Courseiva

CCNA Incident Response Questions

75 of 254 questions · Page 3/4 · Incident Response topic · Answers revealed

Practice these questionsExam hubAll questions
151
MCQmedium

A company uses AWS CloudFormation to manage infrastructure. During a deployment, a stack update fails and the stack is in ROLLBACK_IN_PROGRESS state. The DevOps engineer needs to investigate the failure while preserving the resources that were created before the failure. What should the engineer do?

A.Delete the stack to start fresh.
B.Use the 'describe-stack-events' API to view the error and then manually fix the issue.
C.Call the 'cancel-update' API to stop the rollback and keep the current state.
D.Use the 'continue-update-rollback' API with the 'resources-to-skip' parameter to skip the failing resource.
AnswerD

This allows the rollback to continue while preserving the specified resources.

Why this answer

Option D is correct because using 'continue update rollback' with the 'resources to skip' parameter allows the engineer to skip specific resources and preserve them while continuing the rollback for others. Option A is wrong because deleting the stack removes all resources. Option B is wrong because 'describe stack events' provides information but does not prevent the rollback from continuing.

Option C is wrong because 'cancel update' is not a valid operation; CloudFormation does not support canceling a rollback.

Practice this question →
152
Multi-Selecthard

A company uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is experiencing intermittent HTTP 503 errors. The DevOps team needs to diagnose the cause. Which THREE of the following should the team investigate? (Choose THREE.)

Select 3 answers
A.Security group inbound rules for the ALB
B.SSL certificate expiration on the ALB
C.Auto Scaling group minimum capacity and scaling policy
D.ALB idle timeout settings
E.Health check configuration and target group health status
AnswersC, D, E

Not enough instances can cause 503.

Why this answer

Option A is correct because if the instances are unhealthy, the ALB returns 503. Option C is correct because insufficient instances cannot handle the load. Option E is correct because idle timeout can cause premature connection closure leading to 503.

Option B is wrong because SSL certificate issues cause 502 or 400 errors. Option D is wrong because security group inbound rules affect access, but 503 is from ALB, not the client.

Practice this question →
153
MCQhard

An application running on Amazon ECS with Fargate is experiencing increased latency. The DevOps team suspects that the task is running out of memory and swapping. Which set of CloudWatch metrics should the team examine to confirm this suspicion?

A.NetworkIn and NetworkOut
B.MemoryUtilized and MemoryReserved
C.CPUUtilization and CPUReservation
D.EphemeralStorageUtilized and EphemeralStorageReserved
AnswerB

These metrics show memory usage; high utilization may cause swapping.

Why this answer

Option B is correct because MemoryUtilized and MemoryReserved are the CloudWatch metrics that directly track memory consumption and allocation for ECS tasks using Fargate. When a task runs out of memory, the Linux kernel’s OOM killer may terminate processes, but before that, swapping can occur if swap space is available, causing increased latency. These metrics allow the DevOps team to compare actual memory usage against the task’s memory reservation, confirming if memory pressure is the root cause of the latency.

Exam trap

The trap here is that candidates may confuse memory metrics with CPU or storage metrics, assuming any resource constraint can cause swapping, but only memory metrics directly indicate memory exhaustion and potential swapping behavior.

How to eliminate wrong answers

Option A is wrong because NetworkIn and NetworkOut measure network throughput, not memory usage or swapping, so they cannot confirm memory exhaustion. Option C is wrong because CPUUtilization and CPUReservation track CPU usage and reservation, which are unrelated to memory swapping; high CPU could cause latency but does not indicate memory pressure. Option D is wrong because EphemeralStorageUtilized and EphemeralStorageReserved measure storage usage on the Fargate ephemeral volume, not memory consumption; swapping would involve memory, not ephemeral storage.

Practice this question →
154
MCQhard

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

A.The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.
B.The security group for the EC2 instance does not allow outbound traffic to the RDS instance.
C.The EC2 instance does not have the correct IAM instance profile attached.
D.The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.
AnswerD

A is correct because the access denied error indicates the trust relationship is missing.

Why this answer

The error indicates that the EC2 instance's IAM role 'EC2-AppRole' cannot authenticate to the RDS instance. IAM database authentication requires the EC2 instance to assume a database authentication token, which is generated by calling the RDS API with the 'EC2-AppRole' credentials. However, the RDS instance's resource-based policy only allows 'DatabaseAccessRole' to connect.

For 'EC2-AppRole' to successfully authenticate, it must first assume 'DatabaseAccessRole' via a trust policy that permits the EC2 instance role to assume it. Without this trust relationship, the authentication token request fails, causing the error.

Exam trap

The trap here is that candidates often assume the error is due to missing resource-based policies or network connectivity, but the core issue is the missing trust relationship between the EC2 instance role and the database access role, which is a common misconfiguration in cross-account or cross-role IAM authentication setups.

How to eliminate wrong answers

Option A is wrong because the RDS instance does have a resource-based policy that allows 'DatabaseAccessRole' to connect, as stated in the question; the issue is that the EC2 instance role cannot assume that role. Option B is wrong because security group rules control network traffic, not IAM authentication; if the security group were blocking outbound traffic, the error would be a network timeout or connection refused, not an IAM authentication failure. Option C is wrong because the EC2 instance is already associated with the IAM role 'EC2-AppRole' (the instance profile is attached), and the error is about assuming another role, not about the instance lacking a role.

Practice this question →
155
MCQhard

A Lambda function has the above IAM policy attached. The function is failing to write logs to CloudWatch Logs. What is the most likely reason?

A.The policy does not include the 'logs:PutLogEvents' action.
B.The policy does not allow 'ec2:DescribeInstances' on a specific resource.
C.The log group ARN in the resource does not match the Lambda function's log group.
D.The Lambda function does not have permission to use the KMS key for log encryption.
AnswerC

The resource ARN restricts access to a specific log group; if the function uses a different log group, it fails.

Why this answer

Option B is correct because the Resource ARN in the policy specifies a specific log group name pattern, but if the function is configured to write to a different log group (e.g., /aws/lambda/other-function), access will be denied. Option A is wrong because the actions are correct for writing logs. Option C is wrong because the ec2:DescribeInstances permission is irrelevant to logging.

Option D is wrong because there is no encryption key specified in the policy.

Practice this question →
156
MCQmedium

A company uses an Auto Scaling group with a dynamic scaling policy based on a custom CloudWatch metric. After a recent deployment, the metric spikes unexpectedly, causing the Auto Scaling group to launch several EC2 instances. The operations team wants to quickly determine whether the spike was caused by a real load increase or a deployment issue. What is the MOST efficient way to investigate this?

A.Check the SNS topic that the scaling policy publishes to for notifications.
B.Use CloudWatch Logs Insights to query application logs for error patterns or deployment markers that coincide with the metric spike.
C.Use AWS CloudTrail to review API calls that modified the scaling policy.
D.Temporarily disable the scaling policy and manually increase the desired capacity to handle the load.
AnswerB

CloudWatch Logs Insights allows querying logs to find patterns related to the spike.

Why this answer

Option B is correct because CloudWatch Logs Insights allows you to query application logs for error patterns or deployment markers (e.g., new version tags, exception stack traces) that coincide with the metric spike. This directly correlates the scaling event with application-level evidence, enabling rapid root-cause analysis without altering infrastructure or relying on indirect notifications.

Exam trap

The trap here is that candidates confuse monitoring scaling actions (SNS/CloudTrail) with diagnosing the metric's root cause, overlooking that application logs provide the direct evidence needed to distinguish real load from deployment issues.

How to eliminate wrong answers

Option A is wrong because SNS topics used by scaling policies only send notifications about scaling actions (e.g., instance launched), not the underlying cause of the metric spike; they lack application-level context. Option C is wrong because AWS CloudTrail records API calls that modify the scaling policy (e.g., PutScalingPolicy), but the metric spike itself is not an API call—it is a CloudWatch metric data point, so CloudTrail cannot show why the metric changed. Option D is wrong because temporarily disabling the scaling policy and manually increasing desired capacity is a reactive workaround that does not investigate the root cause; it masks the symptom and risks over-provisioning or missing a deployment bug.

Practice this question →
157
Multi-Selecthard

During an incident, a DevOps engineer needs to block traffic from a specific IP address that is attacking an Application Load Balancer. Which TWO actions can the engineer take to mitigate this?

Select 2 answers
A.Configure Amazon CloudFront to block the IP address.
B.Modify the network ACL for the ALB's subnet to deny the IP address.
C.Use AWS WAF to create an IP set rule that blocks the IP address.
D.Enable VPC Flow Logs to capture traffic from the IP address.
E.Update the ALB security group to deny inbound traffic from the IP address.
AnswersC, E

AWS WAF integrates with ALB to filter requests based on IP.

Why this answer

Option B is correct because updating the security group of the ALB to deny the IP is effective. Option D is correct because AWS WAF can block IPs based on a rule. Option A is wrong because NACLs are for subnets, not ALBs directly.

Option C is wrong because CloudFront is a CDN layer, not directly applicable. Option E is wrong because VPC Flow Logs are for monitoring, not blocking.

Practice this question →
158
MCQmedium

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The engineer checks CloudWatch metrics and sees a CPU Utilization spike to 100% just before the instance became unresponsive. However, the instance status check passed. What should the engineer do NEXT to troubleshoot the issue?

A.Use the EC2 Serial Console to connect to the instance and diagnose the issue.
B.Terminate the instance and launch a new one from the same AMI.
C.Review CloudWatch Logs for the instance to identify any application errors.
D.Increase the instance size and restart the instance.
AnswerA

The serial console provides out-of-band access to the instance for troubleshooting OS-level problems.

Why this answer

Option D is correct because the instance is unresponsive but status check passes, indicating an OS-level issue. The serial console can be used to troubleshoot kernel hangs or high load. Option A is wrong because increasing instance size only helps if resource exhaustion is the root cause, but the instance is already unresponsive.

Option B is wrong because the status check passed, so replacing the instance without investigation may lose data. Option C is wrong because CloudWatch Logs are helpful but do not give interactive access to a hung instance.

Practice this question →
159
MCQhard

A company uses AWS CloudFormation to manage infrastructure. After a failed stack update, the stack is in ROLLBACK_COMPLETE state. The DevOps team needs to identify the specific resource that caused the rollback and review the error message. Which approach provides the most efficient way to achieve this?

A.Run describe-stack-events and filter by status.
B.View the Events tab in the AWS CloudFormation console.
C.Check AWS CloudTrail for the UpdateStack API call.
D.Run describe-stack-resources to list all stack resources.
AnswerB

Provides a clear view of all events and errors.

Why this answer

Option C is correct because the CloudFormation console Events tab lists all stack events, including the failure reason and resource that caused the rollback. Option A is wrong because describe-stack-resources shows resources but not error details. Option B is wrong because describe-stack-events includes the error message.

Option D is wrong because CloudTrail logs API calls but does not directly show CloudFormation resource errors in an aggregated view.

Practice this question →
160
MCQhard

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the DevOps engineer notices that some users are being logged out and losing session data. The deployment uses a rolling update strategy. What is the MOST likely cause?

A.The Auto Scaling group is terminating instances before the new ones are fully ready.
B.The health check interval is too long, causing the ALB to route traffic to unhealthy instances.
C.The ALB sticky session cookie is not being generated correctly.
D.The session data is stored locally on the EC2 instance, not in a shared external store.
AnswerD

When the instance is terminated, local session data is lost, causing users to be logged out.

Why this answer

Option D is correct because during a rolling update, old instances are terminated and new instances are launched. Sticky sessions are tied to a specific instance; when that instance is terminated, the user's session is lost if it is not shared externally. Option A is wrong because the ALB configuration remains unchanged.

Option B is wrong because health checks are not the direct cause. Option C is wrong because Auto Scaling is not involved unless explicitly configured.

Practice this question →
161
Multi-Selecthard

A company runs a critical application on Amazon ECS with Fargate launch type. The application is experiencing intermittent failures due to resource exhaustion. The DevOps team wants to implement automated responses to scale the service. Which THREE steps should the team take to achieve this? (Choose THREE.)

Select 3 answers
A.Create an AWS Lambda function to manually update the service.
B.Create a CloudWatch alarm based on CPU or memory utilization.
C.Configure EC2 Auto Scaling group for the cluster.
D.Use Application Auto Scaling to define a scaling policy.
E.Configure the ECS service to use auto scaling.
AnswersB, D, E

Alarms trigger scaling actions when thresholds are breached.

Why this answer

Option A, Option D, and Option E are correct. Creating a CloudWatch alarm on a metric like CPU or memory triggers scaling. Application Auto Scaling adjusts the desired count of tasks based on the alarm.

The service auto scaling configuration is necessary to define the min/max tasks and scaling policies. Option B is wrong because ECS Cluster Auto Scaling is for EC2 launch type, not Fargate. Option C is wrong because Lambda for scaling is unnecessary and not a best practice.

Practice this question →
162
MCQmedium

A DevOps engineer is investigating a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The engineer needs to determine what actions the user performed and from which IP address. Which AWS service should be used to retrieve this information?

A.AWS CloudTrail management events.
B.Amazon Inspector findings.
C.Amazon S3 server access logs.
D.Amazon CloudWatch Logs for the S3 bucket.
AnswerC

S3 server access logs capture detailed request information.

Why this answer

Option A is correct because S3 server access logs provide detailed records of requests made to a bucket, including requester, IP address, and action. Option B is wrong because CloudTrail logs API calls made by users or roles, but for S3 object-level operations, it must be specifically enabled for data events. Option C is wrong because CloudWatch Logs can store logs but are not the source of S3 access logs.

Option D is wrong because Amazon Inspector is for vulnerability assessments, not logging.

Practice this question →
163
MCQhard

An EC2 instance is in 'running' state according to the CLI output, but the application hosted on it is unreachable. The DevOps engineer checks the security group and finds it allows inbound HTTP traffic from 0.0.0.0/0. The instance has a public IP. What is the MOST likely issue?

A.The network ACL is blocking inbound HTTP traffic.
B.The instance does not have a public IP address assigned.
C.The security group is attached to the instance but does not allow inbound HTTP.
D.The instance's OS firewall (e.g., iptables) is blocking the traffic.
AnswerD

OS-level firewalls can block traffic even if security groups allow it.

Why this answer

Option D is correct because the instance's operating system may have a firewall (e.g., iptables) blocking inbound traffic. Option A is wrong because the instance has a public IP. Option B is wrong because security groups are stateful and allow return traffic.

Option C is wrong because the security group allows all inbound HTTP.

Practice this question →
164
Multi-Selecteasy

Which TWO metrics should a DevOps engineer monitor to detect an EC2 instance that is unresponsive due to resource exhaustion?

Select 2 answers
A.StatusCheckFailed
B.MemoryUtilization
C.DiskReadOps
D.CPUUtilization
E.NetworkIn
AnswersB, D

High memory utilization can lead to swapping and unresponsiveness.

Why this answer

Options B and D are correct. CPUUtilization and MemoryUtilization (if enabled) are key indicators of resource exhaustion. Option A is incorrect because DiskReadOps alone does not indicate exhaustion.

Option C is incorrect because NetworkIn alone is not a resource exhaustion metric. Option E is incorrect because StatusCheckFailed indicates instance health issues but not specifically resource exhaustion.

Practice this question →
165
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

A.The upload succeeds without encryption.
B.The upload succeeds with SSE-S3 encryption.
C.The upload succeeds and is automatically encrypted with SSE-S3.
D.The upload fails with an Access Denied error.
AnswerD

Policy requires encryption.

Why this answer

Option A is correct because the policy requires encryption, so the upload will fail with Access Denied. Option B is wrong because the condition requires encryption. Option C is wrong because SSE-S3 uses AES256, but the condition requires it to be set explicitly.

Option D is wrong because the policy does not allow unencrypted uploads.

Practice this question →
166
MCQeasy

A DevOps engineer is troubleshooting an AWS Lambda function that is intermittently timing out. The function is configured with a 3-second timeout and 128 MB memory. The function processes messages from an SQS queue. What is the most cost-effective change to reduce timeouts?

A.Increase the SQS batch size to 20
B.Increase the function timeout to 10 seconds
C.Increase the function memory to 256 MB
D.Set reserved concurrency to 10
AnswerC

More memory provides more CPU, reducing execution time.

Why this answer

Increasing the memory to 256 MB is the most cost-effective change because Lambda allocates CPU proportionally to memory, so doubling the memory from 128 MB to 256 MB also doubles the CPU performance. This reduces execution time, which can resolve timeouts without increasing the timeout duration, and since Lambda billing is based on compute time (GB-seconds), the total cost may stay the same or even decrease if the function finishes faster.

Exam trap

The trap here is that candidates assume increasing the timeout is the only way to fix timeouts, but AWS explicitly recommends increasing memory as a cost-effective performance tuning method because it also increases CPU, which can reduce execution time and thus avoid timeouts without increasing cost.

How to eliminate wrong answers

Option A is wrong because increasing the SQS batch size to 20 would cause the Lambda function to process more messages per invocation, increasing the workload and likely worsening timeouts rather than fixing them. Option B is wrong because increasing the function timeout to 10 seconds does not address the root cause of slow execution; it only masks the symptom and could increase costs if the function still runs longer. Option D is wrong because setting reserved concurrency to 10 limits the number of concurrent executions but does not improve the performance of a single invocation, so it would not reduce timeouts.

Practice this question →
167
MCQmedium

A company uses AWS Systems Manager to manage a fleet of EC2 instances. During an incident, a DevOps engineer needs to execute a script on a specific instance to collect diagnostic data. The engineer does not have SSH key access. Which approach should the engineer use to execute the script?

A.Use AWS Systems Manager Run Command to execute the script.
B.Use AWS OpsWorks to run the script as a Chef recipe.
C.Use EC2 Instance Connect to SSH into the instance and run the script.
D.Use AWS Systems Manager Session Manager to open a shell and run the script.
AnswerA

Run Command can execute scripts without SSH, using SSM Agent.

Why this answer

Option C is correct because AWS Systems Manager Run Command can execute scripts on EC2 instances without requiring SSH or RDP access, using the SSM Agent. Option A is wrong because AWS OpsWorks requires an agent and is typically used for Chef/Puppet. Option B is wrong because EC2 Instance Connect requires SSH key and port 22.

Option D is wrong because SSM Session Manager is for interactive sessions, not script execution triggered as a command.

Practice this question →
168
MCQhard

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent connection timeouts when calling an external API. The engineer needs to capture network traffic to diagnose the issue. Which solution is most appropriate?

A.Enable detailed CloudWatch Logs for the ECS task.
B.Enable VPC Flow Logs on the ECS task's elastic network interface.
C.Enable AWS X-Ray tracing on the ECS task.
D.Run tcpdump on the EC2 instance hosting the ECS task.
AnswerB

VPC Flow Logs capture network metadata to diagnose connectivity issues.

Why this answer

Option D is correct because VPC Flow Logs capture network traffic metadata at the ENI level, which can be analyzed to identify dropped packets or timeouts. Option A is wrong because AWS X-Ray traces requests but does not capture raw network packets. Option B is wrong because CloudWatch Logs does not capture network traffic.

Option C is wrong because EC2 instances are not used with Fargate.

Practice this question →
169
MCQeasy

An Amazon RDS for PostgreSQL instance is running low on storage. The DevOps engineer needs to increase the allocated storage without downtime. Which action should be taken?

A.Modify the DB instance to a larger instance class.
B.Modify the DB instance to increase the allocated storage.
C.Create a snapshot of the DB instance and restore it with larger storage.
D.Launch a new read replica with larger storage and promote it.
AnswerB

Can be done without downtime.

Why this answer

Option B is correct because RDS supports modifying storage settings without downtime; the change is applied during the next maintenance window or immediately if the 'Apply Immediately' option is selected. Option A is wrong because taking a snapshot and restoring would cause downtime. Option C is wrong because you cannot add storage to an existing instance in a different way; you must modify the DB instance.

Option D is wrong because modifying the DB instance class does not increase storage.

Practice this question →
170
MCQmedium

A company uses AWS CloudTrail to log API events. During an incident investigation, they need to identify who deleted an S3 bucket. Which CloudTrail feature should be used to retrieve the event details quickly?

A.CloudTrail log file integrity validation
B.CloudTrail Lake
C.CloudTrail Event history
D.CloudTrail Insights
AnswerC

Provides 90 days of management events with user identity details.

Why this answer

CloudTrail Event history provides a view of the last 90 days of management events for each AWS region, allowing you to quickly search and filter by resource name (e.g., the S3 bucket name) and event name (e.g., DeleteBucket). This feature is designed for rapid retrieval of recent API activity without needing to query S3 or set up additional infrastructure, making it the fastest option for identifying who deleted an S3 bucket during an incident investigation.

Exam trap

The trap here is that candidates often confuse CloudTrail Insights (which detects unusual activity) with the ability to search for specific past events, or they overcomplicate the solution by choosing CloudTrail Lake when Event history provides the quickest and simplest retrieval for recent events.

How to eliminate wrong answers

Option A is wrong because CloudTrail log file integrity validation is a feature that uses SHA-256 hashing and digital signatures to verify that log files have not been tampered with after delivery; it does not help retrieve or search event details. Option B is wrong because CloudTrail Lake is an analytical data store for running SQL queries on historical events, but it requires configuration and ingestion time, making it slower than Event history for a quick lookup of recent events. Option D is wrong because CloudTrail Insights identifies unusual API activity and potential security threats by analyzing write management events, but it does not provide a direct searchable list of all events or the specific details of who deleted a bucket.

Practice this question →
171
MCQmedium

A company experiences an EC2 instance failure in an Auto Scaling group. The instance is terminated and replaced automatically. The DevOps engineer needs to troubleshoot why the instance failed. Which AWS service should the engineer use to view the instance's console output and screenshots before termination?

A.AWS CloudTrail
B.Amazon CloudWatch Logs
C.AWS Systems Manager Session Manager
D.AWS Config
AnswerC

Session Manager can retrieve EC2 console output and screenshots.

Why this answer

Option B is correct because AWS Systems Manager Session Manager can be used to retrieve EC2 console output and screenshots. Option A (CloudWatch Logs) does not capture console output by default. Option C (CloudTrail) records API calls, not instance-level console output.

Option D (Config) is for configuration compliance, not troubleshooting instance failures.

Practice this question →
172
MCQhard

A Lambda function 'my-function' is invoked multiple times, but no logs appear in CloudWatch. The DevOps engineer runs the above CLI command and sees that the log group exists but 'storedBytes' is 0. What is the MOST likely cause?

A.The Lambda function is invoked too frequently, causing CloudWatch to throttle log ingestion.
B.The log group's retention policy of 7 days deletes logs immediately after creation.
C.The Lambda execution role lacks permissions to create log streams and put log events.
D.The Lambda function does not have a log group; the one shown belongs to another resource.
AnswerC

Missing CloudWatch Logs permissions is a common cause of no logs.

Why this answer

Option D is correct because the Lambda function's execution role must have permissions to create log streams and put log events. Without these permissions, the function cannot write logs. Option A is wrong because log groups with 0 storedBytes indicate no logs were written, not that there are too many.

Option B is wrong because the retention policy does not prevent log creation. Option C is wrong because Lambda automatically creates log groups when logging is configured properly.

Practice this question →
173
MCQhard

An application running on Amazon ECS (Fargate) experiences intermittent HTTP 503 errors. The application uses an Application Load Balancer. The ECS service has a desired count of 2. CPU and memory utilization are below 50%. What is the most likely cause?

A.The ECS service Auto Scaling is too aggressive.
B.The target group health check threshold is set too low.
C.The ALB listener rule is misconfigured.
D.The task definition has an incorrect memory hard limit.
AnswerB

A low threshold may mark healthy instances as unhealthy, causing 503 errors.

Why this answer

Intermittent HTTP 503 errors from an Application Load Balancer (ALB) typically indicate that the target group health checks are failing, causing the ALB to stop routing traffic to the affected tasks. With a desired count of 2 and low CPU/memory utilization, the most likely cause is a health check threshold set too low (e.g., a low unhealthy threshold count), which makes the ALB prematurely mark tasks as unhealthy during transient issues, leading to no healthy targets and 503 responses. This aligns with the symptom of intermittent errors, as tasks may briefly fail a health check but recover quickly, yet the low threshold causes them to be deregistered.

Exam trap

The trap here is that candidates often attribute 503 errors to resource exhaustion (CPU/memory) or scaling issues, but the question explicitly states low utilization, forcing you to focus on health check configuration as the root cause of intermittent availability.

How to eliminate wrong answers

Option A is wrong because aggressive Auto Scaling would typically cause rapid scaling events, not intermittent 503 errors, and with CPU/memory below 50%, there is no resource pressure to trigger scaling. Option C is wrong because a misconfigured ALB listener rule would cause persistent routing failures (e.g., 404 or 502 errors) for specific paths or hosts, not intermittent 503 errors across all requests. Option D is wrong because an incorrect memory hard limit in the task definition would cause the ECS task to be killed (OOMKilled) or fail to start, resulting in consistent 503 errors or task failures, not intermittent ones.

Practice this question →
174
MCQhard

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function sometimes fails due to a transient error in a downstream API. The DevOps engineer wants to ensure that failed messages are retried automatically and eventually sent to a dead-letter queue after 3 failed attempts. The SQS queue is configured with a redrive policy that moves messages to a DLQ after 3 receive attempts. However, Lambda functions that fail are not being retried. What is the MOST likely reason?

A.The batch size is set to 1, preventing retries.
B.The visibility timeout is set too low, causing messages to be retried immediately.
C.The event source mapping has 'MaximumRetryAttempts' set to 0.
D.The dead-letter queue is not configured on the Lambda function.
AnswerC

Setting MaximumRetryAttempts to 0 disables retries by Lambda, so the function is invoked only once per message.

Why this answer

Option D is correct because by default, if a Lambda function fails, the SQS queue treats the message as received and increments the receive count. If the function does not delete the message and returns an error, the message becomes visible again after the visibility timeout. However, if the function returns an error, Lambda will automatically retry the invocation up to 2 times (for a total of 3 attempts) based on the function's retry policy.

But if the function is configured with 'MaximumRetryAttempts' set to 0 in its event source mapping, then no retries will occur. The question states that the SQS redrive policy should handle retries after 3 receive attempts, but if the Lambda function is not retrying, it's likely because the event source mapping's 'MaximumRetryAttempts' is set to 0. Option A is wrong because DLQ is configured on the SQS queue, not Lambda.

Option B is wrong because the visibility timeout affects when the message becomes visible again, but if the function fails, the message will be retried based on the event source mapping settings. Option C is wrong because the batch size does not affect retries.

Practice this question →
175
Multi-Selecteasy

A DevOps engineer is setting up an incident response system for a critical application. The engineer needs to ensure that notifications are sent to the appropriate team when specific CloudWatch alarms trigger. Which TWO services can be used to trigger notifications based on CloudWatch alarms? (Choose TWO.)

Select 2 answers
A.AWS Systems Manager
B.Amazon Simple Notification Service (SNS)
C.Amazon Simple Queue Service (SQS)
D.AWS Chatbot
E.AWS Lambda
AnswersB, D

SNS can send emails, SMS, etc.

Why this answer

Option A is correct because SNS can be directly subscribed to CloudWatch alarms. Option D is correct because Chatbot can integrate with SNS to send messages to chat channels. Option B is wrong because Lambda is not a notification endpoint.

Option C is wrong because SQS is not a notification delivery service. Option E is wrong because SSM is for management.

Practice this question →
176
Multi-Selectmedium

A company uses AWS Systems Manager Patch Manager to patch its EC2 instances. After a patch window, some instances report a 'Failed' status. The DevOps engineer needs to investigate the cause. Which actions should be taken? (Choose three.)

Select 3 answers
A.Check the S3 bucket where Patch Manager logs are stored for detailed error messages.
B.Use the Systems Manager Patch Manager dashboard to view the compliance status for each patch.
C.Review CloudTrail logs for the RunCommand API calls.
D.Verify that the SSM Agent is running and up to date on the failed instances.
E.Use AWS Config to check the configuration history of the instances.
AnswersA, B, D

Patch Manager writes logs to S3.

Why this answer

Option A is correct because Patch Manager logs to S3; checking logs helps identify failures. Option B is correct because Systems Manager requires the SSM Agent to be running and updated. Option D is correct because each patch has a status in the compliance report.

Option C is wrong because CloudTrail is for API activity, not patch details. Option E is wrong because AWS Config shows resource configurations, not patch failures.

Practice this question →
177
MCQmedium

A DevOps engineer notices that an EC2 instance is unresponsive and the CloudWatch alarm 'StatusCheckFailed' is in ALARM state. The instance was launched in a private subnet with no public IP. Which action should the engineer take to diagnose the issue without creating a new instance?

A.Modify the security group to allow SSH from the engineer's IP.
B.Use AWS Systems Manager Session Manager to start a session.
C.Check AWS Personal Health Dashboard for instance issues.
D.Use EC2 Serial Console to connect to the instance.
AnswerD

EC2 Serial Console provides out-of-band access for troubleshooting.

Why this answer

Option A is correct because EC2 Serial Console provides out-of-band access to the instance console, useful for troubleshooting OS-level issues even when network connectivity is lost. Option B is wrong because Systems Manager Session Manager requires the instance to have connectivity to the Systems Manager endpoint and the agent running. Option C is wrong because AWS Personal Health Dashboard provides service health notifications, not instance-level troubleshooting.

Option D is wrong because modifying the security group to allow SSH on port 22 does not help if the instance is unresponsive at the OS level.

Practice this question →
178
MCQmedium

A company has a serverless application using AWS Lambda functions and Amazon API Gateway. The application has been running fine, but recently users report that some requests are timing out with a 504 error. The Lambda function's timeout is set to 30 seconds, and API Gateway's integration timeout is 29 seconds. The CloudWatch logs for the Lambda function show that the function executes in under 5 seconds on average. What is the MOST likely cause of the 504 errors?

A.The Lambda function is logging too much data, causing delays in log delivery.
B.API Gateway's timeout is set to less than the Lambda function's timeout.
C.The Lambda function is experiencing concurrency limits and requests are being throttled.
D.The Lambda function's memory is too low, causing cold starts to take longer than the timeout.
AnswerC

Throttled requests cause API Gateway to wait and time out.

Why this answer

Option B is correct because if the Lambda function is throttled, API Gateway will wait for a response and eventually time out. Option A is wrong because the logs are being produced. Option C is wrong because the function execution is fast.

Option D is wrong because the timeout is adequate.

Practice this question →
179
MCQmedium

A company uses AWS CloudTrail to monitor API activity. During an incident, they need to quickly identify any unauthorized IAM role assumption attempts. Which CloudTrail feature should be used to filter and alert on this specific event?

A.Configure VPC Flow Logs to capture traffic to the IAM endpoint.
B.Use S3 event notifications on the CloudTrail bucket for PutObject events.
C.Set up a CloudWatch Logs metric filter on the CloudTrail log group for 'AssumeRole' events.
D.Enable CloudTrail Insights to detect anomalous AssumeRole events.
AnswerD

CloudTrail Insights uses machine learning to detect unusual patterns in management events.

Why this answer

Option A is correct because CloudTrail Insights identifies unusual API activity like role assumption anomalies. Option B is wrong because CloudWatch Logs filters would require manual setup. Option C is wrong because S3 event notifications are for object-level events.

Option D is wrong because VPC Flow Logs track network traffic, not API calls.

Practice this question →
180
Multi-Selecteasy

A DevOps engineer is troubleshooting an issue where an EC2 instance in a private subnet cannot reach the internet. The instance has a route to a NAT gateway. Which TWO of the following should the engineer check? (Choose TWO.)

Select 2 answers
A.The NAT gateway is in the same subnet as the instance
B.The route table of the private subnet has a route to the NAT gateway
C.The internet gateway is attached to the private subnet
D.The instance has a public IP address
E.The security group allows outbound traffic to the internet
AnswersB, E

Required for traffic to reach NAT gateway.

Why this answer

Option A is correct because the route table must have a route to the NAT gateway. Option B is correct because the security group must allow outbound traffic (e.g., HTTPS). Option C is wrong because the internet gateway is attached to the VPC, not the subnet.

Option D is wrong because public IP is not needed for instances in private subnet using NAT. Option E is wrong because the NAT gateway is in a public subnet, but the instance is in private; the instance does not have a public IP.

Practice this question →
181
MCQmedium

A Lambda function processes SQS messages but sometimes times out after 15 seconds. The function performs a database call that occasionally takes longer. What is the best way to handle this without losing messages?

A.Decrease the SQS visibility timeout to retry faster.
B.Split the batch into smaller batches using partial batch response.
C.Increase the Lambda timeout and increase the SQS visibility timeout, and add a dead-letter queue.
D.Reduce the Lambda reserved concurrency to limit invocations.
AnswerC

Longer timeout allows processing; DLQ captures failed messages.

Why this answer

Option D is correct because increasing the visibility timeout allows the function more time to process, and using a DLQ ensures that messages that repeatedly fail are captured. Option A is wrong because decreasing visibility timeout would cause messages to reappear sooner. Option B is wrong because reducing reserved concurrency would cause throttling.

Option C is wrong because splitting the batch does not address the timeout.

Practice this question →
182
MCQhard

During a deployment, a new application version on an ECS service starts failing health checks. The previous version is still running. The deployment is a rolling update with a 200% percent start. Which ECS feature should the engineer use to automatically revert to the previous version?

A.ECS deployment circuit breaker
B.ECS service auto recovery
C.ECS managed scaling
D.CloudWatch alarm actions
AnswerA

Circuit breaker automatically rolls back on deployment failure.

Why this answer

Option D is correct because a circuit breaker automatically detects deployment failures and rolls back. Option A is wrong because ECS service auto recovery is for underlying infrastructure. Option B is wrong because managed scaling adjusts desired count, not rollback.

Option C is wrong because CloudWatch alarms can trigger rollback but are not automatic within ECS itself.

Practice this question →
183
MCQeasy

A DevOps team receives a CloudWatch alarm that an RDS DB instance's CPU utilization has exceeded 90% for 5 minutes. The application is experiencing latency. What is the best immediate step to mitigate the issue?

A.Analyze slow query logs and optimize queries.
B.Enable Multi-AZ deployment for failover.
C.Modify the RDS instance to a larger instance class.
D.Add a read replica to offload read traffic.
AnswerC

Immediately increases CPU capacity.

Why this answer

Option C is correct because when an RDS instance's CPU utilization exceeds 90% for 5 minutes and the application is experiencing latency, the immediate step is to scale up the instance to a larger class to provide more CPU capacity. This directly addresses the resource bottleneck without requiring time-consuming analysis or architectural changes, making it the fastest mitigation for an ongoing incident.

Exam trap

The trap here is that candidates often confuse reactive scaling (immediate mitigation) with proactive optimization or architectural changes, leading them to choose slow query analysis or read replicas, which are valid but not immediate fixes for a CPU bottleneck.

How to eliminate wrong answers

Option A is wrong because analyzing slow query logs and optimizing queries is a long-term corrective action, not an immediate mitigation step during an active incident where latency is already occurring. Option B is wrong because enabling Multi-AZ deployment provides high availability and automatic failover, but does not increase CPU capacity or resolve performance issues caused by high utilization. Option D is wrong because adding a read replica offloads read traffic but does not reduce CPU utilization on the primary instance, which is the source of the latency.

Practice this question →
184
MCQeasy

A DevOps team is configuring CloudWatch alarms for their production environment. They want to receive notifications when the CPUUtilization metric of an EC2 instance exceeds 90% for three consecutive 5-minute periods. Which combination of settings should they use?

A.Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 3
B.Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 1
C.Period: 5 minutes; Evaluation periods: 1; Datapoints to alarm: 3
D.Period: 5 minutes; Evaluation periods: 5; Datapoints to alarm: 3
AnswerA

This configuration ensures three consecutive 5-minute periods exceed the threshold.

Why this answer

Option A is correct because the evaluation period must be set to 3, and the datapoints to alarm must be 3 to require three consecutive periods. Option B is wrong because datapoints to alarm set to 1 would trigger on any single high reading. Option C is wrong because evaluation period 1 with datapoints 3 is impossible.

Option D is wrong because evaluation period 5 with datapoints 3 would require 3 out of 5, not necessarily consecutive.

Practice this question →
185
MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. Users report intermittent 503 errors. CloudWatch metrics show that the ALB's 'RequestCount' is normal, but 'HTTPCode_ELB_5XX_Count' spikes. The 'TargetResponseTime' metric shows occasional high latency. Which troubleshooting step should the DevOps engineer take FIRST?

A.Enable and analyze the ALB access logs stored in S3, filtering for 503 errors and correlating with target response times.
B.Increase the desired capacity of the Auto Scaling group to handle more requests.
C.Disable connection draining on the target group to prevent slow-draining instances from causing errors.
D.Review AWS CloudTrail logs for any recent configuration changes to the ALB.
AnswerA

Access logs provide detailed per-request data including timestamp, target status, and response time, enabling correlation of errors with slow targets.

Why this answer

Option C is correct because checking the ALB's access logs for 503 errors with their timestamps can reveal whether the errors coincide with high latency targets. Option A is wrong because increasing capacity does not address the root cause. Option B is wrong because CloudTrail logs API calls, not HTTP errors.

Option D is wrong because disabling connection draining could worsen the issue.

Practice this question →
186
Multi-Selectmedium

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Select 2 answers
A.Modify the canary script to add more logging.
B.Review the canary's CloudWatch Logs for error details.
C.Inspect the Lambda function logs associated with the canary.
D.Examine CloudWatch metrics for the canary.
E.Check CloudTrail for CanaryRun API calls.
AnswersB, C

Canary logs contain detailed output of each step.

Why this answer

Option A is correct because canary logs are stored in CloudWatch Logs and can be analyzed. Option D is correct because canaries run on Lambda, and Lambda execution logs may contain additional error details. Option B is wrong because CloudTrail does not log canary execution details.

Option C is wrong because CloudWatch Metrics do not provide detailed error information. Option E is wrong because the canary code is not accessible for modification.

Practice this question →
187
MCQhard

A company runs a critical application on Amazon ECS with Fargate. The application is deployed across multiple Availability Zones and uses an Application Load Balancer (ALB) as the front-end. During a recent incident, users experienced intermittent connectivity failures. The DevOps team suspects that tasks are being stopped due to resource exhaustion. Which combination of metrics and actions should the team use to diagnose and prevent recurrence?

A.Monitor CPU and memory utilization metrics in CloudWatch; increase the task size (CPU and memory) in the task definition.
B.Set up CloudWatch Logs for the application and check for out-of-memory errors; then increase the number of tasks.
C.Monitor NetworkPacketsIn and NetworkPacketsOut metrics in CloudWatch; increase the number of tasks.
D.Monitor the ALB error metrics (5xx count) and scale the ECS service based on request count.
AnswerA

D is correct because high CPU/memory utilization can cause tasks to be stopped; increasing task size provides more resources per task.

Why this answer

Option A is correct because CPU and memory utilization metrics in CloudWatch directly indicate resource exhaustion, which is the suspected cause of tasks being stopped. Increasing the task size (CPU and memory) in the task definition provides more resources per task, preventing the OOM killer or CPU throttling from stopping tasks, without changing the number of tasks or scaling logic.

Exam trap

The trap here is that candidates confuse horizontal scaling (increasing task count) with vertical scaling (increasing task size), assuming that adding more tasks resolves resource exhaustion when the actual issue is insufficient resources per task.

How to eliminate wrong answers

Option B is wrong because while CloudWatch Logs can show out-of-memory errors, increasing the number of tasks does not address resource exhaustion per task—it only distributes load across more tasks, which may still fail if each task is under-provisioned. Option C is wrong because NetworkPacketsIn and NetworkPacketsOut measure network throughput, not CPU or memory exhaustion; high network metrics do not cause tasks to be stopped due to resource exhaustion. Option D is wrong because ALB 5xx errors and request count scaling address load balancing and traffic spikes, not the root cause of tasks being stopped due to insufficient CPU or memory per task.

Practice this question →
188
MCQeasy

A security engineer reviews the CloudTrail log entry above and notices that a security group was modified to allow SSH access from anywhere. The engineer wants to ensure that such changes are automatically detected and remediated in the future. What should the engineer do?

A.Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter that alerts on AuthorizeSecurityGroupIngress events with 0.0.0.0/0.
B.Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the source IP is 0.0.0.0/0.
C.Create an AWS Config rule that checks security group rules and triggers an AWS Systems Manager Automation document to revoke the ingress rule.
D.Enable Amazon GuardDuty to detect and block such changes in real time.
AnswerC

Config can evaluate and remediate security group rules.

Why this answer

Option C is correct because AWS Config can continuously evaluate security group rules against a custom or managed rule (e.g., restricted-ssh) and, upon detecting a noncompliant rule allowing 0.0.0.0/0 on port 22, trigger an AWS Systems Manager Automation document that automatically revokes the offending ingress rule. This provides both detection and remediation without manual intervention, meeting the requirement for automated detection and remediation.

Exam trap

The trap here is that candidates often confuse detection-only services (like CloudWatch alarms or GuardDuty) with services that can also perform automated remediation (like AWS Config with Systems Manager Automation), leading them to choose options that only alert but do not fix the issue.

How to eliminate wrong answers

Option A is wrong because while CloudTrail logs to CloudWatch Logs with a metric filter can alert on AuthorizeSecurityGroupIngress events with 0.0.0.0/0, this only provides notification (detection) but does not automatically remediate the change. Option B is wrong because an IAM policy that denies ec2:AuthorizeSecurityGroupIngress based on source IP 0.0.0.0/0 is not possible—IAM policies cannot inspect the contents of the API request parameters like the CIDR block; they operate on the action and resource ARN, not on the specific values of the request. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, but it cannot block or remediate security group changes in real time; it only generates findings.

Practice this question →
189
MCQmedium

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

A.Restart the SSM Agent on the affected instances.
B.Verify that the patch baseline is associated with the instances.
C.Review the IAM role attached to the instances for sufficient permissions.
D.Check if the instances have outbound internet connectivity to the SSM endpoints.
AnswerD

SSM requires outbound connectivity; lack of connectivity prevents communication.

Why this answer

Option B is correct because checking if the instances have internet connectivity is essential for SSM Agent to communicate with the Systems Manager service. Option A is wrong because the state manager association is not directly related to connectivity. Option C is wrong because IAM roles are necessary for SSM, but the logs show no errors, so roles are likely correct.

Option D is wrong because the SSM Agent logs show no errors, so agent is running.

Practice this question →
190
MCQmedium

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error 'The overall deployment failed because too many individual instances failed deployment'. The team checks the instance logs and finds that the 'BeforeInstall' lifecycle event script returned a non-zero exit code. What is the BEST approach to resolve this?

A.Set the 'ignoreScriptFailure' option to true in the AppSpec file and redeploy.
B.Manually run the script on an instance and then resume the deployment.
C.Fix the script error in the revision and redeploy.
D.Change the deployment configuration to 'AllAtOnce' to speed up deployment.
AnswerC

Correcting the script ensures the deployment succeeds.

Why this answer

Option B is correct because fixing the script and redeploying addresses the root cause. Option A is wrong because ignoring errors may cause application issues. Option C is wrong because using an in-place deployment does not fix the script.

Option D is wrong because altering the script on running instances is not a permanent fix and the deployment will still fail.

Practice this question →
191
MCQmedium

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The DevOps team needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which combination of services should be used?

A.Amazon Athena and Amazon QuickSight
B.Amazon Kinesis Data Analytics and Amazon Elasticsearch Service
C.Amazon S3 and Amazon QuickSight
D.CloudWatch Logs Insights and CloudWatch Dashboards
AnswerD

Logs Insights can query live log data and display results on CloudWatch Dashboards in real-time.

Why this answer

Option B is correct because CloudWatch Logs Insights can query logs and send results to CloudWatch Dashboards for real-time visualization. Option A is wrong because Athena is for querying data in S3, not real-time. Option C is wrong because Kinesis Data Analytics is for streaming data analytics but adds complexity.

Option D is wrong because QuickSight is for BI, not real-time log monitoring.

Practice this question →
192
Multi-Selectmedium

Which THREE steps should a DevOps engineer take to troubleshoot an EC2 instance that cannot be reached via SSH? (Choose three.)

Select 3 answers
A.Check the network ACL inbound rules for the subnet.
B.Verify that the corporate firewall allows SSH to the instance.
C.Create an AMI from the instance and launch a new one.
D.Check the security group inbound rules for port 22.
E.Verify that the instance has a public IP address.
AnswersA, D, E

NACLs control traffic at the subnet level.

Why this answer

Option A is correct because network ACLs (NACLs) are stateless firewall rules applied at the subnet level. If the inbound rule for ephemeral ports or port 22 is not explicitly allowed, SSH traffic will be dropped even if the security group permits it. Checking NACL inbound rules is a fundamental step in troubleshooting connectivity issues.

Exam trap

The trap here is that candidates often overlook network ACLs and focus only on security groups, or they mistake a recovery action (creating an AMI) for a troubleshooting step, when the correct approach is to systematically verify the layered network controls (NACLs, security groups, and public IP assignment).

Practice this question →
193
Multi-Selecteasy

A DevOps team needs to implement a solution to automatically remediate an S3 bucket that becomes publicly accessible. Which TWO services should they use together?

Select 2 answers
A.AWS CloudTrail
B.AWS Config
C.AWS Lambda
D.AWS Systems Manager Automation
E.Amazon GuardDuty
AnswersB, D

Config can evaluate bucket policies and trigger remediation.

Why this answer

AWS Config can continuously monitor S3 bucket configurations and trigger an AWS Lambda function via a custom rule or managed rule (e.g., s3-bucket-public-read-prohibited) when a bucket becomes publicly accessible. Lambda then executes the remediation logic, such as applying a bucket policy that blocks public access. This pair provides an automated, event-driven remediation pipeline without manual intervention.

Exam trap

AWS often tests the misconception that AWS CloudTrail or Amazon GuardDuty can perform automated remediation, but these services are purely detective or auditing tools and lack the ability to execute corrective actions.

Practice this question →
194
Multi-Selectmedium

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which TWO steps should be taken to accomplish this? (Choose TWO.)

Select 2 answers
A.Enable CloudTrail Insights to detect unusual activity in the account.
B.Configure the CloudWatch Events rule to send a notification to an Amazon SNS topic.
C.Create an Amazon CloudWatch Events rule that matches the CreateAccessKey API call via CloudTrail.
D.Create an AWS Config rule that checks for access key creation and sends an SNS notification.
E.Use CloudWatch Logs Insights to run a query on the CloudTrail logs and set an alarm.
AnswersB, C

SNS can send email or SMS alerts.

Why this answer

Option B is correct because Amazon CloudWatch Events (now Events) can be configured to match specific API calls logged by CloudTrail, such as CreateAccessKey. When the rule triggers, it can invoke an SNS topic to send an alert, enabling real-time notification. This approach directly monitors the API activity without additional overhead.

Exam trap

The trap here is that candidates often confuse AWS Config rules (which check resource compliance) with CloudWatch Events (which react to API calls), leading them to choose Option D instead of the correct event-driven approach.

Practice this question →
195
MCQeasy

A DevOps team is designing an incident response plan for a critical microservices architecture. They need to automatically collect and analyze logs from all services during an incident. Which solution should they use?

A.Stream logs to Amazon Kinesis Data Firehose and analyze with Amazon OpenSearch Service.
B.Store logs in Amazon S3 and use Amazon Athena to query them.
C.Use AWS Systems Manager Run Command to execute log collection scripts on each instance.
D.Centralize logs in Amazon CloudWatch Logs and use CloudWatch Logs Insights for real-time querying.
AnswerD

CloudWatch Logs Insights provides fast, interactive queries across log groups.

Why this answer

Option B is correct because CloudWatch Logs Insights allows querying across log groups. Option A is wrong because S3 is storage, not real-time analysis. Option C is wrong because Kinesis Data Firehose is for streaming to destinations, not analysis.

Option D is wrong because Systems Manager Run Command is for ad-hoc commands.

Practice this question →
196
Multi-Selectmedium

A company is experiencing an ongoing security incident where an unauthorized user gained access to an AWS access key and is making API calls. The security team needs to immediately stop the unauthorized access and preserve evidence for investigation. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers
A.Rotate the access key by creating a new key and updating the application.
B.Enable CloudTrail logging to capture API calls for forensic analysis.
C.Change the IAM policy attached to the user to deny all actions.
D.Contact AWS Support to have the key disabled.
E.Delete the compromised access key immediately.
AnswersB, E

D is correct because logging is essential for evidence preservation and investigation.

Why this answer

Option B is correct because enabling CloudTrail logging captures detailed API call records, including source IP, user agent, and request parameters, which are essential for forensic analysis and understanding the scope of the incident. CloudTrail logs provide immutable evidence that can be stored in S3 with versioning and MFA delete, ensuring the integrity of the investigation data.

Exam trap

The trap here is that candidates may think rotating the key (Option A) is sufficient, but rotation does not invalidate the old key immediately—it creates a new key while the old one remains active, which fails to stop the ongoing unauthorized access.

Practice this question →
197
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance fails, and automatic failover does not occur within the expected 1-2 minutes. The DevOps team needs to quickly restore database availability. What should the team do first?

A.Restore the latest automated snapshot to a new DB instance.
B.Modify the DB instance to change the Multi-AZ setting to enable automatic failover.
C.Connect to the standby instance directly and promote it to primary.
D.Reboot the DB instance with failover selected.
AnswerD

Rebooting with failover forces a failover to the standby, typically completing within minutes.

Why this answer

Option C is correct because forcing a failover by rebooting the DB instance with failover is the fastest way to trigger failover. Option A is wrong because restoring from snapshot takes longer. Option B is wrong because modifying the instance does not trigger failover.

Option D is wrong because the standby is not accessible directly.

Practice this question →
198
Matchingmedium

Match each AWS automation or configuration management tool to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Operational hub for managing AWS resources at scale

Configuration management service using Chef and Puppet

PaaS for deploying and scaling web applications

Infrastructure as Code using templates

Create and manage approved IT service catalogs

Why these pairings

These are tools for automation and configuration.

Practice this question →
199
MCQeasy

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

A.Install the CloudWatch Agent in each container.
B.Configure AWS CloudTrail to capture logs.
C.Use the awslogs log driver in the task definition.
D.Write logs to a file and use an S3 bucket with event notifications.
AnswerC

The awslogs log driver automatically sends container stdout/stderr to CloudWatch Logs.

Why this answer

Option B is correct because the awslogs log driver is built into ECS and automatically sends container logs to CloudWatch Logs. Option A is wrong because CloudWatch Agent inside container adds complexity. Option C is wrong because CloudTrail is for API calls.

Option D is wrong because S3 is not real-time and requires additional setup.

Practice this question →
200
MCQmedium

Refer to the exhibit. A DevOps engineer set up a CloudWatch alarm for a Lambda function. The alarm fires when the error count metric exceeds 10 in 5 minutes. The engineer receives an alarm notification, but when checking the Lambda logs, only 3 errors are found in that 5-minute window. What is the MOST likely reason for the discrepancy?

A.The metric filter is not processing logs in real time, causing a delay.
B.The metric filter is counting errors from other log groups or sources that use the same metric name.
C.The metric filter pattern is incorrect and is matching non-error entries.
D.The Lambda function is generating more errors than shown in the logs.
AnswerB

If multiple sources publish to the same metric, the alarm sums them.

Why this answer

Option B is correct. The metric filter might be capturing errors from other log groups that share the same metric name (ErrorCount). If multiple Lambda functions or other services publish to the same metric, the alarm could be summing across all of them.

Option A is wrong because CloudWatch Logs metric filters are near real-time. Option C is wrong because Lambda errors are counted correctly. Option D is wrong because the metric filter is correctly defined.

Practice this question →
201
Multi-Selecthard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a sudden spike in connections, causing the application to timeout. The DevOps engineer notices that the 'DatabaseConnections' metric is high, but the 'CPUUtilization' is low. Which THREE actions should the engineer take to diagnose the issue?

Select 3 answers
A.Check the 'max_connections' parameter in the DB parameter group and increase it if needed.
B.Add a read replica to offload read traffic.
C.Scale up the DB instance class to handle more connections.
D.Enable the 'general_log' and 'log_output' parameters to capture connection attempts.
E.Enable Performance Insights and review the top SQL queries and sessions.
AnswersA, D, E

High connection counts may hit the max_connections limit; increasing it can temporarily alleviate the issue.

Why this answer

Option B is correct because Performance Insights can show which queries are consuming connections. Option D is correct because increased max_connections can help if legitimate, but it's a temporary fix. Option E is correct because enabling connection logging can identify the source of connections.

Option A is wrong because increasing instance class addresses CPU, not connection limits. Option C is wrong because read replicas do not reduce write connection load.

Practice this question →
202
MCQmedium

An IAM policy attached to a DevOps engineer's role is shown above. The engineer is trying to restart a stopped EC2 instance in the us-east-1 region but receives an 'AccessDenied' error. The instance ID is i-0abcd1234efgh5678. What is the MOST likely reason?

A.The policy does not include a condition key that limits the allow to a specific region.
B.The policy does not allow ec2:StartInstances on the specific instance ARN.
C.The Deny statement overrides the Allow statement for the instance.
D.The policy's Deny statement is applied to all EC2 actions.
AnswerC

Even though StartInstances is allowed, the Deny on TerminateInstances might be misinterpreted, but actually the error is likely due to a misunderstanding; however, in IAM, explicit deny overrides allow, but only for the same action. So this is not correct. I'll reconsider.

Why this answer

Option C is correct because the Deny statement explicitly denies TerminateInstances. StopInstances and TerminateInstances are different actions, but the error might be misleading. Actually, the deny is on TerminateInstances, not StopInstances.

However, the engineer is trying to restart, which involves StartInstances. The policy allows StartInstances. The error might be due to the condition on the resource.

Option A is wrong because the policy allows ec2:*. Option B is wrong because the Deny is only for TerminateInstances. Option D is wrong because there is no condition.

The most likely reason is a conflict: the Deny on TerminateInstances might be incorrectly blocking StartInstances? No, that's not possible. Wait, the correct answer is D? Let me re-evaluate. The policy allows StartInstances on all resources.

The Deny is on TerminateInstances. Starting a stopped instance should work. Unless the engineer is using the wrong action? Restarting a stopped instance is StartInstances.

So the error is not due to this policy. Perhaps there is an SCP or other boundary. But the question says 'MOST likely reason'.

Option B is plausible because the Deny on TerminateInstances could be causing confusion. Actually, the correct answer is D because the policy is missing a condition? No, the policy is fine. Let's think: if the instance is stopped, you need StartInstances, which is allowed.

So no error. Maybe the engineer is trying to restart an instance that is running, which requires StopInstances then StartInstances. But the policy allows both.

The only deny is on TerminateInstances. So why error? Possibly because the engineer's role has an additional policy that denies? Or because the resource ARN in the Deny statement matches all instances, but the Allow on StartInstances has Resource "*" which includes the instance. The explicit deny overrides the allow.

But the deny is on TerminateInstances, not StartInstances. So StartInstances is allowed. The error must be something else.

Let's consider that the engineer might be trying to use the AWS console which might perform additional actions like DescribeInstances. That is allowed. I think the correct answer is that the policy is missing ec2:RebootInstances? No, reboot is different.

Actually, the question says 'restart a stopped instance' - that is StartInstances. So the policy allows it. The error might be due to the fact that the Deny statement has the specific resource ARN, but the Allow has "Resource": "*" which includes that resource.

However, the Deny is on a different action. So no conflict. Perhaps the answer is that there is an implicit deny for actions not explicitly allowed? But StartInstances is explicitly allowed.

I'm confused. Let me look for a common trick: the Deny statement does not have a condition, but it denies TerminateInstances on all instances in that account. That shouldn't affect StartInstances.

The only plausible explanation is that the engineer's role has a permissions boundary or an SCP that denies StartInstances. But the question doesn't mention that. Maybe the exhibit is incomplete? Option D: "The policy does not include a condition key that limits the allow to instances with a specific tag." That is not required.

Option B: "The Deny statement overrides the Allow statement for the instance." But it's on a different action. So that's incorrect. Option A: "The policy does not allow ec2:StartInstances on the specific instance ARN." But it allows on "Resource": "*".

So that is wrong. Option C: "The policy's Deny statement is applied to all EC2 actions." No, it's only TerminateInstances. So all options seem wrong.

Perhaps the correct answer is that the engineer is trying to use StopInstances first? The question says 'restart a stopped instance', so it's already stopped. So StartInstances is needed. The error could be due to the fact that the Allow does not specify a resource ARN for StartInstances, but "*" includes all.

So no issue. I'll go with option B as the most plausible because deny can override allow, but only for the same action. Hmm.

Let's assume the answer is B.

Practice this question →
203
Multi-Selecthard

A company runs a web application on EC2 instances behind an Application Load Balancer. The application is experiencing intermittent 503 errors. The DevOps team suspects that the target group's health check settings may be causing healthy instances to be marked as unhealthy. Which THREE configurations should the team review?

Select 3 answers
A.Stickiness setting
B.Health check interval
C.Healthy threshold count
D.Health check path
E.Cross-zone load balancing setting
AnswersB, C, D

Too short an interval may cause false negatives.

Why this answer

Options A, C, and E are correct. Health check path, interval, and threshold all affect how the ALB determines instance health. Option B is wrong because cross-zone load balancing does not affect health checks; D is wrong because stickiness is about session persistence.

Practice this question →
204
MCQeasy

A company runs a critical web application on AWS. The application is deployed on EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group across multiple Availability Zones. The company uses Amazon Route 53 for DNS with a failover routing policy. Recently, the operations team noticed that during a regional outage, the failover did not trigger as expected, and users experienced downtime. The health checks in Route 53 are configured to check the ALB endpoint. The ALB's health checks are configured to check the instances. What is the MOST likely reason the failover did not work?

A.The ALB remained healthy during the regional outage, so Route 53 did not fail over.
B.The failover routing policy requires manual intervention to switch traffic.
C.Route 53 health checks were not configured for the instance IP addresses.
D.Route 53 cannot failover to a different region when the primary endpoint is still reachable.
AnswerA

The ALB might be in a different AZ that was not affected.

Why this answer

Option B is correct because if the ALB itself is healthy but the instances are unhealthy, the ALB health check passes, so Route 53 considers the endpoint healthy. Option A is wrong because health checks are on the ALB. Option C is wrong because failover is automatic.

Option D is wrong because Route 53 can check endpoints in another region.

Practice this question →
205
MCQmedium

A company's production EC2 instance running a web application becomes unresponsive. The operations team checks CloudWatch metrics and sees a CPU Utilization spike to 100% for the last 10 minutes. What is the MOST efficient first step to restore service?

A.Check the instance's system logs in CloudWatch Logs to identify the root cause
B.Create an AMI of the instance and launch a new instance from that AMI
C.Reboot the EC2 instance from the AWS Management Console or CLI
D.Terminate the instance and launch a new one from the latest AMI
AnswerC

Rebooting is fast and often resolves transient issues like high CPU.

Why this answer

Option B is correct because restarting the EC2 instance is the quickest way to restore service when the instance is unresponsive. Option A is wrong because creating an AMI takes time; option C is wrong because investigating CloudWatch Logs delays restoration; option D is wrong because terminating the instance without recovery would cause data loss.

Practice this question →
206
MCQeasy

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to know who attempted to decrypt data using a specific KMS key and whether the attempt succeeded. Which AWS service should the team use?

A.AWS Config
B.KMS key policies
C.AWS CloudTrail
D.CloudWatch Logs
AnswerC

CloudTrail logs all KMS API calls.

Why this answer

AWS CloudTrail is the correct service because it records all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey, as events in the CloudTrail logs. By examining CloudTrail events for the specific KMS key ID, the security team can see who called the Decrypt API and whether the call succeeded (HTTP 200) or failed (e.g., AccessDenied). This provides the exact audit trail needed for incident response.

Exam trap

The trap here is that candidates confuse AWS Config (which tracks resource configuration) with CloudTrail (which tracks API activity), or they assume KMS key policies themselves provide audit logs, when in fact policies only control permissions and do not generate event records.

How to eliminate wrong answers

Option A is wrong because AWS Config evaluates resource compliance against rules and records configuration changes, but it does not capture API-level actions like decryption attempts. Option B is wrong because KMS key policies define who can use the key and under what conditions, but they do not generate logs or provide historical audit records of decryption attempts. Option D is wrong because CloudWatch Logs can store log data from various sources, but it is not the native service for capturing KMS API calls; CloudTrail is the service that generates those logs, which can optionally be sent to CloudWatch Logs.

Practice this question →
207
MCQmedium

A company's incident response process requires that all changes to production resources are automatically paused when a P1 incident is declared. Which AWS service can be used to enforce this by preventing modifications to CloudFormation stacks?

A.AWS Systems Manager Change Manager
B.AWS CloudFormation StackSets with a service control policy (SCP)
C.AWS Config rules with remediation
D.AWS CloudTrail with Insights
AnswerB

A SCP can deny UpdateStack operations during an incident.

Why this answer

Option B is correct because CloudFormation StackSets with a service control policy (SCP) can prevent stack updates. Option A is wrong because CloudTrail is logging. Option C is wrong because Config evaluates compliance, does not prevent changes.

Option D is wrong because Systems Manager Change Manager requires manual approval, not automatic pause.

Practice this question →
208
MCQhard

A DevOps engineer observes the CloudWatch alarm output shown in the exhibit. The alarm is in ALARM state for instance i-0abcd1234efgh5678. The engineer checks the EC2 console and sees that the instance's CPU utilization is currently 10%. What is the MOST likely explanation?

A.The alarm is misconfigured with wrong metric
B.The threshold was set too low
C.The alarm has not yet evaluated enough low datapoints to change state
D.The CPUUtilization metric is not being emitted
AnswerC

Alarm remains ALARM until it evaluates consecutive OK datapoints.

Why this answer

Option D is correct because the alarm evaluated only 1 datapoint (EvaluationPeriods=1) and the CPU spiked to 100% at 09:55, triggering the alarm. It has since dropped, but the alarm state persists until manually reset or until it transitions to OK after enough low datapoints. Option A is wrong because the metric exists.

Option B is wrong because the threshold is 90%. Option C is wrong because the alarm is correctly configured.

Practice this question →
209
MCQmedium

A company uses AWS CodePipeline for CI/CD. A recent deployment to an Amazon ECS service failed because the new task definition referenced an ECR image that does not exist. The pipeline uses a source stage (CodeCommit), build stage (CodeBuild), and deploy stage (ECS). The engineer wants to catch such errors earlier. What should the engineer add to the pipeline?

A.Add an invoke action that calls a Lambda function to check the image.
B.Add a manual approval step before the deploy stage.
C.Add a test stage that runs a script to verify the image exists in ECR.
D.Add a second build stage that re-builds the image.
AnswerC

A test stage can validate the image tag before deployment.

Why this answer

Option C is correct because adding a test stage after the build stage to validate the image existence in ECR would catch the error before deployment. Option A is wrong because adding a manual approval does not automatically catch the error. Option B is wrong because adding a second build stage does not validate the image.

Option D is wrong because adding an invoke action to run a Lambda function would require custom code and is possible but not a built-in validation; however, Option C is more straightforward.

Practice this question →
210
MCQhard

A company uses RDS Multi-AZ with a read replica. During a failover test, the application experiences a 30-second write outage. The application uses a single DB endpoint. How can the outage be minimized?

A.Increase the instance class to improve failover performance.
B.Use RDS Proxy to handle database connections and failover.
C.Use a Route 53 weighted record with health checks to point to both instances.
D.Configure the application to use the read replica endpoint for writes.
AnswerB

RDS Proxy reduces failover impact by pooling connections and rerouting quickly.

Why this answer

Option C is correct because using the RDS proxy with connection pooling and failover handling reduces the outage window by automatically rerouting connections. Option A is wrong because Multi-AZ already provides a standby, but DNS propagation takes time. Option B is wrong because multiple write endpoints are not supported.

Option D is wrong because increasing instance size does not reduce failover time.

Practice this question →
211
MCQhard

A company uses AWS Lambda functions to process events from Amazon SQS. Recently, the Lambda function has been throttled, causing messages to accumulate in the dead-letter queue (DLQ). The function’s reserved concurrency is set to 100, and the account’s regional concurrency limit is 1000. What is the MOST likely cause of the throttling?

A.The function’s concurrency is fully utilized due to long-running invocations
B.The Lambda function has a cold start issue
C.The SQS queue is not configured as a FIFO queue
D.The reserved concurrency is set too high, exceeding the account limit
AnswerA

If invocations overlap, they consume the reserved concurrency and cause throttling.

Why this answer

Option D is correct because if the function’s reserved concurrency is 100 and the account-level limit is 1000, throttling could be due to the function exhausting its own concurrency if it has long-running invocations. Option A is wrong because 100 reserved is not above the account limit. Option B is wrong because SQS standard queue does not require FIFO.

Option C is wrong because cold starts cause latency but not throttling.

Practice this question →
212
MCQhard

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

A.Use Amazon GuardDuty to automatically modify the security group membership of the instance.
B.Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.
C.Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.
D.Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.
AnswerD

AWS Config can detect non-compliant instances (e.g., missing required tags) and trigger SSM Automation to perform remediation actions.

Why this answer

Option D is correct because AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Exam trap

The trap here is that candidates often assume any event-driven automation (like Lambda + EventBridge) is always the best answer, but AWS Config with Systems Manager Automation is the native, fully managed, and auditable solution for compliance-driven remediation without custom code.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that generates findings but cannot directly modify security group membership; it requires an integration with AWS Lambda or EventBridge to perform remediation actions. Option B is wrong because AWS Shield Advanced is a DDoS protection service and has no capability to modify EC2 security group associations or apply quarantine groups. Option C is wrong because while Lambda functions triggered by EventBridge can technically perform the remediation, the question asks for a combination of actions that should be implemented, and AWS Config with Systems Manager Automation is the recommended, fully managed, and auditable approach that avoids the operational overhead of maintaining custom Lambda code and IAM permissions.

Practice this question →
213
MCQhard

An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?

A.Create a new IAM group with a deny-all policy and add all users to it.
B.Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.
C.Attach an IAM policy denying all actions to all IAM users in that account.
D.Apply an SCP that denies all actions to the root user only.
AnswerB

SCPs can restrict both root and IAM users in the account.

Why this answer

Option D is correct because an SCP can deny all actions from the root user and IAM users in the affected account. Option A is wrong because it only affects the root user. Option B is wrong because IAM policies cannot restrict root user.

Option C is wrong because it only affects IAM users, not root.

Practice this question →
214
MCQeasy

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The instance is part of an Auto Scaling group with a minimum size of 2. What is the quickest way to restore service with minimal data loss?

A.Stop and start the instance from the EC2 console.
B.Create a new AMI from the instance and launch a replacement manually.
C.Terminate the instance and let the Auto Scaling group launch a new one.
D.Restore the instance from the most recent EBS snapshot.
AnswerC

Auto Scaling will automatically replace the instance.

Why this answer

Option C is correct because terminating the unresponsive instance triggers the Auto Scaling group to automatically launch a replacement instance, restoring service with minimal data loss. Since the Auto Scaling group has a minimum size of 2, it will immediately detect the terminated instance and launch a new one using the launch template or configuration, ensuring the desired capacity is maintained without manual intervention.

Exam trap

The trap here is that candidates may think stopping and starting the instance (Option A) is the quickest fix, but they overlook that the Auto Scaling group's automated self-healing is designed exactly for this scenario and is faster than any manual recovery method.

How to eliminate wrong answers

Option A is wrong because stopping and starting the instance does not resolve the unresponsive state if the underlying issue is a software or OS hang; it also requires manual action and does not leverage the Auto Scaling group's self-healing capabilities. Option B is wrong because creating a new AMI from the unresponsive instance and manually launching a replacement is time-consuming, may propagate the failure state, and bypasses the automated recovery provided by the Auto Scaling group. Option D is wrong because restoring from the most recent EBS snapshot would revert the instance to a previous state, potentially causing significant data loss, and requires manual steps to attach the volume and launch a new instance, which is slower than letting the Auto Scaling group handle the replacement.

Practice this question →
215
MCQeasy

A DevOps engineer receives an alert that an EC2 instance's CPU utilization has been above 90% for the last 30 minutes. The engineer needs to investigate the root cause. Which AWS service should the engineer use to get OS-level process details and identify which process is consuming the CPU?

A.AWS Config
B.AWS CloudTrail
C.AWS Systems Manager Run Command
D.Amazon CloudWatch
AnswerC

Run Command can execute scripts on EC2 instances to collect OS-level details like running processes.

Why this answer

Option D is correct because Systems Manager Run Command can run scripts (e.g., 'top' or 'ps') on EC2 instances to get process-level details. Option A is wrong because CloudWatch metrics only show aggregated CPU utilization. Option B is wrong because CloudTrail logs API calls.

Option C is wrong because Config records configuration changes.

Practice this question →
216
MCQmedium

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes messages from an Amazon SQS queue. Recently, the processing time has increased, and the SQS queue depth is growing. The CloudWatch metrics show that the ECS service's CPU utilization is consistently around 70%, memory utilization is 80%, and the number of running tasks is at the maximum allowed (10). The service is configured with a target tracking scaling policy based on CPU utilization with a target value of 50%. However, the auto scaling does not seem to be adding tasks. The engineer checks the ECS service events and finds no scaling activity. What is the MOST likely reason the auto scaling is not working, and what action should be taken to resolve the issue?

A.The service has reached the maximum number of tasks defined in the auto scaling configuration; increase the maximum tasks.
B.The scaling policy is not properly configured; recreate it with a lower target value.
C.The CloudWatch metric is not being emitted correctly; check the metric namespace.
D.The ECS service is using Fargate, which does not support target tracking scaling policies.
AnswerA

The max tasks is 10 and the service is at 10, so scaling cannot occur. Increasing the max allows scaling.

Why this answer

The auto scaling is not adding tasks because the ECS service has already reached the maximum number of tasks defined in the auto scaling configuration (10). With CPU utilization at 70% and the target tracking policy set to 50%, the policy would normally trigger scale-out actions, but since the maximum task count is already hit, no scaling activity occurs. The engineer must increase the maximum tasks in the auto scaling configuration to allow further scale-out.

Exam trap

The trap here is that candidates may assume the scaling policy itself is misconfigured or that Fargate lacks support for target tracking, when in reality the issue is the hard cap on the maximum number of tasks preventing any scale-out action.

How to eliminate wrong answers

Option B is wrong because the target value of 50% is appropriate; lowering it would not resolve the issue since the policy is not being triggered due to the max task limit, not the target value. Option C is wrong because CloudWatch metrics are being emitted correctly (CPU utilization is visible at 70%), so the metric namespace is not the problem. Option D is wrong because Fargate fully supports target tracking scaling policies for ECS services; this is a supported and common configuration.

Practice this question →
217
MCQeasy

A company uses CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed KMS key. What must be done to enable this?

A.Enable encryption on the log group using the default AWS managed key.
B.Use a third-party encryption tool before sending logs to CloudWatch.
C.Create a new log group in a region where KMS is enabled.
D.Associate a customer-managed KMS key with the log group and update the key policy to allow CloudWatch Logs to use it.
AnswerD

Associating a CMK and updating the key policy enables encryption.

Why this answer

Option D is correct because CloudWatch Logs supports encryption at rest using a customer-managed KMS key. To enable this, you must associate the KMS key with the log group via the CloudWatch Logs console or API, and you must update the key policy to grant CloudWatch Logs the necessary permissions (kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:DescribeKey). Without this key policy update, CloudWatch Logs cannot use the key to encrypt the log data at rest.

Exam trap

The trap here is that candidates often assume encryption is automatically applied when a KMS key exists in the account, but they overlook the critical step of updating the key policy to grant CloudWatch Logs service principal permissions to use the key.

How to eliminate wrong answers

Option A is wrong because using the default AWS managed key does not meet the security team's requirement for a customer-managed KMS key; the default key is AWS-owned and not customer-managed. Option B is wrong because using a third-party encryption tool before sending logs to CloudWatch would result in encrypted log data that CloudWatch Logs cannot index, search, or process natively, defeating the purpose of centralized logging. Option C is wrong because KMS is available in all AWS regions where CloudWatch Logs is supported; creating a new log group in a different region does not enable customer-managed KMS encryption—you must explicitly associate a customer-managed key with the log group.

Practice this question →
218
MCQmedium

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a patching window, some instances fail to apply patches. The engineer checks the SSM Agent logs and sees 'ERROR: Failed to download patch files from the source.' What is the most likely cause?

A.The IAM instance profile does not grant ssm:UpdateInstanceInformation.
B.The SSM Agent is outdated.
C.The patch baseline is configured incorrectly.
D.The security group or NACL is blocking outbound HTTPS traffic (port 443).
AnswerD

Patch download requires outbound HTTPS to patch repositories.

Why this answer

The error 'Failed to download patch files from the source' indicates that the SSM Agent on the instance cannot reach the patch source repositories (e.g., Windows Update, Amazon Linux repos, or custom patch sources). Systems Manager Patch Manager requires outbound HTTPS (port 443) connectivity to download patch metadata and binaries. If a security group or NACL blocks this traffic, the download fails, producing this exact error in the agent logs.

Exam trap

The trap here is that candidates often assume the error is due to IAM permissions or patch baseline misconfiguration, overlooking that the specific 'Failed to download' message is a classic symptom of network egress blocking, not authorization or configuration issues.

How to eliminate wrong answers

Option A is wrong because ssm:UpdateInstanceInformation is required for the instance to register and send heartbeat data to Systems Manager, but it does not control the ability to download patch files; the error is about download failure, not registration. Option B is wrong because an outdated SSM Agent would typically produce errors about agent version incompatibility or missing features, not a specific 'Failed to download patch files from the source' message; the agent can still attempt downloads. Option C is wrong because a misconfigured patch baseline might cause patches to be incorrectly approved or rejected, but the error message points to a network connectivity issue preventing download, not a baseline configuration problem.

Practice this question →
219
MCQeasy

An application running on Amazon RDS for PostgreSQL is experiencing slow query performance. The DevOps team suspects a specific query is causing high CPU usage. Which tool should they use to identify the problematic query?

A.Amazon RDS Event Subscriptions
B.Amazon RDS Performance Insights
C.Amazon CloudWatch Logs with metric filters
D.Amazon RDS Enhanced Monitoring
AnswerB

Performance Insights shows database load, top queries, and waits.

Why this answer

Option C is correct because Performance Insights provides a dashboard to identify top SQL queries. Option A is wrong because Enhanced Monitoring shows OS metrics, not queries. Option B is wrong because CloudWatch Logs might not capture query text.

Option D is wrong because RDS Event Subscriptions are for instance events.

Practice this question →
220
MCQhard

A company runs a web application on EC2 instances behind an ALB. The security team notices that the ALB is receiving a large number of requests from a single IP address, causing high CPU on the instances. They want to block this IP at the load balancer level without affecting other traffic. The ALB currently has a default action of forwarding to the target group. What is the MOST effective way to block this IP?

A.Update the network ACL for the VPC subnets to deny inbound traffic from that IP.
B.Add a deny rule in the ALB's security group for the source IP.
C.Change the listener rule to forward requests from that IP to a different target group with no instances.
D.Create an AWS WAF web ACL with an IP match condition and associate it with the ALB.
AnswerD

WAF can block requests based on source IP.

Why this answer

Option B is correct because AWS WAF can be integrated with ALB to create a rule that blocks requests from a specific IP address. Option A is wrong because security groups cannot deny traffic; they only allow. Option C is wrong because modifying the listener rule's target group would not block the IP; it would just route elsewhere.

Option D is wrong because the network ACL is for subnets, not for the ALB directly, and would affect all traffic to the subnets.

Practice this question →
221
MCQmedium

A company is using AWS CloudFormation to deploy infrastructure. An engineer needs to ensure that any changes to the production stack are reviewed and approved before they are applied. The engineer also wants to prevent unauthorized changes. Which solution should the engineer implement?

A.Use CloudFormation StackSets to manage the production stack across multiple accounts.
B.Use CloudFormation Change Sets and require manual approval to execute the change set.
C.Use AWS Service Catalog to create a product for the stack and require approval for any portfolio changes.
D.Use AWS CodePipeline to deploy the stack and require manual approval at the deploy stage.
AnswerB

Change Sets allow you to review proposed changes before applying them.

Why this answer

CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact running resources before you apply them. By requiring manual approval to execute the change set, the engineer ensures that all modifications are reviewed and approved, preventing unauthorized changes. This directly meets the requirement for a review-and-approval workflow without introducing unnecessary complexity.

Exam trap

The trap here is that candidates often confuse the purpose of StackSets (multi-account deployment) or CodePipeline (CI/CD pipeline) with the need for a simple change review mechanism, overlooking the direct and built-in capability of CloudFormation Change Sets to preview and require approval before applying changes.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets are designed to deploy stacks across multiple accounts and regions, not to enforce a review-and-approval workflow for changes to a single production stack. Option C is wrong because AWS Service Catalog products and portfolio changes control the provisioning of pre-defined templates, not the approval of changes to an already-deployed stack; it does not provide a change review mechanism for existing stacks. Option D is wrong because while CodePipeline can include a manual approval stage, it is a CI/CD orchestration tool that adds unnecessary overhead and complexity for a simple change review requirement; CloudFormation Change Sets provide a more direct and lightweight solution.

Practice this question →
222
Multi-Selectmedium

A company is experiencing a DDoS attack on their web application hosted on Amazon EC2 behind an Application Load Balancer (ALB). The attack is causing high CPU utilization on the instances. The security team needs to mitigate the attack with minimal disruption to legitimate users. Which TWO actions should the team take? (Choose two.)

Select 2 answers
A.Configure AWS WAF rate-based rules to block excessive requests from specific IP addresses.
B.Enable AWS Shield Advanced on the ALB for additional DDoS protection.
C.Enable VPC Flow Logs to analyze traffic patterns and identify the source of the attack.
D.Scale up the EC2 instances by increasing their instance size.
E.Place an Amazon CloudFront distribution in front of the ALB to cache content.
AnswersA, C

Rate-based rules can block IPs that exceed a threshold.

Why this answer

AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate, which directly mitigates DDoS attacks by limiting excessive traffic from specific sources. This approach minimizes disruption to legitimate users because it only blocks IPs that exceed the threshold, preserving access for normal traffic patterns.

Exam trap

The trap here is that candidates often confuse AWS Shield Advanced as a direct mitigation for application-layer DDoS attacks, when it primarily protects against infrastructure-layer attacks (e.g., SYN floods) and requires WAF for application-layer control.

Practice this question →
223
Multi-Selecteasy

A DevOps engineer needs to receive notifications when an EC2 instance's status check fails. Which TWO services should the engineer use? (Choose TWO.)

Select 2 answers
A.AWS Lambda
B.Amazon Simple Notification Service (SNS)
C.AWS CloudTrail
D.AWS Config
E.Amazon CloudWatch Alarm
AnswersB, E

SNS sends notifications when the alarm triggers.

Why this answer

Amazon CloudWatch Alarms (Option E) can monitor EC2 instance status checks (both system and instance checks) and trigger an action when the alarm state changes to ALARM. Amazon SNS (Option B) is the service that delivers the notification by publishing messages to subscribers (e.g., email, SMS, HTTP endpoints) when the CloudWatch alarm triggers. Together, they provide a complete monitoring and notification pipeline for status check failures.

Exam trap

The trap here is that candidates often select AWS Lambda or AWS Config because they associate them with automation or compliance, but the question explicitly asks for services to 'receive notifications' when a status check fails, which requires a notification delivery service (SNS) and a monitoring service (CloudWatch Alarm), not compute or configuration tracking.

Practice this question →
224
Multi-Selectmedium

A company runs a production database on Amazon RDS for MySQL. The database experiences a sudden spike in connections, causing the application to time out. The DevOps team needs to diagnose the issue quickly. Which combination of actions should be taken? (Choose two.)

Select 2 answers
A.Check CloudWatch metrics for DatabaseConnections and CPUUtilization.
B.Immediately scale up the RDS instance to handle the load.
C.Analyze VPC Flow Logs to identify the source IPs of connections.
D.Use the RDS console to view the number of active connections per user.
E.Enable Performance Insights and review the top SQL statements.
AnswersA, E

These metrics show connection count and resource usage.

Why this answer

Option A is correct because CloudWatch RDS metrics provide real-time connection count. Option D is correct because Performance Insights helps identify SQL queries causing the spike. Option B is wrong because increasing instance size is a mitigation, not diagnosis.

Option C is wrong because the RDS console does not show individual connections. Option E is wrong because VPC Flow Logs show network traffic, not database connections.

Practice this question →
225
MCQeasy

A DevOps engineer is investigating a security incident where an EC2 instance was used to launch an outbound DDoS attack. Which AWS service can provide details about the source IP addresses and network traffic from the instance?

A.VPC Flow Logs
B.AWS CloudTrail
C.Amazon GuardDuty
D.AWS Config
AnswerA

VPC Flow Logs capture IP traffic metadata.

Why this answer

Option B is correct because VPC Flow Logs capture IP traffic information for network interfaces. Option A (CloudTrail) records API calls, not network traffic. Option C (GuardDuty) is a threat detection service but does not provide raw traffic logs.

Option D (Config) records configuration changes.

Practice this question →
← PreviousPage 3 of 4 · 254 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Incident Response questions.

Start 20-question session