CCNA Continuous Improvement for Existing Solutions Questions

Auto Scaling with a dynamic scaling policy based on CPU utilization automatically adds or removes EC2 instances in response to load, handling spikes without manual intervention. This is a minimal architectural change. Option A is wrong because ElastiCache offloads database queries, but the high CPU may be from compute-intensive operations, not database.

Option C is wrong because vertical scaling (larger instances) has an upper limit and may require downtime during resizing. Option D is wrong because CloudFront caches static content at the edge, but it does not reduce CPU load from dynamic requests or compute processing on the instances.

Amazon Athena enables running SQL queries directly on CloudTrail logs stored in S3 without the need to move or transform data. This is the most efficient method for analyzing historical CloudTrail data. Option A is incorrect because CloudWatch Logs Insights is designed for logs stored in CloudWatch Logs, not for S3-stored CloudTrail logs.

Option C is incorrect because using Lambda to export to Redshift adds unnecessary complexity and cost compared to querying in place with Athena. Option D is incorrect because S3 Select is limited to filtering data within a single object and does not support complex SQL queries across multiple log files.

Network Load Balancer (NLB) supports target group stickiness based on source IP address, which ensures that client requests are routed to the same EC2 instance, maintaining session persistence. This is the appropriate method for stateful applications. Option A is incorrect because disabling cross-zone load balancing does not provide stickiness; it only restricts traffic to instances in the same Availability Zone.

Option B is incorrect because NLB does not support cookie-based stickiness; that is a feature of Application Load Balancer. Option C is incorrect because while ALB does support cookie-based stickiness, switching to ALB is unnecessary; NLB already supports source IP stickiness.

It allows automatic testing and rollback by integrating CloudWatch alarms. After deployment, a test stage can run tests and publish a custom metric to CloudWatch. If the metric breaches a threshold (indicating test failure), a CloudWatch alarm triggers a rollback action, such as an AWS Lambda function that calls the CodeDeploy API to roll back the deployment.

This approach automates the entire process without manual intervention. Option A is incorrect because creating a separate pipeline introduces unnecessary complexity and cross-pipeline triggers are not straightforward for rollback. Option B is incorrect because manual approval steps require human interaction, which is not automatic.

Option D is incorrect because CodeDeploy cannot automatically roll back based on a pipeline failure; CodeDeploy only rolls back on its own deployment failures, not failures in subsequent pipeline stages. The test stage is part of the pipeline, and if it fails, the pipeline fails, but CodeDeploy's rollback is not triggered by pipeline stage failures.

Options A and E are correct. Creating an AMI from the instance (A) allows you to quickly launch a new instance in another AZ with the same configuration, improving recovery time. Configuring the Auto Scaling group to launch instances in multiple AZs (E) ensures that the application is already running in another AZ, minimizing downtime during an AZ failure.

Option B is incorrect because EBS multi-attach is for attaching a volume to multiple instances in the same AZ, not for cross-AZ recovery. Option C is incorrect because you cannot directly copy an EBS volume to another AZ; you must create a snapshot and then create a volume in the target AZ within the same region. Option D is incorrect because copying snapshots to another region is designed for regional disasters, not for within-region AZ failures; for AZ failure, you would restore snapshots within the same region.

A NAT Gateway in a public subnet with an Elastic IP provides a static IP for outbound traffic from instances in private subnets. This allows the third-party service to whitelist that IP address. Option A is incorrect because replacing the ALB with an NLB would affect inbound traffic handling and does not solve outbound static IP requirements.

Option B is incorrect because an Application Load Balancer cannot be assigned an Elastic IP; it uses dynamic IP addresses. Option D is incorrect because an Internet Gateway does not provide a static IP; it allows communication between VPC and internet but does not source traffic from a fixed IP.

Enabling HTTP/2 on the Application Load Balancer's HTTPS listener is the simplest way to improve performance during peak hours because ALB natively supports HTTP/2 and can be configured directly in the listener settings without additional infrastructure. Option A is incorrect because configuring EC2 instances to support HTTP/2 does not affect the load balancer's protocol handling. Option B is incorrect because adding a CloudFront distribution in front of the ALB is more complex and does not leverage the ALB's built-in HTTP/2 support.

Option D is incorrect because Network Load Balancers do not support HTTP/2; upgrading to NLB would not achieve the desired performance improvement.

Using an AWS Config rule with auto-remediation via SSM Automation can detect untagged resources in near real-time and automatically apply the required CostCenter tag, ensuring compliance without manual intervention. Option A is incorrect because tagging after creation is reactive and does not prevent untagged resources from existing temporarily. Option B is incorrect because IAM policies cannot enforce tagging across all services consistently, and many services allow resource creation without tags even with IAM restrictions.

Option C is incorrect because CloudFormation stack policies only control updates and deletions, not creation; they cannot prevent the creation of untagged resources.

A: Read replicas offload read queries from the primary instance, reducing read latency with minimal application changes (only need to modify connection strings for read queries). E: Increasing the DB instance size provides more CPU and memory, which can improve query processing and reduce read latency, and does not require application changes beyond a potential brief downtime. C is incorrect because migrating to Aurora is a significant change that requires database migration and possible application modifications, not a minimal change.

B is incorrect because Multi-AZ only provides failover, not read performance improvement. D is incorrect because max_connections does not directly affect read latency.

The correct answer. The issue occurs during deployment when new instances are launched. With sticky sessions enabled, user sessions are tied to specific instances.

If the Auto Scaling group's scale-in policy terminates instances that have active sessions (e.g., during a rolling update or instance replacement), users lose their session data and experience errors. Option A is incorrect because the deregistration delay is about waiting for in-flight requests to complete, not about session stickiness. Option B is incorrect because if stickiness duration were too long, requests would still be routed to terminated instances, but the issue here is after new instances are launched (scale-out), not scale-in.

Option D is incorrect because health checks are configured and would pass for new healthy instances; the errors stem from missing session data on the new instances.

Increasing the Lambda function's memory also increases CPU allocation proportionally, which directly speeds up CPU-bound processing and reduces the chance of timeout during peak hours. Option A is wrong because increasing reserved concurrency only allows more parallel invocations, but does not improve per-invocation performance; it could actually increase load on the same slow function. Option B is wrong because increasing the batch size makes each invocation process more messages, which would further increase processing time and worsen timeouts.

Option C is wrong because using a Lambda function URL changes the invocation source but does not affect CPU allocation or timeout behavior. Option E is wrong because migrating to ECS with Fargate is more complex and not the simplest solution; increasing Lambda memory is a simpler and effective change.

Enabling Cluster Mode on the ElastiCache for Redis cluster and configuring Multi-AZ provides automatic sharding and replication across Availability Zones. This ensures that session data is not lost if an AZ fails, as replicas in other AZs can take over. Option B is incorrect because read replicas alone do not provide automatic failover or data durability across AZ failures unless Multi-AZ is enabled.

Option C is incorrect because increasing instance size does not protect against AZ failure. Option D is incorrect because ElastiCache for Memcached does not support persistence or replication, so data would be lost on node failure.

Options A, C, and E are correct. Option A: AWS CodeBuild is well-suited for running integration tests as part of a CodePipeline test stage. Option C: Adding a test stage between build and deploy is the correct way to insert testing into the pipeline.

Option E: A manual approval step after the test stage provides a safety checkpoint before deployment. Option B is incorrect because CloudFormation is used for infrastructure provisioning, not for running tests. Option D is incorrect because Lambda functions are not designed for running integration tests directly; they are better for lightweight event-driven tasks.

Amazon RDS Multi-AZ does not support cross-Region standby; it only provides high availability within a single region. Option C is correct: Amazon Aurora Global Database offers synchronous cross-Region replication with automatic failover, typically achieving an RPO of less than 1 second and RTO of 1 minute, although it requires migrating from RDS MySQL to Aurora. Option D is incorrect: AWS DMS with continuous change data capture (CDC) uses asynchronous replication, which cannot guarantee a 1-second RPO.

Option B is incorrect because manual snapshots every hour cannot achieve an RPO of 1 second. Option E is incorrect because cross-Region read replicas use asynchronous replication, so RPO is not guaranteed to be 1 second, and manual promotion takes longer than 1 minute.

To automatically enable an AWS Config rule for all new accounts in AWS Organizations, the team should enable AWS Config in every account (Option E) and create a conformance pack in the management account deployed to the organization (Option C). AWS Config conformance packs allow deploying a set of AWS Config rules and remediation actions across accounts via Organizations. Enabling Config in all accounts is a prerequisite for rules to evaluate resources.

Option A (CloudFormation StackSets) can deploy rules but does not automatically enable Config per account. Option B (SCP) denies actions but does not enforce the Config rule itself. Option D (management account rule) would not automatically apply to other accounts unless using conformance packs.

Increasing the health check timeout gives instances more time to respond before being marked unhealthy, and decreasing the unhealthy threshold allows more consecutive failed health checks before considering an instance unhealthy, reducing false positives. Option A is incorrect because changing the protocol does not address the underlying cause of health check failures; it might even fail if the application does not support HTTPS. Option B is incorrect because using a Network Load Balancer does not resolve health check failures; NLB health checks are different but still need proper configuration.

Option C is incorrect because simply increasing the number of instances does not fix the health check issue; instances may still fail health checks if they are not healthy.

Using `Fn::Sub` with `!Ref AWS::StackName` makes the IAM role name unique per stack, preventing naming conflicts when stacks are deployed in the same account. Option A is incorrect because enabling termination protection only prevents accidental deletion, not naming conflicts. Option B is incorrect because a `DeletionPolicy` of `Retain` preserves the resource after stack deletion, but does not influence naming uniqueness; a future stack deployment could still encounter the same name conflict.

Option C is incorrect because a custom resource with a Lambda function unnecessarily adds complexity when a simpler built-in function (`Fn::Sub`) serves the purpose.

When a stack update fails and rolls back, but the rollback itself fails due to a resource (like the EC2 instance) being manually terminated, the stack enters UPDATE_ROLLBACK_FAILED. The recommended recovery is to manually resolve the issue (recreate the EC2 instance with the same configuration) and then use the 'ContinueUpdateRollback' operation to finish the rollback to a consistent state. Option A correctly describes this process.

Option B is incorrect because creating a change set does not address the failed rollback. Option C is incorrect because updating the stack without fixing the underlying drift may fail. Option D is incorrect because deleting and recreating the stack is more drastic and may not be necessary.

To prevent duplicate processing, the team should increase the SQS queue's visibility timeout to 6 minutes (option A). Since each message takes about 30 seconds to process, the default 60-second visibility timeout is too short; if processing exceeds 60 seconds, the message becomes visible again and is reprocessed. Increasing the timeout to 6 minutes (well above the 30-second processing time) ensures the message remains invisible until processing is complete.

Additionally, switching to a FIFO SQS queue with content-based deduplication (option C) provides exactly-once processing semantics, eliminating duplicates regardless of visibility timeout. Option B is incorrect because reserved concurrency limits the number of concurrent Lambda executions but does not prevent duplicates from visibility timeout issues. Option D is incorrect because reducing batch size limits how many messages are polled at once but does not address the root cause of duplicate processing.

Option E is incorrect because a dead-letter queue handles messages that fail repeatedly, not duplicates.

DynamoDB global tables use last-writer-wins (LWW) conflict resolution, and if the same item is updated concurrently in multiple regions, conflicts occur. Using conditional writes and application-level conflict resolution can help. Option A is wrong because strongly consistent reads are not supported for global tables; they only support eventual consistency.

Option B is wrong because write capacity insufficient would cause throttling, not write conflicts. Option D is wrong because DynamoDB global tables do have automatic conflict resolution via LWW; the issue is not misconfiguration but the concurrent updates.