AWS Certified SysOps Administrator Associate SOA-C02 (SOA-C02) — Questions 676–750

S3 Intelligent-Tiering is the correct choice because it automatically monitors access patterns at the object level and moves data between Frequent Access, Infrequent Access, and Archive Instant Access tiers without any retrieval fees or user action. This provides low-latency access for actively requested large files while silently reducing storage cost for objects that become cold. It is ideal for unknown, unpredictable, or changing access patterns because there is no static lifecycle rule to misjudge when data will be accessed again. A small monthly monitoring and automation fee per object applies, but it is typically negligible compared to the savings and avoids the risk of archive-tier retrieval delays.

IAM Access Analyzer unused access analysis examines the service last accessed data for IAM roles and users to identify which actions, services, and resources have not been used within a specified timeframe (e.g., 90 or 180 days). This feature produces findings that directly highlight unused permissions, allowing SysOps administrators to update policies and enforce least privilege. It is the only option listed that provides the historical usage data needed to detect and remove unnecessary access.

CodeDeploy's error is generic, so instance-level detail is decisive. The CodeDeploy agent writes lifecycle event logs to /opt/codedeploy-agent/deployment-root on each EC2 instance, revealing the actual failure (hook script, permissions, or missing dependencies) behind the aggregate deployment-group message.

Tagging each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp) gives the Lambda function the necessary metadata to calculate the instance's age during each invocation. This tag can be read via the DescribeInstances API call, allowing the function to compare the stored timestamp with the current time and identify any instance older than 24 hours. It also makes the process stateless and independent of EC2's built-in attribute details, ensuring the solution works across instances in any state.

This combination correctly grants the developer the full CloudFormation API to create, update, and delete stacks needed for application deployment, while an explicit deny on iam:* overrides any other policy that might inadvertently allow IAM actions. Because an explicit deny always takes precedence over an allow, this ensures the developer cannot alter users, roles, or policies, even if they have attached policies from other sources. This strikes the right balance between enabling deployment workflows and enforcing least privilege.

Cost Anomaly Detection's ML model learns the historical spending pattern for each service. When EC2 (or any service) starts spending at an anomalous rate, the model detects it within hours. The alert subscription can notify via email or SNS with the anomaly amount, affected service, and percentage deviation. No manual threshold tuning is needed — the model self-calibrates.

This is correct because CloudWatch Logs IAM actions are tied to specific resource ARN types. The `logs:CreateLogGroup` action targets a log-group resource, so its Resource element must be the ARN of the log group itself (e.g., `arn:aws:logs:region:account:log-group:MyAppLogs`). By specifying a log-stream ARN, the IAM policy does not match the resource that the CreateLogGroup API call uses, so IAM denies the request. CreateLogStream and PutLogEvents, by contrast, correctly target log-stream ARNs, but that does not help create the log group.

The DeletionPolicy attribute with value Retain is the correct CloudFormation resource-level setting to preserve an S3 bucket when its stack is deleted. It instructs CloudFormation to skip deleting the underlying resource, so the bucket and all objects remain in the AWS account as an orphaned resource. This is designed exactly for the use case of retaining stateful data such as S3 buckets or DynamoDB tables after infrastructure teardown.

CloudWatch Events (now Amazon EventBridge) can match the PutBucketPolicy API call by using an event pattern that filters CloudTrail's AWS API Call events. When the bucket policy is modified, the rule triggers an SNS topic in near-real-time, enabling immediate notification. This approach requires CloudTrail to be enabled and configured to record management events, and it is the only option here that provides real-time, actionable alerts for policy changes.

An Auto Scaling group defines which subnets it can launch instances into, and each subnet maps to exactly one Availability Zone. To spread instances across multiple Availability Zones, you must explicitly configure the ASG to include subnets from each of those zones. Without a corresponding subnet in a given AZ, the group cannot place instances there, so omitting subnets limits the group's ability to recover from zone-level failures.

CloudWatch Anomaly Detection applies machine learning algorithms to analyze a metric's historical behavior, including daily and weekly seasonality, and produces a dynamic baseline band with upper and lower thresholds. For a custom business metric with irregular patterns, these thresholds continually adapt as new data arrives, so you do not need to manually recalibrate for changing normal behavior. It emits an anomaly detection band that can be used in alarms to alert on deviations from expected values.

Geolocation routing is the correct choice because Route 53 uses the geographic location of the user's DNS resolver to determine which record to return. You can create records for continents, countries, or US states and even specify a default record for users in unmatched locations. This enables location-based routing, such as directing users to regional endpoints or enforcing regional restrictions. However, the location is inferred from the resolver's IP address, so it is approximate rather than exact.

With BackupRetentionPeriod set to 0, automated backups are completely disabled, meaning RDS never takes daily snapshots and does not retain transaction logs for PITR. Without any automated backup or retained log, there is no recovery point available to restore from, which directly explains why the restore fails. Manual snapshots could still be used if they were created separately, but the scenario indicates no usable backup exists for restoration.

Setting S3 Object Ownership to Bucket Owner Enforced disables Access Control Lists for the bucket, which prevents new ACLs—including those that would grant public access—from being created. With ACLs disabled, S3 ignores any ACL-based permissions, and all access is controlled exclusively by bucket policies and IAM policies. This is a preventive, proactive measure that stops future public ACL misconfigurations at the source.

aws:MultiFactorAuthPresent is a boolean condition key that returns true if the principal authenticated with multi-factor authentication, and false otherwise. It can be used with the Bool condition operator to require that MFA was used, for example, "Bool": {"aws:MultiFactorAuthPresent": "true"}. This is a straightforward way to enforce MFA but it only checks the presence, not the age, of the MFA authentication. One caveat is that this key is only meaningful for temporary credentials, so you must ensure callers use temporary sessions (e.g., via GetSessionToken) when applying this restriction.

The AWS Instance Scheduler is a reference solution that deploys AWS Lambda functions and Amazon DynamoDB tables via AWS CloudFormation to automatically issue EC2 StopInstances and StartInstances calls based on user-defined daily or weekly periods. It works by evaluating instance tags against stored schedules, supports time zones, and can handle large fleets across accounts and regions. Because it stops rather than terminates instances, EBS-backed volumes, private IP addresses, and instance IDs are preserved.

Amazon Route 53's latency routing policy evaluates the measured latency between the user's DNS resolver and each AWS region where you have a resource, then returns the IP address for the region with the lowest latency. This enables multi-region active-active architectures by using DNS to direct each user request to the most responsive endpoint. For a sysops administrator needing to route traffic to multiple AWS regions, this is the correct service because it explicitly performs latency-based regional routing.

The create-change-set command constructs a change set that describes the modifications CloudFormation would make to the stack if the updated template were applied, without actually changing any resources. You can then use describe-change-set or the CloudFormation console to review every resource action (Add, Modify, Remove) including property details and whether a replacement will occur, before you decide to call execute-change-set. This two-phase approach is specifically designed to give you a safe, non-destructive preview of the update, which is exactly what the question requires.

MFA Delete, when enabled on a versioned S3 bucket, requires the bucket owner to present the root credential plus a valid MFA code for two operations: changing the bucket's versioning state and permanently deleting object versions. An ordinary DeleteObject request without a version ID only creates a delete marker, while any attempt to hard-delete a specific version without the MFA token fails. This prevents an authorized but careless user from irretrievably removing critical financial data.

An EC2 instance can only use IAM permissions if an instance profile containing a role is attached at launch time or later. Without an attached role, the instance has no AWS credentials to sign API requests, so any S3 operation (including upload) fails with an error such as 'Unable to locate credentials' or an access denied error because the request is not authenticated with an authorized IAM identity. The role must be attached to the EC2 instance and the instance must have the necessary permissions in its trust and permissions policies. This is the root cause of the upload failure.

AWS CloudFormation StackSets with automatic deployment is the native, service-integrated method for account baselining. When a new account is added to an AWS Organization, StackSets with service-managed permissions automatically creates stack instances in that account, using the organization's trusted access to deploy the baseline template. This eliminates the need for custom event-driven orchestration and ensures consistent governance across the entire organization.

The latency routing policy selects the AWS region that gives the requesting user the lowest network latency by comparing real-time latency measurements from the client's DNS resolver to each configured regional endpoint. It is the only policy among these that makes a routing decision based on actual network path performance rather than a static geographic or weighting rule, so it matches the requirement to route users to the fastest-performing region for the web application.

Updating the custom cookbook source (e.g., S3, Git, or HTTP) on the OpsWorks stack and then running the 'deploy' lifecycle recipe is the correct and intended method for rolling out application changes. The deploy recipe triggers a stack-wide command that executes your custom Chef recipes on all online instances in the selected layer or stack, following the defined deployment lifecycle (before_deploy, deploy, after_deploy). This ensures all instances receive the same application update in a coordinated, automated fashion, and because OpsWorks uses Chef, the recipe can handle dependencies, configuration templates, and service restarts consistently across the fleet.

An organization trail is created in the management account and, when the 'Enable for all accounts in my organization' option is selected, automatically captures API activity for every account in AWS Organizations, including accounts that join later. The event logs are delivered to a single S3 bucket designated by the management account, making it a centralized, scalable solution. This native integration eliminates the need to configure CloudTrail per member account.

By associating the private subnet's route table with a default route targeted at the NAT gateway, all outbound IPv4 traffic is forwarded to the NAT gateway in the public subnet, which then translates the source address and forwards the traffic to the internet gateway. This lets private instances initiate outbound connections while keeping them unaddressable from the internet, and unsolicited inbound traffic is blocked because the NAT gateway only allows responses to established outbound flows.

AWS Global Accelerator routes traffic over the AWS global network to the endpoint with the lowest latency, using anycast IP addresses that direct users to the nearest edge location. This satisfies the requirement to reach the closest regional Application Load Balancer, unlike DNS-based routing which depends on resolver caching and TTL behaviour.

Amazon CloudFront is a content delivery network (CDN) that caches copies of content at edge locations worldwide, so users receive data from a nearby point of presence instead of the origin server. This reduces round-trip latency and offloads the origin, providing fast, consistent distribution. It integrates with S3, EC2, and custom origins, and supports features like SSL termination, geo-restriction, and Lambda@Edge for edge processing.

Configuring an SSH key in the OpsWorks stack is the correct method because OpsWorks natively supports private Git repositories by letting you supply a private SSH key in the Repository SSH Key field for custom cookbooks. You add the matching public key as a deploy key on the GitHub repository with read-only access, and OpsWorks uses that key to authenticate when it downloads or updates cookbooks on your instances. This keeps the repository private and avoids storing plaintext credentials, while also allowing Chef to automatically pull the latest cookbook revisions during stack updates and instance setup.

A mixed instances policy lets an Auto Scaling group launch both Spot and On-Demand Instances, with the ability to define a percentage split (e.g., 50% On-Demand and 50% Spot) across multiple instance types. Spot Instances can be 60–90% cheaper than On-Demand, so running a portion of the spike capacity on Spot delivers significant cost savings. The On-Demand portion maintains a stable baseline, while the Spot portion absorbs burst capacity; if Spot capacity is reclaimed, the group can optionally fall back to On-Demand, preserving availability and making this the most cost-effective, resilient choice for variable traffic.

This is the correct diagnosis: for a private S3 bucket, CloudFront must use an Origin Access Identity to authenticate its requests. Without an OAI, CloudFront does not sign the origin request with a recognized AWS identity, so S3 treats it as anonymous and denies access. The fix involves creating an OAI, associating it with the distribution's S3 origin, and updating the bucket policy to allow that OAI the `s3:GetObject` permission.

A target tracking scaling policy automatically adjusts the Auto Scaling group's desired capacity based on a CloudWatch metric, such as average CPU utilization, to keep the metric close to a specified target value. For a stateless web app with varying traffic, this provides true elasticity, scaling out to handle spikes and scaling in when demand falls, without manual intervention. Because it directly maps load to capacity, it is the most effective single choice among the listed options.

Configuring the deregistration delay on the load balancer target group and enabling CodeDeploy's load balancer integration ensures that CodeDeploy automatically deregisters each instance, waits for in-flight requests to complete (based on the deregistration delay), performs the deployment, and then re-registers the instance. This built-in integration is the recommended way to avoid downtime during in-place deployments. CodeDeploy also waits for the instance to pass health checks before marking the deployment successful. This configuration is set in the deployment group's load balancer section.

The correct alarm should use the `DatabaseConnections` metric in a metric math expression that compares current connections to 80% of the `max_connections` value. Because `max_connections` is not emitted as a standard RDS CloudWatch metric, you can publish it as a custom metric (updated by a script that reads the DB parameter group) and create an expression like `m1 > 0.8 * m2` to compute the threshold dynamically. This approach self-adjusts if the instance class or parameter group is changed, avoiding the false positives and negatives that come with hard-coded thresholds while targeting the exact `DatabaseConnections` metric that tracks session count.

Global Datastore for Redis provides cross-Region replication with low RPO. Pre-configured Auto Scaling groups in the DR region ensure that compute capacity is ready. Route 53 failover routing automatically redirects traffic when the primary ALB health check fails. This combination meets the RPO and RTO requirements with minimal manual effort.

SuccessPercent is a native CloudWatch Synthetics metric that represents the percentage of successful canary runs during a given period. Configuring a CloudWatch alarm on this metric, with a threshold such as a drop below 99 percent, directly triggers an ALARM state when reliability degrades. This approach uses the existing metric stream, so no custom code or additional metrics are required, and it supports standard alarm features like evaluation periods and actions.

An Application Load Balancer (ALB) is a regional service that spans all Availability Zones (AZs) in its subnet configuration and actively sends health-check requests to each registered target. When an EC2 instance or an entire AZ fails health checks, the ALB automatically stops routing new traffic to that target and continues serving requests from healthy instances in other AZs. Coupled with an Auto Scaling group that spans multiple AZs, this design provides both elasticity and zone-failure tolerance, because the ALB constantly updates its target membership based on instance health and scaling events.

Attaching an instance profile IAM role with logs:PutLogEvents is essential because the CloudWatch agent requires AWS credentials to authenticate and authorize its log writes; without this role, the agent will fail CloudWatch Logs API calls such as CreateLogStream and PutLogEvents. The role is scoped to the EC2 instance via the instance profile, eliminating the need to embed static keys in the AMI or on the instance. This is the foundational security prerequisite for any log collection, and it should also include permissions for DescribeLogStreams and CreateLogGroup if you want the agent to manage those resources automatically.

HealthyHostCount with the TargetGroup dimension reports the number of targets (EC2 instances, IP addresses, or Lambda functions) that pass the configured health checks for that specific target group. This provides direct, per-service visibility into backend capacity and is the correct metric for a dashboard focused on target-group health because the TargetGroup dimension precisely isolates the health of one group.

Moving session state to ElastiCache for Redis decouples user session data from the ephemeral lifecycle of EC2 instances. Because Redis is a centralized, network-accessible store, any instance in the Auto Scaling group can read and write the same session data, and the data survives instance termination or replacement (especially with Redis persistence/AOF). This enables the Application Load Balancer to route requests to any healthy instance, eliminating the single point of failure tied to local storage.

VPC Gateway Endpoints for S3 are horizontally scaled, redundant VPC components that require no additional cost—they are free to use and carry no hourly or per-GB charges. When added to the route table, traffic destined for S3 is directed via prefix lists to stay inside the AWS network, bypassing the NAT Gateway for both data transfer and NAT processing fees. This directly cuts the most common source of S3-related cost overruns from EC2 instances in private subnets.

AWS CloudTrail is the compliance service that records every API action made in an AWS account, capturing the identity, time, source IP, and request parameters for each call. This complete audit trail enables security teams to detect unauthorized or anomalous API activity, such as a user attempting to access resources without permission or a compromised credential generating unusual calls. It is the first place to investigate security incidents and prove compliance for regulatory audits, making it correctly matched to 'Detect unauthorized API calls'.

CloudFront caches the S3 static content at global edge locations, so users are served from nearby points of presence rather than the bucket's Region. This reduces latency and cuts data transfer costs by lowering origin fetches, satisfying both stated goals.

The CloudWatch agent runs under the EC2 instance's attached IAM role, and each PutLogEvents API call requires the logs:PutLogEvents permission to be explicitly allowed in that role's policy. Without this permission, the API returns an AccessDeniedException, and the agent's own log file (typically in /var/log/aws/amazon-cloudwatch-agent/) will record the failure while the logs silently stop appearing in CloudWatch. This is the most common root cause when the agent is running and configured correctly but no new log events arrive.

VPC Flow Logs is a feature of Amazon VPC that captures metadata about IP traffic going to and from network interfaces in a VPC, including the ENI attached to the EC2 instance. Each flow log record includes fields such as source/destination IP, port, protocol, packet/byte counts, and whether the traffic was accepted or rejected by security groups/network ACLs. This makes it the correct service for diagnosing connectivity issues, analyzing traffic patterns, or investigating security incidents, as it directly provides network traffic metadata at the flow level.

AWS CloudTrail is the correct answer because it can be configured to capture S3 data events — object-level API calls such as GetObject, PutObject, and DeleteObject — in addition to management events like CreateBucket. Each event record includes the IAM user or role that made the request, the source IP address, the request parameters, and the response, providing a complete audit trail for incident investigation. Data events are not enabled by default on a trail, so the administrator must explicitly enable them for the target bucket to ensure such logs are captured.

The private subnet's route table must contain a default route (0.0.0.0/0) that targets the NAT Gateway for all outbound internet traffic. Without this route, packets destined for the internet have no next hop and are dropped, even though the NAT Gateway itself is correctly placed and functional. This configuration is per-subnet, which explains why only the affected private subnet lacks internet access while other subnets work normally.

Deploying an identical API Gateway and Lambda setup in a second Region and using Route 53 failover routing with health checks on the primary endpoint provides an active-passive disaster recovery pattern. When the health check fails, Route 53 automatically returns the secondary Region's IP address, directing clients to the standby stack. This approach ensures cross-Region availability and is the standard solution for making a Lambda-based critical application resilient to an entire Region outage.

FSR fully initializes the volume's block index immediately upon creation. The first I/O to any block is served from EBS at full throughput rather than waiting for lazy initialization from S3. For a 2 TB database volume where I/O latency determines restore time, FSR eliminates the 2-hour performance degradation period entirely.

The ALB emits the CloudWatch metric HTTPCode_ELB_5XX_Count, which counts the number of 5xx HTTP response codes generated by the load balancer itself (e.g., 502, 503, 504) for each target group and LoadBalancer dimension. By creating a metric math expression that divides this metric by the RequestCount metric (or a sliding window sum of both), you can calculate a 5xx error rate in real time. A CloudWatch alarm can be attached directly to that expression, evaluating at a chosen period (e.g., 5 minutes) and triggering an SNS notification when the calculated rate crosses a threshold, providing operational monitoring that is immediate and built into the ALB service.

The Deny clause for iam:ListMFADevices when the session lacks an MFA-authenticated condition blocks the AWS Management Console from displaying a user's existing MFA devices and prevents the self-service MFA enrollment flow from working. Because iam:ListMFADevices is one of the first API calls the console makes when a user attempts to manage or set up MFA, this Deny effectively locks out any user who has not yet enrolled MFA, making it impossible to satisfy the MFA requirement. A correctly designed MFA enforcement policy must explicitly allow iam:ListMFADevices (along with iam:CreateVirtualMFADevice and iam:EnableMFADevice) without requiring MFA, allowing users to bootstrap their first device.

An S3 bucket policy can deny s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms, using a condition block with StringNotEqualsIfExists (or an equivalent combination of conditions). Because the bucket policy is evaluated synchronously before the write is committed, any upload that lacks the header or specifies a different encryption type is immediately rejected with an Access Denied error. This makes it a true preventive control: it enforces server-side encryption with KMS on every PUT, regardless of what IAM permissions the caller holds. This is the correct solution when sensitive data must never be stored unencrypted or with non-KMS encryption.

Choosing 'Reboot with failover' instructs Amazon RDS to perform a graceful, forced failover from the primary to the standby replica in the other Availability Zone. This simulates an AZ outage or primary instance failure, letting you validate that your application reconnects and continues operating after RDS promotes the standby and updates the DNS endpoint. The reboot causes only a short interruption while the failover completes, making it the correct way to test resilience without manual infrastructure changes.

The IAM account password policy is the native, preventative control that enforces password requirements at the account level for all IAM users. When you set a minimum length of 12 characters, IAM rejects any password creation or change that does not meet this threshold, ensuring compliance before the password is ever stored. This is the intended mechanism that directly satisfies the security policy requirement.

EventBridge can ingest CloudTrail API calls as events, and a rule with an event pattern filtering for the 'CreateAccessKey' API call from the IAM service will trigger in real time. The rule's target can be an SNS topic, which then sends notifications (e.g., email, SMS) to subscribers, providing immediate alerting. This is the standard serverless pattern for reacting to AWS API activity because it is real-time, scalable, and requires no polling or log parsing.

AWS CloudFormation with the AWS Serverless Application Model (SAM) is the definitive infrastructure-as-code approach for serverless applications. SAM is an open-source framework that extends CloudFormation with simplified syntax to define serverless resources like Lambda functions, API Gateway APIs, and DynamoDB tables in a template, then transforms them into full CloudFormation stacks. It also provides local testing via the SAM CLI, supports automatic IAM role generation, and enables deployment through CodeDeploy for safer Lambda traffic shifting, making it purpose-built for serverless. By using SAM, a SysOps administrator can version, review, and reliably replicate the entire serverless application in a repeatable, auditable way.

CloudWatch metrics track CPU, memory, network, and request latency, while Elastic Beanstalk aggregates application and web server logs that can expose 5xx errors, stack traces, or slow queries. Reviewing these data sources together reveals whether the performance issue is due to a bottleneck, a recent deployment, or a resource limitation, allowing you to make a data-driven adjustment. This is the correct first step before any scaling action to ensure the actual root cause is addressed.

AWS CloudTrail is the service designed to provide a complete audit trail of API activity in your account. It records every management event, including calls like AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, and CreateSecurityGroup, along with the identity of the caller, the source IP, timestamp, and request parameters. This gives you the definitive answer to the SysOps administrator's need to audit all changes to security groups and other resources.

CloudTrail delivers log files to S3 with SSE-S3 encryption applied automatically, but its PutObject requests do not include an x-amz-server-side-encryption header. The bucket policy in this scenario uses a condition that requires that exact header on all writes (e.g., s3:x-amz-server-side-encryption equals AES256). Because CloudTrail omits the header, the condition evaluates to false and the bucket policy denies the request, so log delivery fails even though the object would have been encrypted server-side.

An SCP in the management account is the correct preventive control because AWS Organizations applies SCPs to all member accounts, OUs, and their principals, including the root user. The SCP can deny s3:CreateBucket unless the request includes the condition key s3:x-amz-server-side-encryption-aws-kms, forcing all new buckets to use SSE-KMS. Because SCPs are evaluated before the API call is allowed, they stop the bucket from being created at all, giving central management of encryption policy across the entire organization.

A cross-Region Read Replica uses Amazon RDS's asynchronous replication to continuously stream transactions from the primary DB instance in the source Region to a read replica in us-west-2. In a disaster, you can promote the replica to a standalone primary instance within minutes, and the replication lag is typically well under 5 minutes when the network is healthy, meeting the RPO requirement. This gives you a warm standby database in the target Region, enabling fast failover without needing to restore from backups.

RDS encryption at rest is a one-time immutable setting that must be enabled during DB instance creation. To encrypt an existing unencrypted database, you must create a new encrypted DB instance—either by restoring from a snapshot of the original or by exporting/importing data—and then migrate traffic, since there is no in-place conversion. The new instance will use an AWS KMS customer master key to encrypt the storage, automated backups, snapshots, and read replicas. This approach is the only supported path to satisfy the encryption requirement without losing data.

The IAM Credential Report is a downloadable CSV that lists every IAM user in the account with detailed fields including password last used, password last changed, access key IDs, key last used, and key rotation dates. This report is generated on demand or on a schedule using the AWS API, CLI, or console and directly satisfies the requirement to report on IAM users. It is the correct answer because it is purpose-built for summarizing user credential activity.

CloudWatch retains CPUUtilization only while the instance runs; a stopped instance emits no datapoints, so the queried period returns an empty result set. The metric namespace and dimensions remain valid, making the instance's stopped state the reason no datapoints appear for the specified range.

AWS X-Ray is the correct choice because it provides end-to-end distributed tracing for Lambda invocations, capturing a segment for the entire execution and subsegments for each downstream operation, such as DynamoDB queries, HTTP calls, or custom code blocks. When the X-Ray SDK is installed and the function is instrumented with wrappers or decorators, you can view segment details to see the exact duration of each subsegment, pinpointing which line or API call is slow. Even without custom instrumentation, X-Ray shows the overall execution time and any downstream service traces, but adding subsegments yields the precise line-level breakdown needed for this troubleshooting.

CloudFront's native geo-restriction feature allows you to configure an allowlist or blocklist of two-letter ISO country codes directly in the distribution's settings. When a viewer in a denied country requests content, CloudFront's edge locations reject the request with an HTTP error before it ever reaches the origin. This works at the edge, requires no code or additional AWS services, and precisely matches the requirement of restricting access by geographic location. Because this feature is built into CloudFront itself, it is the correct choice among the options.

Changing the S3 bucket name in the CloudFormation template to a unique name resolves the conflict because the CreateBucket API only needs a name that is not already taken globally. This is the correct approach because it allows CloudFormation to provision a brand-new bucket without naming collision. Alternatively, you could omit the BucketName property entirely so CloudFormation generates a unique name with a random suffix, but specifying a deliberate unique name works equally well.

When a stack update fails and the automatic rollback also fails, the stack enters the UPDATE_ROLLBACK_FAILED state. To recover, you must first resolve the underlying cause, such as an insufficient IAM permission or a resource that cannot be rolled back, then call the ContinueUpdateRollback API or use the AWS Management Console to resume the rollback. This action transitions the stack to UPDATE_ROLLBACK_COMPLETE, restoring it to its last known stable configuration.

CloudFront is a global content delivery network that automatically integrates with AWS Shield Standard, providing always-on detection and inline mitigation for L3 and L4 DDoS attacks such as UDP floods and SYN floods. Its large edge footprint and anycast routing absorb and dissipate attack traffic close to the source, preventing it from reaching the origin. For additional protection, you can enable AWS Shield Advanced and combine it with AWS WAF for L7 attack mitigation.

User data in the launch configuration runs at each instance boot, so newly launched Auto Scaling instances install the CodeDeploy agent automatically. This satisfies the requirement that instances joining the group have the agent present before CodeDeploy attempts deployment.

Amazon Inspector is purpose-built for vulnerability management, using an agent installed on EC2 instances to continuously collect telemetry about software packages, network configurations, and running processes. It correlates this data against a database of known Common Vulnerabilities and Exposures (CVEs) and performs network reachability checks to identify exposure of ports and protocols. This provides ongoing, deep scanning of software vulnerabilities and makes Inspector the correct choice.

Externalizing session state to ElastiCache for Redis removes the dependency on local instance storage, allowing any instance in the Auto Scaling group to handle any user's request. When an instance is replaced, the session data remains available in the Redis cluster. This makes the application stateless and supports seamless scaling and recovery.

A cross-Region read replica in us-west-2 maintains an asynchronous copy of the primary RDS database using the engine's native replication. In a disaster, you can promote the replica to a standalone primary DB instance within minutes, which meets a 15-minute RPO because replication lag is typically well below that threshold and the RTO is minimal. The replica also supports read traffic in the DR Region before promotion, making it a cost-effective and operationally proven pattern for RDS disaster recovery.

A Lambda timeout error indicates that the function exceeded its configured execution time limit, so increasing the timeout gives the process more time to complete its work. Reviewing CloudWatch Logs is essential to determine why the function is slow, such as inefficient logic, a large download, or a blocking call to another service. After increasing the timeout, verify both the function's memory allocation and the maximum allowed timeout (15 minutes) to ensure the new setting is valid, and monitor logs to confirm the root cause is resolved.

Checking the system status checks in the EC2 console is the correct first triage step because these checks directly report on the health of the underlying physical host, network connectivity, and power delivery. A failed system status check (e.g., 'System reachability' or 'Instance connectivity') indicates a hardware-level issue that is independent of the guest OS, guiding you toward a stop/start recovery rather than a reboot. CloudWatch metrics for status checks should also be reviewed to confirm the duration and pattern of the failure.

Creating an invalidation for the path '/*' issues a request that removes all cached objects from every edge location in the CloudFront distribution. When the invalidation completes, the next request for any of those objects causes CloudFront to go back to the S3 origin and fetch the latest version, thereby ensuring users see updated content. This is the immediate, targeted mechanism designed for exactly this scenario.