 15

Drag and drop the steps to configure an SAP Fiori front-end server on AWS behind an Application Load Balancer (ALB) into the correct order.