Troubleshooting Scenario Questions

The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.

Why wrong: B is wrong because the error is about assuming the role, not about the RDS policy.

The security group for the EC2 instance does not allow outbound traffic to the RDS instance.

Why wrong: D is wrong because the error is an IAM permission error, not a network connectivity error.

The EC2 instance does not have the correct IAM instance profile attached.

Why wrong: C is wrong because the log shows the instance role is assumed (the user ARN is from that role).

Add annotations to the traces for better filtering.

Why wrong: Incorrect: Annotations are for filtering, not diagnosing network latency.

View the raw segments of the upstream service.

Why wrong: Incorrect: Segments show service-internal timing, not network latency.

Adjust the sampling rules to capture more traces.

Why wrong: Incorrect: Sampling rules affect trace volume, not diagnosis.

Enable AWS CloudTrail data events for Lambda.

Why wrong: CloudTrail records API calls, not function execution timing.

Create a CloudWatch dashboard with function duration metrics.

Why wrong: Metrics show aggregated data, not per-invocation details.

Add more logging statements to the function code and check CloudWatch Logs.

Why wrong: Logging helps but may not capture precise timing of external calls.

Verify that the monitoring account's CloudWatch cross-account observability is enabled.

Why wrong: Other accounts are working, so this is not the issue.

Review the source account's CloudWatch Logs retention policy to confirm logs are not expired.

Why wrong: Logs are still in CloudWatch Logs; the retention policy does not affect forwarding.

Ensure the IAM role in the source account has the correct trust policy for the monitoring account.

Why wrong: Cross-account observability uses resource policies, not roles.

Create a custom resource in the stack that publishes to Amazon SNS.

Why wrong: Custom resources are not needed; CloudFormation natively supports SNS notifications.

Create a CloudWatch alarm on the StackStatus metric.

Why wrong: Stack status is not a metric; CloudFormation does not emit metrics.

Use Amazon EventBridge to capture CloudFormation events and publish to SNS.

Why wrong: Though possible, it's less efficient than the built-in notification option.

The security group for the RDS instance has changed during failover.

Why wrong: Security groups remain the same.

The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.

Why wrong: RDS DNS updates quickly and is not usually the issue.

The database instance is still in the process of failover and is not yet accepting connections.

Why wrong: The status is Available, so failover is complete.

The launch template has insufficient IAM permissions to create instances.

Why wrong: A is wrong because insufficient permissions result in an 'Unauthorized' error, not a quota error.

The VPC subnet does not have enough available IP addresses.

Why wrong: C is wrong because insufficient IP addresses would show a different error.

There is an instance that is not passing health checks, preventing new instances.

Why wrong: D is wrong because health check failures cause termination and replacement, not a quota error.

Check the SNS topic that the scaling policy publishes to for notifications.

Why wrong: SNS notifications only indicate that scaling occurred, not why.

Use AWS CloudTrail to review API calls that modified the scaling policy.

Why wrong: CloudTrail logs API calls but does not show application-level metrics or deployment issues.

Temporarily disable the scaling policy and manually increase the desired capacity to handle the load.

Why wrong: This is a reactive fix that does not help determine the root cause of the spike.

Create a read replica and promote it to primary.

Why wrong: This does not increase storage on the original instance.

Delete old automated snapshots to free up storage.

Why wrong: Automated snapshots do not consume the instance's allocated storage.

Scale up the DB instance to a larger instance class.

Why wrong: Instance class does not affect storage.

Check the ALB target group health check settings and ensure instances are healthy.

Why wrong: ALB logs show 200, so targets are responding.

Examine the request headers in CloudFront logs to identify unusual patterns.

Why wrong: Request headers are unlikely to cause 504 errors.

Review the CloudFront cache hit ratio and optimize caching strategies.

Why wrong: Cache hit ratio does not cause 504 errors.

Increase the size of the Auto Scaling group to ensure more instances are available.

Why wrong: Increasing the group size does not address the underlying cause; it might mask the issue.

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce' to bypass the error.

Why wrong: Changing the deployment configuration does not resolve the underlying issue; it may cause downtime.

Redeploy the application using a different revision.

Why wrong: Redeploying the same revision will likely fail again; the root cause must be addressed.

Review the CloudWatch metrics for CPU utilization and network throughput.

Why wrong: Metrics may not show the cause of unreachability if instance is healthy.

Reboot the instance to reset the network interface.

Why wrong: Rebooting is unnecessary if the instance is running and healthy.

Stop and start the instance to move it to new underlying hardware.

Why wrong: Stopping/starting is invasive and not first step.

The role does not have permission to describe instances, so the condition cannot be evaluated.

Why wrong: DescribeInstances works, so the condition is evaluated.

The policy's Resource element is set to '*' and must be restricted to specific instance ARNs.

Why wrong: Resource '*' is acceptable for these actions.

The policy does not include the ec2:RebootInstances action.

Why wrong: Missing actions are not the issue; the allowed actions fail.

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Why wrong: CPU and memory metrics do not provide API-level latency breakdowns.

Enable CloudWatch Logs Insights to query API logs for slow requests.

Why wrong: CloudWatch Logs Insights can search logs but does not provide distributed tracing or latency breakdowns per endpoint across microservices.

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Why wrong: OpenTelemetry can be used for traces and metrics, but the question asks for latency breakdowns; X-Ray is more directly suited and simpler.

Set up VPC Flow Logs to analyze network latency between services.

Why wrong: VPC Flow Logs capture network metadata, not application request latency.

Delete the error logs to free up storage space.

Why wrong: Error logs are essential for forensic analysis.

Create a read replica to offload traffic from the primary instance.

Why wrong: Read replica does not help identify the attack source.

Increase the DB instance size to handle the increased load.

Why wrong: Scaling up does not address the security incident.