Troubleshooting practice questions

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

Exhibit

Refer to the exhibit.

Error log from an application instance:

2023-10-01T12:34:56Z ERROR Failed to assume role: AccessDenied
User: arn:aws:sts::123456789012:assumed-role/EC2-AppRole/i-0a1b2c3d4e5f
is not authorized to perform: sts:AssumeRole on resource:
arn:aws:iam::123456789012:role/DatabaseAccessRole

Trap 1: The RDS instance does not have a resource-based policy that grants…

B is wrong because the error is about assuming the role, not about the RDS policy.

Trap 2: The security group for the EC2 instance does not allow outbound…

D is wrong because the error is an IAM permission error, not a network connectivity error.

Trap 3: The EC2 instance does not have the correct IAM instance profile…

C is wrong because the log shows the instance role is assumed (the user ARN is from that role).

A
The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.
Why wrong: B is wrong because the error is about assuming the role, not about the RDS policy.
B
The security group for the EC2 instance does not allow outbound traffic to the RDS instance.
Why wrong: D is wrong because the error is an IAM permission error, not a network connectivity error.
C
The EC2 instance does not have the correct IAM instance profile attached.
Why wrong: C is wrong because the log shows the instance role is assumed (the user ARN is from that role).
D
The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.
A is correct because the access denied error indicates the trust relationship is missing.

Question 2mediummultiple choice

A DevOps team is troubleshooting a slow application. They enabled AWS X-Ray tracing and see that one of the downstream services has a high average response time. However, the traces show that the service itself is fast; the delay is in the network call from the upstream service. Which X-Ray feature should the team use to identify the root cause?

Trap 1: Add annotations to the traces for better filtering.

Incorrect: Annotations are for filtering, not diagnosing network latency.

Trap 2: View the raw segments of the upstream service.

Incorrect: Segments show service-internal timing, not network latency.

Trap 3: Adjust the sampling rules to capture more traces.

Incorrect: Sampling rules affect trace volume, not diagnosis.

A
Examine the trace map to see the connection between services.
Correct: The trace map visualizes service connections and latency.
B
Add annotations to the traces for better filtering.
Why wrong: Incorrect: Annotations are for filtering, not diagnosing network latency.
C
View the raw segments of the upstream service.
Why wrong: Incorrect: Segments show service-internal timing, not network latency.
D
Adjust the sampling rules to capture more traces.
Why wrong: Incorrect: Sampling rules affect trace volume, not diagnosis.

Question 3mediummultiple choice

A DevOps engineer is troubleshooting a production AWS Lambda function that occasionally times out. The function has a timeout of 30 seconds and uses a synchronous invocation. The engineer wants to capture invocation logs to identify the cause. Which approach will provide the MOST detailed diagnostic information?

Trap 1: Enable AWS CloudTrail data events for Lambda.

CloudTrail records API calls, not function execution timing.

Trap 2: Create a CloudWatch dashboard with function duration metrics.

Metrics show aggregated data, not per-invocation details.

Trap 3: Add more logging statements to the function code and check…

Logging helps but may not capture precise timing of external calls.

A
Enable AWS CloudTrail data events for Lambda.
Why wrong: CloudTrail records API calls, not function execution timing.
B
Create a CloudWatch dashboard with function duration metrics.
Why wrong: Metrics show aggregated data, not per-invocation details.
C
Add more logging statements to the function code and check CloudWatch Logs.
Why wrong: Logging helps but may not capture precise timing of external calls.
D
Enable AWS X-Ray tracing on the Lambda function.
X-Ray provides detailed traces showing each subsegment's duration, helping identify bottlenecks.

Question 4easymultiple choice

A DevOps engineer is troubleshooting an Auto Scaling group (ASG) that is not launching instances as expected. The ASG is configured with a launch template that uses an Amazon Linux 2 AMI. The engineer checks the EC2 Auto Scaling console and sees that the group's desired capacity is set to 2, but only 1 instance is running. The last scaling activity shows 'Failed to launch instance. Error: Your quota allows for 0 more running instance(s).' What is the most likely cause?

Trap 1: The launch template has insufficient IAM permissions to create…

A is wrong because insufficient permissions result in an 'Unauthorized' error, not a quota error.

Trap 2: The VPC subnet does not have enough available IP addresses.

C is wrong because insufficient IP addresses would show a different error.

Trap 3: There is an instance that is not passing health checks, preventing…

D is wrong because health check failures cause termination and replacement, not a quota error.

A
The launch template has insufficient IAM permissions to create instances.
Why wrong: A is wrong because insufficient permissions result in an 'Unauthorized' error, not a quota error.
B
The account has reached the EC2 instance limit for the selected instance type in the region.
B is correct because the error explicitly states quota for running instances is exceeded.
C
The VPC subnet does not have enough available IP addresses.
Why wrong: C is wrong because insufficient IP addresses would show a different error.
D
There is an instance that is not passing health checks, preventing new instances.
Why wrong: D is wrong because health check failures cause termination and replacement, not a quota error.

Question 5easymulti select

A DevOps engineer is troubleshooting an Amazon RDS for PostgreSQL instance that is running out of storage. The engineer wants to resolve the issue without downtime. Which TWO actions can achieve this? (Choose two.)

Trap 1: Create a read replica and promote it to primary.

This does not increase storage on the original instance.

Trap 2: Delete old automated snapshots to free up storage.

Automated snapshots do not consume the instance's allocated storage.

Trap 3: Scale up the DB instance to a larger instance class.

Instance class does not affect storage.

A
Create a read replica and promote it to primary.
Why wrong: This does not increase storage on the original instance.
B
Enable storage auto scaling on the DB instance.
Auto scaling adds storage automatically without manual intervention.
C
Delete old automated snapshots to free up storage.
Why wrong: Automated snapshots do not consume the instance's allocated storage.
D
Scale up the DB instance to a larger instance class.
Why wrong: Instance class does not affect storage.
E
Modify the DB instance to increase the allocated storage size.
Modifying storage can be done with minimal downtime.

Question 6mediumdrag order

Drag and drop the steps to troubleshoot a failed deployment in AWS CodeDeploy into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 7mediummultiple choice

A company's DevOps team uses AWS CodePipeline to automate deployments. A recent pipeline execution failed at the 'Deploy' stage. The engineer needs to view the detailed logs for the failed action. Which AWS service or feature should the engineer use?

Trap 1: S3 access logs

S3 access logs are for bucket access.

Trap 2: CodeBuild logs

CodeBuild logs are for build projects, not the deploy stage.

Trap 3: CloudTrail

CloudTrail logs API calls, not pipeline execution details.

A
CloudWatch Logs
CodePipeline logs execution details to CloudWatch Logs.
B
S3 access logs
Why wrong: S3 access logs are for bucket access.
C
CodeBuild logs
Why wrong: CodeBuild logs are for build projects, not the deploy stage.
D
CloudTrail
Why wrong: CloudTrail logs API calls, not pipeline execution details.

Question 8easymultiple choice

A DevOps engineer is troubleshooting a failed build in AWS CodeBuild. The build log shows: 'Error: Cannot find module 'lodash'.' The buildspec.yml file lists 'npm install' as a command. What is the most likely cause?

Trap 1: The npm install command is running before the source is downloaded.

CodeBuild downloads source first.

Trap 2: The lodash package is not compatible with the Node.js version.

Compatibility issues usually produce a different error.

Trap 3: The build environment does not have internet access to download…

The error is about a missing module, not a network error.

A
The npm install command is running before the source is downloaded.
Why wrong: CodeBuild downloads source first.
B
The lodash package is not compatible with the Node.js version.
Why wrong: Compatibility issues usually produce a different error.
C
The package.json file is missing or does not include lodash.
npm install reads package.json; if lodash is not listed, it won't be installed.
D
The build environment does not have internet access to download packages.
Why wrong: The error is about a missing module, not a network error.

Question 9hardmultiple choice

A team uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. During a stack update, they need to modify the DB instance class but want to avoid downtime. Which update policy should they use?

Trap 1: Use a CreationPolicy on the DB instance.

CreationPolicy only waits for signals during creation, not for modifications.

Trap 2: Use a WaitCondition to delay the update until maintenance window.

WaitCondition does not control the timing of resource updates.

Trap 3: Use an UpdatePolicy with AutoScalingRollingUpdate.

This policy is for Auto Scaling groups, not RDS.

A
Use a CreationPolicy on the DB instance.
Why wrong: CreationPolicy only waits for signals during creation, not for modifications.
B
Use a WaitCondition to delay the update until maintenance window.
Why wrong: WaitCondition does not control the timing of resource updates.
C
Use a stack policy to prevent replacement of the DB instance.
A stack policy can prevent accidental replacement, but for intentional modifications, you need to allow updates with a policy that requires maintenance window.
D
Use an UpdatePolicy with AutoScalingRollingUpdate.
Why wrong: This policy is for Auto Scaling groups, not RDS.

Question 10mediummulti select

A DevOps engineer is troubleshooting a failed CodePipeline execution. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage succeeds, but the deploy stage fails with 'No deployments found for the specified deployment group.' Which TWO actions should the engineer take to resolve this?

Trap 1: Update the IAM role for CodePipeline to allow it to list deployment…

The error message is not about permissions; it's about not finding the group.

Trap 2: Check the CodeBuild build logs for errors.

The build succeeded, so logs are not the issue.

Trap 3: Ensure the CodeCommit repository has a valid commit.

The source stage pulled code successfully.

A
Update the IAM role for CodePipeline to allow it to list deployment groups.
Why wrong: The error message is not about permissions; it's about not finding the group.
B
Confirm that the CodeDeploy deployment group exists in the same AWS Region as the pipeline.
Cross-region mismatches can cause this error.
C
Check the CodeBuild build logs for errors.
Why wrong: The build succeeded, so logs are not the issue.
D
Verify that the deploy stage in CodePipeline is configured with the correct deployment group name.
A typo or incorrect name would cause this error.
E
Ensure the CodeCommit repository has a valid commit.
Why wrong: The source stage pulled code successfully.

Question 11hardmultiple choice

A developer is troubleshooting a failed CodeBuild build. The build is triggered by a pull request from a forked repository. The buildspec includes a command to fetch pull request references. What is the most likely cause of the failure?

Exhibit

Refer to the exhibit.
```
Starting build...
[Container] 2024/01/15 10:00:00 Phase complete: DOWNLOAD_SOURCE State: FAILED
[Container] 2024/01/15 10:00:00 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: git fetch origin +refs/pull/*:refs/remotes/origin/pr/*. Reason: exit status 128
```

Trap 1: The IAM role for CodeBuild does not have permission to read from…

Would cause a different error.

Trap 2: The buildspec file is not present in the source code.

The build would not start if buildspec missing.

Trap 3: The buildspec contains invalid syntax.

The error is during git fetch, not buildspec parsing.

A
The IAM role for CodeBuild does not have permission to read from the repository.
Why wrong: Would cause a different error.
B
The buildspec file is not present in the source code.
Why wrong: The build would not start if buildspec missing.
C
The CodeBuild project is not configured to allow pull requests from forked repositories.
Fetching PR refs from forks requires explicit configuration.
D
The buildspec contains invalid syntax.
Why wrong: The error is during git fetch, not buildspec parsing.

Question 12mediummultiple choice

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack update. The stack contains an AWS::Lambda::Function resource. The update failed with the error 'Resource creation cancelled' after a timeout. The engineer wants to view the logs from the Lambda function during the stack update to diagnose the issue. What should the engineer do?

Trap 1: Use AWS CodeBuild to build and test the function locally

CodeBuild is not related to CloudFormation stack updates

Trap 2: Enable detailed CloudFormation logging in the stack template

CloudFormation does not have detailed logging for function output

Trap 3: Review the CloudFormation stack events in the AWS Management Console

Stack events show resource creation status, not function logs

A
Use AWS CodeBuild to build and test the function locally
Why wrong: CodeBuild is not related to CloudFormation stack updates
B
Enable detailed CloudFormation logging in the stack template
Why wrong: CloudFormation does not have detailed logging for function output
C
Access the CloudWatch Logs log group for the Lambda function
Lambda writes logs to CloudWatch Logs automatically
D
Review the CloudFormation stack events in the AWS Management Console
Why wrong: Stack events show resource creation status, not function logs

Question 13hardmultiple choice

A DevOps engineer is troubleshooting a slow AWS CodeBuild project. The build is a Java application that compiles source code and runs tests. The build environment uses a general1.large compute type. The build duration has increased from 5 minutes to 15 minutes over the past month. The engineer notices that the build logs show 'Downloading...' messages for Maven dependencies for several minutes. What is the most cost-effective way to reduce the build time?

Trap 1: Configure the build to use a VPC with a NAT gateway

NAT gateway does not cache dependencies.

Trap 2: Use AWS CodeArtifact as a proxy for Maven dependencies

CodeArtifact still requires downloading; caching is more cost-effective.

Trap 3: Change the compute type to general1.2xlarge

More compute does not speed up network downloads.

A
Configure the build to use a VPC with a NAT gateway
Why wrong: NAT gateway does not cache dependencies.
B
Use AWS CodeArtifact as a proxy for Maven dependencies
Why wrong: CodeArtifact still requires downloading; caching is more cost-effective.
C
Change the compute type to general1.2xlarge
Why wrong: More compute does not speed up network downloads.
D
Enable local caching in the CodeBuild project for dependencies
Local caching stores dependencies across builds.

Question 14easymultiple choice

Refer to the exhibit. A DevOps engineer is troubleshooting a cross-account deployment where an AWS CodeBuild project in Account A needs to upload build artifacts to an S3 bucket in Account B. The engineer attaches this IAM policy to the CodeBuild service role in Account A. However, the upload fails. What is the most likely reason?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}

Trap 1: The bucket policy in Account B grants s3:PutObject to Account A

That would help, but the issue is the condition.

Trap 2: The policy does not include s3:PutObjectAcl permission

PutObjectAcl is not required for upload.

Trap 3: The policy does not include s3:GetObject permission

GetObject is not needed for upload.

A
The bucket policy in Account B grants s3:PutObject to Account A
Why wrong: That would help, but the issue is the condition.
B
The condition requires bucket-owner-full-control ACL, but the bucket policy may not allow it
Cross-account uploads often require bucket policy to grant permissions.
C
The policy does not include s3:PutObjectAcl permission
Why wrong: PutObjectAcl is not required for upload.
D
The policy does not include s3:GetObject permission
Why wrong: GetObject is not needed for upload.

Question 15hardmultiple choice

A DevOps engineer is troubleshooting a CloudFormation stack that failed to update. The error message indicates a circular dependency among resources. The template includes an Auto Scaling group, a launch template, and an IAM instance profile. The launch template references the IAM instance profile, and the Auto Scaling group references the launch template. The IAM instance profile's role references the Auto Scaling group name in its trust policy. How can the engineer resolve the circular dependency?

Trap 1: Use DependsOn clauses to explicitly order the resource creation

DependsOn cannot break a circular dependency; it would still be circular.

Trap 2: Place the launch template and Auto Scaling group in a nested stack

Nested stacks do not resolve circular dependencies.

Trap 3: Hardcode the Auto Scaling group name in the IAM role's trust policy

Hardcoding does not break the circular dependency because the name is still a reference to the resource.

A
Use DependsOn clauses to explicitly order the resource creation
Why wrong: DependsOn cannot break a circular dependency; it would still be circular.
B
Pass the Auto Scaling group name as a parameter to the IAM role's trust policy, and create the Auto Scaling group with a condition that depends on the role
Using a parameter breaks the circular reference by not requiring the actual Auto Scaling group resource to exist when the role is created.
C
Place the launch template and Auto Scaling group in a nested stack
Why wrong: Nested stacks do not resolve circular dependencies.
D
Hardcode the Auto Scaling group name in the IAM role's trust policy
Why wrong: Hardcoding does not break the circular dependency because the name is still a reference to the resource.

Question 16hardmultiple choice

A DevOps engineer is troubleshooting a CodePipeline that has a Build stage using AWS CodeBuild. The build logs show 'Error: No such file or directory' for a file that is present in the source repository. What is the most likely cause?

Trap 1: The build commands are not executed because the pre_build phase…

The error is about a missing file, not a phase failure.

Trap 2: The artifact definition in the buildspec.yaml is incorrect.

Artifact definitions affect output, not input files.

Trap 3: The environment variables in CodeBuild are not set correctly.

Environment variables do not cause file not found errors.

A
The buildspec.yaml specifies an incorrect path for the file relative to the source root.
The build process runs from the source root; incorrect relative paths cause file not found errors.
B
The build commands are not executed because the pre_build phase failed.
Why wrong: The error is about a missing file, not a phase failure.
C
The artifact definition in the buildspec.yaml is incorrect.
Why wrong: Artifact definitions affect output, not input files.
D
The environment variables in CodeBuild are not set correctly.
Why wrong: Environment variables do not cause file not found errors.

Question 17mediummultiple choice

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack creation. The stack creates an EC2 instance with a user data script that runs a configuration management tool. The instance launches successfully, but the user data script fails. How can the engineer retrieve the user data execution logs to debug the issue?

Trap 1: Use AWS CloudTrail to view the user data execution events.

CloudTrail logs API calls, not script execution.

Trap 2: Use AWS Systems Manager Run Command to retrieve the logs remotely.

Run Command is for running commands, not retrieving logs from user data.

Trap 3: Check the CloudWatch Logs group for the instance.

Logs are not automatically sent to CloudWatch; the CloudWatch agent must be installed.

A
Use AWS CloudTrail to view the user data execution events.
Why wrong: CloudTrail logs API calls, not script execution.
B
Use AWS Systems Manager Run Command to retrieve the logs remotely.
Why wrong: Run Command is for running commands, not retrieving logs from user data.
C
Check the CloudWatch Logs group for the instance.
Why wrong: Logs are not automatically sent to CloudWatch; the CloudWatch agent must be installed.
D
Access the instance via EC2 Instance Connect and check /var/log/cloud-init-output.log.
Cloud-init logs contain the output of user data scripts.

Question 18mediummultiple choice

A DevOps team is troubleshooting a CloudFormation stack creation failure. The error message states: 'CREATE_FAILED: Resource handler returned message: "You have attempted to create more resources than the current AWS account limit"'. Which step should the team take to resolve this issue?

Trap 1: Delete the failed stack and recreate it with the same template.

Retrying without increasing limits will result in the same error.

Trap 2: Review the IAM permissions for the CloudFormation service role.

The error is not about permissions.

Trap 3: Modify the CloudFormation template to use a different resource type.

This does not address the limit issue.

A
Delete the failed stack and recreate it with the same template.
Why wrong: Retrying without increasing limits will result in the same error.
B
Review the IAM permissions for the CloudFormation service role.
Why wrong: The error is not about permissions.
C
Modify the CloudFormation template to use a different resource type.
Why wrong: This does not address the limit issue.
D
Check the current service limits for the resource type and request a limit increase from AWS Support.
The error explicitly states that the account limit has been reached.

Question 19mediummultiple choice

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. The stack creation fails with the error: 'The following resource(s) failed to create: [DBInstance]'. The CloudFormation template includes a parameter for the DB instance class. Which troubleshooting step should be taken FIRST?

Trap 1: Increase the stack creation timeout to allow more time for the…

Timeout is not the issue if the error is immediate.

Trap 2: Verify that the VPC has at least two public subnets in different…

RDS does not require public subnets; it can be in private subnets.

Trap 3: Use the Amazon RDS console to check if a DB instance with the same…

While possible, the stack events are more immediate and specific.

A
Increase the stack creation timeout to allow more time for the database to be created.
Why wrong: Timeout is not the issue if the error is immediate.
B
Check the CloudFormation stack events for a detailed status message from the DBInstance resource.
Stack events provide the specific reason for failure, such as 'DBInstance class not supported'.
C
Verify that the VPC has at least two public subnets in different Availability Zones.
Why wrong: RDS does not require public subnets; it can be in private subnets.
D
Use the Amazon RDS console to check if a DB instance with the same identifier already exists.
Why wrong: While possible, the stack events are more immediate and specific.

Question 20hardmultiple choice

Refer to the exhibit. A developer is troubleshooting a failed AWS CodeBuild build. The buildspec file contains the following build commands: 'pre_build' - run linting, 'build' - './gradlew build', 'post_build' - package artifact. The error occurs in the build phase. Which of the following is the MOST likely cause?

Exhibit

Build complete
[Container] 2024/03/15 14:30:00 Phase complete: BUILD State: FAILED
[Container] 2024/03/15 14:30:00 Phase context: statusCode: COMMAND_EXECUTION_ERROR, Message: Error while executing command: ./gradlew build. Reason: exit status 1

Trap 1: The build environment ran out of disk space.

Disk space would cause a different error message.

Trap 2: The artifact packaging step failed.

Packaging is in post_build, which hasn't run yet.

Trap 3: The linting step failed.

The error occurs in the build phase, not pre_build.

A
The Gradle build encountered compilation or test errors.
exit status 1 from gradlew indicates a build failure.
B
The build environment ran out of disk space.
Why wrong: Disk space would cause a different error message.
C
The artifact packaging step failed.
Why wrong: Packaging is in post_build, which hasn't run yet.
D
The linting step failed.
Why wrong: The error occurs in the build phase, not pre_build.