Operations and Maintenance practice questions

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume

Why wrong: Incorrect. AWS does not allow creating an encrypted snapshot directly from an unencrypted volume. You must first create an unencrypted snapshot, then copy it with encryption.

Use the AWS Management Console to modify the volume and enable encryption in place

Why wrong: Incorrect. The AWS Management Console or APIs do not support in-place encryption of an existing EBS volume. Encryption must be applied at volume creation time.

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Why wrong: Incorrect. The ModifyVolume API does not support enabling encryption on an existing volume. Encryption can only be applied when creating a new volume.

Reduce the health check grace period on the Auto Scaling group.

Why wrong: Reducing the health check grace period on the Auto Scaling group does not affect database reconnection time. It only affects how quickly instances are replaced if they fail health checks.

Increase the minimum number of application servers in the Auto Scaling group.

Why wrong: Increasing the minimum number of application servers does not reduce reconnection time; it only ensures more capacity.

Use an RDS Proxy to manage database connections from the application servers.

Why wrong: Incorrect. RDS Proxy does not support SAP HANA. It is used with supported RDS databases (e.g., MySQL, PostgreSQL) to pool connections, but SAP HANA is not an RDS database and cannot use RDS Proxy.

AWS Config

Why wrong: AWS Config evaluates resource compliance, not patching workflows.

AWS CloudFormation

Why wrong: CloudFormation is for provisioning, not operational patching.

Amazon CloudWatch Events

Why wrong: CloudWatch Events can trigger actions but lacks approval workflow.

AWS Systems Manager Inventory and AWS Config

Why wrong: Systems Manager Inventory and AWS Config - Incorrect because Systems Manager Inventory collects software inventory, not all configuration changes. Although AWS Config records configurations, the combination is not as comprehensive as CloudTrail + Config.

Amazon VPC Flow Logs and AWS CloudTrail

Why wrong: Amazon VPC Flow Logs and AWS CloudTrail - Incorrect because VPC Flow Logs capture network traffic, not configuration changes; CloudTrail logs API calls but still misses configuration recording.

Amazon CloudWatch Logs and Amazon CloudWatch Metrics

Why wrong: Amazon CloudWatch Logs and Amazon CloudWatch Metrics - Incorrect because CloudWatch Logs and Metrics are for monitoring and logging, not auditing changes.

VPC Flow Logs

Why wrong: Flow Logs capture network traffic.

AWS CloudTrail

Why wrong: CloudTrail logs API activity.

AWS Config

Why wrong: Config tracks configuration changes.

Configure AWS Budgets to alert on storage costs.

Why wrong: AWS Budgets tracks cost usage, not disk space.

Use AWS Config rules to monitor disk space.

Why wrong: AWS Config evaluates resource configurations, not disk space.

Create an AWS Trusted Advisor check for disk utilization.

Why wrong: Trusted Advisor does not monitor disk space on EC2 instances.

AWS Config

Why wrong: AWS Config is used for compliance and configuration auditing, not for patching.

AWS CloudFormation

Why wrong: AWS CloudFormation is for infrastructure provisioning, not for scheduling OS patches.

AWS OpsWorks

Why wrong: AWS OpsWorks is a configuration management service using Chef/Puppet, but it is not the primary service for patch scheduling.

AWS CloudTrail logs and S3 access logs.

Why wrong: AWS CloudTrail logs are for API calls, not database events. S3 access logs are for S3 bucket access.

CloudWatch Logs from the EC2 instance hosting the database.

Why wrong: CloudWatch Logs from the EC2 instance hosting the database are not available for RDS because RDS is a managed service; you do not have access to the underlying EC2 instance logs.

VPC Flow Logs and Network Load Balancer logs.

Why wrong: VPC Flow Logs capture network traffic metadata, not database failover events. Network Load Balancer logs record traffic distribution, not database failover causes.

Associate an Elastic IP address with each instance.

Why wrong: Elastic IPs do not affect health checks.

Change the health check protocol to TCP.

Why wrong: ALB only supports HTTP/HTTPS health checks.

Decrease the health check interval.

Why wrong: A shorter interval might cause more false negatives.

AWS Config

Why wrong: AWS Config tracks configuration changes and resource relationships, not real-time performance metrics.

AWS Service Catalog

Why wrong: AWS Service Catalog manages service portfolios and product provisioning, not performance monitoring.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor offers recommendations for cost optimization, security, and performance, but does not provide real-time performance data.

HTTPCode_ELB_5XX

Why wrong: Shows ALB errors (5XX codes) but not per-target imbalance that could cause timeouts.

HealthyHostCount

Why wrong: Indicates health status of targets but not request distribution across targets.

TargetResponseTime

Why wrong: Measures latency from target to ALB, but does not directly reveal timeouts caused by uneven traffic.

Create a new RDS instance with larger storage and migrate data

Why wrong: Creating a new EC2 instance and migrating data causes significant downtime and unnecessary complexity. Not efficient.

Stop the instance, modify storage, and start the instance

Why wrong: Stopping the EC2 instance to modify storage causes downtime. With Elastic Volumes, online modification is possible, making this less efficient.

Take a snapshot, restore to a larger instance, and update DNS

Why wrong: Taking a snapshot and restoring to a larger instance involves downtime and additional steps. Not the most efficient.

The maintenance window schedule is set to a different time zone.

Why wrong: Time zone differences would affect all instances in the same way, not cause partial failures.

The instances do not have an IAM instance profile attached.

Why wrong: Without the correct IAM role, Systems Manager cannot communicate with the instances at all.

The patch baseline is configured in the wrong AWS Region.

Why wrong: If the patch baseline is in the wrong Region, instances in that Region would not be patched at all, not just some.

ec2:TerminateInstances

Why wrong: Terminate permanently deletes instances, which is beyond the required permissions.

ec2:RunInstances

Why wrong: RunInstances launches new instances, which is not required.

ec2:RebootInstances

Why wrong: Reboot is not the same as stop/start.

The AWS Backup service does not have permission to create snapshots in the account.

Why wrong: Insufficient permissions would cause a different error, such as 'AccessDenied'.

The EBS volume is not tagged with the required backup tags.

Why wrong: Tags are not required for AWS Backup to take snapshots; they are used for resource identification.

The EC2 instance does not have the AWS Backup agent installed.

Why wrong: AWS Backup for EBS volumes does not require an agent; it uses snapshots.

Use an EC2 instance with SAP HANA system replication across regions.

Why wrong: This is valid for HANA, but the question mentions SAP ERP, which typically uses ASE or Oracle. Also, RDS is the managed service.

Take daily snapshots of the database and copy them to the DR region. Restore from snapshots during a disaster.

Why wrong: Snapshots are periodic, leading to potential data loss of up to a day, and restore time is high.

Use AWS Database Migration Service (DMS) to continuously replicate changes to a database in the DR region.

Why wrong: DMS can replicate, but it may have higher latency and is not as tightly integrated as RDS read replicas.

Migrate the database data to an instance store volume for higher IOPS.

Why wrong: Migrating to instance store volumes is not recommended for persistent database data because instance store is ephemeral and data would be lost on instance stop/termination. Additionally, instance store may not provide the required IOPS consistency.

Add additional EBS volumes to the LVM stripe and redistribute the data.

Why wrong: Adding additional EBS volumes to the LVM stripe can increase total IOPS but involves complex reconfiguration and data redistribution. It may be more disruptive than simply increasing IOPS on the existing volume, especially if the current volume supports elastic IOPS adjustments.

Upgrade the database instance to a larger EC2 instance type with higher network bandwidth.

Why wrong: Upgrading the database instance to a larger EC2 instance type with higher network bandwidth does not directly resolve the I/O bottleneck on the EBS volume. CPU and memory utilization are not fully utilized, so this would not address the issue.

Migrate the database to an io2 Block Express volume with provisioned IOPS.

Why wrong: Migrating to io2 Block Express is expensive and may require downtime, making it overkill for this situation.

Add additional EBS volumes and configure RAID 0 striping to increase IOPS.

Why wrong: Adding volumes and RAID 0 striping adds complexity, may require downtime, and does not solve the burst credit exhaustion issue.

Increase the volume size to 1000 GB to increase baseline IOPS and burst credits.

Why wrong: Increasing volume size temporarily boosts baseline IOPS and burst credits, but it only delays the problem if workload exceeds baseline; it is not a permanent fix.

Deploy a configuration management tool like AWS OpsWorks to apply patches.

Why wrong: OpsWorks is for configuration management, not OS patching.

Schedule a weekly maintenance window and manually apply patches via RDP/SSH.

Why wrong: Manual patching is not automated and error-prone.

Create an Auto Scaling group with a custom AMI that includes the latest patches.

Why wrong: This does not automate patching of existing instances.

The volume is attached to an instance that does not support EBS optimization.

Why wrong: No evidence of instance type in output.

The volume has DeleteOnTermination enabled, which affects write performance.

Why wrong: DeleteOnTermination has no impact on performance.

The volume is not encrypted, causing performance degradation.

Why wrong: Encryption has minimal performance impact.