CCNA Incident Response Questions

Option B is correct because S3 bucket names are unique and cannot be recreated immediately; however, objects can be recovered if versioning and MFA delete were enabled. Option A is incorrect because buckets cannot be restored from CloudTrail. Option C is incorrect because only the bucket owner can delete a bucket, but deletion cannot be undone.

Option D is incorrect because buckets are not recovered automatically.

Option A is correct because the first step in incident response is to gather information. CloudTrail logs all API calls, including TerminateInstances, and can identify who or what terminated the instance. Option B is wrong because examining the application logs does not reveal the termination cause.

Option C is wrong because scaling policies would not cause termination without CloudWatch. Option D is wrong because the termination reason is not available in the console without checking logs.

The correct answer is D. Sticky sessions are tied to the instance ID. If the ALB target group's deregistration delay is too short, the ALB may route traffic to a new instance before the session is migrated.

Session stickiness duration would affect how long sessions persist on the same instance, but not cause loss during deployments. Lifecycle hooks are for custom actions. Health check thresholds affect availability.

Option B is correct because Fargate tasks require a VPC and subnets with outbound internet access (NAT Gateway or Internet Gateway) to pull images from ECR or Docker Hub. Option A is wrong because CPU/memory limits would cause tasks to fail with resource errors, not prevent starting. Option C is wrong because the security group is already configured.

Option D is wrong because the task definition is already defined.

Option D is correct because a deregistration delay setting can cause the ALB to continue sending requests to instances that are being de-registered, leading to 503 errors if the instances are no longer accepting traffic. Option A is incorrect because healthy instances mean the health checks pass. Option B is incorrect because a missing security group rule would cause connection timeouts, not 503.

Option C is incorrect because cross-zone load balancing does not cause 503 errors.

Option D is correct because the history shows that 1 datapoint with value 90.0 was greater than the threshold of 80.0. Option A is wrong because the datapoint is 90.0, not 80.0. Option B is wrong because it crossed the threshold.

Option C is wrong because the alarm uses 1 datapoint, not 3.

Option A is correct because the appspec.yml references lifecycle event hooks scripts; if the file is missing, 'ScriptMissing' error occurs. Option B is wrong because the AMI is not related to script files. Option C is wrong because the security group does not affect script execution.

Option D is wrong because the deployment group configuration is not the cause.

Option B is correct because system status checks indicate problems with the underlying physical host, such as loss of network connectivity or power. Option A is wrong because instance status checks are for the OS, not system. Option C is wrong because EBS volume issues are instance status checks.

Option D is wrong because security group rules affect network access but not system status checks.

Option C is correct because AWS Systems Manager Run Command can execute commands (e.g., 'top') on EC2 instances to gather process-level details. Option A (CloudTrail) does not provide OS-level metrics. Option B (Config) records configuration state.

Option D (Inspector) is for vulnerability assessment.

Option B is correct because CloudTrail delivers events to CloudWatch Logs, and a metric filter on 'CreateAccessKey' can trigger a CloudWatch Alarm to send an SNS notification. Option A is wrong because CloudWatch Events (now Amazon EventBridge) can directly match CloudTrail events, but the question asks for minimal latency and a common pattern. Option C is wrong because S3 event notifications are not designed for real-time alerting on API calls.

Option D is wrong because Lambda polling CloudTrail is inefficient and introduces latency.

Option B is correct because attaching a deny-all policy immediately blocks all actions. Option A is wrong because deleting the user may fail if there are dependencies. Option C is wrong because signing certificates are only for programmatic access, not console.

Option D is wrong because rotating keys does not revoke existing sessions.

Option D is correct because increasing the soft memory limit provides more memory to the container, reducing the likelihood of out-of-memory errors causing 503s. Option A is wrong because increasing CPU units may help if the issue is CPU-bound, but memory is more likely the cause of 503 errors. Option B is wrong because increasing desired count helps with load distribution but not if each task is resource-constrained.

Option C is wrong because changing to hard limit may cause the task to be killed if it exceeds memory.

Option A is correct because AWS Config remediation with SSM Automation can automatically modify security group rules. Option B is wrong because AWS Config rules only evaluate, not remediate. Option C is wrong because CloudWatch Events cannot directly modify security groups.

Option D is wrong because Service Catalog is for provisioning, not remediation.

Option C is correct because restricting the Principal to a specific AWS account prevents public access. Option A is wrong because public access is enabled by Principal "*". Option B is wrong because blocking public access at the account level is an alternative, but the question asks to change the template.

Option D is wrong because blocking public access on the bucket is another approach, but the template change is required.

Option A is correct because CloudTrail logs ConsoleLogin events. Option D is correct because a CloudWatch Events rule can filter for the ConsoleLogin event and check the source IP address, then trigger an SNS notification. Option B is wrong because CloudWatch Logs Insights is used for querying logs, not for real-time alerting.

Option C is wrong because S3 events are not triggered by CloudTrail log delivery. Option E is wrong because Config rules are for resource configuration, not API call events.

Option D is correct because a VPC endpoint for S3 (Gateway or Interface) is needed for private subnet access to S3 without NAT. Option A is wrong because the routing table is not typically an issue for S3 access via Internet Gateway. Option B is wrong because the IAM role is already configured.

Option C is wrong because no proxy is required.

Option C is correct. The SystemStatus is 'impaired', meaning there is a problem with the underlying physical host (system status check). The instance status is 'ok', so the OS is fine.

Option A is wrong because the instance is running. Option B is wrong because instance status is ok. Option D is wrong because there is a system impairment.

Options A and C are correct. A is correct because a missing or invalid task execution role can prevent ECS from pulling the image from ECR. C is correct because if the image is in a private ECR repository, the task execution role needs the ecr:GetDownloadUrlForLayer permission.

Option B is wrong because the service role is for load balancer integration, not image pulling. Option D is wrong because Fargate does not support EBS. Option E is wrong because increasing task memory is unrelated to pulling images.

Option B is correct because an explicit Deny overrides any Allow. The Deny action s3:DeleteObject explicitly denies the delete, even though the Allow all s3 actions includes delete. Option A is wrong because the resource ARN matches.

Option C is wrong because the policy allows all s3 actions, but the Deny blocks delete. Option D is wrong because the policy is valid.

Option C is correct because the pipeline can be manually retried from the approval step, which re-initiates the approval action. Option A is wrong because changing the pipeline definition requires a stack update. Option B is wrong because the console allows approving or rejecting directly.

Option D is wrong because the manual approval is a step, not a stage.

Option B is correct because AWS X-Ray provides end-to-end tracing and can identify errors and performance issues in Lambda functions. Option A is wrong because CloudTrail logs API calls, not application errors. Option C is wrong because Config is for resource compliance.

Option D is wrong because Trusted Advisor provides best-practice checks, not real-time error analysis.

Option B is correct because CloudTrail records all S3 API calls, including bucket policy changes. Option A is wrong because CloudWatch monitors metrics. Option C is wrong because Config records configuration changes but not the identity.

Option D is wrong because GuardDuty detects threats but doesn't log API calls.

Option C is correct because the response plan must have the correct ARN of the SNS topic. Option A is wrong because the logs show no invocations, so the function is not being triggered. Option B is wrong if the function policy allows SNS.

Option D is wrong because the function is not invoked.

Option D is correct because the CloudWatch agent must be configured to collect memory metrics; CPU metrics are collected by default. Option A is wrong because instance store volumes would not affect CloudWatch metrics. Option B is wrong because CloudWatch metrics are stored for 15 months.

Option C is wrong because the root volume size does not prevent metric collection.

Option D is correct because if the health check endpoint is not returning a 200 status, the ALB will consider the target unhealthy and return 503. Option A is wrong because scaling based on CPU would not directly cause 5xx. Option B is wrong because Fargate has no OS patching.

Option C is wrong because the application logs show no errors.

Option D is correct because Systems Manager Incident Manager supports escalation plans with timeouts and multiple engagement levels. Option A is wrong because Lambda is not needed. Option B is wrong because CloudWatch Events is not the escalation mechanism.

Option C is wrong because it requires manual re-paging.

Option B is correct because taking a snapshot of the EBS volume preserves the disk state for analysis. Option C is correct because collecting memory dump captures volatile data like running processes and network connections. Option A is wrong because terminating the instance destroys evidence.

Option D is wrong because detaching the volume stops the instance, but if the instance is stopped, memory is lost; better to snapshot while running. Option E is wrong because the instance metadata is not volatile and can be retrieved later.

Option C is correct because the instance needs an IAM role with the AmazonSSMManagedInstanceCore policy to communicate with Systems Manager. Without it, the SSM Agent cannot call the SSM API. Option A is wrong because the agent is already running.

Option B is wrong because outbound internet access is not strictly required if using VPC endpoints. Option D is wrong because time synchronization is important but not the first thing to check.

Option A is correct because VPC Flow Logs capture traffic. Option C is correct because the database port must be open. Option D is correct because NACL rules must allow both inbound and outbound.

Option B is wrong because the issue is not DNS. Option E is wrong because the security group already allows the EC2 security group.

The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed.

This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Option A is correct because CodeDeploy deployment logs provide details of the deployment process. Option B is correct because comparing CloudWatch metrics before and after the deployment can show changes. Option D is correct because application logs from the new instances can reveal errors.

Option C is wrong because CloudTrail logs API calls, not application performance. Option E is wrong because the deployment group configuration is unlikely to change performance directly.

Option A is correct because CloudFront edge locations cache content closer to users. Option C is correct because Lambda@Edge can perform custom processing at edge locations, such as URL rewriting or A/B testing, which can optimize content delivery. Option B is wrong because S3 Transfer Acceleration speeds up uploads, not downloads.

Option D is wrong because a Network Load Balancer is for TCP/UDP traffic, not HTTP/HTTPS content. Option E is wrong because ElastiCache is for database caching, not CDN.

Correct: A and D. Deploying across multiple Availability Zones provides resilience against AZ failures. Using an Auto Scaling group ensures capacity is maintained.

Option B provides read scalability but not write availability. Option C is for disaster recovery, not immediate availability. Option E is for performance, not availability.

Option A is correct to stop the instance. Option D is correct to detach the IAM role to prevent further actions. Option E is correct to isolate the instance by modifying the security group.

Option B is wrong because snapshotting may capture malware. Option C is wrong because terminating destroys evidence.

Option B is correct because AWS CloudTrail records API calls for deployments. Option C is correct because AWS Config provides a history of configuration changes. Option A is wrong because Amazon Inspector is for vulnerability assessment.

Option D is wrong because AWS Trusted Advisor is for cost optimization and best practices. Option E is wrong because AWS Service Catalog is for managing IT service catalogs.

Option A is correct because a CloudWatch alarm triggers based on a metric. Option C is correct because the 'StatusCheckFailed' metric is the correct metric to monitor instance health. Option D is correct because an SNS topic is needed to send notifications.

Option B is wrong because CloudWatch Logs is for log data, not metrics. Option E is wrong because CloudWatch Events is for scheduling or event patterns, but not for metric alarms.

The ALB returns 200 OK for all requests, so the origin itself is not failing. However, HTTP 504 errors from CloudFront typically indicate that the origin (ALB) is not responding within CloudFront's timeout window. The ALB's idle timeout (default 60 seconds) can cause the ALB to close idle connections, while CloudFront's origin timeout (default 30 seconds) is separate.

If the ALB's idle timeout is shorter than the time CloudFront waits for a response, the ALB may close the connection before CloudFront receives the full response, leading to a 504. Option D directly addresses this mismatch.

Option D is correct because the issue is a connection spike that exceeds the max_connections parameter. Using a CloudWatch alarm on 'DatabaseConnections' to invoke a Lambda function that modifies the DB parameter group (requires reboot or apply immediately) can increase the limit. Option A is wrong because scaling storage does not increase max_connections.

Option B is wrong because Multi-AZ is for high availability, not scaling connections. Option C is wrong because RDS Proxy manages connection pooling but does not change the max_connections limit; it would have been a preventive measure.

Option B is correct because increasing DynamoDB write capacity reduces throttling. Option D is correct because reducing the batch size lowers the number of writes per invocation. Option A is wrong because Lambda concurrency is not the issue; DynamoDB is throttling.

Option C is wrong because DynamoDB Streams is required for the trigger; disabling it stops the trigger. Option E is wrong because enabling DynamoDB Accelerator (DAX) is for reads, not writes.

Option C is correct because creating a CloudFront invalidation removes cached objects from edge locations. Option A is wrong because TTL settings affect how long content is cached, but invalidation is immediate. Option B is wrong because invalidating the entire distribution is not necessary; a path-specific invalidation works.

Option D is wrong because changing S3 bucket policy does not affect cache.

Option A is correct because adding the instance to an Auto Scaling group with a scaling policy to launch additional instances can handle increased load. Option B is wrong because rebooting causes downtime and does not address the root cause of high CPU. Option C is wrong because increasing the instance size manually requires a stop and start, causing downtime.

Option D is wrong because creating a new AMI and launching a new instance is time-consuming and not immediate.

Option B is correct because ALB health checks have a configurable timeout; if the response takes longer than the timeout, the health check fails, causing 503 errors. Option A is wrong because security groups typically do not cause intermittent failures. Option C is wrong because the application is running, so it is not crashing.

Option D is wrong because scaling policies do not directly cause 503 errors.

Option B is correct because CloudTrail event history includes the sourceIPAddress field in the event record, which directly provides the IP address from which the API call was made. Option A is wrong because CloudTrail Insights detects unusual activity but does not provide the IP address for individual events. Option C is wrong because CloudTrail Lake is used for aggregating and querying trails but the source IP is still found in the event record.

Option D is wrong because S3 server access logs are separate from CloudTrail and do not capture IAM user activity.

Option A is correct because creating an organization trail in the management account will automatically apply to all accounts. Option B is correct because enabling CloudTrail on the S3 bucket ensures logs are delivered. Option D is correct because SCP can deny the ability to create or modify trails, preventing member accounts from creating separate trails.

Option C is wrong because disabling CloudTrail in member accounts is manual and not scalable. Option E is wrong because Config rules can detect but not prevent.

Option A is correct because the Deny statement explicitly denies PutObject if encryption is not AES256. The Allow statement only allows if AES256 is specified. Since no encryption is specified, the condition in the Deny statement (StringNotEquals AES256) is true, causing a deny.

Option B is wrong because the Allow statement's condition is not met, so it does not grant permission. Option C is wrong because the Deny statement explicitly matches the condition. Option D is wrong because explicit Deny overrides Allow.

Option B is correct because a rollback failure indicates that CloudFormation could not undo some changes. Continuing the rollback process or manually fixing the resource allows the stack to reach a consistent state. Option A is wrong because deleting the stack may cause data loss.

Option C is wrong because ignoring may leave the stack in an inconsistent state. Option D is wrong because updating again may compound the issue.

Option A (CloudWatch) provides metrics and alarms. Option D (X-Ray) provides tracing for latency. Option B is wrong because CloudTrail records API calls but not latency.

Option C is wrong because Config monitors configuration changes. Option E is wrong because GuardDuty is for security threats.

Option C is correct because the alarm action is 'ec2:recover', which initiates instance recovery. Option A is wrong because the action is recover, not reboot. Option B is wrong because the alarm does not stop the instance.

Option D is wrong because the alarm evaluates every 60 seconds, not 2 minutes as a total period.

Options A, B, and D are correct. A is correct because AWS CloudTrail logs S3 API calls including GetObject. B is correct because S3 server access logs provide detailed object-level access logs including requester, IP, and object key.

D is correct because Amazon Athena can query both CloudTrail logs and S3 access logs efficiently. Option C is wrong because AWS Config records resource configuration, not data access. Option E is wrong because VPC Flow Logs capture network traffic but not S3 object-level access.

Option C is correct because Amazon Macie uses machine learning to discover, classify, and protect sensitive data, and it can alert on public buckets. Option A is wrong because AWS Trusted Advisor checks for public buckets but does not provide real-time alerts. Option B is wrong because S3 Block Public Access is a preventive control, not detective.

Option D is wrong because AWS Config can track bucket policies but does not automatically alert on public access.

Option A is correct because health checks are failing, causing the ALB to stop sending traffic to those instances, which results in 503 errors. The CPU utilization might be low because the unhealthy instances are not receiving traffic. Option B is wrong because if the scaling policy were too aggressive, you'd see more instances and possibly lower CPU, not 503 errors.

Option C is wrong because connection draining does not cause health check failures. Option D is wrong because the application itself is failing health checks, not the ALB configuration.

Option A is correct because increasing timeout may allow the function to complete. Option D is correct because CloudWatch Logs show execution details and errors. Option B is wrong because memory allocation doesn't directly affect timeout.

Option C is wrong because VPC configuration is not directly related to timeout unless network issues. Option E is wrong because reserved concurrency affects scaling, not timeout.

Option B is correct because a high SurgeQueueLength indicates that the ALB is receiving more requests than the instances can handle, and the queue is filling up, leading to 503 errors when the queue overflows. Option A is wrong because unhealthy hosts would cause errors but not necessarily an increasing queue. Option C is wrong because a misconfigured security group would block traffic entirely.

Option D is wrong because an SSL certificate issue would cause TLS errors, not 503.

Option C is correct because Point-in-Time Restore (PITR) allows restoring to any time within the backup retention period, down to the second. Option A is wrong because a manual snapshot from before the deletion would need to be created, which is slower. Option B is wrong because the binlog contains changes, but replaying requires manual effort and is not the fastest AWS-native method.

Option D is wrong because RDS does not have a native 'undo' feature.

Option B is correct because the account-level Lambda concurrency limit may be reached. Increasing reserved concurrency for one function reduces the pool available for others. Option A is wrong because SQS batch size does not cause throttling.

Option C is wrong because SQS polling interval is controlled by Lambda. Option D is wrong because IAM permissions would cause access denied errors, not throttling.

Option A is correct because high CPU utilization can cause the CloudWatch agent to miss its scheduled batch upload, leading to log loss. Option B is wrong because disk space issues would cause different symptoms (disk full errors). Option C is wrong because the log group retention does not cause missing logs.

Option D is wrong because network bandwidth, while possible, is less likely than CPU starvation given the high CPU utilization.

Option B is correct because RDS performance insights can show database load and identify if connections are being dropped. Option E is correct because checking the RDS error log can reveal connection-related errors. Option A is wrong because increasing max_connections may not help if the issue is resource contention.

Option C is wrong because enabling Multi-AZ does not fix connection resets. Option D is wrong because security group changes are unlikely to be the cause of intermittent resets.

Option A is correct because Amazon RDS Proxy provides connection pooling and can direct read/write traffic appropriately. Option B is wrong because it requires code changes. Option C is wrong because there is no such thing as a read-only endpoint for a Multi-AZ cluster.

Option D is wrong because it does not offload read traffic.

Option B is correct because by default, CloudFront does not invalidate objects in edge locations immediately; invalidation requests can take minutes to complete. Also, users may be hitting a different edge location that still has cached content. Option A is wrong because S3 bucket policies do not affect cache.

Option C is wrong because TTL settings affect how long content is cached, but invalidation should override that. Option D is wrong because the origin is S3, not an ALB.