Select Two (Multi-Select) Questions

Enable MFA Delete on the bucket.

MFA Delete requires a valid multi-factor authentication code to permanently delete an object version or suspend versioning, meaning an accidental delete request without the temporary code will be rejected. Because the MFA device is separate from AWS credentials, even a compromised access key cannot complete destructive actions like version removal. This adds a human/physical factor that effectively prevents costly accidental deletions and serves as a last line of defense for critical data.

Configure cross-region replication to a destination bucket.

Cross-region replication asynchronously copies every permitted object version to a destination bucket in a different AWS Region, creating a geographically separate backup that is insulated from source-bucket failures and erroneous deletions. If the source object is accidentally overwritten or removed, administrators can retrieve the pristine copy from the replica bucket and restore it to the source, as long as versioning is enabled on both buckets. Because the copy is independent of the source, even a full source-bucket deletion event does not destroy the disaster-recovery copy.

Enable versioning on the bucket.

Versioning retains every historical version of every object, so a simple DELETE only creates a delete marker and the previous versions remain hidden but recoverable; an accidental PUT overwrite also preserves the prior version. Removing the delete marker or restoring an earlier version instantly rolls back the unintended change. This makes versioning the structural backbone that other safeguards like MFA Delete and replication rely on to ensure that no single accident can permanently erase data.

Misconfigured firewall or iptables

A misconfigured firewall or iptables ruleset can block all inbound and outbound traffic, effectively making the instance unreachable despite the OS running normally. The instance status check performs a network reachability test at the OS level, and if the packet filtering rules prevent the response, the check fails, indicating an instance-level problem. Since the issue stems from guest OS configuration rather than AWS infrastructure, it is correctly identified as an instance status check failure.

Corrupted file system

A corrupted file system, particularly on the root volume, can prevent the OS from mounting the disk, cause kernel panics, or result in the entire system becoming unresponsive and unable to process any requests. Since the corruption is within the guest OS environment and does not require AWS-side intervention, it is reported as a failed instance status check. The instance status check detects this because the OS fails to respond to the network-level reachability probe, confirming that a corrupted file system is a valid cause of an instance status check failure.

Use a VPC Gateway Endpoint for Amazon S3 to keep S3 traffic within AWS.

A VPC gateway endpoint routes S3 traffic privately within the AWS network instead of through a NAT gateway or internet gateway, eliminating NAT data processing charges and internet data transfer for that traffic. This directly cuts the transfer costs the stem asks to reduce.

Use Amazon CloudFront to cache and serve static content.

CloudFront caches static content at edge locations and serves users from the nearest point of presence, so fewer requests travel back to the EC2 origin. This reduces origin data transfer out, which is the dominant cost driver for internet-facing content.

Target group for each backend service

In an Application Load Balancer, traffic is not forwarded directly to backend instances; it is forwarded to target groups. A target group logically groups a set of backend instances or IP addresses for one specific service, and each target group has its own health checks, stickiness policy, and routing metadata. Because each backend service is a distinct application, you need a separate target group per service so that a listener rule can route a specific URL path to the correct group of instances.

Listener rule with a path pattern condition

A listener rule defines the routing logic for the ALB by combining a condition (such as a path pattern or host header) with an action (such as forwarding to a target group). For path-based routing across backend services, you must configure listener rules that match distinct URL paths and forward each match to the correct target group. Without these rules, the ALB has no mechanism to decide which backend service should handle a given request path.

Configure a lifecycle policy to delete incomplete multipart uploads after 7 days

A lifecycle rule with the 'Incomplete multipart upload' action (e.g., days after initiation = 7) automatically aborts and deletes all parts of any multipart upload that was not completed due to network failure, timeout, or user cancellation. Because S3 bills for every stored part of an incomplete upload just like a full object, leaving these orphaned parts accrues storage costs indefinitely. Setting a 7-day expiration ensures orphaned data is removed without requiring manual intervention, directly reducing storage waste from failed uploads. This is a native S3 cost-control mechanism, not a data-protection feature.

Create a lifecycle policy to transition objects to S3 Standard-IA after 90 days

Transitioning objects to S3 Standard-IA after 90 days reduces monthly per-GB storage charges, because Standard-IA costs roughly half of S3 Standard for storage while still providing millisecond access. Media files are typically accessed frequently right after upload (e.g., editing, streaming) but become rarely accessed over time, so a 90-day interval aligns with the access-pattern shift. Note that S3 Standard-IA charges a retrieval fee per GB and requires a minimum of 128 KB per object, so the policy is cost-effective only if the objects are indeed larger and rarely read. This is a lifecycle transition rule, which is the appropriate way to optimize storage costs.

Review stack events to identify the resource that blocked rollback.

Stack events expose the precise CloudFormation status of each logical resource during the failed update and subsequent rollback attempt, including the exact API error that caused the rollback to stall—for example, an EC2 security group dependency that could not be evaluated. By reviewing the most recent event entries, you can pinpoint whether a resource is stuck in CLEANUP_IN_PROGRESS or UPDATE_ROLLBACK_IN_PROGRESS and read the underlying failure message. This diagnosis determines whether you can safely run continue-update-rollback without skipping resources.

Use continue-update-rollback after resolving the underlying issue or specifying resources to skip when appropriate.

The continue-update-rollback API operation is the official recovery path when a stack reaches UPDATE_ROLLBACK_FAILED, but it will fail again unless the root cause—such as a missing IAM permission or a deleted resource—is fixed first. You can optionally pass --resources-to-skip to instruct CloudFormation to ignore a resource that cannot be rolled back, provided that resource is not critical to the stack's stable state. This is a targeted remediation, distinct from simply reviewing events, because it actively moves the stack back toward a usable status.

Deploy a NAT Gateway in a public subnet.

Deploying a NAT Gateway in a public subnet is correct because the NAT Gateway is a managed service that must reside in a subnet that has a route to an Internet Gateway (IGW). This placement enables the NAT Gateway to translate private IP addresses from instances in private subnets into its own Elastic IP address and forward traffic to the IGW for outbound connections. Because the NAT Gateway is in a public subnet, it can reach the internet and, at the same time, it does not accept inbound connections from the internet, preserving the security boundary. Its managed nature means you do not need to patch or operate it, and it automatically scales to handle bursts of traffic.

Add a route in the private subnet's route table pointing to the NAT Gateway for 0.0.0.0/0.

Adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway is an essential configuration that enables instances in the private subnet to send outbound internet traffic. Without this route, even if a NAT Gateway exists in a public subnet, instances would have no path to the gateway and their internet-bound packets would be dropped or sent to a dead-end. This route directs all outbound IPv4 traffic to the NAT Gateway, which then performs Network Address Translation and forwards the traffic through the VPC's Internet Gateway. It is a fundamental step for private-instance internet access, and it does not open any inbound ports, so the instances remain protected from unsolicited inbound connections.

Create an Amazon CloudWatch Events rule that matches the CloudFormation stack status change.

CloudFormation publishes stack status change events to the default CloudWatch Events event bus. You can create an event rule with an event pattern matching the 'CloudFormation Stack Status Change' detail type and then target a Lambda function, SNS topic, or other service. This provides a near-real-time, serverless way to react to stack transitions without polling.

Configure CloudFormation stack notifications to send events to an Amazon SNS topic.

CloudFormation can be configured with an SNS topic in the stack's notification options, and it sends stack events (such as UPDATE_COMPLETE, UPDATE_FAILED, etc.) directly to that topic. This provides a simple push-based notification mechanism that can fan out to email, Lambda, or other subscribers. It is a valid alternative to CloudWatch Events for receiving stack status updates.

Transit gateway with VPN attachment

An AWS Transit Gateway acts as a network transit hub, and adding a Site-to-Site VPN attachment lets an on-premises network connect to the gateway over an IPsec tunnel using the public internet. This is a valid hybrid connectivity option because the transit gateway can route traffic between many VPCs and the VPN attachment, simplifying the network while still supporting site-to-site VPN connectivity.

AWS Direct Connect

AWS Direct Connect establishes a dedicated, private physical link between your on-premises data center and AWS, bypassing the public internet entirely. It uses 802.1Q VLAN tagging to provision multiple virtual interfaces over a single connection, producing lower latency and more consistent bandwidth than internet-based VPNs, and it can be paired with a Site-to-Site VPN to add encryption.

AWS Site-to-Site VPN

AWS Site-to-Site VPN creates two encrypted IPsec tunnels between your on-premises customer gateway device and an AWS virtual private gateway or transit gateway, traffic flowing over the public internet. It is a fully supported, hardware-free hybrid connection that provides encrypted, secure communication to either a single VPC or multiple VPCs when attached to a transit gateway.

Enable provisioned IOPS on the DB instance.

Enabling provisioned IOPS on the DB instance creates an io1/io2 storage volume with a fixed, predictable IOPS level, decoupling performance from burst balances. This gives consistent low-latency I/O for transactional workloads and avoids the variability of general-purpose SSD when sustained throughput is required. It directly addresses storage I/O performance, making it a correct configuration choice.

Create a read replica in the same AWS Region.

Creating a read replica in the same Region allows SELECT-intensive traffic to be serviced by a separate read-only endpoint, reducing the primary instance's query load and freeing its resources for writes. Because the replica uses asynchronous replication, it may lag slightly, but same-Region placement minimizes network latency while enabling effective read scaling. This configuration is a correct answer because it improves overall performance for mixed workloads by distributing read operations.

Run queries in real-time against incoming log data.

CloudWatch Logs Insights operates on log data that has been ingested into CloudWatch Logs, and because ingestion is a near real-time process—typically within seconds—queries reflect the most recent events. The console even offers a 'Live' button that continuously polls and re-runs the query against incoming data, giving a real-time tail-like experience. However, this is not streaming analytics; the query engine still scans the stored log data rather than processing events as a continuous stream.

Visualize query results with bar charts and line graphs.

CloudWatch Logs Insights includes built-in visualization capabilities that render query results directly in the console as bar charts, line graphs, pie charts, and other chart types. Visualizations are generated when the query uses aggregation functions such as count(), avg(), or sum() combined with GROUP BY or bin(time) to create time series. These visualizations are useful for quick visual analysis but are ephemeral—they do not create persistent dashboard widgets; for persistent dashboards, you must add the query as a widget to a CloudWatch Dashboard.

Query multiple log groups in a single query.

A single CloudWatch Logs Insights query can combine and analyze log events from multiple log groups, up to a maximum of 20 log groups per query, provided they belong to the same AWS account and Region. In the console, you simply select multiple log groups in the dropdown; when using the API, you pass an array in the logGroupNames parameter. This capability is essential for correlating logs across services (e.g., API Gateway and Lambda) in one query, avoiding the need to manually merge log data before analysis.

Use HTTPS instead of HTTP when accessing S3 from the EC2 instance.

HTTPS uses TLS to encrypt the entire HTTP request and response payload between the EC2 instance and S3, including object data, providing confidentiality and integrity against eavesdropping and tampering. This is a client-side action: the application must explicitly use the https:// prefix in the S3 endpoint URL, and AWS recommends this as the primary measure for protecting data in transit.

Use S3 VPC endpoints to ensure traffic between the VPC and S3 does not traverse the internet.

A VPC endpoint for S3 routes traffic between the EC2 instance and S3 through the AWS private network rather than over the public internet, eliminating exposure to internet-based attackers. While this is a critical isolation measure, it does not inherently encrypt the traffic; to fully protect data in transit, it should be combined with TLS/HTTPS.

Check the system status checks in the EC2 console.

Checking the system status checks in the EC2 console is the correct first triage step because these checks directly report on the health of the underlying physical host, network connectivity, and power delivery. A failed system status check (e.g., 'System reachability' or 'Instance connectivity') indicates a hardware-level issue that is independent of the guest OS, guiding you toward a stop/start recovery rather than a reboot. CloudWatch metrics for status checks should also be reviewed to confirm the duration and pattern of the failure.

Review the instance system log (console output).

Reviewing the instance system log (console output) provides visibility into the guest operating system's boot sequence, kernel messages, and initialization logs. This is primarily useful for diagnosing software-level or OS-level failures such as kernel panics, filesystem corruption, or failing disk mounts. However, if the problem is with the underlying host hardware, the guest OS log often shows no error because the VM never receives proper network connectivity or CPU resources; thus, it is a complementary diagnostic but not the definitive health check for host issues.

Stop and start the instance (recovery action).

Stopping and starting the instance is the AWS recovery action that provisions the instance on a new physical host, resolving issues caused by failed hardware, network components, or degraded power on the original host. This process preserves the instance ID, EBS volumes, IP addresses, and all data on EBS-backed storage, but it does not preserve instance store volumes. After performing stop/start, you should verify that the system status checks transition to '2/2 passed' to confirm the underlying host issue has been resolved.

Route table in the private subnets with a default route pointing to the NAT Gateway

The route table associated with the private subnets must contain a default route (0.0.0.0/0) pointing to the NAT Gateway's network interface. This ensures that any outbound IPv4 traffic from instances in those subnets is forwarded to the NAT Gateway for translation. Without this route, private instances would have no path to the internet, even though the NAT Gateway exists.

Internet Gateway attached to the VPC

An Internet Gateway (IGW) is a horizontally scaled, redundant component that provides a target for the VPC's public subnets' default routes and enables communication with the internet. For the NAT Gateway to function, it must have a route through an IGW because the NAT Gateway itself resides in a public subnet and uses the IGW as its next hop for outbound traffic. Without an IGW attached to the VPC, the NAT Gateway cannot reach the internet, so the entire design fails.

NAT Gateway in a public subnet

The NAT Gateway is a fully managed service that must be deployed in a public subnet, with an Elastic IP address and a route via the Internet Gateway. It translates the source IP of outbound traffic from private instances to its own public IP, thereby enabling those instances to initiate internet connections while remaining inaccessible from the internet. This placement in a public subnet is mandatory, as the NAT Gateway needs direct internet connectivity through the IGW.

Configure network ACLs to filter traffic at the subnet level.

Network ACLs are a stateless, subnet-level firewall that filters traffic based on numbered rules evaluated in ascending order. Because they are stateless, you must explicitly define both inbound and outbound rules, and responses to allowed inbound traffic require a corresponding outbound rule. NACLs apply uniformly to every instance in the subnet, providing a coarse boundary that can block traffic before it reaches security groups, though they cannot inspect individual instance traffic.

Enable VPC Flow Logs to capture traffic information.

VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in your VPC, such as source/destination IP, port, protocol, and whether the action was accepted or rejected. The logs are published to Amazon CloudWatch Logs or S3, enabling you to audit traffic patterns, diagnose overly permissive or restrictive security group and NACL rules, and support forensic analysis. Flow Logs do not filter or block traffic themselves; they are a visibility tool that complements but never replaces actual security controls.

Use security groups to control inbound and outbound traffic at the instance level.

Security groups act as a stateful, virtual firewall at the instance or elastic network interface (ENI) level. They support only allow rules by default deny inbound and allow all outbound unless restricted, and because they are stateful, return traffic is automatically permitted regardless of the outbound rule set. Security groups are evaluated as a whole, with no rule ordering, making them ideal for granular, per-instance control based on source security group, CIDR, or port, but they cannot explicitly deny traffic like NACLs can.

AWS::ECS::TaskDefinition

A task definition is the core configuration document that ECS uses to launch containers. It specifies the Docker image, CPU and memory limits, port mappings, environment variables, logging configuration, and IAM roles. Without a task definition, ECS cannot start a container, making it the fundamental resource required for any ECS deployment.

AWS::ECS::Service

An ECS service is responsible for maintaining the desired number of running copies of a task definition. It handles rolling updates, task placement, and can integrate with a load balancer for traffic distribution. While the service does not define the container, it is required for long-running, scalable applications that need automatic replacement of failed tasks.

AWS::ECS::Cluster

An ECS cluster is a logical grouping of Fargate tasks or EC2 instances that provides the compute capacity for your containers. It acts as the namespace where services and tasks are scheduled, and it must exist before tasks can run. In CloudFormation, you either create a cluster resource or reference an existing one, but the cluster itself does not contain container configuration details.

Configure the CloudWatch alarm to send a notification to an SNS topic.

A CloudWatch alarm alone does nothing until you attach an action; publishing to an SNS topic is the standard action that enables out-of-band notification. When the alarm enters ALARM state, it sends a message to the SNS topic, which then delivers via email, SMS, or Lambda. This is the notification layer of the solution, not the metric collection itself.

Create a CloudWatch alarm on the 'DatabaseConnections' metric.

The DatabaseConnections metric is published by RDS to CloudWatch as a per-instance value representing the current number of client network connections. Creating a CloudWatch alarm on this metric allows you to set a threshold and evaluation period, so the alarm state changes when connection count breaches that threshold. This is the actual monitoring mechanism that detects the condition you care about.

Use AWS Backup to create backup plans for the Storage Gateway.

AWS Backup natively integrates with Storage Gateway, allowing you to define backup plans that automatically create point-in-time snapshots of the gateway's data and store them in S3. This gives you a fully managed, policy-driven backup solution with retention and lifecycle rules, so you don't need to run manual backup scripts on the on-premises file servers. The snapshots are durable in S3 and can be restored quickly when needed, making this the correct way to automate backup of the gateway.

Configure the file gateway to cache data locally for frequently accessed files.

A file gateway maintains an on-premises cache for frequently accessed files, which improves read performance and reduces the latency of accessing hot data from on-premises users. While only a subset of files may be cached locally, the authoritative, complete dataset is continuously uploaded to S3, ensuring the cloud remains the durable backup target. Configuring the local cache is a valid part of a hybrid backup architecture because it keeps the primary file server workload performant while S3 holds the full backup, but the cache itself is not the backup.

Deploy an AWS Storage Gateway file gateway on-premises.

Deploying an AWS Storage Gateway file gateway on-premises presents an SMB/NFS share that file servers can mount, and all writes to that share are converted into S3 objects, providing a durable cloud copy of the files. The gateway synchronizes changes to S3 in near-real time, keeping the backup current without manual intervention, and it supports local caching for performance. This deployment is the foundational component that connects the on-premises file environment to AWS, enabling the backup workflow described by the other correct option.

A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR.

Network ACLs are stateless and operate at the subnet boundary. To allow an EC2 instance in the public subnet to reach a database in the private subnet, the private subnet's NACL must have an inbound rule permitting traffic from the public subnet's CIDR on the database's port. Because NACLs are stateless, you also need a corresponding outbound rule on the private subnet NACL to allow the return traffic back to the EC2 instance, and reciprocal inbound/outbound rules on the public subnet NACL if it has restrictive rules.

A security group rule on the database allowing inbound traffic from the EC2 instance's security group.

Security groups act as stateful virtual firewalls at the instance or ENI level. Adding an inbound rule on the database's security group that references the EC2 instance's security group as the source permits traffic from any instance associated with that source security group, regardless of its IP address. This is a precise and scalable way to allow database access because it automatically applies to all instances in the source SG and statefully allows return traffic without separate outbound rules.

Attach an Internet Gateway to the VPC.

The Internet Gateway (IGW) is the VPC-wide component that enables bidirectional communication between the VPC and the internet. A NAT gateway must be provisioned inside a public subnet whose route table includes a 0.0.0.0/0 route to this IGW; without the IGW, the NAT gateway cannot resolve an external destination or forward return traffic. In short, the IGW is the essential upstream path that makes the NAT gateway's outbound translation functional.

Add a route to the private subnet's route table with destination 0.0.0.0/0 pointing to the NAT Gateway.

To allow instances in a private subnet to reach the internet, their subnet's route table must contain a default route (destination 0.0.0.0/0) pointing to the NAT Gateway's network interface. Without this route, the private instance's outbound packets are only delivered to destinations within the VPC CIDR, and any attempt to reach an external IP will fail with a routing error. This route is what directs traffic from the private instance to the NAT gateway, which then performs source address translation and sends it to the IGW.

Place a NAT Gateway in a public subnet.

The NAT Gateway must reside in a public subnet — a subnet that has a direct route to an Internet Gateway and uses an Elastic IP address. This placement allows the NAT gateway to receive outbound packets from private instances, translate their source IP addresses to its own EIP, and forward the traffic through the IGW to the internet. If the NAT gateway were placed in a private subnet, it would have no path to the IGW and thus could not perform its function.