CCNA Continuous Improvement Questions

Options A and C are correct. A buffer-based scaling policy (target tracking) is more responsive than step scaling. Decreasing the cooldown period allows faster scaling out.

B is wrong because increasing instance size does not improve scaling responsiveness. D is wrong because decreasing minimum size could worsen performance. E is wrong because increasing cooldown slows down scaling.

Option B is correct because API Gateway caches authorizer responses; if the cache is enabled and the token is cached with a deny, subsequent requests with the same token will fail. Option A is wrong because the authorizer is being invoked. Option C is wrong because token expiration would cause a different error.

Option D is wrong because the Lambda function returns a policy.

Option A is correct because AWS X-Ray provides distributed tracing to pinpoint performance bottlenecks. Option B is wrong because CloudWatch Logs Insights is for querying logs, not tracing. Option C is wrong because increasing task size is a reactive fix.

Option D is wrong because CloudWatch Synthetics monitors endpoints, not internal traces.

Option A is correct because enabling ElastiCache for Redis cluster mode allows data to be distributed across multiple shards, reducing CPU load per node. Option B is wrong because read replicas are for read-heavy workloads, not for reducing CPU load on the primary. Option C is wrong because a larger node type may help but is less cost-effective than sharding.

Option D is wrong because ElastiCache does not support Lambda extensions.

Option A is correct because a service control policy can prevent creating unencrypted buckets. Option C is correct because AWS Config rules can detect non-compliant buckets. Option D is correct because S3 default encryption ensures new objects are encrypted.

Option B is wrong because S3 bucket policies enforce encryption at upload time, not after creation. Option E is wrong because CloudTrail logs events but does not enforce encryption.

Option D is correct because replacing instances with a new launch template and attaching the existing EBS volumes preserves data. Option A is wrong because it causes downtime. Option B is wrong because it does not preserve state.

Option C is wrong because it does not preserve data.

Option A is correct because AWS CodePipeline integrated with CodeBuild and CodeCommit provides a fully managed CI/CD service. Option B is wrong because Lambda@Edge is for edge computing, not deployment. Option C is wrong because S3 triggers are for event notifications, not full CI/CD.

Option D is wrong because CloudFormation is for infrastructure, not deployment pipeline.

Option B is correct. The output shows the instance has a security group 'sg-web-app' attached to its network interface. If that security group allows inbound traffic from 0.0.0.0/0, the instance would be accessible from the internet.

The subnet being private does not matter if a security group allows public access. Option A is wrong because the instance is in a private subnet, so it should not have a public IP. Option C is wrong because the output does not show a route table.

Option D is wrong because the instance does not have a public IP attached; it's in a private subnet.

Option D is correct because S3 default encryption ensures that all objects are encrypted at rest using SSE-S3 or SSE-KMS, regardless of whether the upload request specifies encryption. Option A is wrong because bucket policies cannot enforce encryption; they can deny uploads without encryption headers but are not the simplest method. Option B is wrong because S3 Access Points are used for managing access, not encryption.

Option C is wrong while valid, it's more complex than simply enabling default encryption.

Option C is correct because rightsizing the instance to a larger type can provide more CPU capacity, potentially reducing contention and allowing the same workload to run efficiently. Option A is wrong because buying Reserved Instances locks in cost but does not solve performance. Option B is wrong because terminating and recreating does not change instance type.

Option D is wrong because adding more instances may increase cost unnecessarily.

Option C is correct because the IAM role assumed by CloudFormation lacks the necessary permissions. Option A is wrong because the error is about the user/role, not AWS. Option B is wrong because the error does not mention S3.

Option D is wrong because the region is specified in the template.

Option C is correct because creating an HTTPS listener with an ACM certificate and redirecting HTTP to HTTPS ensures encryption. Option A is wrong because CloudFront adds complexity and cost. Option B is wrong because a TCP listener does not terminate TLS.

Option D is wrong because ACM cannot be directly associated with a TCP listener.

Option A is correct because the root user ARN does not grant access to individual IAM users; the policy must allow the entire account or specific user ARNs. Option B is wrong because the bucket policy can refer to another account. Option C is wrong because S3 does not require VPC endpoints for cross-account access.

Option D is wrong because the bucket policy can use IAM user ARNs.

Option A is correct because CloudFront geo-restriction allows whitelisting or blacklisting countries. Option D is correct because the geographic restriction feature is built-in. Option B is incorrect because S3 bucket policies do not support geographic restrictions.

Option C is incorrect because Lambda@Edge can be used but is more complex. Option E is incorrect because WAF can block based on country using geo match conditions.

Option A (Application Auto Scaling with target tracking) is the correct approach for ECS services. Option B (Auto Scaling group) is for EC2. Option C (CloudWatch alarm to stop tasks) is not scaling.

Option D (Lambda to add tasks) is less efficient.

Option C is correct because NoncurrentVersionExpirationInDays applies to noncurrent versions, but if the object has no current version (e.g., all versions are delete markers), the rule doesn't clean up delete markers. Option A is wrong because the rule is enabled. Option B is wrong because versioning is enabled.

Option D is wrong because bucket policy doesn't affect lifecycle.

Option B is correct because the AMI ID is region-specific. The template uses a hardcoded AMI ID that likely does not exist in the region where the stack is being created. Option A is incorrect because the AMI ID is syntactically correct.

Option C is incorrect because the instance type is valid. Option D is incorrect because SQS queue creation succeeds.

Option D is correct because increasing the number of DPUs (data processing units) allocated to the Glue job can parallelize processing and reduce runtime. Option A is wrong because converting to Parquet is a good practice but does not reduce processing time if the job is CPU-bound. Option B is wrong because increasing the timeout does not speed up processing.

Option C is wrong because S3 Transfer Acceleration speeds up uploads, not Glue processing.

Option A is correct because modifying the DBInstanceClass property in CloudFormation with an UpdatePolicy of AutoScalingReplacingUpdate will cause a replacement with minimal downtime. Option B is wrong because changing the template and updating the stack directly may cause downtime. Option C is wrong because creating a new stack and deleting the old one is not minimal downtime.

Option D is wrong because AWS OpsWorks is not relevant.

Option A is correct because CloudWatch Events can filter CloudTrail events and trigger a notification via SNS. Option B is wrong because it requires creating a custom metric. Option C is wrong because it is passive.

Option D is wrong because it requires custom analytics.

Option C is correct because the Lambda function's ENI must be deleted first by deleting the Lambda function or updating its configuration to not use the subnet. Option A is incorrect because the ENI is managed by Lambda and cannot be manually deleted. Option B is incorrect because the subnet is in use, so the stack cannot continue.

Option D is incorrect because force delete is not a valid operation for subnets.

Option B is correct because using CloudFormation StackSets with approval gates in CodePipeline allows centralized management and approval workflow. Option A is wrong because Change Sets require manual review and execution, increasing operational overhead. Option C is wrong because direct CLI updates bypass approval.

Option D is wrong because Service Catalog is for end-user provisioning, not for change management of existing stacks. Option E is wrong because it adds an extra service (Lambda) without need.

Options B and C are correct. Adding a Global Secondary Index with a different partition key can distribute reads across partitions. Adjusting read capacity units increases throughput.

Option A is wrong because changing the sort key would require a new table. Option D is wrong because DynamoDB Accelerator (DAX) improves read performance but is not a capacity change. Option E is wrong because table replication is for disaster recovery.

Option B is correct because increasing the number of Lambda function instances will increase concurrency and process more messages in parallel. Option A is wrong because increasing batch size may cause timeouts. Option C is wrong because increasing function memory/timeout does not directly improve throughput.

Option D is wrong because SQS visibility timeout does not affect Lambda concurrency.

Option A is correct because enabling DynamoDB auto scaling adjusts capacity dynamically, and adding retry logic with exponential backoff in Lambda handles transient errors. Option B is wrong because SQS with Lambda can buffer requests. C is wrong because increasing capacity might be costly and does not handle spikes.

D is wrong because Lambda retries on its own but without backoff.

Option D is correct. The Deny statement explicitly denies PutObject if the encryption is NOT aws:kms. Since the user uses SSE-S3 (AES256), the condition 'StringNotEquals' evaluates to true (AES256 != aws:kms), so the Deny applies and the request is denied.

Option A is wrong because the Allow statement is for GetObject, not PutObject. Option B is wrong because the Deny overrides any allow. Option C is wrong because the Deny explicitly denies.

Options B and C are correct. A target tracking scaling policy based on a metric like CPU utilization automatically adjusts capacity. A simple scaling policy with a step adjustment allows rapid scaling out.

Option A is wrong because scheduled scaling is for predictable patterns. Option D is wrong because manual scaling is not automated. Option E is wrong because a lifecycle hook delays scale-in, increasing costs.

Option C is correct because creating an additional CloudFront distribution with an origin in Europe or using a multi-region origin setup reduces latency for European users. Option A is wrong because S3 Transfer Acceleration improves uploads, not downloads. Option B is wrong because increasing TTL would reduce origin load but not latency for uncached objects.

Option D is wrong because adding more cache behaviors doesn't help with geographic latency.

Option A is correct because an increase in request count without a corresponding increase in target capacity can cause the ALB to return 503 errors when all targets are unhealthy or overloaded. Option B is incorrect because security groups were not changed. Option C is incorrect because if the health check path was removed, health checks would fail consistently, not intermittently.

Option D is incorrect because a missing security group rule would block traffic entirely, not cause intermittent errors.

Option A is correct because increasing the cooldown period makes the Auto Scaling group more conservative, but that would slow scaling. Actually, decreasing the cooldown allows faster scaling. The question asks for improved responsiveness; Option A (decreasing cooldown) is the correct answer.

Option B is wrong because a larger instance type may not help if the issue is scaling speed. Option C is wrong because multiple instance types add complexity and might not speed up scaling. Option D is wrong because scheduled scaling is proactive but does not respond to unexpected spikes.

Option A is correct. The first statement allows GET from the specified IP range. The second statement denies all actions if not using HTTPS.

Since the request uses HTTPS (SecureTransport true), the Deny condition does not apply, so the Allow takes effect.

Option A, Option C, and Option E are correct. Option A checks health check settings and logs. Option C checks if the service is running and tasks are healthy.

Option E checks if the service's desired count matches running tasks. Option B (Check target group stickiness) is not directly related to 503 errors. Option D (Switch to Network Load Balancer) is a major change and not diagnostic.

Option B is correct because Change Sets show the changes and potential errors before execution. Option A is wrong because it only shows the last event, not the planned changes. Option C is wrong because StackSets manage multiple accounts/regions, not single stack updates.

Option D is wrong because Drift detection shows differences from the template, not update conflicts.

Option A is correct because the CLI command is querying the wrong region. The stack was created in us-east-1 but the CLI default region might be different. Option B is wrong because the stack was created successfully.

Option C is wrong because outputs are returned correctly. Option D is wrong because the stack name is exactly as used.

Option C is correct because using a VPC endpoint for S3 (Gateway or Interface) ensures traffic stays within the AWS network. Option A is wrong because internet traffic goes over the public internet. Option B is wrong because a NAT gateway is for outbound internet, not private access to S3.

Option D is wrong because S3 Transfer Acceleration uses the internet.

Option C is correct because increasing WCUs alone would cost more and might not be efficient if the issue is read-heavy. Option D (DAX) reduces read latency but doesn't increase write capacity. Option A (increase memory) increases CPU but not write capacity.

Option B (SQS) decouples the writes, allowing retries and smoothing out spikes, which is cost-effective because SQS is cheap and prevents throttling by buffering requests.

Option D is correct because the error occurs even though the user has the StopInstances permission; likely the instance is protected by a resource-based policy or a service control policy (SCP) at the account level. Option A is wrong because the policy uses Resource '*' which includes all instances. Option B is wrong because there is no condition requiring tags.

Option C is wrong because the CLI syntax is correct.

Option C is correct because the Deny statement with StringNotEquals will block any PutObject that does not specify SSE-S3 (AES256). Since the CLI command does not specify encryption, the Deny applies. Option A is wrong because the Allow statement requires encryption.

Option B is wrong because the object is not encrypted. Option D is wrong because it would be denied.

Option A is correct because S3 bucket policies can deny PutObject requests that do not specify the required encryption, ensuring SSE-KMS is used. Option B is wrong because S3 default encryption only applies if no encryption header is set, but can be overridden. Option C is wrong because IAM policies can restrict API calls but not enforce encryption on objects.

Option D is wrong because AWS Config can detect non-compliant objects but not prevent them.

Option B is correct because a dynamic scaling policy adjusts the number of instances based on CPU utilization. Option A is wrong because it does not replace unhealthy instances. Option C is wrong because it replaces all instances at fixed times.

Option D is wrong because it only replaces instances on a schedule.

Option B is correct because creating a CloudFront invalidation removes cached objects, forcing CloudFront to fetch the latest content from the origin. Option A is wrong because S3 bucket versioning controls object versions but does not invalidate CloudFront cache. Option C is wrong because decreasing TTL affects future caching but does not clear existing cache.

Option D is wrong because disabling the distribution is disruptive and unnecessary.

Options A, B, and D are correct. Enabling Performance Insights helps identify queries causing load. Enabling enhanced monitoring provides OS-level metrics.

Using RDS events can indicate maintenance or issues. C is wrong because increasing instance size is a remedy, not a diagnostic step. E is wrong because Multi-AZ is for high availability, not performance diagnosis.

Option B is correct because creating a read replica offloads read traffic from the primary instance, improving read performance. Option A is wrong because increasing the DB instance size may help but is more expensive and not as targeted. Option C is wrong because RDS Proxy is for connection pooling, not read scaling.

Option D is wrong because Multi-AZ provides high availability, not read scaling.

Option B is correct. The error message indicates that the LaunchConfigurationName property must be a string, meaning it was probably not provided or was of the wrong type. Option A is wrong because the error does not mention IAM.

Option C is wrong because the error is about LaunchConfigurationName, not VPC. Option D is wrong because the error is about the creation, not the resource type itself.

Option A is correct because CloudWatch can monitor service quotas via metrics published by AWS and trigger alarms. Option B is wrong because AWS Config evaluates resource configurations, not quotas. Option C is wrong because Trusted Advisor provides a dashboard but not proactive alarms.

Option D is wrong because CloudTrail logs API calls, not quota utilization.

Option C is correct because an S3 bucket policy that denies PutObject without the correct encryption header enforces encryption at upload time. Option A is wrong because default encryption applies only if no encryption header is provided; it can be overridden. Option B is wrong because it only encrypts existing objects, not future ones.

Option D is wrong because CloudTrail does not enforce encryption.

Option A is correct because Multi-AZ with a standby in another region (cross-region) provides synchronous replication with low RPO/RTO. Option D is correct because a read replica in another region can be promoted quickly. Option B is wrong because cross-region snapshot copy has higher RPO.

Option C is wrong because automated backups have higher RPO. Option E is wrong because DMS has higher latency.

Option A is correct because Amazon RDS Proxy handles connection pooling, reducing database load and improving scalability, which directly addresses latency and timeouts. Option B is wrong because Read Replicas help with read-heavy workloads but do not reduce connection overhead. Option C is wrong because DynamoDB Accelerator (DAX) is used for DynamoDB, not RDS.

Option D is wrong because increasing instance size is a vertical scaling approach that does not address the connection pooling issue and may still lead to timeouts under high connection counts.

Option C is correct because origin access identity (OAI) allows CloudFront to access S3 securely. Option A is wrong because signed URLs are for end-user access. Option B is wrong because bucket policy with OAI is the right approach, but this option describes OAI.

Option D is wrong because CloudFront does not use IAM roles for S3 access.

Option A is correct because the pipeline role needs s3:PutObject permission on the bucket. Option B is wrong because S3 bucket policy is not the issue if the pipeline uses a role. Option C is wrong unless the role already has the permission.

Option D is wrong because versioning is not required for writes.

Option D is correct because an S3 bucket policy with a condition that denies PutObject if encryption headers are not present enforces encryption for all new objects. Option A is wrong because default encryption only encrypts objects that don't specify encryption, but doesn't enforce it. Option B is wrong because pre-signed URLs do not enforce encryption.

Option C is wrong because CloudFront does not enforce encryption at the S3 level.

Option B is correct because rolling back the stack update to the last known good state is the standard approach. Option A is incorrect because continuing update may propagate errors. Option C is incorrect because deleting the stack would remove all resources.

Option D is incorrect because a new stack may have dependencies.

Option D is correct because increasing the Lambda function's reserved concurrency ensures the function can handle more concurrent executions, reducing throttling. Option A is wrong because Lambda does not support concurrency limits per queue. Option B is wrong because using a Lambda event source mapping for SQS already batches messages.

Option C is wrong because adding more queues does not increase concurrency per function.

Options B and D are correct. 503 errors from ALB indicate the target group has no healthy targets. Checking ECS service events (B) can reveal why tasks are unhealthy. Enabling ECS service Auto Scaling (D) will increase the number of tasks to handle traffic.

Option A is wrong because increasing ALB idle timeout does not affect health. Option C is wrong because increasing deregistration delay might help but is not a primary fix. Option E is wrong because increasing task memory might not solve the health issue if it's due to capacity.

Options A, C, and E are correct. An Application Load Balancer provides DNS names for services. AWS Cloud Map enables service discovery with custom DNS names.

Amazon Route 53 can be used to register custom domain names. Option B is wrong because Amazon ECS Service Connect is a feature for service discovery but is not required; it can be used instead of Cloud Map. Option D is wrong because Network Load Balancer is not required for DNS-based discovery.

Option D is correct because running a task definition dry-run in CodePipeline can validate the image existence before deployment. Option A is wrong because ECR lifecycle policies manage images, not validate deployment. Option B is wrong because CloudTrail logs events but does not prevent failures.

Option C is wrong because ECR scan on push only scans for vulnerabilities, not image existence.

CloudWatch alarms can monitor EC2 status check metrics and trigger an SNS notification. Option B is correct. Option A uses CloudTrail for API calls, not status checks.

Option C is for load balancer target health. Option D uses SSM, which is not real-time for status checks.

Option A is correct because Lambda functions in a VPC require a NAT gateway or VPC endpoints to access external services; without it, they cannot reach the internet, causing timeouts. Option C is wrong because Lambda automatically scales. Option D is wrong because the function already has a VPC configuration.

Option B is wrong because concurrent executions do not cause timeouts.

Option C is correct because setting up RDS read replicas offloads read traffic from the primary instance, and can be done with zero application changes if the application uses a separate endpoint. Option A is wrong because increasing instance size is a vertical scaling approach but may not help with complex joins. Option B is wrong because ElastiCache requires application code changes.

Option D is wrong because DynamoDB is a different database and would require significant application rework.

Option B is correct because specifying 'UpdateReplacePolicy' does not exist; the correct approach is to allow modification of storage type without replacement. Option A is wrong because creating a new stack is unnecessary. Option C is wrong because DeletionPolicy affects stack deletion, not updates.

Option D is correct because changing the 'StorageType' property in the template will trigger a modification that can be done online with minimal downtime.

Option B is correct because creating a separate Lambda function with the same code but a different name allows testing and debugging without impacting the production function. Option A is wrong because version aliases can route traffic but still affect production. Option C is wrong because CloudWatch Logs will show the production function's logs.

Option D is wrong because changing the timeout directly on the production function could break the SLA.

Option C is correct because high request count per target with low CPU suggests the application is I/O bound or waiting on external calls; adding more instances will distribute the load and reduce queueing. Option A is wrong because increasing instance size may not help if the bottleneck is not CPU. Option B is wrong because scaling based on CPU would not trigger since CPU is low.

Option D is wrong because changing the ALB routing algorithm to least outstanding requests could help but adding more instances is more direct.

Option B is correct because S3 default encryption can be set at the bucket level for all objects. Option A is wrong because bucket policies can enforce encryption but require a policy per bucket. Option C is wrong because AWS Config can detect noncompliant buckets but not enforce encryption.

Option D is wrong because IAM policies cannot enforce encryption on S3 buckets.