Select Two (Multi-Select) Questions

Network packet drops

Why wrong: Incorrect; packet drops indicate network issues, not resource contention.

Swap usage

Why wrong: Incorrect; swap usage can indicate memory pressure but ballooning is the direct metric.

Disk queue length

Why wrong: Incorrect; disk queue length indicates storage contention, not CPU/memory.

Configure a NAT gateway to allow outbound internet access

Why wrong: NAT gateway is for internet access, not isolation.

Deploy a bastion host in a public subnet for administrative access

Why wrong: Bastion host is for management, not network isolation.

Use a transit gateway to interconnect all VPCs

Why wrong: Transit gateway centralizes connectivity but does not inherently isolate; additional routing policies are needed.

Reduce the number of instances in the auto-scaling group

Why wrong: Reducing instances would increase load on remaining servers, worsening latency.

Review security group rules for the load balancer

Why wrong: Security groups control access but do not directly cause latency.

Swap rate

Why wrong: Swap rate is a memory metric, not a CPU contention metric.

Memory ballooning

Why wrong: Memory ballooning is related to memory overcommitment, not CPU contention.

CPU utilization per core

Why wrong: CPU utilization shows usage but does not directly indicate contention; high utilization can occur without contention.

Network ACLs that block unauthorized IP ranges

Why wrong: Network ACLs control traffic at the subnet level, not service-level access.

Security groups that allow traffic from authorized services

Why wrong: Security groups apply to compute instances, not storage buckets.

A read replica database in a different AZ

Why wrong: Incorrect; stateless web app does not require database.

A single large EC2 instance to handle all traffic

Why wrong: Incorrect; single instance is a single point of failure.

Use a single EC2 instance with an auto-recovery policy

Why wrong: Single instance is a single point of failure.

Set up health checks to automatically replace unhealthy instances

Why wrong: Health checks are operational, not a deployment requirement for HA.

Enable cross-zone load balancing on the ALB

Why wrong: Cross-zone distributes traffic within a region, not a high availability requirement.

The log retention policy

Why wrong: Log retention is an operational consideration, not deployment.

The password complexity requirements

Why wrong: Password policy is a security configuration, not a deployment consideration.

The number of virtual CPUs assigned to the hypervisor

Why wrong: Hypervisor CPU assignment is not a VM deployment consideration.

Backup frequency and retention.

Why wrong: Backup settings are independent of storage type.

Physical location of the data center.

Why wrong: Location is a region/zone decision, not storage type.

Operating system compatibility with the storage.

Why wrong: Managed database abstracts the OS.

Shrink an existing partition to free space

Why wrong: Shrinking partitions is risky and may not be supported online.

Restore the VM from a recent backup to a larger disk

Why wrong: Restoring from backup causes significant downtime.

Add a new disk and move data to it

Why wrong: Moving data requires application downtime and reconfiguration.

Use a single virtual switch for all tenants.

Why wrong: A shared vSwitch can allow sniffing.

Place all tenants on the same storage array for efficiency.

Why wrong: Shared storage can lead to data leakage.

Physical access logs from the data center.

Why wrong: Physical logs are not relevant for cloud SIEM.

Firewall configuration backup files.

Why wrong: Config backups are not real-time logs.

Employee vacation schedule.

Why wrong: Not a security data source.

Embed credentials directly in the IaC templates.

Why wrong: Credentials should be stored in a secure secrets manager.

Manually modify resources after deployment to tune performance.

Why wrong: Manual modifications cause configuration drift.

Disk encryption settings.

Why wrong: Disk encryption does not cause provisioning failures.

Incorrect resource tagging.

Why wrong: Tagging is metadata and does not affect provisioning success.

Change the load balancing algorithm to least connections.

Why wrong: Algorithm change does not increase network capacity.

Increase the number of backend instances.

Why wrong: More instances distribute requests but each still has same bandwidth limit; overall throughput may still be constrained by bandwidth per instance if traffic is not evenly distributed.

Number of running processes

Why wrong: While many processes could cause CPU/memory pressure, those have already been ruled out; the number of processes alone is not a direct performance metric for slowdown.

Virtual machine snapshot size

Why wrong: Snapshot size primarily affects storage space and backup times, not immediate performance.

Hypervisor version

Why wrong: Hypervisor version is a configuration item, not a real-time performance metric; it is unlikely to cause intermittent slowdown.

Set up a VPN to a neighboring region

Why wrong: Would route data outside the required region.

Deploy in a single availability zone

Why wrong: Single point of failure, not highly available.

Deploy across multiple regions

Why wrong: May violate data residency requirements.

Disable VPC flow logs to reduce costs.

Why wrong: Flow logs provide valuable monitoring and troubleshooting information.

Use the default security group for all instances.

Why wrong: Default security groups may not provide least privilege.

Place all instances in the same subnet for simplicity.

Why wrong: This reduces security isolation and makes troubleshooting harder.

Expose the API endpoints without authentication for ease of integration.

Why wrong: Open endpoints are a major security risk.

Return detailed error messages including stack traces to help developers.

Why wrong: Detailed errors can reveal system internals to attackers.

Disable HTTPS to reduce latency.

Why wrong: HTTPS encrypts data; disabling it exposes sensitive information.

Review the user's recent access logs to see which actions were allowed.

Why wrong: Access logs show historical actions, not all effective permissions.

Check the resource-based policies on each resource the user might access.

Why wrong: Resource-based policies control access from a resource perspective, not the user's effective permissions.

Log in as the root user and run a permissions report.

Why wrong: The root user has full access and cannot be used to simulate another user's permissions.