Select Two (Multi-Select) Questions

Disable object ACLs on the bucket.

Why wrong: Disabling object ACLs is insufficient because public access can be granted through many other channels, including bucket policies, access point policies, and the bucket's own ACL. While disabling ACLs entirely (or setting the ObjectOwnership to BucketOwnerEnforced) removes the ability to grant public read via individual object ACLs, it does nothing to neutralize an existing bucket policy that explicitly allows the AllUsers principal. Public exposure is only fully remediated when all permission vectors are addressed simultaneously, and this action alone leaves the bucket still publicly readable.

Enable S3 server access logging.

Why wrong: Enabling S3 server access logging only records requests for audit and forensic purposes, providing a record of who accessed which object—it does not alter authorization in any way. Public read access granted via a bucket policy or object ACL continues to function unchanged while logs are captured, so this is purely detective, not corrective. Logging is valuable for post-incident analysis and compliance, but choosing it as the primary fix would leave the vulnerability completely active.

Install the CloudWatch Logs agent on an EC2 instance and tail the logs.

Why wrong: The agent is used to send logs to CloudWatch, not to search across log groups.

Create a Lambda function that reads logs from each log group and searches for the pattern.

Why wrong: While possible, it's not a recommended or efficient method for ad-hoc searching.

Use Amazon Kinesis Data Analytics to process the log streams.

Why wrong: Kinesis Data Analytics is for real-time analysis of streaming data, not for querying stored logs.

OpsCenter

Why wrong: OpsCenter aggregates operational issues, such as Amazon CloudWatch alarms and AWS Config alerts, into OpsItems, providing operators with a centralized console to view, triage, and run diagnostics or remediation runbooks. While it can invoke Systems Manager documents to resolve an issue, OpsCenter itself is a management and tracking tool for operational work items, not a mechanism that applies or enforces EC2 configuration changes. It does not maintain a desired instance state or execute arbitrary configuration scripts on its own, so it is not the appropriate answer for instance configuration management.

Parameter Store

Why wrong: Parameter Store is a secure, hierarchical store for configuration data such as AMI IDs, license keys, and environment variables, supporting plaintext or KMS-encrypted strings and advanced parameters with expiration policies. It provides configuration values to Systems Manager documents, Lambda functions, or EC2 user data, but it cannot execute commands, apply settings, or enforce a desired state on an instance; it simply supplies the data that other tools consume. Thus it is not the mechanism that manages or enforces EC2 instance configurations.

Use CloudWatch Logs Insights to analyze the custom metrics.

Why wrong: CloudWatch Logs Insights is a query engine designed specifically for searching and analyzing log data stored in CloudWatch Logs, using a purpose-built query language (e.g., fields, stats, filter). It has no capability to read or analyze metric data points; metrics are time-series numeric values, not log events. Attempting to use Logs Insights for custom metrics would fail because there is no automated path to ingest metrics into a log group, and the tool only interprets timestamped log messages, not numeric metric samples.

Use Amazon Managed Service for Prometheus to scrape the metrics.

Why wrong: Amazon Managed Service for Prometheus (AMP) is a fully managed, Prometheus-compatible monitoring service that scrapes metrics from Kubernetes endpoints, and it does support querying and alerting via PromQL. However, it is a separate monitoring stack with its own data store and console, and it is not directly integrated with CloudWatch dashboards or CloudWatch alarms unless you set up additional exporters or remote write configurations. In a solution explicitly focused on using CloudWatch for visualization and alerting, choosing AMP would introduce unnecessary complexity and diverge from the question's requirement to emit metrics directly to CloudWatch.

Enable default encryption for CloudWatch Logs in the AWS account settings

Why wrong: CloudWatch Logs does not offer any 'default encryption' setting at the AWS account level for KMS keys. Encryption for CloudWatch Logs is always configured per log group, not via a global account setting. Enabling EBS or S3 default encryption, for example, has no effect on CloudWatch Logs, so this option is not a valid solution.

Update the log group's resource policy to reference the KMS key

Why wrong: A log group's resource policy is used to control access for delivery destinations (such as cross-account subscription filters or S3 exports) and does not govern KMS encryption. The KMS key association is a log group attribute, not a resource policy statement. To permit CloudWatch Logs to use your KMS key, you must update the key policy on the KMS key itself, granting the `logs.amazonaws.com` service principal the required crypto permissions.

Associate the KMS key with each log stream individually

Why wrong: KMS encryption for CloudWatch Logs is applied at the log group level, not at the individual log stream level. Log streams inherit the encryption configuration of their parent log group, and the `AssociateKmsKey` API takes a `logGroupName` parameter only. There is no API to attach a KMS key to a single log stream, so this approach is incorrect.

Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.

Why wrong: An S3 lifecycle policy only governs objects already residing in an Amazon S3 bucket—it has no effect on log data that is still stored natively in CloudWatch Logs. Even if logs were exported or streamed to S3, this policy would only handle transition to Glacier after 90 days, but it would not delete the CloudWatch log group or free up CloudWatch Logs storage. Thus, this option fails to address the actual requirement of limiting retention in CloudWatch Logs.

Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.

Why wrong: CloudWatch Logs subscription filters can stream log events in real time to Amazon Kinesis Data Streams, Kinesis Data Firehose, Lambda, or Amazon OpenSearch Service—they do not deliver data directly to S3. To land logs in S3, you would have to configure a Kinesis Data Firehose delivery stream as the subscription destination, which adds complexity and still leaves the original logs in CloudWatch Logs. This approach is for continuous streaming analytics or replication, not for enforcing a 90-day retention boundary.

Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.

Why wrong: CloudWatch Logs does not offer a built-in 'lifecycle policy' that automatically transitions log groups to Amazon S3 after a specified number of days. The only native mechanisms are the log group retention policy (which deletes data) and manual/automated export tasks via the ExportTask API. Therefore, this option describes a non-existent feature and cannot be implemented to meet the requirement.

Enable public accessibility for easy management.

Why wrong: Enabling public accessibility assigns a public IP to the RDS instance and allows inbound traffic from the internet through the security group, dramatically increasing the attack surface for brute force and SQL injection attempts. Management should instead be performed from within the VPC using a bastion host or via an AWS VPN/Direct Connect, ensuring the database never receives unsolicited internet traffic. This violates the principle of least privilege because it exposes the database port to potentially untrusted networks.

Use a single Availability Zone to reduce complexity.

Why wrong: Choosing a single Availability Zone has no security benefit; it merely avoids the cost of a standby replica. In fact, it introduces availability risks where a data center failure could cause loss of access to the database, which is a separate concern from confidentiality or integrity. Security best practices for RDS focus on network isolation, encryption, and access control, not on reducing AZ count, so this option distracts from proper hardening.

Grant direct IAM user access to the database.

Why wrong: Applying direct IAM user rights to an RDS database is conceptually invalid because IAM users are AWS control‑plane identities; they do not authenticate to the database engine itself. RDS supports IAM database authentication, but that still creates a database user authenticated through an authentication token — it does not grant IAM users direct table access. Entangling IAM permissions with database privileges creates a broad, unmanageable permission surface, whereas the correct pattern is to use database users, groups, and roles with least privilege.

Modify the canary script to add more logging.

Why wrong: You cannot modify the pre-built canary scripts that CloudWatch Synthetics provides (e.g., Heartbeat, API canary) to inject additional logging; they are managed runtimes intended for immediate use. For custom diagnostic logging, you would need to author a new custom canary script using the Synthetics SDK, then redeploy it—so modifying the script is not a valid, immediate diagnostics step and does not help you interpret an existing failure.

Examine CloudWatch metrics for the canary.

Why wrong: CloudWatch metrics for a canary, such as SuccessPercent, Duration, and Failed, provide aggregated counts and timing data that tell you a failure happened but not why. They lack the granular diagnostic content needed to debug an error—no endpoint, response payload, stack trace, or specific assertion failure appears in the metric data. Metrics only help you detect the problem, not resolve it.

Check CloudTrail for CanaryRun API calls.

Why wrong: CloudTrail records control-plane API activities such as CreateCanary, StartCanary, and StopCanary, but it does not log the internal execution output or script-level errors of a canary run. A CanaryRun API call in CloudTrail would only indicate that a run was triggered or invoked, not what happened during that run or why it failed, so CloudTrail is not useful for diagnosing a failed canary.

AWS CloudFormation

Why wrong: AWS CloudFormation is an infrastructure-as-code provisioning engine that creates and updates AWS resources from templates. It does not manage or rotate application credentials; at most, it can reference secrets stored elsewhere via dynamic references such as `{{resolve:secretsmanager:...}}` in resource properties. Since it has no scheduling or credential lifecycle mechanism, it is wrong for this task.

AWS KMS

Why wrong: AWS KMS is a key management service that creates and controls KMS keys and performs encryption and decryption operations. It supports automatic rotation of the key material for KMS keys, but that rotates the encryption key, not the actual secret value such as a database password. Storing credentials and rotating those secrets is outside KMS's scope, so it cannot serve as a standalone secret management and rotation service.

AWS IAM

Why wrong: AWS IAM governs identities for AWS API access, including users, roles, groups, and policies, and supports rotating IAM user access keys for programmatic access. It does not manage application-defined secrets like database passwords, and its access keys are separate from credentials used by applications. Since the question asks about data credential management and rotation, IAM is not one of the correct services.

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Why wrong: Auto scaling has a lag; on-demand is better for unpredictable spikes.

Increase the Lambda function timeout to the maximum (15 minutes).

Why wrong: Timeout does not affect concurrency.

Set API Gateway throttling limits to a high value to prevent throttling.

Why wrong: Throttling limits are for protection; setting high values may not be sufficient.

The parent stack is referencing an output from the nested stack that does not exist

Why wrong: This would cause a different error, not a creation failure.

The nested stack is in a different AWS region from the parent stack

Why wrong: Nested stacks must be in the same region.

The nested stack's name is not unique among all stacks in the account

Why wrong: Stack names only need to be unique within the account and region.

Use AWS CloudTrail to review Canary API calls.

Why wrong: CloudTrail logs API calls to create canaries, not execution details.

Check the EC2 instance CPU utilization in the VPC where the canaries run.

Why wrong: Canaries run as Lambda functions, not on EC2 instances.

Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.

Why wrong: Incorrect: A KMS key in Account B is not required. If a customer-managed KMS key is used for the artifact bucket, it is in Account A, and the Account B role needs decrypt permission on that key, not a shared Account B key.

Create a resource-based policy on the CodeCommit repository in Account B that grants access to the CodePipeline service role in Account A.

Why wrong: Incorrect: The CodeCommit repository is in Account A, so there is no CodeCommit repository in Account B and no resource-based policy is needed there.

Create an S3 bucket in Account B to store the artifacts and grant cross-account access.

Why wrong: Incorrect: The S3 artifact bucket should reside in Account A, the pipeline account, not Account B.

Enable encryption after creating the RDS instance by modifying the instance

Why wrong: Enable encryption after creating the RDS instance by modifying the instance [wrong]

Enable SSL/TLS for the RDS instance

Why wrong: Enable SSL/TLS for the RDS instance [wrong]

Store the database files in an encrypted S3 bucket

Why wrong: Store the database files in an encrypted S3 bucket [wrong]

Set up a VPC endpoint for S3

Why wrong: Not required for access; it's for network isolation.

Create a KMS key and grant CodeBuild access to it

Why wrong: Not required if the bucket uses SSE-S3 or no encryption.

Create a change set to see what changes were attempted.

Why wrong: Change sets are for previewing changes, not for troubleshooting failures.

Use the 'describe-stack-resource' AWS CLI command to get the resource status.

Why wrong: This provides resource status but not the root cause of the failure.

Security group inbound rules for the ALB

Why wrong: Inbound rules affect client access, but 503 is from ALB.

SSL certificate expiration on the ALB

Why wrong: SSL issues cause 502 or 400, not 503.

Attach a security group to the KMS key.

Why wrong: Security groups are for EC2 instances, not for KMS keys.

Configure the S3 bucket policy to allow only requests from the VPC.

Why wrong: Bucket policy controls access to S3, not to the KMS key.

Create a service control policy (SCP) that denies KMS operations from outside the VPC.

Why wrong: SCPs apply to accounts, not to specific KMS keys.

Terminate the instance immediately

Why wrong: Terminating the instance immediately is harmful because the default EBS root volume is deleted upon termination (unless DeleteOnTermination is false), and any ephemeral instance store data, memory, and process artifacts are lost forever. The incident response team would lose critical forensic evidence such as running malware binaries, open network connections, and cryptographic material, making attribution and root-cause analysis impossible. Additionally, termination may trigger Auto Scaling replacement, potentially letting the same compromise re-spawn before containment is complete.

Create an AMI of the instance for forensic analysis

Why wrong: Creating an AMI is an indirect and risky forensic method: it captures the EBS volume state but fails to preserve volatile memory, active process listings, or network connections, which are often the most valuable evidence. The AMI itself becomes a potential vector for accidentally deploying the compromised environment later, and the snapshot process may be inconsistent if the instance is actively writing to disk. A direct snapshot of the root EBS volume, taken after stopping the instance, is the preferred method for preserving disk evidence without the overhead of a reusable image.

Use Amazon CloudFront with multiple origins pointing to each Region's API Gateway.

Why wrong: CloudFront is for content delivery, not for regional failover of API endpoints directly.

Deploy Lambda@Edge functions to handle requests at edge locations.

Why wrong: Lambda@Edge runs at edge, not in a secondary Region.