Troubleshooting practice questions

Create an RDS event subscription for 'low storage' events.

Why wrong: Event subscriptions notify about database events like storage, not slow queries.

Monitor the 'CPUUtilization' metric in CloudWatch.

Why wrong: CPUUtilization shows overall CPU usage but does not identify individual slow queries.

Enable Enhanced Monitoring to view process list and SQL queries.

Why wrong: Enhanced Monitoring provides OS-level metrics like CPU and memory, but not query details.

Set reserved concurrency to 1 to isolate the function.

Why wrong: Reserved concurrency affects scaling, not timeout diagnosis.

Check the VPC configuration for the Lambda function.

Why wrong: VPC issues could cause timeouts, but it's not the first step.

Increase the function memory allocation.

Why wrong: Memory increase may improve performance but not directly address timeout.

Increase the Lambda function reserved concurrency.

Why wrong: Reserved concurrency ensures capacity but does not affect timeout.

Increase the memory allocation for the Lambda function.

Why wrong: Increasing memory can improve CPU speed but does not change the timeout limit.

Configure a dead-letter queue (DLQ) for the Lambda function.

Why wrong: A DLQ handles failed invocations but does not prevent timeouts.

The alarm period is set longer than 30 minutes.

Why wrong: The alarm would still trigger after the period.

The alarm is not configured to evaluate the metric correctly.

Why wrong: Configuration seems correct.

The SQS queue is not being polled.

Why wrong: Messages become visible after visibility timeout.

Access is denied only if the bucket is encrypted

Why wrong: Encryption does not affect IAM policy evaluation.

Access is allowed only if the instance is in the same region

Why wrong: Region does not affect this evaluation.

Access is allowed because the IAM role allows it

Why wrong: An explicit deny overrides any allow.

Amazon CloudWatch Synthetics canary to monitor the application endpoint.

Why wrong: Synthetics checks endpoint availability, not internal microservice latency.

Amazon CloudWatch Logs Insights to query application logs for errors.

Why wrong: Logs Insights does not trace request paths or latency.

Amazon CloudWatch ServiceLens to visualize service maps and traces.

Why wrong: ServiceLens uses X-Ray; X-Ray is the direct service for tracing.

Create a change set to see what changes were attempted.

Why wrong: Change sets are for previewing changes, not for troubleshooting failures.

Use the 'describe-stack-resource' AWS CLI command to get the resource status.

Why wrong: This provides resource status but not the root cause of the failure.

The SQS queue's dead-letter queue (DLQ) is not configured, causing messages to be reprocessed.

Why wrong: DLQ does not cause duplicate processing; it stores failed messages.

The function's batch size is too large, causing timeouts.

Why wrong: Batch size of 10 is within limit and function completes in 10 seconds.

The function's reserved concurrency is too high, causing overloading.

Why wrong: Reserved concurrency limits the function; it does not cause overload.

AWS Config timeline

Why wrong: Config shows configuration changes, not errors.

AWS Service Catalog

Why wrong: Service Catalog is not used for CloudFormation troubleshooting.

AWS CloudTrail event history

Why wrong: CloudTrail shows API calls, not CloudFormation resource errors.

Enable AWS Shield Advanced to protect the ALB from DDoS attacks.

Why wrong: DDoS protection would not resolve a 503 error due to misconfiguration.

Verify that the SSL certificate associated with the ALB is not expired.

Why wrong: An expired SSL certificate would cause HTTPS errors, not 503.

Check the ALB's target group health check settings and verify that the health check path is correct.

Why wrong: The ALB is reported as healthy, so health check settings are likely correct.

Enable CloudWatch Logs for the RDS instance and query the error log.

Why wrong: Error log may not contain query performance data.

Install the CloudWatch agent on the EC2 instances to collect database performance counters.

Why wrong: Collects OS-level metrics, not database query performance.

Monitor the ALB's 'TargetResponseTime' metric and correlate with RDS 'CPUUtilization'.

Why wrong: Provides only high-level correlation, not query details.

AWS Trusted Advisor

Why wrong: Trusted Advisor provides optimization recommendations, not deployment history.

AWS Service Catalog

Why wrong: Service Catalog is for managing portfolios of IT services.

Amazon Inspector

Why wrong: Inspector is for vulnerability scanning, not deployment events.

Enable server-side encryption on the artifact bucket.

Why wrong: Encryption does not affect permissions.

Enable CloudWatch Logs for the build project.

Why wrong: Logs do not affect artifact upload.

Add s3:GetObject permission to the CodeBuild service role for the source bucket.

Why wrong: Source bucket may already have read, but error is about put.

The npm install command is running before the source is downloaded.

Why wrong: CodeBuild downloads source first.

The lodash package is not compatible with the Node.js version.

Why wrong: Compatibility issues usually produce a different error.

The build environment does not have internet access to download packages.

Why wrong: The error is about a missing module, not a network error.

AWS X-Ray

Why wrong: X-Ray traces requests through applications, not infrastructure metrics.

Amazon VPC Flow Logs

Why wrong: Flow Logs capture network traffic information, not database metrics.

AWS CloudTrail

Why wrong: CloudTrail records API calls, not performance metrics.

Increase the max_connections parameter in the DB parameter group.

Why wrong: May not address the root cause if the issue is not connection limit.

Enable Multi-AZ deployment to provide a standby instance.

Why wrong: Multi-AZ does not prevent connection resets.

Review the security group rules to ensure the application can connect.

Why wrong: Intermittent resets are unlikely due to security group rules.

CloudWatch Logs Insights and CloudWatch metrics.

Why wrong: CloudWatch Logs Insights requires streaming database logs, which may not capture every query.

VPC Flow Logs and Lambda.

Why wrong: Flow logs show network connections, not SQL queries.

CloudTrail and CloudWatch alarms.

Why wrong: CloudTrail does not log database queries.

AWS CloudTrail

Why wrong: CloudTrail records API calls, not database queries.

Amazon CloudWatch Metrics

Why wrong: CloudWatch metrics show aggregate database performance, not individual queries.

VPC Flow Logs

Why wrong: VPC Flow Logs capture network traffic, not database queries.

Use DependsOn clauses to explicitly order the resource creation

Why wrong: DependsOn cannot break a circular dependency; it would still be circular.

Place the launch template and Auto Scaling group in a nested stack

Why wrong: Nested stacks do not resolve circular dependencies.

Hardcode the Auto Scaling group name in the IAM role's trust policy

Why wrong: Hardcoding does not break the circular dependency because the name is still a reference to the resource.

ecr:InitiateLayerUpload

Why wrong: This is for uploading layers, not describing.

ecr:GetRepositoryPolicy

Why wrong: This is a different action not needed for describing repositories.

ecr:ListImages

Why wrong: ListImages is not the same as describe repositories.