Continuous Improvement for Existing Solutions practice questions

Configure a simple scaling policy based on CPU utilization.

Why wrong: Simple scaling is reactive and adds capacity after metrics exceed thresholds.

Configure a scheduled scaling policy to add instances during known peak hours.

Why wrong: Scheduled scaling requires manual setup and does not adapt to unexpected spikes.

Configure a target tracking scaling policy based on average CPU utilization.

Why wrong: Target tracking is also reactive, maintaining a target metric.

Migrate the application to use Amazon DynamoDB with global tables.

Why wrong: This requires significant application changes.

Use Amazon RDS Multi-AZ with a standby instance for read traffic.

Why wrong: Multi-AZ standby is not used for read traffic.

Implement Amazon ElastiCache in front of the database to cache read queries.

Why wrong: ElastiCache requires application changes to implement caching logic.

Enable default encryption on each bucket using SSE-S3.

Why wrong: Default encryption only applies to objects uploaded without encryption headers; it can be overridden.

Require that all buckets use AWS KMS managed keys for encryption.

Why wrong: This does not enforce encryption at upload time.

Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

Why wrong: Stack policies protect resources from updates, not from unencrypted uploads.

Attach an IAM role to the underlying EC2 instance.

Why wrong: Fargate does not use underlying EC2 instances.

Assign an IAM role to the ECS service using the ECS service-linked role.

Why wrong: The service-linked role is for ECS to manage resources, not for the application.

Store AWS credentials in the container environment variables.

Why wrong: Storing credentials in environment variables is insecure.

Move the messages to a DLQ immediately after the first failure.

Why wrong: This would lose messages that could be retried successfully.

Decrease the batch size to 1 so that each invocation processes a single message.

Why wrong: This reduces throughput and does not handle partial failures in a batch.

Increase the batch size to 100 to process more messages per invocation.

Why wrong: This may increase the number of failures per invocation.

Use Amazon GuardDuty to monitor S3 data access patterns.

Why wrong: GuardDuty is for threat detection, not encryption enforcement.

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Why wrong: This does not enforce encryption; users can still choose not to use the role.

Enable AWS CloudTrail to log all S3 API calls.

Why wrong: Logging does not enforce encryption.

Use On-Demand Instances only for the batch job to ensure availability.

Why wrong: On-Demand is costlier than Spot for this workload.

Purchase Reserved Instances for the batch job capacity.

Why wrong: Reserved Instances require a 1- or 3-year commitment, not suitable for short monthly jobs.

Increase the ALB idle timeout to 120 seconds.

Why wrong: Increasing idle timeout does not address high CPU utilization.

Enable cross-zone load balancing on the ALB.

Why wrong: Cross-zone load balancing distributes traffic evenly but does not add capacity.

Reduce the target tracking scaling threshold to 50% average CPU.

Why wrong: Lowering threshold may cause frequent scaling but does not guarantee faster response to spikes.

Create a custom AMI that pre-populates session data from Amazon S3.

Why wrong: Session data is dynamic and cannot be pre-populated in an AMI.

Increase the Auto Scaling group's cooldown period to 600 seconds.

Why wrong: Longer cooldown delays scaling, which can cause performance issues.

Enable sticky sessions (session affinity) on the ALB.

Why wrong: Sticky sessions route traffic to the same instance but do not protect against instance termination.

Use AWS CloudTrail to monitor the UpdateStack API call and trigger a rollback via a Lambda function.

Why wrong: CloudTrail is for auditing, not automatic rollback.

Use AWS Config rules to detect stack failure and revert changes.

Why wrong: AWS Config does not perform rollbacks.

Create a custom resource in the CloudFormation template that performs rollback.

Why wrong: Custom resources add unnecessary complexity.

Increase the task-level CPU limit to 2048 units.

Why wrong: Increasing CPU limit per task does not change scaling behavior.

Decrease the target tracking value to 50% average CPU.

Why wrong: Lowering threshold may cause frequent scaling but not necessarily faster response to spikes.

Decrease the scale-in cooldown period to 60 seconds.

Why wrong: Scale-in cooldown affects termination, not launch speed.

Use AWS CloudTrail to capture log file changes.

Why wrong: CloudTrail records API calls, not application logs.

Modify the application to write logs to stdout and use the awslogs driver.

Why wrong: Requires code modification, which may not be feasible.

Set up an Amazon S3 bucket and use an AWS Lambda function to periodically copy log files.

Why wrong: Running a Lambda function to copy logs is less efficient and adds complexity.

Enable Multi-AZ for the RDS instance.

Why wrong: Multi-AZ provides failover, not read scaling.

Implement DynamoDB Accelerator (DAX) in front of the database.

Why wrong: DAX is for DynamoDB, not RDS for MySQL.

Scale up the RDS instance to a larger instance type.

Why wrong: Scaling up helps but does not fully address read-heavy workload.

{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::my-bucket/*"}

Why wrong: Grants full S3 access, violating least privilege.

{"Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": "*"}

Why wrong: Resource wildcard is too permissive.

The user cannot describe instances or terminate instances.

Why wrong: Describe is allowed by the first statement.

The user can terminate instances and describe instances.

Why wrong: Deny overrides Allow for termination.

The user can describe instances but cannot terminate any instances.

Why wrong: The user can describe, but the Deny prevents termination.

There are two instances with the Environment=production tag.

Why wrong: There are three instances in the output.

One of the instances is stopped.

Why wrong: The query filters for running instances only.

The command lists all instances in the account regardless of tags.

Why wrong: The command uses a filter for Environment=production.

Use CloudFormation change sets to review and approve all changes before update.

Why wrong: Change sets require manual approval, not automated recovery.

Write a custom AWS Lambda function that reverts changes when a stack update fails.

Why wrong: This adds unnecessary complexity; CloudFormation already provides automatic rollback.

Apply a stack policy to prevent updates to critical resources.

Why wrong: Stack policies prevent updates but do not auto-recover failures.

Configure an in-memory cache like Amazon ElastiCache to cache frequent queries.

Why wrong: Caching reduces read load but not writes; still CPU contention may remain.

Increase the instance size of the RDS DB instance to a larger instance type.

Why wrong: Vertical scaling may help temporarily but is not as efficient as offloading reads.

Enable Multi-AZ for the RDS instance to distribute the load across two instances.

Why wrong: Multi-AZ is for high availability, not read scaling.

{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}

Why wrong: PutImage is for ECR, not ECS service update.

{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}

Why wrong: RunTask starts a task, not updates a service.

{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}

Why wrong: RegisterTaskDefinition is for registering task definitions, not updating services.

Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.

Why wrong: This does not address DynamoDB throttling.

Configure reserved concurrency for the Lambda function to limit its maximum concurrency.

Why wrong: Reserved concurrency limits Lambda, not DynamoDB throttling.

Increase the concurrency limit for the Lambda function to allow more parallel executions.

Why wrong: More concurrency may increase throttling.