CCNA Operations and Support Questions

CloudTrail records API activity in an account, capturing the identity of the caller, the time, the source IP, and the request details. Creating a trail that delivers events to an S3 bucket with a 365-day lifecycle or retention policy satisfies the compliance requirement for long-term audit visibility.

CloudWatch Logs Insights runs SQL-like queries against log groups aggregated from multiple AWS services, returning results without exporting data elsewhere. This satisfies the centralised collection and query requirement directly, since logs remain in CloudWatch and are analysed in place rather than piped to Athena or OpenSearch.

Setting the log group's retention policy to 365 days directly satisfies the one-year compliance requirement, since CloudWatch Logs deletes events automatically once the configured retention period elapses. Configuring this at the log group level applies uniformly to every log stream within it, avoiding per-stream management and preventing indefinite storage costs.

Azure Update Manager provides agentless assessment and scheduled patching for Azure and Arc-enabled machines. By assigning a maintenance configuration, the administrator defines the recurrence and maintenance window, and the service installs approved updates automatically, satisfying the requirement without interactive logon to each VM.

By default an Auto Scaling group only uses EC2 status checks, so an instance that is running but failing the load balancer health check stays in service. Adding ELB as a health check type makes the group treat unhealthy ELB targets as unhealthy instances and replace them, which is exactly the behavior the team needs.

The cloud provider's cost explorer aggregates spend by service, region and account, revealing which resources drive the sudden increase. This satisfies the investigation requirement, providing the cost-driver visibility needed before tags can be applied for allocation.

AWS Budgets lets you define a monthly cost budget with a threshold and configure alerts when actual or forecast spend exceeds it. This directly satisfies the $10,000 notification requirement, whereas CloudWatch alarms track metrics rather than billing amounts.

The cooldown period enforces a waiting interval after each scaling activity before another can begin. Extending it prevents the auto-scaling group from reacting to brief CPU spikes, stabilising instance additions and removals as the stem requires.

AWS Systems Manager Patch Manager defines patch baselines and maintenance windows, then applies patches to Linux instances via the SSM Agent during those windows. It satisfies the stem's requirement for scheduled automated patching, unlike services lacking native patch orchestration or Linux package support.

These two platform metrics express consumed IOPS and consumed bandwidth as percentages of the disk's provisioned limits. If IOPS Consumed Percentage approaches 100 while bandwidth remains low, the disk is IOPS-throttled; if bandwidth percentage saturates first, it is throughput-throttled. This directly distinguishes the two causes described.

The cooldown period prevents the Auto Scaling group from launching or terminating additional instances immediately after a scaling activity, damping rapid oscillation. Increasing it forces the group to wait longer between actions, directly reducing the flapping instability described.

Sinks define inclusion filters and a destination, letting Cloud Logging route matching entries to a BigQuery dataset. This satisfies the requirement to automatically export Compute Engine logs while preserving their structured JSON payloads for analysis.

A Deployment manages a ReplicaSet, which ensures the desired number of Pod replicas are running. If a container process fails, the kubelet restarts it according to the Pod's restartPolicy (default Always). If a node becomes unhealthy, the ReplicaSet controller creates replacement Pods on healthy nodes. This directly satisfies both automatic container restart and Pod rescheduling requirements for the payment microservice.

AWS X-Ray traces requests across distributed services, building a service map that pinpoints latency between tiers. Since logs show no errors, the bottleneck is performance rather than failure, and X-Ray's segment and subsegment timing exposes exactly where the web tier's downstream calls stall.

Distributed tracing propagates a shared trace context across service boundaries, letting the administrator visualise each span's duration and pinpoint the microservice causing increased latency. Unlike metrics or logs, which show isolated per-service data, it reconstructs the full request path, directly satisfying the requirement to trace requests across distributed microservices.

Azure Monitor metric alerts evaluate platform metrics such as Percentage CPU against a threshold over a defined aggregation window, satisfying the 15-minute average above 90% condition. The action group then delivers the email notification to the operations team, fulfilling the alerting requirement without needing Log Analytics queries.

AWS Compute Optimizer analyses CloudWatch metrics to generate rightsizing recommendations for EC2 instances, identifying over-provisioned or underutilised capacity. This directly satisfies the company's cost-reduction goal by surfacing specific instance-type downsizing opportunities, unlike tools that only report utilisation data without actionable sizing guidance.

A patch automation service inventories missing OS patches and applies them to tagged Windows servers only within the defined maintenance window, preventing disruption outside approved hours. This satisfies the requirement to patch a server group while minimising disruption, unlike manual patching or always-on update schedules.

Amazon CloudWatch collects and tracks metrics such as CPU utilization for EC2 instances. It allows the creation of alarms that trigger when a metric breaches a threshold for a specified number of evaluation periods. In this scenario, an alarm can be set to fire when average CPU utilization exceeds 80% for 5 consecutive minutes, directly meeting the team's requirement for monitoring and alerting.

Continuous cross-region replication keeps a standby copy within seconds of the primary, satisfying the one-minute RPO, while automatic failover redirects traffic without manual intervention, meeting the fifteen-minute RTO. Neither scheduled snapshots nor single-region backups can achieve both targets.

Azure Backup for VMs uses an extension installed on the VM to take snapshot-based backups of the OS and data disks. Associating the VMs with the backup policy created in the Recovery Services vault ensures the daily schedule and 30-day retention are applied. This, combined with the vault and policy, enables file-level recovery from the VM backups, fully meeting the administrator's requirements.

Amazon SNS delivers alerts by fanning messages out to email, SMS, HTTP endpoints and Lambda subscribers, satisfying the notification channel requirement. It integrates natively with CloudWatch alarms, so critical threshold breaches reach operators without custom polling infrastructure.

Continuous replication to a standby database keeps a near-current copy available, so failover avoids restoring from backup and removes the slow restoration step. This directly reduces database recovery time, helping the application meet its one-hour RTO.

AWS Systems Manager Patch Manager applies OS patches to Windows and Linux instances on a schedule, using maintenance windows and patch baselines. It supports compliance reporting and controlled rollback through baseline approval rules, meeting the maintenance-window and rollback requirements.

An Auto Scaling group can be configured to use EC2 status checks as health checks. When an instance fails a status check, the Auto Scaling group terminates it and launches a new instance from the launch template. This provides automatic replacement and maintains the desired capacity, meeting the requirement for unattended recovery.

An HTTP health check against a dedicated application health endpoint evaluates whether the application is actually serving requests, which is the behavior the team wants. Setting a matcher of 200 confirms a valid response, and raising the unhealthy threshold prevents a single slow response from ejecting a target. Because CPU pressure alone does not affect an HTTP health check, busy-but-responsive instances stay in rotation during deployments.

Increasing the cooldown period forces the auto-scaling group to wait after each scaling activity before triggering another, directly damping the rapid add-remove oscillation described. This satisfies the stability constraint by preventing consecutive scale-out and scale-in events from chasing transient metric spikes.

Mandatory, standardised tag keys with controlled values ensure every resource is attributable to a department and project, preventing untagged or inconsistently labelled resources from skewing cost reports. This enforces consistent cost attribution across the estate.

Scheduled scaling provisions capacity at fixed times, matching the predictable weekday 9 AM spike and 5 PM decline without relying on reactive metrics. This avoids over-provisioning during known idle periods, directly satisfying the cost-effectiveness constraint in the stem.

An Auto Scaling group with a launch template can span multiple Availability Zones, automatically replacing unhealthy instances and launching new ones to meet demand. An Application Load Balancer operates at Layer 7, supports HTTP/HTTPS health checks, and can route traffic based on path or host. Together, they provide automatic recovery and high availability for a stateless web application, directly satisfying the engineer's requirements.

Scale-in requires its own trigger because the threshold differs from scale-out. A separate CloudWatch alarm with a less-than-30-percent condition, evaluated over the same period, provides the discrete signal the Auto Scaling group needs to remove capacity only after utilization genuinely drops, matching the scenario's stated scale-in condition.

User-defined routes allow the administrator to override Azure's default system routes. By creating a UDR on the spoke subnets with the next hop type set to 'Virtual appliance' and specifying the NVA's private IP address, all traffic destined for the internet or other networks can be forced through the NVA for inspection. This directly satisfies the requirement to route spoke traffic through the NVA in the hub.

Amazon CloudWatch Logs is a managed service that ingests log data from EC2 instances via the CloudWatch agent, from AWS services, and from custom sources. It stores logs durably in log groups and supports querying with CloudWatch Logs Insights, a query language for searching and analyzing log events, which matches the central collection and ad hoc query requirements.

Centralising logs in a log management system aggregates entries from all sources into one queryable store, enabling correlation and consistent alert rules across services. Without centralisation, security events scattered across hosts cannot be searched or alerted on reliably, undermining structured log-based detection.

VPC Flow Logs capture accepted and rejected IP traffic metadata for elastic network interfaces, subnets or VPCs, including source, destination, port and action. Publishing them to CloudWatch Logs or S3 satisfies the troubleshooting requirement, since the records reveal whether traffic between the two VPCs is reaching its destination.

AWS Compute Optimizer analyses CloudWatch metrics and resource configuration to generate rightsizing recommendations for EC2 instances, identifying over-provisioned or underutilised capacity. This directly satisfies the goal of finding underutilised instances, unlike billing or inventory tools that only report spend.

AWS Systems Manager Patch Manager with a maintenance window satisfies the no-business-hours constraint by targeting the 50 Linux instances via tags and running patch baselines only within a defined schedule, using an IAM service role rather than SSH. This avoids manual intervention and prevents patching outside the approved window.

Composite alarms evaluate the state of multiple child alarms and fire only when the Boolean expression is true, which directly suppresses the storm of individual notifications. Routing only the composite alarm to the SNS topic means the on-call engineer receives one actionable alert that represents the correlated condition, preserving the underlying child alarms for diagnostics.

AWS Compute Optimizer analyses CloudWatch metrics against instance families and returns rightsizing recommendations for over-provisioned EC2 instances, directly meeting the cost-optimisation requirement. Cost Explorer and Trusted Advisor do not produce instance-level downsizing guidance of this kind.

VPC Flow Logs capture IP traffic metadata at the network interface level, recording source/destination IPs, ports, protocols, and packet accept/reject decisions without inspecting packet payloads. This satisfies the stem’s requirement to *analyse traffic metadata* between subnets, as the logs are published to Amazon CloudWatch Logs or S3 for querying with tools like Athena, enabling identification of blocked flows or asymmetric routing.

Application Auto Scaling for ECS services supports target tracking policies that watch the ECSServiceAverageCPUUtilization metric and adjust the desired task count to hold utilization near the target. Because the metric reflects the whole service, Fargate tasks scale out before saturation and scale in when load falls, which directly addresses the latency spike.

IAP TCP forwarding tunnels SSH over the internal IP through Google's infrastructure, authenticating the user's identity and IAM role before the connection is allowed. Because the instance needs no external address and the firewall permits only the IAP source range, the compliance rule is satisfied. Access is also logged per session, giving the auditability the rule demands.

S3 server access logs capture detailed records for every request made to a bucket, including the requester's IP address, the operation, and the response code. Analyzing these logs lets the engineer identify which sources are generating the traffic that drives the egress charges.

The pending:wait lifecycle state holds the instance in service-pending until the script signals complete-lifecycle-action, so the load balancer never routes traffic to an unconfigured instance. This satisfies the constraint that traffic must wait for successful script completion.

AWS CloudWatch Logs ingests and stores logs from AWS workloads, while Azure Log Analytics provides the centralised workspace and Kusto queries for advanced troubleshooting. Together they satisfy the multi-cloud constraint by covering both providers and enabling cross-environment querying.

An Auto Scaling group configured with the ELB health check type uses the load balancer's health status to determine instance health. When an instance fails the ELB health check, Auto Scaling terminates it and launches a replacement to maintain the desired capacity, providing the automatic recovery the team needs without manual intervention.

When a container crashes and restarts, the current container may not yet have produced logs. The --previous flag retrieves logs from the terminated instance, which is exactly where the crash reason appears. This is a non-disruptive read-only action that satisfies the requirement to inspect without modifying the running workload, making it the correct diagnostic step.

Azure Log Analytics ingests application logs from multiple sources into a single workspace, then supports KQL queries for security analysis and configurable retention extending to two years. This directly meets the centralisation and long-retention constraints in the stem.

Configuring the task definition's container to use the awslogs log driver sends the container's stdout and stderr streams to a specified CloudWatch Logs log group and stream. This captures the output the engineer needs to diagnose why a task stopped, and it requires no application changes because Docker's logging mechanism handles the capture.

Externalizing session state to ElastiCache for Redis decouples the session data from any single instance. If an instance fails, a replacement instance can read the same session data from the shared store, allowing users to continue without losing their sessions. This directly satisfies the requirement for session continuity with minimal interruption.

Target tracking scaling continuously adjusts capacity to hold a chosen metric, such as average CPU utilisation, at a target value. It reacts to real-time metric changes automatically, satisfying the requirement for dynamic adjustment without manually defined thresholds.

Amazon CloudWatch Logs ingests VPC flow logs and application logs into log groups, then supports CloudWatch Logs Insights for searching and querying across them. This satisfies the centralisation requirement directly, since both log types converge in one service without additional infrastructure, unlike S3-based aggregation that lacks native querying.

Lengthening the interval and timeout gives backends more time to respond and reduces the probe rate that may be contributing to the flapping. It does not mask a truly failed instance, because consecutive failures are still required, but it prevents transient latency spikes from marking healthy instances as unhealthy during bursts.

VPC Flow Logs capture IP traffic metadata for network interfaces, subnets or VPCs, recording accepted and rejected packets. Enabling them on the affected interfaces lets the engineer analyse traffic patterns and pinpoint where packets are dropped between the two VPCs.

A cloud monitoring service ingests metrics such as CPU utilisation from VM agents and hypervisor APIs, then stores and visualises them in dashboards. It satisfies the requirement to collect and visualise CPU metrics across the fleet, unlike compute or storage services that do not provide metric aggregation.

Tagging resources with department and project keys lets cost management tools group and filter spend along those dimensions. This enables accurate cost attribution, which untagged resources cannot support because billing data lacks the metadata needed to map charges to owners.

Azure Policy is the governance service that evaluates resources against business rules and can deny noncompliant resource creation or updates. By assigning a built-in or custom policy definition that requires HTTPS-only traffic and a minimum TLS version, the administrator can enforce the requirement across all subscriptions in the tenant, including future ones, at deployment time.

ApproximateNumberOfMessagesVisible reports the count of messages awaiting retrieval, directly reflecting backlog depth. Scaling on this metric adds EC2 capacity precisely when consumer throughput lags behind incoming demand, satisfying the requirement to scale on queue depth rather than CPU or network statistics.

Azure Application Insights satisfies the distributed tracing requirement by correlating requests across microservices through its telemetry model, using operation IDs to stitch spans into an end-to-end transaction view. This exposes per-hop latency, letting you pinpoint which service introduces delay during intermittent performance issues.

Packet Mirroring clones traffic from a specified instance or subnet and sends it to a collector instance for analysis. It operates at the VPC level, requires no agent on the monitored instance, and does not disrupt production traffic. This allows the engineer to capture and analyze packet-level details to diagnose the suspected packet loss.

CloudWatch anomaly detection builds a learned baseline from historical CPU patterns and alarms on deviations, catching unusual spikes rather than fixed thresholds. Static thresholds would either miss subtle spikes or fire constantly on normal variation.

Azure Backup stores VM backups in a Recovery Services vault, which encrypts data at rest by default. The policy controls the backup schedule and retention, and file-level recovery is supported directly from the recovery point. This combination satisfies the nightly schedule, 90-day retention, file restore, and encryption requirements.

AWS Cost Explorer provides pre-built dashboards that visualise cost and usage data, including breakdowns by dimension such as department when costs are tagged accordingly. This directly satisfies the requirement for an existing billing dashboard, unlike raw billing reports or custom-built tooling that would need manual configuration.

A unique request ID per transaction lets you correlate every log line belonging to one request across services, which is essential for tracing distributed calls. Without it, entries from concurrent requests interleave and become impossible to reconstruct during analysis.

AWS Compute Optimizer analyses CloudWatch metrics for EC2 instances and delivers rightsizing recommendations, directly satisfying the requirement to identify underutilised instances and cut cloud spend. It evaluates CPU, memory and network utilisation over time, unlike billing tools that only report cost.

A multi-AZ database keeps a synchronized standby in a separate zone and promotes it automatically during a zone failure. This removes the need to restore from backup, keeping database downtime within the recovery time objective and allowing the application tier to reconnect with minimal delay.

CloudWatch Network Monitor continuously probes network paths between source and destination resources in different regions and reports round-trip latency and packet loss. It works without application changes, which fits the requirement to measure the user-to-endpoint path while leaving the workload untouched, making it the correct monitoring service here.

AWS Compute Optimizer analyses CloudWatch metrics and resource configuration to generate rightsizing recommendations for EC2 instances, identifying over-provisioned capacity. This directly satisfies the requirement to reduce costs by flagging underutilised instances, unlike billing or cost-explorer tools that report spend without recommending instance-size changes.

Log-based metrics in Cloud Logging convert log entries matching a filter into a numeric time series. Creating a metric that counts HTTP 500 entries, then attaching a Cloud Monitoring alerting policy with the specified threshold and window, directly satisfies the requirement. This is the standard Google Cloud pattern for alerting on log content.

AWS Config can evaluate S3 bucket configurations against a rule that checks if server access logging is enabled. When a bucket is non-compliant, Config can trigger automatic remediation using an SSM Automation document that enables logging. This provides continuous compliance and automatic correction, meeting the requirement.

ALB health checks periodically probe each registered target on a configured protocol, port, and path. Reducing healthy and unhealthy thresholds makes the load balancer react faster to failing targets, which directly addresses identifying unhealthy targets before they serve traffic. This is the native mechanism for detecting target health in an ALB and is the correct operational control in this scenario.

Patch Manager, part of AWS Systems Manager, applies OS and security patches to managed EC2 instances on a schedule you define. Configuring a maintenance window satisfies the low-downtime constraint, since patching runs automatically during the specified period rather than requiring manual intervention on each instance.

Continuous replication copies every write to the DR region, giving an RPO measured in seconds or minutes, comfortably inside the 15-minute target. Snapshot or batch approaches would leave larger gaps between recovery points, breaching the stated RPO.

Patch Manager, part of AWS Systems Manager, automates patching of EC2 instances and on-premises managed nodes using patch baselines, maintenance windows, and compliance reporting. It supports scheduled scans and installs, and its compliance dashboard shows which nodes are missing patches. This directly satisfies the requirement for automated, scheduled patching with compliance visibility across the fleet.

X-Ray traces requests across EC2, ELB and RDS, exposing per-segment latency so the bottleneck service is identified. VPC Flow Logs complement this by revealing network-level drops or rejects along the path that tracing alone may not show.