CCNA Continuous Improvement Questions

Option D is correct because Provisioned Concurrency keeps a number of execution environments warm. Option A is wrong because increasing memory reduces cold start duration but does not eliminate it. Option B is wrong because it increases cost and complexity.

Option C is wrong because it reduces performance.

Option A is correct because ElastiCache for Redis provides an in-memory cache that reduces database read load without code changes. Option B is wrong because it would not reduce database load. Option C is wrong because RDS Proxy is for connection pooling, not caching.

Option D is wrong because increasing instance size is a vertical scaling approach that may not be as cost-effective as caching.

Option D is correct. Using DynamoDB Accelerator (DAX) caches hot data and reduces read/write load on partitions. Option A: Increasing read/wix capacity units does not apply to on-demand mode.

Option B: Adding a secondary index does not reduce throttling on the base table. Option C: Using SQS for writes would add latency and change application behavior.

Options B and D are correct. B: Using a lifecycle hook with a custom action can pause the instance before termination, allowing graceful draining. D: Using a rolling update with a batch size ensures that only a portion of instances are patched at a time.

Option A is wrong because stopping instances all at once causes downtime. Option C is wrong because increasing desired capacity without draining connections may cause issues. Option E is wrong because Amazon Inspector identifies vulnerabilities but does not implement patching.

Option A is correct because enabling log file validation creates a digest file that can be used to verify integrity. Option D is correct because S3 Object Lock prevents objects from being deleted or overwritten. Option B is incorrect because SSE-KMS does not prevent tampering.

Option C is incorrect because S3 Lifecycle does not prevent deletion. Option E is incorrect because S3 Transfer Acceleration does not provide security.

Option B is correct because the Condition block requires the resource tag to be 'Environment: production', but the action 'StartInstances' does not support resource-level authorization; it requires 'ec2:StartInstances' to be allowed without conditions, or the condition must be on the request. AWS evaluates conditions on the resource only for actions that support it. Option A is wrong because the policy allows all actions.

Option C is wrong because the policy does not enforce MFA. Option D is wrong because the policy is attached to a group, not a user, but that should still work.

Option A is correct because a NAT Gateway in a public subnet allows outbound internet traffic while preventing inbound connections. Option B is incorrect because a NAT instance is less managed and secure. Option C is incorrect because a VPC endpoint is for AWS services only.

Option D is incorrect because an Internet Gateway attached to the private subnet would allow inbound traffic.

Option B is correct because leveraging AWS X-Ray to trace requests end-to-end helps identify which component is causing latency. Option A is wrong because adding more EC2 instances may not address the root cause and could increase costs. Option C is wrong because switching to a Network Load Balancer (NLB) does not provide visibility into application-level latency.

Option D is wrong because enabling detailed monitoring on the ALB only provides metrics, not traces. Option E is wrong because migrating to Lambda adds complexity and may not solve latency issues caused by other factors.

Option C is correct. AWS recommends stopping and starting the instance to move it to new underlying hardware when system status checks fail. Option A is wrong because the instance is already running.

Option B is wrong because reboot may not resolve hardware issues. Option D is wrong because changing instance type does not fix underlying hardware impairment.

Option A is correct because a high SurgeQueueLength means the ALB is receiving more requests than the healthy instances can handle, causing queuing. Option B is wrong because surge queue is for HTTP requests, not connections. Option C is wrong because it is not a client-side issue.

Option D is wrong because the queue is at the ALB level, not instance level.

Option B is correct because AWS VPN CloudHub provides a hub-and-spoke model for multiple VPN connections, but for failover, using BGP with Direct Connect and VPN as backup is standard. However, the best answer is to use a Direct Connect gateway with a VPN attachment for failover. Option A is wrong because it adds latency.

Option C is wrong because it bypasses Direct Connect. Option D is wrong because it does not provide automatic failover.

The ALB sends requests to targets based on health checks. If the health check path returns a non-200 status, the target is marked unhealthy. A misconfigured health check path (e.g., pointing to a non-existent endpoint) can cause all instances to be marked unhealthy, leading to 503 errors.

Option B is correct because it directly affects health check status. Options A, C, and D would not cause the healthy host count to drop to zero.

Options A and C are correct. Resource quotas prevent a single namespace from consuming all resources. Horizontal Pod Autoscaler automatically scales pods based on resource usage.

Option B is wrong because Vertical Pod Autoscaler adjusts resource requests, but can cause pod restarts. Option D is wrong because cluster autoscaler adds nodes, not reduces evictions due to pod-level constraints. Option E is wrong because increasing requests may lead to over-provisioning.

The exhibit shows the log group has a retention policy of 30 days. To change it to 7 days, use the put-retention-policy CLI command. Option B is correct.

Option A (CloudTrail) is for API logs. Option C (S3 lifecycle) is for objects, not CloudWatch Logs. Option D (export to S3) is for archival, not deletion.

Option D is correct because the CloudWatch agent can be configured to buffer logs to disk, preventing data loss during instance termination. Option A is incorrect because EBS volumes do not persist when an instance is terminated unless termination protection is enabled, but logs are on instance store. Option B is incorrect because S3 Lifecycle does not affect CloudWatch log retention.

Option C is incorrect because CloudWatch agent does not export to S3 directly without additional configuration.

Option B is correct because Fargate tasks are ephemeral; they can be replaced due to deployments or health checks, causing loss of local session data. Option A is wrong because ALB sticky sessions are irrelevant if the container itself is replaced. Option C is wrong because scaling out does not cause individual container replacement.

Option D is wrong because the issue is about session persistence, not security groups.

Option C is correct because increasing memory and vCPU together can improve performance for CPU-bound tasks. Option A is wrong because increasing only memory doesn't address CPU. Option B is wrong because increasing only vCPU might not be enough if memory is also a bottleneck.

Option D is wrong because scaling horizontally may not reduce latency for a single request if the task itself is underpowered.

Option B: Enabling DynamoDB auto scaling adjusts capacity based on traffic patterns, reducing throttling-related errors. Option C: Configuring API Gateway caching reduces the load on Lambda and DynamoDB for repeated requests. Option A: Increasing Lambda timeout may not address root cause and could mask issues.

Option D: Provisioned concurrency helps with cold starts but not with DynamoDB throttling. Option E: Lambda reserved concurrency limits concurrency, which could worsen throttling.

Option D is correct because Amazon EFS provides a fully managed NFS file system that can be mounted by multiple EC2 instances with strong consistency. Option A is wrong because EBS volumes can only be attached to one instance at a time (multi-attach is limited). Option B is wrong because S3 is object storage, not a file system.

Option C is wrong because S3 Glacier is for archival.

Option A provides detailed metrics for each service. Option C helps trace requests across services. Option E shows latency distribution.

Option B (CloudTrail) is for API calls. Option D (VPC Flow Logs) is for network traffic analysis, not application latency.

Option B is correct because using an origin shield reduces load on the origin and improves cache hit ratio, reducing latency. Option A is wrong because enabling additional SSL methods does not affect latency. Option C is wrong while adding more edge locations is not directly configurable; CloudFront automatically uses a global network.

Option D is wrong because S3 Transfer Acceleration speeds up uploads, not downloads.

Option B is correct because setting the bucket's DeletionPolicy to Retain allows the stack to update even if the bucket already exists, and manual deletion is avoided. Option A is wrong because it does not prevent the update failure if the bucket exists. Option C is wrong because importing requires manual steps and does not prevent update failures.

Option D is wrong because it does not address the root cause.

Option D is correct because migrating to a containerized, stateless application decouples storage and allows scaling. Option A is wrong because a larger instance still has a single point of failure. Option B is wrong because RDS is for databases, not for application data stored in files.

Option C is wrong because a Multi-Attach EBS volume has limited support and multiple instances writing to the same volume can cause data corruption.

Option B is correct because increasing the TTL allows objects to stay in cache longer. Option C is correct because normalizing query strings ensures that different query string orders don't create multiple cache entries. Option A is wrong because shorter TTL reduces cache hits.

Option D is wrong because custom error responses don't affect cache hit ratio. Option E is wrong because enabling compression improves speed, not cache hit ratio.

Option A is correct because the exhibit shows SupportedArchitectures includes both x86_64 and arm64, so t3.large supports both. Option B is wrong because it does support arm64. Option C is wrong because the architecture is chosen at launch, not automatically.

Option D is wrong because t3.large is current generation.

Correct answers are A, C, and D. Option A ensures data is available in multiple AZs. Option C distributes instances for high availability.

Option D handles traffic distribution and health checks. Option B is wrong because EBS volumes cannot be attached cross-AZ. Option E is wrong because Read Replicas are for RDS, not EBS.

Option D is correct because placing instances in an Auto Scaling group across multiple Availability Zones ensures that if one AZ fails, traffic is routed to the other. Option A is wrong because a larger instance does not add fault tolerance. Option B is wrong because multiple subnets in one AZ still share that AZ's risk.

Option C is wrong because multiple EBS volumes do not provide instance-level redundancy.

Option D is correct because using a sticky session (session affinity) ensures that requests from a user are routed to the same instance during the update. Option A is wrong because a blue/green deployment would lose state if not designed for stateful apps. Option B is wrong because terminating instances immediately loses state.

Option C is wrong because scaling out first without sticky sessions may route requests to new instances that don't have the state.

Option D is correct because Lambda's event source mapping for SQS has a 'Maximum retries' setting (default 3) that controls how many times Lambda will retry a failed message batch. Option A is wrong because the SQS queue's 'Default visibility timeout' affects how long a message is hidden after being received, not the number of retries. Option B is wrong because the 'maxReceiveCount' is a SQS redrive policy property, not directly for Lambda retries.

Option C is wrong because the DLQ property is for sending failed messages to a dead-letter queue, not for controlling retry count.

Option D is correct because using Amazon ECS task networking with VPC and enabling VPC Flow Logs captures network traffic metadata. Option A is wrong because AWS X-Ray captures application-level traces, not network packets. Option B is wrong because CloudWatch Logs agent captures logs, not network traffic.

Option C is wrong because ECS Exec allows shell access but not traffic capture.

Option B is correct because a swap at the DNS level (e.g., Route 53 weighted records or blue/green with ALB) is key. Option D is correct because for stateful apps, migrating session state to ElastiCache or DynamoDB ensures continuity. Option A is wrong because ELB does not manage blue/green natively.

Option C is wrong because setting TTL high delays traffic switching. Option E is wrong because deregistering instances from the old group is done after testing, not immediately.

Option A is correct because SCPs can enforce encryption. Option C is correct because Config rules detect non-compliance. Option E is correct because remediation actions can auto-fix violations.

Option B is wrong because IAM policies are not preventive at the OU level. Option D is wrong because CloudTrail trails are for logging, not enforcement.

Options A and E are correct. Option A: Viewing stack events shows detailed error messages for each resource. Option E: Using ChangeSets allows previewing changes before applying.

Option B is wrong because the stack is in ROLLBACK_COMPLETE, not UPDATE_ROLLBACK_FAILED. Option C is wrong because StackSets manage multiple accounts, not single stack debugging. Option D is wrong because the template is already in use; reviewing the previous version is not directly helpful.

Option C is correct. When using Fargate, each task gets an ENI. If the security group for the tasks does not allow inbound traffic from the ALB on the health check port, the health check will fail.

The architect confirmed the application responds correctly, so the issue is likely network connectivity. Option A is wrong because the health check path is correct. Option B is wrong because target group deregistration delay does not cause health check failures.

Option D is wrong because the ALB is already configured correctly; the issue is at the task level.

Option B is correct because DNS TTL caching can cause the application to resolve the old IP for the duration of the TTL, even after the DNS record is updated during failover. Option A is wrong because the RDS DNS name remains the same after failover; only the IP changes. Option C is wrong because the connection pool's connection timeout is 30 seconds, which is short, but the issue is DNS caching, not timeout.

Option D is wrong because RDS failover typically takes less than 2 minutes, but the 5-minute downtime suggests DNS propagation delay.

Option D is correct because the spread strategy distributes tasks across availability zones, reducing contention. Option A is wrong because increasing memory doesn't address placement. Option B is wrong because more tasks could worsen contention.

Option C is wrong because GPU instances are not relevant.

Option C is correct because the condition restricts allowed instance types, so t2.medium is not allowed. Option A is incorrect because the condition is explicit. Option B is incorrect because the condition applies.

Option D is incorrect because the policy is evaluated at launch time.

The StackStatusReason indicates resource creation failure (MyEC2Instance). This could be due to insufficient IAM permissions to create the EC2 instance. Option A is correct.

Option B (template syntax) would cause a validation error before stack creation. Option C (out of quota) would also cause failure but is less specific. Option D (wrong region) would not cause a rollback after creation starts.

Option B is correct because the lifecycle rule expires noncurrent versions after 30 days. Deleting the object creates a delete marker (current version) and the previous version becomes noncurrent. After 30 days, the noncurrent version is permanently deleted.

Option A is wrong because the delete marker remains. Option C is wrong because only noncurrent versions expire. Option D is wrong because the delete marker is not expired.

Option D is correct because AWS Config rules with automatic remediation via Systems Manager Automation documents can enforce encryption and public access settings across accounts using an organization-wide conformance pack. Option A is too manual. Option B (Service Control Policies) can prevent public access but not enforce encryption on existing buckets.

Option C (CloudWatch Events) requires per-account setup and custom Lambda functions.

Option D is correct because detailed CloudWatch metrics (at 1-minute granularity) can provide more granular data to pinpoint when CPU spikes occur. Option A is wrong because increasing instance size only masks the symptom. Option B is wrong because scaling policies respond to sustained high CPU, not intermittent spikes.

Option C is wrong because CloudTrail records API calls, not instance-level metrics.

Option D is correct because the command filters by security group ID, so only interfaces in that group are shown. The second interface may belong to a different security group. Option A is wrong because the filter is by group-id, not instance-id.

Option B is wrong because the command does not filter by device index. Option C is wrong because the command can list all interfaces in the group regardless of attachment.

Option B is correct because Amazon CloudWatch Logs and Metrics provide centralized monitoring. Option A is wrong because AWS X-Ray is for tracing, not metrics. Option C is wrong because AWS Config is for configuration compliance.

Option D is wrong because Amazon Inspector is for security assessment.

Option C is correct because non-essential containers can fail without affecting the task. Option A is wrong because only essential container failure stops the task. Option B is wrong because ECS will not restart a non-essential container by default; it depends on the task definition restart policy.

Option D is wrong because the sidecar's CPU=0 means it can use up to the available CPU, but it still runs.

When a Lambda function is VPC-enabled, it requires a VPC endpoint for services like S3, DynamoDB, or a NAT gateway for internet access. If the function needs to access the database via a public endpoint, a NAT gateway is needed. Option D is correct.

Option A is about Lambda's environment variables. Option B is about database credentials. Option C is about Lambda's concurrency, not connectivity.

Option A is correct because the pattern suggests the function times out after 30 seconds of processing, and the SQS messages become visible again after the visibility timeout. The errors at regular intervals (20 minutes) indicate that the function retries the same messages. Option B is wrong because insufficient concurrency would cause throttles, not errors.

C is wrong because memory would cause out-of-memory errors, not timeouts. D is wrong because runtime updates would cause all invocations to fail.

Option B is correct because updating the service with the new task definition and a rolling update deployment controller achieves a rolling update. Option A is wrong because deleting and recreating causes downtime. Option C is wrong because updating the task definition alone does not trigger deployment.

Option D is wrong because creating a new service is unnecessary.

Option A avoids downloading dependencies on every build by using a custom Docker image with pre-installed dependencies. Option B caches dependency files in a persistent S3 bucket. Option C (increase compute) may help but does not address the root cause.

Option D (parallel builds) may increase complexity. Option E (CodeArtifact) is for storing artifacts but does not speed up initial download as much as caching.

Options B and D are correct. WAF can inspect custom headers, and ALB can forward headers to the target. Option A is wrong because Security Groups do not inspect headers.

Option C is wrong because Cognito is for user pools, not custom headers. Option E is wrong because CloudFront is a CDN, not a security service.

Option D is correct. When a Lambda function is configured to access a VPC, it loses internet access unless a NAT gateway or VPC endpoints are provided. To access S3, the function needs an S3 VPC endpoint (gateway type) in the same VPC and subnet.

Without it, the PutObject call fails with 'Access Denied' because the function cannot reach the S3 API endpoint. Option A is wrong because the IAM policy allows s3:PutObject. Option B is wrong because the bucket policy does not deny access.

Option C is wrong because the source bucket permissions are for read, not write; the error is on write.

Options A, B, and D are correct. Create a read replica (A) from the source DB instance. Modify the application to use the read replica endpoint for read queries (B).

Ensure the read replica is in a different AZ for high availability (D). Option C is wrong because read replicas do not need to be in the same AZ. Option E is wrong because Multi-AZ is for the source instance, not the read replica.

Option B is correct because the Lambda function should only be invoked via the API Gateway, not directly from the internet. The security group should restrict inbound traffic from the API Gateway's source, not from all IPs. Option A is incorrect because outbound traffic is needed for the function to send responses.

Option C is incorrect because VPC attachment is necessary for accessing internal resources. Option D is incorrect because the Lambda function is already in a VPC.

Option D is correct because S3 Versioning keeps all versions, and when combined with a lifecycle policy to expire after 30 days, it allows recovery. Option A is wrong because it is for access logs. Option B is wrong because it prevents overwrites but not deletions.

Option C is wrong because it is for archive, not immediate recovery.

Option A is correct because increasing the Lambda timeout gives more time for authorization. Option C is correct because enabling caching reduces invocations of the authorizer. Option B is wrong because request validation does not affect authorizer performance.

Option D is wrong because it does not help the authorizer. Option E is wrong because concurrency is not the issue.

Option A is correct because adding a memory alarm allows the Auto Scaling group to scale out before memory exhaustion causes failures. Option B is wrong because increasing instance count per AZ doesn't address the root cause of memory pressure. Option C is wrong because memory-optimized instances provide more memory per instance, reducing the likelihood of failure.

Option D is wrong because a scheduled scaling policy is for predictable traffic, not for memory-driven scaling.

Option C is correct because if the health check target is misconfigured (e.g., wrong path or port), healthy instances may be marked as unhealthy, causing unnecessary replacements and errors. Option A is wrong because a longer health check interval would reduce unnecessary replacements. Option B is wrong because instance type does not directly affect health checks.

Option D is wrong because a smaller Auto Scaling group might cause capacity issues but not necessarily errors due to unhealthy instances.

Options A, C, and D are correct. VPC Flow Logs capture network traffic, Container Insights provides metrics, and CloudWatch Logs capture container logs. B is for Linux commands, not AWS services.

E is for CI/CD, not troubleshooting.