Courseiva

CCNA Incident Response Questions

27 questions · Incident Response topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQeasy

A company uses AWS CloudTrail to record API calls across multiple accounts and regions. The security team needs to be alerted immediately when an IAM user creates a new access key. Which combination of services should be used to achieve this with minimal latency?

A.Send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic.
B.Enable S3 event notifications on the CloudTrail S3 bucket to trigger a Lambda function.
C.Use Amazon EventBridge to match the CloudTrail event and invoke an AWS Lambda function that sends an email.
D.Configure a Lambda function to poll the CloudTrail API every minute and check for new access keys.
AnswerA

This is the standard low-latency alerting pattern for CloudTrail events.

Why this answer

CloudTrail can stream logs to CloudWatch Logs, where a metric filter can be configured to match the 'CreateAccessKey' API call. This metric filter triggers a CloudWatch Alarm, which publishes to an SNS topic for immediate notification, providing minimal latency. Option B is incorrect because S3 event notifications on the CloudTrail bucket notify on object creation, but CloudTrail delivers log files in batches (e.g., every 5 minutes), causing delays beyond the required minimal latency.

Option C is incorrect because while Amazon EventBridge can match CloudTrail events in near real-time, the question's intended solution (and the one that best fits 'minimal latency') is the metric filter + alarm pattern; however, EventBridge is a valid alternative, but the correct answer as per options is A. Option D is incorrect because polling the CloudTrail API every minute is inefficient, introduces latency, and does not provide real-time alerting.

Practice this question →
2
MCQhard

A company uses AWS Config to track resource changes. They want to automatically remediate non-compliant security group rules that allow public SSH access. What is the MOST effective approach?

A.Set up an AWS Config rule that triggers a Lambda function to remove the SSH rule.
B.Use Amazon CloudWatch Events to detect the change and invoke a Lambda function.
C.Use AWS Service Catalog to enforce security group templates.
D.Create an AWS Config rule with an automatic remediation action using AWS Systems Manager Automation.
AnswerD

This is the correct approach because AWS Config rules continually evaluate resources against a desired policy, and when they detect non-compliance they can trigger an automatic remediation action—a Systems Manager Automation document—to fix the resource. In this case the rule (such as the managed RESTRICTED_SSH rule) would flag any security group with port 22 open to 0.0.0.0/0, and the associated SSM Automation document (for example, AWS-RevokeSecurityGroupIngress) would revoke the offending rule automatically. AWS Config tracks the remediation status and retries until the resource becomes compliant, providing a closed-loop, auditable remediation process without manual involvement.

Why this answer

AWS Config can directly associate an AWS Systems Manager Automation document as a remediation action for a non-compliant rule. This approach provides a fully managed, idempotent, and auditable remediation workflow without requiring custom Lambda code or external event orchestration. The automation document can be configured to automatically remove the SSH ingress rule (port 22) from the security group when the Config rule detects non-compliance.

Exam trap

The trap here is that candidates often assume a custom Lambda function (Option A) is the most flexible or effective approach, but AWS Config's native remediation with Systems Manager Automation is the recommended, fully managed, and less error-prone solution for automatic compliance enforcement.

How to eliminate wrong answers

Option A is wrong because while a Lambda function can remove the SSH rule, this approach requires you to write, deploy, and maintain custom code, and it does not natively integrate with AWS Config's remediation lifecycle (e.g., automatic retries, resource exclusion, or rollback). Option B is wrong because Amazon CloudWatch Events (now Amazon EventBridge) can detect security group changes, but it only provides an event notification; it does not include built-in remediation orchestration, compliance evaluation, or the ability to automatically trigger a remediation action directly from a Config rule evaluation. Option C is wrong because AWS Service Catalog is used to provision and govern pre-defined product templates, not to automatically remediate existing non-compliant resources; it cannot react to a Config compliance change or modify an already deployed security group.

Practice this question →
3
MCQhard

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

A.The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.
B.The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.
C.The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.
D.The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.
AnswerB

The aws:ViaAWSService global condition key is true when an AWS service, such as Systems Manager, makes the API call on the principal's behalf rather than the principal making a direct call. The policy's condition requires this key to be false, so when the tool is invoked via Systems Manager the actual value is true and the Allow statement does not match. With no other matching Allow, the request is implicitly denied, which is exactly the error observed.

Why this answer

The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed.

This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Exam trap

The trap here is that candidates focus on the IP address condition and assume the error is due to an IP mismatch, overlooking the subtle aws:ViaAWSService condition that denies calls made through AWS services even when the source IP is allowed.

How to eliminate wrong answers

Option A is wrong because granting ec2:CreateSnapshot on all resources ("*") would not cause an access denied error; the error is due to a condition key, not resource ARN specificity. Option C is wrong because a deny on ec2:DeleteSnapshot is unrelated to the CreateSnapshot failure; IAM evaluates deny statements independently per action. Option D is wrong because the source IP 203.0.113.0/24 is included in the Condition block (as stated in the question), so implicit denial does not apply; the error is caused by the aws:ViaAWSService condition, not the IP condition.

Practice this question →
4
MCQhard

An IAM policy is attached to a role used by an operations team. The team reports that they are unable to start or stop EC2 instances tagged with Environment=Production. Other instances can be described. What is the MOST likely reason for this failure?

A.The condition key ec2:ResourceTag/Environment is not valid for ec2:StartInstances and ec2:StopInstances.
B.The role does not have permission to describe instances, so the condition cannot be evaluated.
C.The policy's Resource element is set to '*' and must be restricted to specific instance ARNs.
D.The policy does not include the ec2:RebootInstances action.
AnswerA

These actions do not support resource-level conditions; they require request-based conditions.

Why this answer

The `ec2:ResourceTag` condition key is not supported for the `ec2:StartInstances` and `ec2:StopInstances` actions in IAM policy evaluation. AWS documentation explicitly states that these actions do not support resource-level permissions based on tags; they only support the `ec2:ResourceTag` condition key for certain read-only or tagging actions. Therefore, the condition in the policy cannot be evaluated, causing the operations team to fail when attempting to start or stop Production-tagged instances.

Exam trap

The trap here is that candidates assume all EC2 actions support resource-level condition keys like `ec2:ResourceTag`, but AWS explicitly restricts tag-based conditions to specific actions, and `ec2:StartInstances` and `ec2:StopInstances` are not among them.

How to eliminate wrong answers

Option B is wrong because the team can describe other instances, indicating they have the `ec2:DescribeInstances` permission; the issue is not a lack of describe permission but the unsupported condition key. Option C is wrong because setting the Resource element to '*' is not the cause of the failure; the policy's condition key is the problem, and restricting to specific instance ARNs would not resolve the unsupported condition key issue. Option D is wrong because the `ec2:RebootInstances` action is irrelevant to the failure to start or stop instances; the missing action is not the root cause.

Practice this question →
5
Multi-Selecthard

During a security incident, a DevOps engineer discovers that an EC2 instance has been compromised. The instance has an IAM role with permissions to access S3 and DynamoDB. Which THREE immediate actions should the engineer take to contain the incident?

Select 3 answers
A.Terminate the instance immediately
B.Create an AMI of the instance for forensic analysis
C.Stop the EC2 instance
D.Update the security group to deny all inbound and outbound traffic
E.Remove the IAM role from the instance
AnswersC, D, E

Stopping the EC2 instance is the correct primary action because it halts the CPU, terminates all running processes, and closes all network sockets, immediately ending malicious activity on the instance. The attached EBS volumes persist, allowing for later root volume snapshots and forensic analysis. However, be aware that memory and instance store volumes are lost, so if live memory forensics is required, it must be performed before the stop command is issued.

Why this answer

To contain the incident, immediate actions should focus on isolating the instance and revoking its permissions to prevent further damage. Stopping the instance (C) preserves its state for later forensics while halting current malicious activity. Updating the security group (D) blocks all network traffic to and from the instance, cutting off communication.

Removing the IAM role (E) revokes the instance's access to S3 and DynamoDB, preventing data exfiltration or unauthorized actions. Terminating the instance (A) is not recommended because it destroys volatile data and evidence, hindering investigation. Creating an AMI (B) is a forensic step that should be done after containment; it does not immediately stop the compromise.

Practice this question →
6
Multi-Selectmedium

A company uses AWS Lambda with an Amazon DynamoDB trigger. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors. The DevOps team needs to mitigate the issue. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers
A.Increase the Lambda function's reserved concurrency
B.Disable DynamoDB Streams on the table
C.Enable DynamoDB Accelerator (DAX) for the table
D.Increase the DynamoDB table's write capacity
E.Reduce the batch size for the DynamoDB stream event source mapping
AnswersD, E

DynamoDB throttling occurs when write requests exceed the provisioned write capacity (WCUs) of the table. If the Lambda function writes processed items back to the same table, insufficient WCUs will cause ProvisionedThroughputExceededException, leading to retries and stream processing failures. Increasing the write capacity reduces throttling, allowing the stream-triggered writes to succeed and the function to make progress.

Why this answer

To mitigate 'ProvisionedThroughputExceededException' errors when a Lambda function is triggered by DynamoDB Streams, two actions are effective. Option D: Increase the DynamoDB table's write capacity to handle the write demand from the stream processing. Option E: Reduce the batch size for the DynamoDB stream event source mapping to lower the number of writes per invocation, reducing the chance of exceeding throughput.

Option A is wrong because Lambda reserved concurrency controls how many concurrent executions Lambda can run, but the issue is DynamoDB throttling, not Lambda capacity. Option B is wrong because disabling DynamoDB Streams would stop the trigger entirely, which is not a mitigation. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes, and does not affect write throughput.

Practice this question →
7
Multi-Selecthard

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all CloudTrail trails across the organization are delivering events to a centralized S3 bucket in the management account. Currently, some member accounts have their own trails. Which THREE steps should the security team take to enforce this? (Choose three.)

Select 3 answers
A.Manually disable CloudTrail in each member account.
B.Create an organization trail in the management account that applies to all accounts.
C.Use AWS Config rules to detect non-compliant trails and trigger automatic remediation.
D.Enable CloudTrail on the centralized S3 bucket to log access.
E.Use a service control policy (SCP) to deny the 'cloudtrail:CreateTrail' and 'cloudtrail:UpdateTrail' actions.
AnswersB, C, E

Correct: Creating an organization trail in the management account automatically applies to all accounts and delivers events to the central S3 bucket.

Why this answer

Creating an organization trail in the management account automatically applies to all accounts and delivers events to the specified S3 bucket. Option C is correct because AWS Config rules can detect non-compliant trails (e.g., trails not delivering to the central bucket) and trigger automatic remediation, such as disabling the non-compliant trail or applying a fix. Option E is correct because an SCP that denies 'cloudtrail:CreateTrail' and 'cloudtrail:UpdateTrail' prevents member accounts from creating or modifying their own trails, enforcing the use of the organization trail.

Option A is incorrect because manually disabling CloudTrail in each member account is not scalable and does not prevent future trails. Option D is incorrect because enabling CloudTrail on the centralized S3 bucket (server access logging) logs access to the bucket itself, but does not ensure that CloudTrail trails deliver events to that bucket; it is not a necessary step for centralizing trail logs.

Practice this question →
8
MCQhard

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group (ASG) for web servers, and an Amazon RDS Multi-AZ DB instance. The ASG uses a launch template with Amazon Linux 2 and a user data script that installs the web application and connects to the RDS database using a static password stored in the user data. Recently, the security team discovered that the user data script is exposed in the EC2 console and could be viewed by anyone with EC2 describe-instances permissions. The team wants to remediate this immediately without causing downtime. The ASG is configured with a min size of 2, max size of 6, and desired capacity of 4. The application is currently under load. Which option describes the best course of action?

A.Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.
B.Immediately modify the user data on each running EC2 instance to remove the password, then update the launch template to reference AWS Secrets Manager.
C.Update the existing launch template to use AWS Secrets Manager for the database password. The ASG will automatically apply the change to existing instances.
D.Delete the existing launch template and create a new one with secrets from AWS Secrets Manager. Then terminate all running instances and let the ASG launch new ones.
AnswerA

This action creates a new launch template version that retrieves the password from AWS Secrets Manager, then performs an instance refresh with a minimum healthy percentage of 100%. This replaces instances one by one without downtime, remediating the security issue on all instances.

Why this answer

It uses an instance refresh with a minimum healthy percentage of 100% to replace instances without downtime, while the new launch template version retrieves the password from AWS Secrets Manager, eliminating the static password exposure. This approach ensures that the security vulnerability is remediated immediately without disrupting the running application under load.

Exam trap

The trap here is that candidates assume updating the launch template automatically propagates to existing instances, but in reality, the ASG only applies the launch template to new instances, so an instance refresh or manual replacement is required to remediate existing instances.

How to eliminate wrong answers

Option B is wrong because modifying user data on running instances does not change the launch template, so any new instances launched by the ASG will still use the exposed static password; also, manually editing instances is not scalable and risks configuration drift. Option C is wrong because updating the launch template does not automatically apply changes to existing instances; the ASG only uses the launch template for new instances, so existing instances remain vulnerable until replaced. Option D is wrong because terminating all running instances at once would cause downtime, violating the requirement to avoid disruption, and the ASG would launch replacements based on the new template, but the immediate termination is not safe under load.

Practice this question →
9
MCQmedium

A company uses AWS CloudTrail to audit API activity. During an incident investigation, they find that a user with the IAM policy 'AdministratorAccess' deleted an S3 bucket. The security team wants to know the source IP address and user agent used for the delete operation. Which action should the team take to obtain this information?

A.View the CloudTrail event history for the delete-bucket event.
B.Check the S3 server access logs for the deleted bucket.
C.Use CloudWatch Logs to search for the event in the CloudTrail log group.
D.Query AWS Config to find the configuration item for the bucket deletion.
AnswerA

Viewing the CloudTrail event history for the delete-bucket event provides the source IP address and user agent because CloudTrail records management API calls, including DeleteBucket. This is the direct and correct method to obtain the required information.

Why this answer

CloudTrail event history captures all management events, including DeleteBucket, and records the source IP address and user agent for each API call. By viewing the event history for the specific delete-bucket event, the security team can directly retrieve the required metadata without needing additional log sources or configurations. Option B is incorrect because S3 server access logs log object-level operations, not management events like bucket deletion.

Option C is not the most direct method; CloudWatch Logs can be used if CloudTrail is configured to send events to a log group, but the simplest way is from CloudTrail event history directly. Option D is incorrect because AWS Config tracks resource configuration changes, not API call details like source IP.

Exam trap

The trap here is that candidates confuse S3 server access logs (which log object-level operations) with CloudTrail management events, leading them to incorrectly choose option B for a bucket deletion that is a management API call.

How to eliminate wrong answers

Option B is wrong because S3 server access logs record object-level requests (e.g., GET, PUT, DELETE on objects), not management-level API calls like DeleteBucket, and they do not capture the user agent or IAM user identity. Option C is wrong because CloudTrail does not automatically deliver events to a CloudWatch Logs log group unless a specific trail is configured with CloudWatch Logs integration; the default event history is not searchable via CloudWatch Logs. Option D is wrong because AWS Config records configuration changes to resources (e.g., bucket existence), but it does not capture the source IP address or user agent of the API call that triggered the change.

Practice this question →
10
MCQeasy

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?

A.The security group for the RDS instance has changed during failover.
B.The application is using the database's DNS endpoint for the old primary, which is no longer the writer.
C.The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.
D.The database instance is still in the process of failover and is not yet accepting connections.
AnswerB

After failover, the writer endpoint points to the new primary, but if the application caches the old endpoint, it may fail.

Why this answer

After an RDS Multi-AZ failover, the DNS endpoint for the DB instance remains the same but its underlying IP address changes to point to the new primary (formerly the standby). If the application caches the IP address of the old primary or uses a direct connection to the old writer endpoint, it will attempt to connect to a node that is no longer the writer. The correct practice is to always connect using the RDS instance endpoint (CNAME), which automatically resolves to the current writer, and to avoid caching the resolved IP address.

Since the instance status is 'Available', the new primary is ready, so the issue is a stale connection target.

Exam trap

The trap here is that candidates assume a failed Multi-AZ failover or a DNS propagation delay, when in reality the instance is healthy and DNS updates quickly, but the application's cached IP address from the old primary is the root cause.

How to eliminate wrong answers

Option A is wrong because security groups are associated with the RDS instance itself, not with a specific node; during a failover, the security group configuration is preserved and does not change. Option C is wrong because the DNS record (CNAME) for the RDS endpoint is managed by AWS Route 53 with a very low TTL (typically 5 seconds) and propagates quickly; the application's DNS resolver would have the updated record long before the failover completes. Option D is wrong because the RDS console shows the instance status as 'Available', which means the failover has completed and the new primary is accepting connections; the issue is not that the instance is still transitioning.

Practice this question →
11
MCQhard

A company runs a critical web application on AWS. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The Auto Scaling group uses a launch template that specifies an Amazon Linux 2 AMI. The application stores session state in an ElastiCache Redis cluster. Recently, the operations team received alerts that the application is returning 503 errors intermittently. Investigation shows that the ALB target group health checks are failing for some instances, but those instances are still in service. The CloudWatch logs from the instances show that the application is running, but the health check endpoint is timing out after 5 seconds. The health check is configured with a 5-second timeout, 10-second interval, and 2 consecutive successes required to mark healthy. The DevOps engineer suspects that the issue is due to high CPU utilization on the instances causing the health check to respond slowly. The engineer wants to implement a solution that prevents the ALB from routing traffic to instances that are experiencing high CPU, and also automatically scales out to handle the increased load. What should the engineer do?

A.Configure the Auto Scaling group to use ELB health checks and set the health check grace period to 600 seconds.
B.Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.
C.Create a scheduled scaling action to add more instances during peak hours.
D.Increase the health check timeout to 10 seconds and the interval to 20 seconds to give instances more time to respond.
AnswerB

Stopping high CPU instances removes them from the ALB, and target tracking scaling adds capacity when needed.

Why this answer

It addresses both the immediate issue (high CPU causing health check timeouts) and the scaling requirement. Stopping the instance via a CloudWatch alarm removes it from the ALB target group, preventing traffic routing to unhealthy instances. The target tracking scaling policy based on CPU utilization automatically adds instances when CPU is high, ensuring capacity matches demand.

Exam trap

The trap here is that candidates may think increasing health check timeout or grace period solves the problem, but AWS expects you to recognize that high CPU instances should be removed from service and replaced via scaling, not just given more time to respond.

How to eliminate wrong answers

Option A is wrong because increasing the health check grace period to 600 seconds only delays the start of health checks, but does not prevent traffic from being routed to instances with high CPU after the grace period ends; it also does not trigger scaling. Option C is wrong because a scheduled scaling action is reactive to time-based patterns, not to real-time CPU spikes, and does not address the immediate health check failures. Option D is wrong because increasing the health check timeout and interval only masks the symptom by allowing more time for slow responses, but does not remove unhealthy instances from service or scale out to handle load.

Practice this question →
12
MCQeasy

A DevOps engineer receives an alarm that an EC2 instance's CPU utilization has exceeded 90% for 5 minutes. The engineer needs to automatically recover the instance. Which AWS service should be used to configure automatic recovery?

A.Amazon CloudWatch Alarms
B.AWS Lambda
C.AWS Systems Manager Automation
D.EC2 Auto Scaling
AnswerA

Amazon CloudWatch Alarms are the native mechanism for EC2 AutoRecovery. By configuring an alarm on the System Status Check metric (StatusCheckFailed_System) with the 'recover' action, you let EC2 automatically restart the instance on new hardware while preserving its instance ID, private IP, Elastic IP, and instance store data. This is the direct, built-in solution that requires no custom code or additional orchestration.

Why this answer

Amazon CloudWatch Alarms can be configured to trigger an EC2 instance recovery action when a metric like CPU utilization exceeds a threshold (e.g., 90% for 5 minutes). The alarm sends a signal to the EC2 service, which automatically recovers the instance by stopping it and starting it on a new underlying host, preserving the instance ID, private IP, and Elastic IP. This is the native, built-in mechanism for automatic instance recovery without requiring additional compute or orchestration services.

Exam trap

The trap here is that candidates often confuse EC2 Auto Scaling (which replaces instances) with automatic recovery (which recovers the same instance), or they overcomplicate the solution by choosing Lambda or Systems Manager when a simple CloudWatch Alarm action is the correct and native AWS mechanism.

How to eliminate wrong answers

Option B is wrong because AWS Lambda is a serverless compute service that can execute custom code in response to events, but it is not the direct service used to configure automatic EC2 instance recovery; while Lambda could be used to script a recovery, it adds unnecessary complexity and latency compared to the native CloudWatch Alarm recovery action. Option C is wrong because AWS Systems Manager Automation provides runbooks for automated remediation and operational tasks, but it is not the primary service for configuring automatic EC2 instance recovery; it would require additional setup and is not the simplest or recommended approach. Option D is wrong because EC2 Auto Scaling is designed to manage the number of instances in an Auto Scaling group based on scaling policies, not to recover a specific impaired instance; it would terminate and replace the instance rather than recover it, which changes the instance ID and associated resources.

Practice this question →
13
Multi-Selecthard

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with the error: 'UPDATE_ROLLBACK_IN_PROGRESS'. The DevOps engineer needs to investigate the cause. Which THREE steps should the engineer take? (Choose THREE.)

Select 3 answers
A.Create a change set to see what changes were attempted.
B.Use the 'describe-stack-resource' AWS CLI command to get the resource status.
C.Review the CloudFormation console to identify which resource failed.
D.Use the '--retain-resources' option to preserve resources that failed to delete.
E.Check the CloudFormation stack events for error messages.
AnswersC, D, E

The console highlights the failed resource.

Why this answer

Options C, D, and E are correct. Option C: Reviewing the CloudFormation console directly shows which resource failed, enabling targeted investigation. Option D: Using '--retain-resources' preserves resources that failed to delete during rollback, allowing further analysis.

Option E: Stack events contain detailed error messages and status updates that pinpoint the failure cause. Option A is incorrect because change sets are used to preview changes before execution, not for troubleshooting failures. Option B is incorrect because 'describe-stack-resource' returns details for a specific resource but does not provide the overall failure context and is not a primary troubleshooting step.

Practice this question →
14
Multi-Selecthard

A company uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is experiencing intermittent HTTP 503 errors. The DevOps team needs to diagnose the cause. Which THREE of the following should the team investigate? (Choose THREE.)

Select 3 answers
A.Security group inbound rules for the ALB
B.SSL certificate expiration on the ALB
C.Auto Scaling group minimum capacity and scaling policy
D.ALB idle timeout settings
E.Health check configuration and target group health status
AnswersC, D, E

Not enough instances can cause 503.

Why this answer

The correct options are C, D, and E. Option C is correct because if the Auto Scaling group's minimum capacity is too low or scaling policies are not responsive, there may be insufficient instances to handle the load, causing HTTP 503 errors. Option D is correct because a low idle timeout setting on the ALB can cause premature closure of idle connections, leading to 503 errors for long-lived requests.

Option E is correct because if health checks are misconfigured or instances are unhealthy, the ALB will route traffic to unhealthy targets or have no healthy targets, resulting in 503 errors. Option A is incorrect because security group inbound rules affect whether traffic can reach the ALB; if they block traffic, the client would receive a timeout or connection refused, not a 503 from the ALB. Option B is incorrect because SSL certificate expiration causes SSL handshake failures, resulting in 502 Bad Gateway or connection errors, not 503.

Practice this question →
15
MCQhard

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

A.The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.
B.The security group for the EC2 instance does not allow outbound traffic to the RDS instance.
C.The EC2 instance does not have the correct IAM instance profile attached.
D.The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.
AnswerD

For IAM database authentication, the application must first assume the IAM role 'DatabaseAccessRole' to obtain credentials authorized to generate the RDS token; the trust policy on 'DatabaseAccessRole' must explicitly list 'EC2-AppRole' as a trusted principal. When this trust policy does not allow the EC2 instance's role to assume it, the STS AssumeRole call returns 'AccessDenied', so the application cannot acquire the token required for authentication to RDS. This exactly matches the observed error, confirming the trust policy of 'DatabaseAccessRole' is the root cause.

Why this answer

The error indicates that the EC2 instance's IAM role 'EC2-AppRole' cannot authenticate to the RDS instance. IAM database authentication requires the EC2 instance to assume a database authentication token, which is generated by calling the RDS API with the 'EC2-AppRole' credentials. However, the RDS instance's resource-based policy only allows 'DatabaseAccessRole' to connect.

For 'EC2-AppRole' to successfully authenticate, it must first assume 'DatabaseAccessRole' via a trust policy that permits the EC2 instance role to assume it. Without this trust relationship, the authentication token request fails, causing the error.

Exam trap

The trap here is that candidates often assume the error is due to missing resource-based policies or network connectivity, but the core issue is the missing trust relationship between the EC2 instance role and the database access role, which is a common misconfiguration in cross-account or cross-role IAM authentication setups.

How to eliminate wrong answers

Option A is wrong because the RDS instance does have a resource-based policy that allows 'DatabaseAccessRole' to connect, as stated in the question; the issue is that the EC2 instance role cannot assume that role. Option B is wrong because security group rules control network traffic, not IAM authentication; if the security group were blocking outbound traffic, the error would be a network timeout or connection refused, not an IAM authentication failure. Option C is wrong because the EC2 instance is already associated with the IAM role 'EC2-AppRole' (the instance profile is attached), and the error is about assuming another role, not about the instance lacking a role.

Practice this question →
16
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

A.The upload succeeds without encryption.
B.The upload succeeds with SSE-S3 encryption.
C.The upload succeeds and is automatically encrypted with SSE-S3.
D.The upload fails with an Access Denied error.
AnswerD

The correct behavior is that the upload request is denied at the IAM authorization layer. The policy statement uses a Deny effect with a condition like "Null": {"s3:x-amz-server-side-encryption": "true"} to require the encryption header. As the request does not include the header, the condition matches, and S3 returns AccessDenied. This is a common pattern for enforcing server-side encryption on all uploads.

Why this answer

The upload fails with an Access Denied error because the IAM policy attached to the user includes a condition that requires the request to include the `x-amz-server-side-encryption` header with a value of `AES256`. Since the user attempts to upload without specifying any server-side encryption, the request does not satisfy the condition and is denied. Option A is incorrect because the policy denies unencrypted uploads.

Option B is incorrect because the user did not request SSE-S3. Option C is incorrect because automatic encryption does not override the IAM policy condition; the policy explicitly requires the encryption header to be present in the request.

Practice this question →
17
MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. Users report intermittent 503 errors. CloudWatch metrics show that the ALB's 'RequestCount' is normal, but 'HTTPCode_ELB_5XX_Count' spikes. The 'TargetResponseTime' metric shows occasional high latency. Which troubleshooting step should the DevOps engineer take FIRST?

A.Enable and analyze the ALB access logs stored in S3, filtering for 503 errors and correlating with target response times.
B.Increase the desired capacity of the Auto Scaling group to handle more requests.
C.Disable connection draining on the target group to prevent slow-draining instances from causing errors.
D.Review AWS CloudTrail logs for any recent configuration changes to the ALB.
AnswerA

Access logs provide detailed per-request data including timestamp, target status, and response time, enabling correlation of errors with slow targets.

Why this answer

The correct first step is to enable and analyze ALB access logs (Option A). ALB access logs contain detailed information about each HTTP request, including the response status code (e.g., 503), target response time, and the specific target that handled the request. By filtering for 503 errors and correlating with high target response times, the engineer can identify whether the errors are caused by slow or failing targets.

Option B (increasing desired capacity) does not address the root cause and may not help if the issue stems from target health or configuration. Option C (disabling connection draining) can worsen the problem by abruptly terminating in-flight requests, increasing errors. Option D (reviewing CloudTrail logs) is not useful because CloudTrail captures API changes, not HTTP-level errors.

Practice this question →
18
Multi-Selectmedium

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Select 2 answers
A.Modify the canary script to add more logging.
B.Review the canary's CloudWatch Logs for error details.
C.Inspect the Lambda function logs associated with the canary.
D.Examine CloudWatch metrics for the canary.
E.Check CloudTrail for CanaryRun API calls.
AnswersB, C

Reviewing the canary's CloudWatch Logs is the correct first step because each canary run emits a dedicated log stream containing step-by-step execution details, error and stack traces, HTTP response bodies, and console output from the canary script. Since the canary has already failed, these logs are the definitive source for pinpointing the root cause—whether it's an assertion failure, a timeout, an invalid response, or an unexpected HTTP status.

Why this answer

CloudWatch Synthetics canaries automatically log execution details, including errors, to CloudWatch Logs. Reviewing these logs provides specific error information, such as 'ClientError' details. Option C is correct because each canary runs as an AWS Lambda function, and the Lambda function's CloudWatch Logs contain runtime logs, including any exceptions or errors thrown during execution.

Option A is incorrect because while adding logging could be a long-term improvement, the question asks for diagnostic actions; the canary already logs to CloudWatch Logs, so modifying the script is not necessary for diagnosis. Option D is incorrect because CloudWatch metrics provide aggregate statistics (e.g., success/failure rates) but not detailed error codes or messages. Option E is incorrect because CloudTrail records API calls to create, start, or stop canaries, not the execution details of individual canary runs.

Practice this question →
19
Multi-Selecteasy

A DevOps team needs to implement a solution to automatically remediate an S3 bucket that becomes publicly accessible. Which TWO services should they use together?

Select 2 answers
A.AWS CloudTrail
B.AWS Config
C.AWS Lambda
D.AWS Systems Manager Automation
E.Amazon GuardDuty
AnswersB, D

Config can evaluate bucket policies and trigger remediation.

Why this answer

AWS Config can monitor S3 bucket configurations using a managed rule such as s3-bucket-public-read-prohibited. When a violation is detected, Config can automatically invoke an AWS Systems Manager Automation document as a remediation action. Systems Manager Automation runs a pre-defined workflow (e.g., applying a bucket policy that blocks public access) to correct the issue.

This combination provides automated, event-driven remediation without manual intervention, making AWS Config and AWS Systems Manager Automation the correct pair.

Exam trap

AWS often tests the misconception that AWS Lambda is the primary service for custom remediation. However, AWS Config natively integrates with AWS Systems Manager Automation for automatic remediation of non-compliant resources, reducing the need for custom Lambda functions. Lambda is not listed as a correct answer in this scenario.

Practice this question →
20
MCQeasy

A DevOps team is designing an incident response plan for a critical microservices architecture. They need to automatically collect and analyze logs from all services during an incident. Which solution should they use?

A.Stream logs to Amazon Kinesis Data Firehose and analyze with Amazon OpenSearch Service.
B.Store logs in Amazon S3 and use Amazon Athena to query them.
C.Use AWS Systems Manager Run Command to execute log collection scripts on each instance.
D.Centralize logs in Amazon CloudWatch Logs and use CloudWatch Logs Insights for real-time querying.
AnswerD

Amazon CloudWatch Logs centralizes log streams from EC2 instances, Lambda, and other AWS services via the CloudWatch agent, making logs available for query within seconds of ingestion. CloudWatch Logs Insights provides an interactive, purpose-built query engine that can search, filter, and aggregate log events across multiple log groups using a simple query language, without requiring external infrastructure. This combination supports fast, exploratory incident analysis, real-time alarming via metric filters, and full retention options—making it the most direct and operationally ready choice.

Why this answer

Amazon CloudWatch Logs provides a centralized log management service that integrates natively with AWS services. During an incident, CloudWatch Logs Insights enables real-time, ad-hoc querying and analysis of logs from all microservices without needing to set up additional infrastructure, making it the most efficient solution for incident response.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing complex streaming or analytics services (like Kinesis or Athena) for real-time incident analysis, when the native CloudWatch Logs Insights service is designed specifically for this use case with minimal setup and lower latency.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is a streaming data delivery service that requires additional configuration to buffer and deliver logs to Amazon OpenSearch Service, adding latency and complexity not ideal for real-time incident analysis. Option B is wrong because storing logs in Amazon S3 and querying with Athena is designed for batch analytics, not real-time querying, and incurs significant latency due to S3 eventual consistency and Athena's per-query overhead. Option C is wrong because AWS Systems Manager Run Command is a one-time or scheduled command execution tool, not a continuous log collection and analysis solution, and it requires manual intervention to trigger scripts during an incident, which violates the automated incident response requirement.

Practice this question →
21
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance fails, and automatic failover does not occur within the expected 1-2 minutes. The DevOps team needs to quickly restore database availability. What should the team do first?

A.Restore the latest automated snapshot to a new DB instance.
B.Modify the DB instance to change the Multi-AZ setting to enable automatic failover.
C.Connect to the standby instance directly and promote it to primary.
D.Reboot the DB instance with failover selected.
AnswerD

Rebooting the DB instance with the 'Reboot with failover' option selected forces a synchronous failover to the standby instance, typically completing in 60-120 seconds. This is the fastest method to manually initiate a failover while preserving existing data, as the standby is already in sync and becomes the new primary.

Why this answer

When automatic failover does not occur within the expected 1-2 minutes, the fastest way to manually trigger a failover is to reboot the DB instance with the 'Reboot with Failover' option selected. This forces the RDS service to promote the standby replica to the new primary, restoring database availability without waiting for the automated health check to complete. Option D is correct because it directly initiates the failover process, leveraging the existing Multi-AZ setup.

Exam trap

The trap here is that candidates assume they can directly access or promote the standby instance (Option C), but RDS does not expose the standby as a connectable endpoint, and the only manual failover mechanism is the reboot with failover option.

How to eliminate wrong answers

Option A is wrong because restoring from the latest automated snapshot to a new DB instance is a time-consuming process (can take minutes to hours depending on size) and does not utilize the existing standby replica, which is already synchronized and ready to take over. Option B is wrong because modifying the Multi-AZ setting to 'enable automatic failover' is not a valid action; Multi-AZ is already enabled and the setting cannot be toggled to 'enable' failover—failover is inherent to Multi-AZ and the issue is that the automatic health check did not trigger it. Option C is wrong because you cannot directly connect to the standby instance in Amazon RDS Multi-AZ; the standby is not accessible as a standalone database endpoint and there is no 'promote' operation available to the user—RDS manages the standby entirely.

Practice this question →
22
MCQeasy

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

A.Install the CloudWatch Agent in each container.
B.Configure AWS CloudTrail to capture logs.
C.Use the awslogs log driver in the task definition.
D.Write logs to a file and use an S3 bucket with event notifications.
AnswerC

The `awslogs` log driver, configured under the `logConfiguration` element in the ECS task definition, makes Docker send the container's `stdout` and `stderr` directly to a specified CloudWatch Logs group and stream. The ECS agent automatically creates log streams, and you can set `awslogs-group`, `awslogs-region`, and `awslogs-stream-prefix`; the task execution role must have `logs:CreateLogStream` and `logs:PutLogEvents` permissions. This approach requires no changes to the application image, works on both Fargate and EC2 launch types, and provides near-real-time access to logs through the CloudWatch console, CLI, or APIs. It is the native, recommended method for centralizing ECS container logs.

Why this answer

The awslogs log driver is the simplest native integration between Amazon ECS and CloudWatch Logs. By specifying the log driver in the task definition, the ECS container agent automatically captures stdout and stderr from the container and streams them to CloudWatch Logs without any additional agents or custom code.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing the CloudWatch Agent (Option A) because they assume an agent is needed, but the awslogs log driver is the built-in, simpler mechanism for ECS tasks.

How to eliminate wrong answers

Option A is wrong because installing the CloudWatch Agent inside each container adds unnecessary complexity and overhead; the awslogs log driver handles log forwarding at the container runtime level, making an in-container agent redundant. Option B is wrong because AWS CloudTrail captures API activity and management events, not application stdout/stderr logs, so it cannot fulfill the requirement to capture application output. Option D is wrong because writing logs to a file and using S3 event notifications introduces latency, extra components (S3 bucket, notifications), and does not provide real-time log streaming to CloudWatch Logs; the awslogs driver is far simpler and more direct.

Practice this question →
23
MCQhard

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

A.Use Amazon GuardDuty to automatically modify the security group membership of the instance.
B.Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.
C.Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.
D.Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.
AnswerD

AWS Config can detect non-compliant instances (e.g., missing required tags) and trigger SSM Automation to perform remediation actions.

Why this answer

AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Exam trap

The trap here is that candidates often assume any event-driven automation (like Lambda + EventBridge) is always the best answer, but AWS Config with Systems Manager Automation is the native, fully managed, and auditable solution for compliance-driven remediation without custom code.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that generates findings but cannot directly modify security group membership; it requires an integration with AWS Lambda or EventBridge to perform remediation actions. Option B is wrong because AWS Shield Advanced is a DDoS protection service and has no capability to modify EC2 security group associations or apply quarantine groups. Option C is wrong because while Lambda functions triggered by EventBridge can technically perform the remediation, the question asks for a combination of actions that should be implemented, and AWS Config with Systems Manager Automation is the recommended, fully managed, and auditable approach that avoids the operational overhead of maintaining custom Lambda code and IAM permissions.

Practice this question →
24
MCQmedium

A company is using AWS CloudFormation to deploy infrastructure. An engineer needs to ensure that any changes to the production stack are reviewed and approved before they are applied. The engineer also wants to prevent unauthorized changes. Which solution should the engineer implement?

A.Use CloudFormation StackSets to manage the production stack across multiple accounts.
B.Use CloudFormation Change Sets and require manual approval to execute the change set.
C.Use AWS Service Catalog to create a product for the stack and require approval for any portfolio changes.
D.Use AWS CodePipeline to deploy the stack and require manual approval at the deploy stage.
AnswerB

Change Sets allow you to review proposed changes before applying them.

Why this answer

CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact running resources before you apply them. By requiring manual approval to execute the change set, the engineer ensures that all modifications are reviewed and approved, preventing unauthorized changes. This directly meets the requirement for a review-and-approval workflow without introducing unnecessary complexity.

Exam trap

The trap here is that candidates often confuse the purpose of StackSets (multi-account deployment) or CodePipeline (CI/CD pipeline) with the need for a simple change review mechanism, overlooking the direct and built-in capability of CloudFormation Change Sets to preview and require approval before applying changes.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets are designed to deploy stacks across multiple accounts and regions, not to enforce a review-and-approval workflow for changes to a single production stack. Option C is wrong because AWS Service Catalog products and portfolio changes control the provisioning of pre-defined templates, not the approval of changes to an already-deployed stack; it does not provide a change review mechanism for existing stacks. Option D is wrong because while CodePipeline can include a manual approval stage, it is a CI/CD orchestration tool that adds unnecessary overhead and complexity for a simple change review requirement; CloudFormation Change Sets provide a more direct and lightweight solution.

Practice this question →
25
MCQhard

A DevOps engineer notices that an EC2 instance in an Auto Scaling group is repeatedly failing health checks and being terminated. The engineer needs to capture the root cause by collecting memory dumps and system logs before termination. What should the engineer do?

A.Configure the CloudWatch Agent to collect memory and system logs and publish them to CloudWatch Logs.
B.Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.
C.Use AWS Systems Manager Run Command to execute a script on the instance that collects diagnostics before it is terminated.
D.Enable EC2 instance metadata service (IMDS) to capture diagnostic data that persists after termination.
AnswerB

EC2Rescue can run diagnostics at startup; extending the grace period gives time for the tool to collect data before termination.

Why this answer

EC2Rescue is specifically designed to collect memory dumps and system logs from EC2 instances, and by configuring it to run at startup and extending the Auto Scaling health check grace period, the engineer ensures diagnostics are captured before the instance is terminated for failing health checks. This approach directly addresses the need to gather root cause data from a failing instance that is about to be replaced.

Exam trap

The trap here is that candidates often assume Systems Manager Run Command (Option C) can reliably execute scripts on failing instances, but they overlook that the instance must be in a running and reachable state, which is not guaranteed when health checks are repeatedly failing and termination is imminent.

How to eliminate wrong answers

Option A is wrong because the CloudWatch Agent collects logs and metrics during normal operation but does not capture memory dumps or system logs at the point of failure before termination; it cannot guarantee data collection from an instance that is being terminated due to health check failures. Option C is wrong because AWS Systems Manager Run Command requires the instance to be running and reachable to execute commands, but the instance is repeatedly failing health checks and may be terminated before the command can run, making it unreliable for capturing pre-termination diagnostics. Option D is wrong because EC2 instance metadata service (IMDS) provides metadata about the instance (e.g., instance ID, AMI ID) but does not capture diagnostic data like memory dumps or system logs, and it does not persist after termination.

Practice this question →
26
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?

A.The DNS CNAME for the RDS endpoint has not propagated to the application's DNS resolver
B.The standby instance has a different storage configuration than the primary
C.The application is using the old master user credentials that were changed on the primary but not replicated to the standby
D.The security group for the RDS instance does not allow inbound traffic from the application's new IP address
AnswerC

Credentials are not replicated across Multi-AZ; they must be the same.

Why this answer

The most likely cause is that the application is using credentials that were changed on the primary but not replicated to the standby. In RDS Multi-AZ, changes made via the RDS console or API (e.g., modifying the master password) are automatically replicated, but direct SQL modifications (e.g., ALTER USER) are not. After failover, the standby becomes the new primary with the old credentials, causing 'Access denied for user' errors.

Option A is incorrect because DNS CNAME propagation delays cause connection timeouts, not authentication failures. Option B is incorrect because storage configuration differences do not affect authentication. Option D is incorrect because the security group remains associated with the RDS instance and the application's IP address does not change during failover.

Practice this question →
27
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

A.Use IAM Access Analyzer to validate the roles against a policy template.
B.Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.
C.Run AWS Trusted Advisor and check the IAM report for roles with long session durations.
D.Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.
AnswerB

The AWS Config managed rule iam-role-max-session-duration evaluates every IAM role in the account, comparing each role's MaxSessionDuration setting against the rule's maxSessionDuration parameter. This rule is triggered proactively on configuration changes and periodically, so it detects both existing and newly modified roles, flagging any role whose allowed session duration exceeds the defined threshold as noncompliant. It integrates with AWS Organizations and can be remediated automatically or through Config conformance packs.

Why this answer

AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to evaluate resource configurations (like IAM role session duration) with CloudTrail's event logging or IAM Access Analyzer's policy analysis, leading them to choose options that detect creation events rather than continuously assess the current state of all roles.

How to eliminate wrong answers

Option A is wrong because IAM Access Analyzer is designed to analyze resource-based policies (like S3 bucket policies or KMS key policies) for unintended public or cross-account access, not to validate IAM role session duration settings against a policy template. Option C is wrong because AWS Trusted Advisor checks for IAM use (e.g., unused IAM users, MFA on root) but does not include a specific check for IAM role maximum session duration. Option D is wrong because while CloudTrail can log `CreateRole` and `UpdateAssumeRolePolicy` events, a metric filter cannot directly evaluate the `MaxSessionDuration` parameter from the event; it would require complex custom parsing and still not provide ongoing compliance evaluation like AWS Config.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Incident Response questions.

Start 20-question session