CCNA Continuous Improvement Questions

Option D is correct because file versioning (changing the URL) guarantees fresh content without cache invalidation costs. Option A is wrong because it is costly and not automatic. Option B is wrong because reducing TTL increases origin load.

Option C is wrong because it does not invalidate existing cache.

Option A is correct because Multi-AZ RDS provides database high availability. Option B is correct because Auto Scaling across multiple AZs provides compute high availability. Option C is correct because an ALB distributes traffic across healthy instances.

Option D is wrong because a single EBS volume is not highly available. Option E is wrong because storing data only on the instance store is not durable.

Option D is correct. An SSL/TLS certificate must be associated with the CloudFront distribution, and the custom domain must be configured in the distribution settings. Option A: S3 supports HTTPS but CloudFront needs its own certificate.

Option B: ELB is not needed for static websites. Option C: ACM certificates can be used but must be in US East (N. Virginia) region for CloudFront.

Option B is correct because if the application is not properly configured to use the ElastiCache cluster, session data may be lost on instance replacement or scaling events. Option A is wrong because the Auto Scaling group is configured, but the issue is session persistence. Option C is wrong because health checks do not affect session data.

Option D is wrong because the ALB is not causing logout; the issue is session storage.

Option B is correct because using the RDS cluster endpoint (for Aurora) or the Multi-AZ DNS name (which automatically points to the current primary) ensures the application reconnects with minimal disruption. Option A is wrong because read replicas are for read scaling, not automatic failover. Option C is wrong because using an Elastic IP with RDS is not supported.

Option D is wrong because a Network Load Balancer adds complexity and latency.

Correct answers are B and C. Option B prevents deletion of the database. Option C uses update policies to control how changes are applied.

Option A is wrong because a new stack would require data migration. Option D is wrong because disabling rollback is risky. Option E is wrong because service roles don't prevent downtime.

Option C is correct because AWS CloudTrail logs all API calls to S3, including KMS decrypt calls. Option A is wrong because AWS Config records resource configuration, not access. Option B is wrong because VPC Flow Logs track network traffic, not API calls.

Option D is wrong because CloudWatch Logs can store logs but not generate them from S3 access.

Option C is correct because AWS CodeDeploy allows automatic rollback based on CloudWatch alarms. Option A is wrong because manual rollback is slower. Option B is wrong because CloudFormation stack rollback requires stack update, not real-time.

Option D is wrong because Elastic Beanstalk uses CodeDeploy internally but with less control.

Option B is correct because 'ResourceNotReady' indicates a dependency is not ready. Option A is incorrect because template syntax errors would show before deployment. Option C is incorrect because code errors would show during invocation.

Option D is incorrect because tags do not cause this error.

Options B and D are correct. Read Replicas can offload read traffic from the primary, reducing CPU utilization. Amazon ElastiCache caches frequent query results, reducing database queries.

Option A is wrong because increasing instance size of the primary helps but is not the only solution and may require downtime. Option C is wrong because converting to Multi-AZ does not reduce read load; Multi-AZ is for failover. Option E is wrong because RDS Proxy helps with connection pooling but not CPU reduction from queries.

Options A, C, and D are correct. A: Lambda Provisioned Concurrency reduces cold starts for predictable traffic. C: Using DAX reduces read latency and DynamoDB costs.

D: API Gateway caching reduces the number of requests to Lambda and DynamoDB. Option B is wrong because increasing timeout may increase costs without improving performance. Option E is wrong because DynamoDB on-demand can be more expensive for predictable workloads.

Option A: Adding more EC2 instances scales horizontally, distributing load. Option B: Increasing instance size vertical scaling may cause downtime if done without rolling replacement. Option C: Adding read replicas to ElastiCache offloads read traffic.

Option D: Enabling ELB connection draining ensures in-flight requests complete during instance replacement, improving availability. Option B is not chosen because it can cause downtime.

Option B is correct because using a launch template with a pre-warmed Amazon Machine Image (AMI) reduces instance startup time. Option D is correct because scheduled scaling can add capacity before expected spikes. Option A is wrong because decreasing the health check grace period may cause instances to be terminated prematurely.

Option C is wrong because increasing cooldown period delays scaling. Option E is wrong because reducing the health check interval does not speed up instance initialization.

For write-heavy workloads, using DynamoDB Accelerator (DAX) can reduce latency by caching writes. Option B is correct. Option A (increase WCU) is unnecessary with on-demand.

Option C (GSI) adds overhead. Option D (Auto Scaling) is for provisioned capacity.

Option D is correct because the CloudWatch agent can be installed on EC2 to send logs to CloudWatch Logs without code changes. Option A is wrong because copying logs to S3 requires custom scripting. Option B is wrong because Amazon Kinesis Agent is more complex and not necessary.

Option C is wrong because it would require modification to the application. Option E is wrong because CloudTrail is for API activity, not application logs.

Options A, B, and D are correct. A: RTO and RPO define recovery objectives. B: Replication of data ensures consistency.

D: DNS failover routes traffic to DR site. C is incorrect because using larger instances may not be needed. E is incorrect because multiple AZs solve high availability within a region, not DR across regions.

Option B is correct because a target tracking scaling policy automatically adjusts capacity based on the metric. Option A is wrong because step scaling is more complex and less efficient. Option C is wrong because scheduled scaling is for predictable patterns.

Option D is wrong because Lambda is not needed for this.

Option D is correct because using an EBS multi-attach enabled volume with a cluster file system allows instances in different AZs to share the same storage, providing high availability and no data loss. Option A is wrong because EBS snapshots are not real-time. Option B is wrong because EBS volumes cannot be attached to instances in different AZs.

Option C is wrong because EFS is a different service and not EBS.

Correct answers are A and E. Option A reduces risk by limiting blast radius. Option E speeds up releases by automating testing and deployment.

Option B is wrong because long-lived branches increase merge complexity. Option C is wrong because manual gates slow down frequency. Option D is wrong because rebuilding from scratch is risky and slow.

Option A is correct because CloudWatch Logs Insights allows querying multiple log groups in a single query, enabling centralized search. Option B is wrong because subscription filters send logs to a destination, but Kinesis Data Firehose is not designed for ad-hoc search. Option C is wrong because S3 is for long-term storage, not real-time search.

Option D is wrong because CloudWatch Contributor Insights analyzes top contributors, not arbitrary patterns.

Option B is correct because CodePipeline can publish events to Amazon SNS when the pipeline state changes, enabling notifications. Option A is wrong because CloudWatch alarms are for metrics, not pipeline state. Option C is wrong because CloudWatch Events (now Amazon EventBridge) can trigger notifications, but using SNS directly from CodePipeline is simpler.

Option D is wrong because SES is for email sending, but SNS is more appropriate.

Option D is correct because using multiple write replicas with sharding distributes the write load. Option A is wrong because adding more read replicas does not help write performance. Option B is wrong because Multi-AZ does not improve write performance; it provides failover.

Option C is wrong while increasing IOPS helps, it may not be cost-effective compared to sharding.

Option C is correct. Adding read replicas offloads read traffic from the primary instance, reducing CPU and IOPS load. Option A: Increasing instance size helps but may require downtime.

Option B: Multi-AZ is for high availability, not read scaling. Option D: Enabling Performance Insights provides monitoring but does not directly improve performance.

Option B is correct because adopting a cell-based architecture isolates failures to individual cells, reducing blast radius. Option A is wrong because a single shared database creates a single point of failure. Option C is wrong while Auto Scaling helps with capacity, it does not isolate failures.

Option D is wrong because a single Application Load Balancer can still be a bottleneck.

Option B is correct because a metric filter can create a metric from log events, and an alarm can trigger when the metric breaches a threshold. Option A is wrong because CloudWatch Logs Insights is for querying, not real-time alerting. Option C is wrong because an S3 event notification is for S3 events, not log content.

Option D is wrong because Lambda subscriptions are for real-time processing, but simpler is metric filter + alarm.

Option A is correct because Systems Manager Inventory collects and queries patch compliance data. Option B is wrong because it only shows state, not failures. Option C is wrong because Patch Manager does not have a dashboard.

Option D is wrong because it's not about missing patches.

Option A is correct because CloudWatch Events (now Amazon EventBridge) can match IAM CreateAccessKey events and trigger a notification. Option B is wrong because S3 events are for object-level operations, not API calls. Option C is wrong because CloudTrail logs events but doesn't natively send alerts.

Option D is wrong because Config rules evaluate resource configurations, not API calls.

Option D is correct because ElastiCache for Redis with Cluster Mode enabled and Multi-AZ provides automatic failover and data replication across Availability Zones. Option A is wrong because a single-node cluster has no redundancy. Option B is wrong because increasing instance size does not provide failover.

Option C is wrong because disabling persistence reduces durability.

Option D is correct because Lambda functions in a VPC require a NAT gateway or VPC endpoints to access the SQS API, which is outside the VPC. Without a NAT gateway, the function cannot poll the SQS queue, causing timeouts. Option A is wrong because Lambda can access RDS within the same VPC without issues.

Option B is wrong because 3-second timeout should be sufficient for a 2-second query if network is fine. Option C is wrong because the RDS instance size does not affect network connectivity to SQS.

Option A is correct because Amazon EC2 Auto Scaling with a launch template can reference the latest AMI ID using SSM Parameter Store. Option B is wrong because updating the AMI ID in the Auto Scaling group requires manual intervention. Option C is wrong because it does not automatically update the AMI.

Option D is wrong because CloudFormation does not automatically update the AMI.

Options A, C, and D are correct. AWS KMS provides managed keys with automatic annual rotation. AWS CloudTrail logs KMS API calls for auditing.

S3 uses server-side encryption with KMS keys (SSE-KMS). Option B is wrong because S3 SSE-S3 uses S3-managed keys, not customer-controlled. Option E is wrong because IAM is for access control, not encryption key management.

Option B is correct because the policy only allows access from the IP range 192.0.2.0/24, and the user's IP 203.0.113.5 is not in that range. Option A is wrong because the resource is correct. Option C is wrong because the action is correct.

Option D is wrong because the condition is valid.

Option A is correct. The bucket policy might deny access even if the IAM role allows it, because bucket policies are evaluated in addition to IAM policies. Option B is wrong because the pipeline uses the service role, not Git credentials.

Option C is wrong because there is no mention of encryption. Option D is wrong because the error is Access Denied, not a network issue.

Options A, C, and E are correct. Option A: Increasing the number of tasks per service allows handling more concurrent requests. Option C: Decreasing the cooldown period allows faster scaling.

Option E: Increasing the target value for the scaling metric makes scaling more aggressive. Option B is wrong because decreasing the number of subnets reduces capacity. Option D is wrong because decreasing the ALB idle timeout does not affect scaling.

Option B is correct because increasing the idle timeout setting on the ALB can help prevent premature connection closures that cause 504 errors. Option A is wrong because increasing the deregistration delay only affects instance draining, not idle timeouts. Option C is wrong because enabling cross-zone load balancing does not address timeout issues.

Option D is wrong because increasing the health check interval does not affect idle timeouts.

Options A and C are correct. Option A: Amazon RDS Multi-AZ provides high availability and automated backups. Option C: Amazon Aurora is a MySQL/PostgreSQL-compatible relational database with high availability and automated backups.

Option B is wrong because DynamoDB is NoSQL. Option D is wrong because ElastiCache is an in-memory cache. Option E is wrong because Redshift is a data warehouse.

Option B is correct. ResourceNotFoundException indicates the DynamoDB table does not exist or has been deleted. Option A is wrong because insufficient permissions cause AccessDeniedException.

Option C is wrong because throttling causes ProvisionedThroughputExceededException. Option D is wrong because a different error would occur if the function timed out.

Options A and D are correct. A: Blocking public access prevents unintended exposure. D: Enabling encryption protects data at rest.

B is incorrect because versioning is for data protection, not security. C is incorrect because logging is for auditing. E is incorrect because lifecycle policies manage storage, not security.

Option A is correct because using Read Replicas offloads read traffic from the primary instance, allowing the primary to be smaller. Option B is wrong because Reserved Instances reduce cost but do not change the instance size. Option C is wrong because it reduces availability.

Option D is wrong because it increases cost.

The correct answer is D because increasing the number of instances and adding an Auto Scaling group ensures capacity can handle spikes, preventing all hosts from becoming unhealthy. Option A is wrong because Reserved Instances don't help with scaling. Option B is wrong because instance refresh is for updates, not capacity.

Option C is wrong because a larger ALB does not fix the root cause of insufficient capacity.

Option D is correct because checking the stopped task logs in CloudWatch Logs reveals application errors. Option A is wrong because the task definition is likely correct if the old tasks work. Option B is wrong because the service event stream shows deployment events, not task logs.

Option C is wrong because ECS Exec requires the task to be running.

Option A is correct because if the DynamoDB table is in a different AWS account, the Lambda execution role must have cross-account trust permissions. Option B is wrong because DynamoDB does not require VPC endpoints for access. Option C is wrong because Lambda's temporary credentials are sufficient.

Option D is wrong because DynamoDB table names are case-sensitive but the error is ResourceNotFoundException, not AccessDeniedException.

Option B is correct because adding multiple origins in different regions and using geographic distribution or origin failover reduces latency for users in Europe. Option A is wrong because Lambda@Edge adds cost and complexity. Option C is wrong because cache behaviors do not affect latency.

Option D is wrong because Transfer Acceleration is for uploads.

Option D (RDS for MariaDB read replicas with read-only database connections) offloads read traffic without code changes, as read replicas can be used by modifying the connection string. Option A (Aurora) would require migration. Option B (ElastiCache) requires application code to cache data.

Option C (DynamoDB Accelerator) is for DynamoDB, not MariaDB.

Option D is correct because enabling connection draining on the ALB target group allows in-flight requests and WebSocket connections to complete before the instance is deregistered. Option A is wrong because sticky sessions do not prevent disconnections during scale-in. Option B is wrong because ASG lifecycle hooks do not affect ALB connections.

Option C is wrong because a Network Load Balancer is for TCP/UDP, not HTTP/WebSocket at the application layer.

Option D is correct because creating a read replica with the new version, promoting it, and switching DNS minimizes downtime. Option A is wrong because in-place upgrade causes downtime. Option B is wrong because snapshots take time.

Option C is wrong because DMS has overhead and potential lag.

Option B is correct because instance store volumes are ephemeral but provide low-cost storage; however, they are not durable. For temporary data, using an EBS volume with snapshots is not cost-effective. Option A is wrong because RAID with additional EBS volumes increases cost.

Option C is wrong because increasing IOPS adds cost. Option D is wrong because S3 is not block-level storage.

Option C is correct because moving session state to ElastiCache makes the application stateless, allowing instances to be added/removed without session loss. Option A is wrong because Auto Scaling without session management will cause session loss. Option B is wrong because sticky sessions alone don't prevent loss if an instance fails.

Option D is wrong because increasing instance size doesn't improve scalability.

Option B is correct because on-demand DynamoDB tables can still throttle if traffic exceeds the previous peak by more than double. The table might have a hot partition despite high cardinality if the workload is skewed. Option A is wrong because on-demand can handle sudden increases, but within limits.

Option C is wrong because provisioned capacity is not used. Option D is wrong because DynamoDB Accelerator (DAX) is for reads, not writes.

Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account.

Option C is reactive. Option D is not scalable across accounts.

Options A, C, and E are correct. Read replicas offload read traffic, ElastiCache reduces database load, and Multi-AZ provides high availability but not read scaling. Option B is wrong because it does not support sharding.

Option D is wrong because it only provides failover, not read scaling.

Options A, C, and D are correct. Change sets allow review, stack policies protect resources, and IAM policies enforce least privilege. Option B is wrong because nested stacks do not enforce change management.

Option E is wrong because Drift detection identifies differences but does not manage changes.

Option B is correct because CloudFormation can directly publish to SNS topics on stack events, including failures. Option A is inefficient because it requires polling. Option C is not native.

Option D is expensive and complex.

Option C is correct because adding an Auto Scaling group with a scaling policy based on CPU utilization dynamically adjusts capacity to handle load spikes, reducing 503 errors. Option A is wrong because larger instances may not be cost-effective and do not address dynamic scaling. Option B is wrong because increasing the ALB idle timeout does not affect CPU utilization.

Option D is wrong because reducing the health check interval may cause premature instance replacement without fixing the root cause.

Option B is correct because the Deny statement without a condition applies to all uploads, overriding the Allow. Option A is incorrect because the Allow only applies to SSE-S3. Option C is incorrect because the Deny statement applies to all principals.

Option D is incorrect because the Deny statement is explicit.

Option A is correct because change sets allow you to review changes before applying. Option B is correct because stack policies prevent updates to critical resources. Option D is correct because rolling updates with batch size reduce impact.

Option C is wrong because deletion policy only protects against stack deletion, not updates. Option E is wrong because nested stacks don't inherently prevent downtime.

Option C is correct because disabling rollback on failure allows the stack to remain in a failed state for investigation. Option A is wrong because you cannot describe stack events of a deleted stack. Option D is wrong because creating a change set does not help with the current failure.

Option B is wrong because you can check the specific resource status reason.

Option C is correct because scheduled scaling can pre-emptively add capacity based on known traffic patterns. Option A is wrong because increasing cooldown would delay scaling. Option B is wrong because step scaling is more aggressive but not proactive.

Option D is wrong because lowering threshold would cause over-scaling and cost.

Option C is correct because changing the default encryption configuration to SSE-KMS automatically encrypts new objects with the specified KMS key without re-uploading existing objects. Option A is incorrect because a lifecycle policy does not change encryption. Option B is incorrect because bucket policies do not control encryption keys.

Option D is incorrect because existing objects are not re-encrypted by default encryption changes.

Option A is correct because the new primary may have a pending modification (e.g., scaling) applied during failover, causing a brief performance impact. Option B is incorrect because failover is automatic. Option C is incorrect because parameter group changes require a reboot, not failover.

Option D is incorrect because Multi-AZ does not provide read replicas.

Option A is correct because the IAM role used by CloudFormation needs permissions to create EC2 instances. Option C is correct because updating the stack with the corrected IAM role allows the resource creation to proceed. Option B is wrong because the template doesn't need to be changed.

Option D is wrong because the service role is not the issue. Option E is wrong because user does not need more permissions.

Option B is correct because ECS Service Auto Scaling can use a target tracking scaling policy with the SQS ApproximateNumberOfMessagesVisible metric to scale the number of tasks. Option A is wrong because CloudWatch alarms on CPU can cause slow reaction. Option C is wrong because Lambda is not suitable for long-running CPU-bound tasks.

Option D is wrong because adjusting CPU allocation does not address scaling; it's a vertical scaling approach.

Option A is correct. The error indicates that the 'express' module is not found, which means it was not included in the deployment package. Option B is wrong because the function ran, so the handler is correct.

Option C is wrong because the Lambda execution role does not affect module availability. Option D is wrong because the error is a missing module, not a memory issue.

Option D is correct because updating the stack with a change set that replaces the resource causing the limit error is the safest way to handle it. Option A is wrong because deleting and recreating causes downtime. Option B is wrong because manual modifications lead to drift.

Option C is wrong because rolling back doesn't fix the underlying issue.