Troubleshooting Scenario Questions

Keep the bastion host but move it into a private subnet; engineers can connect by using a corporate VPN into the VPC.

Why wrong: A bastion host remains a high-value target and still requires controlled network access. Even if the bastion is private, inbound connectivity and SSH exposure remain. Session Manager provides a more direct elimination of the bastion as well as auditability.

Attach a public IP to each private instance so engineers can SSH directly and use security groups to restrict access.

Why wrong: Public IPs for instances in private subnets defeat the private-subnet isolation and increase attack surface. While security groups could limit access, it’s still direct internet exposure rather than brokered, permissioned management via AWS SSM.

Create a security group rule that allows engineers’ source IP addresses to reach instances over RDP on port 3389.

Why wrong: Allowing RDP with IP-based controls still requires a management network path and does not remove exposure. It also doesn’t align with using AWS SSO-based authentication for secure access auditing and operational workflows.

Enable AWS Config only for EC2 security groups and rely on it for API call auditing.

Why wrong: AWS Config captures configuration changes and evaluations (for example, resource state and rule compliance). It is not a complete substitute for API-level auditing across all services and accounts.

Turn on S3 server access logging for every bucket and assume it covers all AWS services.

Why wrong: S3 server access logging records requests made to S3 buckets. It does not provide audit logs for IAM, KMS, Secrets Manager, or other service API calls.

Use only Amazon CloudWatch alarms with no logging destination to reduce storage costs.

Why wrong: CloudWatch alarms are for monitoring and alerting on metrics. Without a retained log destination such as CloudTrail, they do not provide the detailed “who/what/when” event records needed for investigation.

Add an IAM policy statement allowing s3:GetObject for the bucket that stores the encrypted data.

Why wrong: S3 permissions determine whether the encrypted ciphertext can be retrieved. They do not grant cryptographic authorization to call kms:Decrypt on the KMS key.

Enable a CloudFront distribution for the KMS key alias.

Why wrong: CloudFront settings and distribution behavior do not affect KMS key policy evaluation for kms:Decrypt.

Create a VPC gateway endpoint for KMS to route decryption requests privately.

Why wrong: Private networking can affect connectivity, but it cannot replace authorization. Without key-policy permission, KMS will still deny kms:Decrypt with AccessDenied.

Disable CloudTrail during troubleshooting

Why wrong: Disabling audit logging weakens accountability and investigation capability.

Attach AdministratorAccess permanently to every developer role

Why wrong: Permanent broad access violates least privilege.

Create shared administrator access keys for the team

Why wrong: Shared long-term keys remove accountability and increase compromise risk.

Disable CloudTrail during troubleshooting

Why wrong: Disabling audit logging weakens accountability and investigation capability.

Create shared administrator access keys for the team

Why wrong: Shared long-term keys remove accountability and increase compromise risk.

Attach AdministratorAccess permanently to every developer role

Why wrong: Permanent broad access violates least privilege.

Enable KMS automatic key rotation for the customer-managed key in account B.

Why wrong: Key rotation is unrelated to authorization failures. The problem is that the key policy in account B is not allowing the cross-account principal to use kms:Decrypt for the key.

Attach the key policy as an IAM permissions policy to the instance role in account A only; key policies are not evaluated cross-account.

Why wrong: KMS key policies are evaluated on the key itself. Without updating the key policy in account B, cross-account calls will still be denied even if IAM permissions exist in account A.

Disable encryption on the EBS volume until authorization is fixed, then re-enable encryption after mount.

Why wrong: Disabling encryption violates security requirements and does not address why KMS authorization fails. Encrypted volumes and snapshots require correct KMS policies to be usable.

Disable CloudWatch Logs entirely and rely on application local files for 90 days.

Why wrong: Local files are not a durable or centralized substitute for CloudWatch Logs. This would increase operational risk, make retention harder to enforce, and reduce the team’s ability to search and audit logs across the fleet.

Increase the number of CloudWatch alarms so that metrics are collected less expensively.

Why wrong: Alarms do not reduce metric collection cost. The expensive part in the exhibit is detailed monitoring on every instance and indefinite log retention, neither of which is solved by adding more alarms.

Export all logs to Amazon S3 immediately and keep detailed monitoring enabled on every instance.

Why wrong: Exporting logs to S3 can help with archival economics, but it does not reduce the detailed monitoring charge, which is one of the largest costs in the exhibit. Keeping detailed monitoring on every instance preserves the major recurring cost driver.

Attach AdministratorAccess permanently to every developer role

Why wrong: Permanent broad access violates least privilege.

Create shared administrator access keys for the team

Why wrong: Shared long-term keys remove accountability and increase compromise risk.

Disable CloudTrail during troubleshooting

Why wrong: Disabling audit logging weakens accountability and investigation capability.

Disable CloudTrail during troubleshooting

Why wrong: Disabling audit logging weakens accountability and investigation capability.

Attach AdministratorAccess permanently to every developer role

Why wrong: Permanent broad access violates least privilege.

Create shared administrator access keys for the team

Why wrong: Shared long-term keys remove accountability and increase compromise risk.

Enable AWS Config delivery to a separate bucket and create a rule to detect noncompliant S3 policies; this will automatically generate GetObject logs.

Why wrong: AWS Config evaluates resource configuration and policy compliance, but it does not provide object-level access logs like GetObject and PutObject. The requirement is detective visibility into access and writes, not configuration drift detection. This approach would not fill the logging gap for exfiltration investigations.

Turn on VPC Flow Logs for the VPC hosting the S3 gateway endpoint, because network logs show S3 object read and write details.

Why wrong: VPC Flow Logs capture network traffic metadata (e.g., src/dst IPs and ports) but not S3 API actions at the object level. They cannot directly answer which objects were read from or written to within the bucket. The symptom is missing CloudTrail visibility into object-level operations, not network reachability.

Add an S3 bucket policy that denies all GetObject requests unless the caller uses TLS; the denial events will create investigation logs automatically.

Why wrong: A bucket policy denial will generate some logs, but it does not provide comprehensive object access visibility for legitimate reads and writes. Additionally, enforcement does not equal detective coverage; you may still miss successful access events. The question asks for configuration to provide missing object-level logs.

Keep the current long retention and detailed monitoring; reduce the log volume by sampling 10% of events

Why wrong: Sampling reduces ingest/storage, but it also changes which events are retained. This conflicts with compliance requirements that the full log data must remain available in CloudWatch Logs for 90 days.

Move all logs to S3 immediately and delete the CloudWatch log groups to reduce costs

Why wrong: Deleting the CloudWatch log groups would remove the logs from CloudWatch Logs before the required 90-day audit window. Even if data is exported to S3, this does not satisfy the stated compliance requirement that logs remain available in CloudWatch Logs for 90 days.

Increase CloudWatch alarm thresholds to reduce the number of metric datapoints

Why wrong: Alarm thresholds affect when alarms trigger, not how CloudWatch metrics are collected or billed for monitoring. It typically does not reduce the metric ingestion/monitoring cost drivers enough to address the unexpected cost increase.

An S3 lifecycle policy that deletes objects after 1 day to eliminate storage costs

Why wrong: Deleting after 1 day would remove data before it can be used for occasional troubleshooting. Storage cost optimization must still respect retention and troubleshooting requirements; lifecycle rules should transition to cheaper classes rather than delete immediately unless deletion is explicitly acceptable.

An S3 lifecycle policy that keeps all objects in S3 Standard and only applies compression at read time

Why wrong: Staying in S3 Standard does not address the cost driver (storage class pricing based on access frequency). “Compression at read time” is not an S3 lifecycle storage class optimization mechanism and would not directly lower S3 storage class charges as requested.

A policy that changes bucket encryption from SSE-S3 to SSE-KMS to reduce storage cost

Why wrong: Changing encryption type affects security and KMS key usage, not the fundamental S3 storage class pricing model. It is not a reliable method to reduce storage costs for infrequent access workloads.

Enable KMS automatic key rotation for the customer-managed key in account B.

Why wrong: Key rotation is unrelated to authorization failures. The problem is that the key policy in account B is not allowing the cross-account principal to use kms:Decrypt for the key.

Attach the key policy as an IAM permissions policy to the instance role in account A only; key policies are not evaluated cross-account.

Why wrong: KMS key policies are evaluated on the key itself. Without updating the key policy in account B, cross-account calls will still be denied even if IAM permissions exist in account A.

Disable encryption on the EBS volume until authorization is fixed, then re-enable encryption after mount.

Why wrong: Disabling encryption violates security requirements and does not address why KMS authorization fails. Encrypted volumes and snapshots require correct KMS policies to be usable.

Disable CloudTrail during troubleshooting

Why wrong: Disabling audit logging weakens accountability and investigation capability.

Create shared administrator access keys for the team

Why wrong: Shared long-term keys remove accountability and increase compromise risk.

Attach AdministratorAccess permanently to every developer role

Why wrong: Permanent broad access violates least privilege.

Disable CloudTrail during troubleshooting

Why wrong: Disabling audit logging weakens accountability and investigation capability.

Attach AdministratorAccess permanently to every developer role

Why wrong: Permanent broad access violates least privilege.

Create shared administrator access keys for the team

Why wrong: Shared long-term keys remove accountability and increase compromise risk.