Free AWS Certified CloudOps Engineer - Associate (SOA-C03) Sample Questions

Correct answers: A, D — General Purpose SSD (gp3); Provisioned IOPS SSD (io2)

• A. Correct. General Purpose SSD (gp3) volumes are designed to provide a balance of price and performance for a wide variety of transactional workloads. Users can provision performance (IOPS and throughput) independently of storage capacity, making them a flexible and high-performance choice suitable for IOPS-intensive workloads, including many relational and NoSQL databases.
• B. Incorrect. Throughput Optimized HDD (st1) volumes are low-cost magnetic storage designed for frequently accessed, throughput-intensive workloads with large datasets and large I/O sizes, such as big data, data warehouses, and log processing. They are optimized for throughput (MiB/s), not IOPS.
• C. Incorrect. Cold HDD (sc1) volumes provide the lowest-cost magnetic storage and are designed for less frequently accessed workloads. They are not suitable for high-performance or IOPS-intensive database workloads due to their low performance characteristics.
• D. Correct. Provisioned IOPS SSD (io2) volumes are the highest-performance EBS SSD volumes, specifically engineered for critical, I/O-intensive workloads like large relational or NoSQL databases that require sustained, low-latency performance. They offer high durability and consistent, provisioned IOPS.
• E. Incorrect. EBS Magnetic (standard) volumes are a previous-generation HDD-based volume type. They offer the lowest performance and are not intended for new deployments, especially those requiring high performance or IOPS-intensive capabilities.

Correct answer: D — The network connection between the instance and the EBS volume is saturated.

• A. This option is incorrect. Firstly, a low balance indicates that burst credits are nearly depleted, not necessarily fully exhausted (which would be 0%). Secondly, EBS performance credits are not a daily allocation; they replenish over time in a burst bucket. Therefore, the phrasing 'for the day' is inaccurate.
• B. This option is incorrect. A low `EBSIOBalance %` or `EBSByteBalance %` indicates the exact opposite. It signifies that the workload's I/O demand is exceeding the instance's baseline performance, causing the instance to consume its burst credits. If the instance were operating below its baseline, the credit balance would be high (at or near 100%) as credits would accumulate.
• C. This option is incorrect. If the EBS volume were detached from the instance, I/O operations would fail entirely. The specific performance metrics `EBSIOBalance %` and `EBSByteBalance %` would likely show no activity or would not be reported, rather than indicating a low but positive balance.
• D. This is the correct answer. EBS-optimized instances have a dedicated network connection to EBS. The `EBSIOBalance %` and `EBSByteBalance %` metrics track the burst performance credits. A consistently low balance means the workload frequently requires more performance than the instance's baseline, thus heavily consuming the burst credits. This sustained high demand is effectively saturating the dedicated network capacity, leading to credit depletion and performance throttling. This throttling is the reason the instance is performing below expectations.

Correct answers: C, D — CloudWatch cross-account observability; An IAM role in each source account that grants the management account read-only access to CloudWatch data.

• A. Incorrect. AWS CloudTrail organization trails are used to centralize and monitor API activity and events across all accounts in an AWS Organization. This is essential for auditing and security compliance but does not aggregate application performance metrics from Amazon CloudWatch.
• B. Incorrect. VPC peering is a networking feature that allows you to connect two VPCs privately. It enables network traffic routing between them but provides no mechanism for centralizing or monitoring CloudWatch metrics.
• C. Correct. Amazon CloudWatch cross-account observability is the purpose-built feature for this use case. It allows a central monitoring account to link to multiple source accounts to view, correlate, and analyze their metrics, logs, and traces in a unified dashboard.
• D. Correct. This is the foundational security mechanism required to enable cross-account access. The central management account needs permissions to read CloudWatch data from the source accounts. This is achieved by creating an IAM role in each source account that the management account's IAM principal can assume.
• E. Incorrect. Amazon S3 bucket replication is a feature for copying S3 objects between buckets, often for disaster recovery or data aggregation for batch analysis. While CloudWatch data can be exported to S3, this method is not suitable for real-time, centralized monitoring of metrics.

Correct answer: B — /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json

• A. Incorrect. While the `/etc` directory is a standard location for configuration files on Linux, it is not the default path used by the unified CloudWatch agent. The agent is installed under `/opt` and expects its configuration in a subdirectory there.
• B. Correct. On Linux instances, the unified CloudWatch agent is installed in the `/opt/aws/amazon-cloudwatch-agent/` directory. The default path where the agent and its control script (`amazon-cloudwatch-agent-ctl`) look for the primary configuration file is `/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json`.
• C. Incorrect. The `/var` directory is typically used for variable data files, such as logs, caches, and spools, not for static application configuration. This is not a recognized path for the CloudWatch agent's configuration.
• D. Incorrect. The `~/.aws/` directory is the default location for user-specific AWS CLI configurations and credentials. The CloudWatch agent runs as a system-wide service and requires its configuration to be in a system-level directory, not a user's home directory.

Correct answer: A — Create a composite alarm with the rule expression `ALARM(HighCPU) OR ALARM(LowMemory)`.

• A. This is the correct solution. AWS CloudWatch Composite Alarms are specifically designed to combine the states of multiple other alarms using logical expressions. The rule expression `ALARM(HighCPU) OR ALARM(LowMemory)` directly implements the required 'OR' logic, creating a new alarm that reflects the combined state without needing additional services or custom code. This is the most direct and efficient method.
• B. This is incorrect. Configuring both alarms to target the same SNS topic only centralizes notifications. It does not create a new, single alarm (`ApplicationUnhealthy`) that has its own state based on the other two. You would receive two separate notifications instead of a single notification from a combined alarm.
• C. This is incorrect because it confuses combining metrics with combining alarm states. Metric math operates on the underlying metric data (e.g., `CPUUtilization`) before an alarm threshold is evaluated. The requirement is to act on the *state* of the pre-existing alarms, not to create a new alarm based on a combination of raw metrics.
• D. This is an overly complex and indirect solution. While it is technically possible to use an EventBridge rule to trigger a Lambda function in response to alarm state changes, it introduces unnecessary complexity, cost, and maintenance overhead (custom code). Composite alarms provide a native, serverless, and much more direct way to achieve the same outcome.

Correct answer: B — Create a CloudWatch alarm that triggers an EC2 action to reboot the instance and a separate action to send a notification to an Amazon SNS topic.

• A. This approach is incorrect because it introduces unnecessary complexity and overhead. Using an SQS queue and a polling script on the instance itself makes the solution less reliable, as the script may fail to run if the instance is unresponsive due to the high CPU utilization.
• B. This is the correct and most efficient solution. Amazon CloudWatch alarms are designed for this exact use case. They can be configured to monitor metrics like CPU utilization and trigger multiple actions when a threshold is breached. Natively supported actions include EC2 actions (reboot, stop, terminate) and sending notifications to an Amazon SNS topic. This is a direct, reliable, and fully-managed approach.
• C. This option is incorrect because AWS Config is the wrong tool for this task. AWS Config is used for assessing, auditing, and evaluating the configurations of AWS resources for compliance and governance, not for monitoring real-time performance metrics like CPU utilization.
• D. This is an inefficient and unreliable solution. Relying on a local cron job adds operational overhead for script management and is not a cloud-native approach. Furthermore, if the instance is under high load, the cron job itself might fail to execute, making it an unreliable self-remediation mechanism.

Correct answer: A — AWS Config rule with an SSM Automation runbook as a remediation action.

• A. This is the most effective solution. AWS Config is a service designed specifically for assessing, auditing, and evaluating the configurations of AWS resources. A managed or custom Config rule can continuously monitor EC2 instances for the presence of the required `CostCenter` tag. Upon detecting a non-compliant instance, it can automatically trigger a pre-configured remediation action, such as an AWS Systems Manager (SSM) Automation runbook, to stop the instance. This provides a fully managed, event-driven, and auditable solution for enforcing compliance policies.
• B. This solution is incorrect because a daily scheduled Lambda function is not event-driven and would not meet the requirement to stop non-compliant instances 'within minutes' of launch. An instance could run for up to 24 hours before being detected, violating the policy's immediacy requirement.
• C. While this is a valid event-driven approach, it is not the most effective solution compared to AWS Config for this use case. This method requires writing and maintaining custom Lambda code for the checking and remediation logic. Furthermore, triggering on the `RunInstances` API call can introduce race conditions, as tags might be applied in a subsequent API call shortly after the instance is created. AWS Config is purpose-built for compliance and handles the resource state evaluation more robustly.
• D. This solution is incorrect because a CloudWatch alarm's primary function is to monitor metrics and trigger notifications or simple actions. It does not provide the logic to inspect individual resource configurations (like tags) and perform a targeted remediation action like stopping a specific instance. This approach only notifies a team, requiring manual intervention to enforce the policy.

Correct answer: B — Create one or more read replicas and direct read traffic to them.

• A. Incorrect. Increasing the instance size (vertical scaling) provides more resources like CPU and RAM, which can improve overall performance. However, it's not the most efficient or targeted solution for read-heavy workloads. This approach can be costly and has an upper limit, whereas read replicas allow for horizontal scaling of the read capacity.
• B. Correct. This is the ideal solution for scaling read-intensive database workloads on RDS. Read replicas are asynchronous copies of the primary database instance created specifically to serve read traffic. By offloading read queries to one or more read replicas, the load on the primary instance is reduced, which improves read performance and the overall scalability of the application.
• C. Incorrect. Multi-AZ deployment is a high-availability and disaster recovery feature, not a performance scaling solution. It creates a synchronous standby replica in a different Availability Zone for automatic failover. This standby instance does not serve read traffic and is only promoted to primary if the original primary instance fails.
• D. Incorrect. Migrating from a relational database like PostgreSQL to a NoSQL database like DynamoDB is a massive architectural undertaking. It would require significant application code changes and a complex data migration process. This is an excessive and inappropriate solution for a problem that can be effectively solved using the built-in read replica feature of RDS.

Correct answers: C, D — Manually add more Aurora Replicas to the cluster.; Enable Auto Scaling for Aurora Replicas.

• A. Incorrect. Increasing the instance size of the primary writer instance is a form of vertical scaling. While this can improve the overall performance of the primary instance, it does not horizontally scale out the read capacity of the cluster. The most effective way to handle high read traffic is by distributing it across multiple read replicas.
• B. Incorrect. Aurora Multi-Master mode is designed for high availability and write scalability by allowing multiple instances to handle write operations. It does not specifically address the need to scale out read capacity, which is the primary function of Aurora Replicas.
• C. Correct. Manually adding Aurora Replicas is a direct and standard method for horizontally scaling the read capacity of an Aurora cluster. Each replica can serve read requests, offloading traffic from the primary writer instance and distributing the read load across the cluster.
• D. Correct. Enabling Auto Scaling for Aurora Replicas is an automated and elastic method to manage read capacity. It dynamically adds or removes replicas based on predefined metrics (like CPU utilization), ensuring the cluster has sufficient capacity to handle fluctuating read traffic efficiently.
• E. Incorrect. The Aurora storage volume automatically scales I/O to meet the demands of the database workload. Increasing Provisioned IOPS is not a feature of Aurora's standard storage model and does not address the compute bottleneck associated with handling a high volume of read queries. Scaling read capacity requires adding more compute resources (replicas), not changing storage I/O settings.

Correct answers: A, D — Enable Cluster Mode.; Enable Multi-AZ with automatic failover.

• A. Enabling Cluster Mode for an ElastiCache for Redis cluster allows for horizontal scaling. Data is partitioned (sharded) across multiple nodes, which allows the cluster to scale both its dataset size and its read/write throughput by adding more shards. This configuration directly addresses the requirement to scale reads horizontally to handle high traffic.
• B. Disabling automatic backups is detrimental to a critical Tier-1 application. Backups are crucial for data durability and disaster recovery. This action does not contribute to high availability or read scalability and would increase the risk of data loss.
• C. Deploying a cluster in a single Availability Zone creates a single point of failure, which is the opposite of a highly available architecture. If that Availability Zone experiences an outage, the entire cache becomes unavailable. High availability requires resources to be distributed across multiple Availability Zones.
• D. Enabling Multi-AZ with automatic failover is a core feature for achieving high availability with ElastiCache for Redis. This configuration creates replica nodes in different Availability Zones from the primary node. If the primary node fails, ElastiCache automatically promotes a read replica to become the new primary, minimizing downtime and ensuring the cache remains available.
• E. The question explicitly states the application uses ElastiCache for Redis, so changing the engine is not a valid configuration. Furthermore, Memcached is a simpler caching engine that does not have built-in support for replication or the Multi-AZ automatic failover feature, making it unsuitable for applications with stringent high-availability requirements.

Correct answer: D — The health check is configured to evaluate the health of the target, but 'Evaluate Target Health' is set to No on the primary alias record.

• A. Incorrect. In a primary-secondary failover configuration, a health check is not required for the secondary record. Route 53 assumes the secondary endpoint is healthy and will automatically fail over to it if the primary record fails its health check. The absence of a health check on the secondary record does not prevent the failover process.
• B. Incorrect. A high Time to Live (TTL) value would delay the propagation of the failover for clients that have the primary record's IP address cached. However, it would not prevent the failover mechanism itself from triggering. Route 53 would start serving the secondary record's address once the primary is deemed unhealthy. Furthermore, since this is an Alias record pointing to an ELB, the TTL is managed by AWS and is typically very short (e.g., 60 seconds).
• C. Incorrect. Amazon Route 53 fully supports using an S3 bucket configured for static website hosting as a target for a record set, including as a secondary target in a Failover routing policy.
• D. Correct. When using an Alias record that points to an AWS resource like an Elastic Load Balancer, the 'Evaluate Target Health' setting is critical. If this is set to 'No', Route 53 does not check the health of the underlying resource (the ELB). It will consider the record healthy as long as the alias target exists, regardless of the status of the instances behind it. To make the failover work, 'Evaluate Target Health' must be set to 'Yes' so that Route 53 can use the ELB's health status to determine when to fail over.

Correct answer: B — To verify that an endpoint is reachable and healthy, allowing Route 53 to route traffic away from unhealthy endpoints.

• A. Incorrect. Monitoring DNS query logs for malicious activity is a security function, not the role of a Route 53 health check. This task is typically handled by services like Amazon GuardDuty, AWS WAF, or by analyzing logs stored in Amazon S3 or CloudWatch Logs.
• B. Correct. The primary function of a Route 53 health check is to monitor the health and performance of specified endpoints, such as web servers or other resources. When a health check determines an endpoint is unhealthy, Route 53 can be configured (e.g., with a failover routing policy) to stop responding to DNS queries with that endpoint's IP address, thereby routing traffic to healthy endpoints and improving application availability.
• C. Incorrect. Automatically scaling resources based on traffic or performance metrics is the primary function of AWS Auto Scaling. While a health check determines if an endpoint is healthy or unhealthy, it does not trigger scaling actions itself. Auto Scaling uses its own health checks or metrics from CloudWatch to make scaling decisions.
• D. Incorrect. Encrypting DNS queries is a security and privacy feature, not the function of a health check. DNS query encryption is handled by protocols like DNS over HTTPS (DoH) or DNS over TLS (DoT). Route 53 health checks are concerned with endpoint availability, not data encryption in transit.

Correct answer: B — By updating the DNS CNAME record of the DB instance endpoint to point to the standby instance.

• A. This is incorrect. AWS does not directly update or swap the IP addresses visible to the application. The redirection mechanism is managed at the DNS level to ensure a seamless transition without requiring manual IP address changes in connection strings.
• B. This is the correct mechanism. During a Multi-AZ failover, Amazon RDS automatically updates the DNS CNAME record for the DB instance endpoint. This record is flipped to point from the failed primary instance to the newly promoted standby instance. Applications using this single endpoint will resolve the new IP address (after the DNS TTL expires) and connect to the new primary, typically without any application-level changes.
• C. This is incorrect. The failover process for Amazon RDS Multi-AZ does not involve re-routing traffic at the VPC router level for client connections. The redirection is handled by updating the DNS record associated with the database endpoint.
• D. This is incorrect. A key design principle of RDS Multi-AZ is to make failover as transparent as possible to the application. Requiring a new endpoint would necessitate application code or configuration changes. Instead, the same single DB instance endpoint is used before, during, and after the failover.

Correct answers: A, D — PITR allows restoring to any point in time within the last 35 days.; Restoring from a backup always creates a new DynamoDB table.

• A. This is a core feature of DynamoDB Point-in-Time Restore (PITR). It allows you to restore a table to any specific second during the preceding 35 days, providing granular recovery capabilities from accidental write or delete operations.
• B. This statement is incorrect. PITR is a fully managed feature where backups are stored transparently within the AWS DynamoDB infrastructure. The backups are not stored in an S3 bucket within the customer's AWS account.
• C. This statement is incorrect. PITR is a continuous backup solution, not one based on discrete daily snapshots. It continuously captures changes to the table, which is what enables restoration to any specific point in time, down to the second.
• D. This statement is correct. When you restore a table from any DynamoDB backup, including a PITR, the process always creates a new table. You cannot overwrite an existing table with a restore operation. This is a safety feature to prevent accidental data loss on the original table.
• E. This statement is incorrect. PITR is a feature that you enable once per table. After it's enabled, the backup process is automatic and continuous, requiring no manual triggers or recurring actions from the user.

Correct answers: A, C — Install the AWS Systems Manager (SSM) Agent on the EC2 instance.; Install the AWS VSS provider on the EC2 instance.

• A. Correct. To perform application-consistent backups, AWS Backup needs to orchestrate actions within the guest operating system. The AWS Systems Manager (SSM) Agent provides the necessary communication channel for AWS Backup to run commands on the EC2 instance, which is a prerequisite for triggering VSS operations.
• B. Incorrect. The backup frequency defines the Recovery Point Objective (RPO) by setting how often backups are created. This setting has no influence on the consistency of the data captured within each backup.
• C. Correct. The AWS VSS (Volume Shadow Copy Service) provider is a specific software component that must be installed on the Windows EC2 instance. This provider allows AWS services to interact with the native Windows VSS framework to quiesce I/O and flush memory buffers to disk before a snapshot is taken. This ensures the backup of a VSS-aware application is in a transactionally consistent state.
• D. Incorrect. While attaching the `AmazonSSMManagedInstanceCore` policy to the EC2 instance's IAM role is a mandatory prerequisite for the SSM Agent to function, it is a supporting requirement. The most direct actions to achieve application consistency involve installing the agent (A) and the VSS provider (C), which are the software components that actively perform the work on the instance.
• E. Incorrect. EBS encryption is a security measure that protects data at rest. It does not affect the state of the application or the data's consistency at the moment the backup is taken.

Correct answers: B, D — A step-by-step guide on how to restore the RDS database from the latest cross-region snapshot.; The process to identify and attach the correct, restored EBS volumes to the newly launched EC2 instances.

• A. This is incorrect. While matching the original instance type is beneficial for performance consistency, it is not a critical requirement for a successful recovery. The application can be brought online using a different, available instance type in the disaster recovery region if necessary. The primary focus is on data restoration, not exact hardware specifications.
• B. This is correct. The RDS database contains the application's state, making its restoration a critical step. A detailed, step-by-step guide for restoring the database from the most recent cross-region snapshot is essential for a runbook. This reduces the risk of human error during a high-stress disaster recovery event and ensures the application's data integrity.
• C. This is incorrect. A list of IAM users is a matter of security and access control, not a direct step in the technical recovery of the application's infrastructure and data. While IAM roles for instances are important, a list of human users is not critical for the runbook's recovery procedure.
• D. This is correct. Similar to the RDS database, the EBS volumes store stateful data for the web servers. The runbook must clearly document the process of creating new EBS volumes from cross-region snapshots, and then accurately identifying and attaching these restored volumes to the correct, newly launched EC2 instances. Failure to do this correctly would result in data loss or application malfunction.
• E. This is incorrect. Cost reports are used for financial management and optimization. They are completely irrelevant to the technical steps required to execute a disaster recovery plan and restore application functionality.

Correct answer: B — AWS Systems Manager Patch Manager configured with a patch baseline and a maintenance window.

• A. This approach is incorrect. While technically possible, using Lambda and EventBridge to run shell scripts is not an efficient or scalable solution for patch management. It would require significant custom scripting to manage connections, track patch status, and handle errors across a large fleet, and it lacks the built-in controls for patch approval and scheduling that other AWS services provide.
• B. This is the correct answer. AWS Systems Manager Patch Manager is the purpose-built service for automating patch management on EC2 instances. It directly addresses all requirements of the question by allowing the creation of patch baselines to define a set of approved patches and the configuration of maintenance windows to schedule the patching process during specific times. This is the most efficient, scalable, and manageable solution.
• C. This is an inefficient, manual, and outdated approach. Using a custom script on a bastion host with SSH is not scalable, is prone to errors, requires managing SSH keys securely, and lacks the centralized logging, reporting, and automation features of a managed AWS service like Systems Manager. It does not meet the requirement for an efficient, automated solution.
• D. This approach is incorrect because it is reactive rather than proactive. AWS Config is designed to detect non-compliance with rules, and an Automation runbook can remediate it. However, the question asks for a scheduled, proactive monthly patching process. Using AWS Config for this is overly complex and less direct than using Patch Manager, which is designed specifically for scheduled patching operations.

Correct answer: C — Parameter Store

• A. Incorrect. Distributor is an AWS Systems Manager feature used to create, securely store, and distribute software packages to managed instances. It is not designed for storing general configuration data or secrets.
• B. Incorrect. OpsCenter is a feature that provides a central location for operations engineers to view, investigate, and resolve operational issues (OpsItems) related to AWS resources. It does not store or manage configuration data.
• C. Correct. Parameter Store provides secure, hierarchical storage for configuration data management and secrets management. You can store data such as passwords, database strings, and license codes as parameter values. It supports plain text data (String, StringList) and encrypted secrets (SecureString) and can be easily referenced by other AWS services and applications.
• D. Incorrect. Inventory is an AWS Systems Manager feature that automates the collection of metadata from your managed instances, such as installed applications and network configurations. Its purpose is to provide visibility into your environment, not to store and manage configuration data.

Correct answer: B — State Manager

• A. Incorrect. AWS Systems Manager Run Command is used to execute ad-hoc commands or scripts on managed instances. It is suitable for one-time tasks but does not continuously monitor or enforce a desired state over time.
• B. Correct. AWS Systems Manager State Manager is specifically designed to define and maintain a consistent configuration state for your instances. By creating a State Manager association, you can schedule an SSM document to run periodically, which checks for the presence and status of the agent and automatically takes corrective action (like installing or starting it) if the instance drifts from the desired state.
• C. Incorrect. AWS Systems Manager Automation is used to orchestrate complex workflows and runbooks that can involve multiple AWS services and steps, such as updating AMIs or performing backups. While it could be used to build a custom solution for this task, it is not the most direct or purpose-built feature for continuous state enforcement on individual instances.
• D. Incorrect. AWS Systems Manager Patch Manager automates the process of patching managed instances with security and other types of updates for operating systems and applications. Its focus is on patch compliance, not on enforcing the installation and running state of custom software like a monitoring agent.

Correct answer: C — Stack

• A. Incorrect. A Construct is the basic building block in the AWS CDK, representing one or more AWS resources. Constructs are composed together within a Stack, but a Construct itself is not the deployable unit that maps directly to a CloudFormation stack.
• B. Incorrect. An App is the root-level container for a CDK application. It can contain one or more Stacks, but the App itself is not the deployable unit; rather, it is the entry point for synthesizing and deploying the Stacks it contains.
• C. Correct. In the AWS CDK, a Stack is the construct that directly corresponds to an AWS CloudFormation stack. It is the fundamental unit of deployment. When you run `cdk deploy`, the CDK synthesizes the Stack object into a CloudFormation template and deploys it.
• D. Incorrect. An Aspect is a mechanism in the AWS CDK that allows you to apply an operation to all constructs within a specific scope, such as adding tags to all resources in a stack. It is used for applying cross-cutting concerns and is not a deployable unit.

Correct answer: C — Trusted Access for AWS CloudFormation StackSets

• A. Incorrect. Consolidated Billing is a foundational feature of AWS Organizations that aggregates billing for multiple accounts. It does not grant the cross-account permissions required for services like CloudFormation StackSets to deploy resources.
• B. Incorrect. While enabling 'All Features' in AWS Organizations is a prerequisite for using service-managed permissions, it is not the specific action that grants the necessary permissions. Enabling 'All Features' unlocks advanced capabilities, including trusted access, but you must still explicitly enable trusted access for the specific service.
• C. Correct. To use service-managed permissions with CloudFormation StackSets, you must enable Trusted Access between AWS Organizations and AWS CloudFormation. This action grants the CloudFormation service permissions to create the required IAM roles (e.g., AWSCloudFormationStackSetExecutionRole) in member accounts, allowing the management or delegated administrator account to deploy and manage stacks across the organization.
• D. Incorrect. Service Control Policies (SCPs) are used to enforce permission boundaries and restrict the maximum permissions available in an account. They do not grant permissions. In fact, an overly restrictive SCP could potentially block a StackSet deployment, but enabling SCPs is not the mechanism that allows them.

Correct answer: B — AWS CodeDeploy with a canary deployment configuration for AWS Lambda.

• A. Incorrect. AWS CloudFormation is a service for defining and provisioning infrastructure as code. While it supports some update policies like blue/green for services like Amazon ECS, it does not natively provide fine-grained canary deployments with automatic, alarm-based rollbacks specifically for AWS Lambda functions.
• B. Correct. AWS CodeDeploy is a fully managed deployment service that automates application deployments. It natively supports canary and linear deployment configurations for AWS Lambda, which allows for gradually shifting traffic to a new function version. Crucially, it integrates directly with Amazon CloudWatch alarms to monitor the deployment and can automatically trigger a rollback to the previous stable version if any alarms are breached, perfectly matching the requirements.
• C. Incorrect. AWS Elastic Beanstalk is a Platform as a Service (PaaS) offering designed for deploying and scaling web applications and services on familiar servers such as Apache and Nginx, typically running on EC2 instances. It is not used for managing deployments of serverless AWS Lambda functions.
• D. Incorrect. Manually updating a Lambda function alias is a high-risk, error-prone approach that lacks the required automation. This method does not provide a built-in mechanism for gradual traffic shifting or for automatic rollbacks based on CloudWatch alarms. A managed and automated solution like AWS CodeDeploy is the best practice for this scenario.

Correct answer: C — By adding a `Condition` element to the policy statement that checks if `aws:MultiFactorAuthPresent` is 'true'.

• A. Incorrect. Simply adding a `Deny` statement without a condition would block the sensitive actions for all users, regardless of whether they have authenticated with MFA. While a `Deny` statement can be used to enforce MFA, it must be paired with a condition that denies the action *if* MFA is not present (e.g., `aws:MultiFactorAuthPresent` is 'false').
• B. Incorrect. Creating a separate IAM policy is an organizational choice, but it doesn't describe the mechanism for enforcing MFA. The critical component is the content of the policy, specifically the condition element that checks for MFA presence, not the existence of a separate policy file.
• C. Correct. This is the standard and most direct method for enforcing MFA for specific actions in AWS. By adding a `Condition` element to an IAM policy statement that checks if the `aws:MultiFactorAuthPresent` key is 'true', you ensure that the permissions in that statement are only granted if the user's session was authenticated using MFA.
• D. Incorrect. An IAM password policy is used to manage password characteristics such as complexity, length, and rotation requirements. It has no settings related to enforcing MFA for API actions. MFA enforcement for specific actions must be configured within an IAM policy using conditions.

Correct answer: C — Filter the AWS CloudTrail Event History for the user's ARN and look for events with an 'AccessDenied' error message.

• A. This is incorrect. Amazon S3 server access logs are service-specific and only provide information about requests made to S3 buckets. They do not provide a comprehensive view of all API calls across the various AWS services that the applications might be using.
• B. This is incorrect. The IAM Policy Simulator is a proactive tool used for testing and debugging policies before they are applied. It simulates what API calls a user would be allowed or denied but does not provide historical data on actual API calls that have already occurred and failed.
• C. This is the correct and most efficient method. AWS CloudTrail is the definitive service for logging all API activity within an AWS account. It records successful and failed API calls, including those denied by IAM policies. By filtering the CloudTrail Event History for the specific user's ARN and searching for an 'AccessDenied' error message within the specified time frame, the engineer can quickly identify exactly which API calls were blocked.
• D. This is incorrect. While application logs might indicate that an error occurred, they are often not configured to capture the specific AWS API call that failed or the detailed IAM error message. Furthermore, this method is inefficient as it would require checking logs on multiple instances or services, whereas CloudTrail provides a centralized, authoritative audit trail.

Correct answer: A — AWS Config with a custom rule

• A. Correct. AWS Config is designed for continuous monitoring, auditing, and evaluating the configurations of AWS resources against desired policies. A custom AWS Config rule can be created (typically using an AWS Lambda function) to specifically check for S3 buckets that have the `Classification: Confidential` tag and are also publicly accessible. Upon detecting a non-compliant resource, AWS Config can trigger automated remediation actions, such as invoking an AWS Systems Manager Automation document or another Lambda function to modify the bucket's settings and remove public access.
• B. Incorrect. Amazon GuardDuty is an intelligent threat detection service that continuously monitors for malicious activity and unauthorized behavior. It does not evaluate resource configurations against custom compliance policies based on tags, but rather focuses on security threats like unusual API activity or communication with malicious IP addresses.
• C. Incorrect. AWS CloudTrail is a service that provides event history and records API calls for your AWS account, which is crucial for auditing and governance. While it logs the events that might make a bucket public, it does not continuously check the current configuration state of resources against a compliance rule or natively trigger remediation based on that state.
• D. Incorrect. Amazon CloudWatch Events (now Amazon EventBridge) is an event bus service that can react to state changes in AWS resources. While it could be part of a solution to trigger a process (like a Lambda function) when a bucket configuration changes, it does not have the built-in capability to evaluate the compliance of a resource's configuration. AWS Config is the service that provides the rule evaluation framework itself.

Correct answer: C — Customer managed keys allow the user to control the key policy and enable/disable automatic rotation, while AWS managed keys do not.

• A. This statement is incorrect. Both AWS managed keys and customer managed keys can be used for server-side encryption with various AWS services. The ability to perform encryption is not the differentiating factor; the level of management and control over the key is.
• B. This statement is technically correct regarding pricing, as AWS managed keys are free and customer managed keys have a monthly fee plus per-request charges. However, this is a consequence of the difference in control, not the primary or 'key' difference itself. The fundamental distinction lies in the management model and control level.
• C. This statement is correct and describes the fundamental difference. With customer managed keys, you have full control over the key's lifecycle, including defining the key policy, managing IAM permissions for administration and usage, enabling/disabling the key, and deciding whether to enable automatic key rotation. For AWS managed keys, AWS controls the key policy and lifecycle, and automatic rotation is mandatory and cannot be disabled.
• D. This statement is incorrect. All KMS keys, including AWS managed keys, are regional resources by default. However, only customer managed keys can be configured as multi-Region keys, which allows for their use across different AWS Regions. AWS managed keys are strictly confined to the single region in which they are created.

Correct answer: C — Amazon EventBridge, AWS Lambda, and a Network ACL (NACL)

• A. Incorrect. AWS WAF is a web application firewall that operates at the application layer (Layer 7) to protect against common web exploits over HTTP/S. It cannot be used to block traffic for protocols like SSH (which operates over TCP at a lower layer). While EventBridge/CloudWatch Events and Lambda are correct for the automation workflow, WAF is the wrong tool for blocking SSH-based attacks.
• B. Incorrect. Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not provide a mechanism for real-time blocking of malicious IP addresses. AWS Step Functions could orchestrate a response, but it requires another service to perform the actual blocking action and is not the most direct component.
• C. Correct. This is the most effective solution for this scenario. Amazon EventBridge can capture GuardDuty findings in near real-time. An EventBridge rule can be configured to match the specific finding type and trigger an AWS Lambda function. The Lambda function can parse the finding's details to extract the attacker's IP address and then programmatically add a 'deny' rule to the appropriate Network ACL (NACL). A NACL operates at the subnet level and is the correct tool for blocking malicious IP addresses at the network layer for any type of traffic, including SSH.
• D. Incorrect. AWS Systems Manager is used for operational tasks like patch management, configuration management, and automation on EC2 instances. An S3 bucket policy controls access to objects within an S3 bucket. Neither of these services is relevant for blocking network traffic from a malicious IP address targeting an EC2 instance.

Correct answer: A — The Route 53 Resolver rule has not been associated with the VPC.

• A. This is the correct answer. A Route 53 Resolver rule, once created, does not automatically apply to any VPC. It must be explicitly associated with each VPC where you want the rule to be active. If the rule is not associated with the VPC containing the EC2 instances, the VPC's DNS resolver will not be aware of the rule and will not forward the specified queries.
• B. This is incorrect. Security groups are an AWS resource and cannot be applied to on-premises servers. Security groups would be applied to the Route 53 Resolver's outbound endpoint ENIs within the VPC. While a misconfigured security group on the outbound endpoint could block traffic, the most fundamental and likely cause for queries not being forwarded at all is a missing rule association.
• C. This is incorrect. Route 53 Resolver uses two types of endpoints for hybrid DNS. An outbound endpoint is used to forward queries from a VPC to an on-premises network. An inbound endpoint is used to allow DNS queries from an on-premises network to resolve AWS resources. This scenario requires an outbound endpoint, so a missing inbound endpoint is irrelevant to the problem.
• D. This is incorrect. For Route 53 Resolver rules to function, EC2 instances must use the default Amazon-provided DNS server (located at the VPC CIDR base + 2), which is configured via the default DHCP options set. This DNS server is what intercepts the queries and applies the resolver rules. Changing the DHCP options set to point to a custom DNS server would bypass the Route 53 Resolver service entirely. Therefore, this option describes a correct configuration, not a cause of the problem.

Correct answer: B — To allow DNS queries from an on-premises network to be resolved using Route 53 Resolver within a VPC.

• A. Incorrect. This describes the function of a Route 53 Resolver outbound endpoint, which is used to forward DNS queries originating from within a VPC to an external network, such as an on-premises data center.
• B. Correct. A Route 53 Resolver inbound endpoint provides an IP address within a VPC that on-premises DNS servers can forward DNS queries to. This allows DNS queries from the on-premises network to be resolved by Route 53, enabling seamless hybrid DNS resolution.
• C. Incorrect. Public DNS resolution for resources within a VPC is managed by Route 53 public hosted zones and the default VPC DNS resolver. An inbound endpoint is specifically designed for hybrid cloud scenarios involving private DNS resolution.
• D. Incorrect. The primary function of an inbound endpoint is to resolve DNS queries, not to log them. DNS query logging is a separate feature configured through Route 53 Resolver Query Logging, which can send logs to services like Amazon S3, CloudWatch Logs, or Kinesis Data Firehose.

Correct answers: B, D — CloudFront geolocation restriction; AWS WAF

• A. Incorrect. AWS Shield Advanced is a managed Distributed Denial of Service (DDoS) protection service. While it works with CloudFront, its primary purpose is to protect against large-scale DDoS attacks, not to block access from specific countries or filter application-layer exploits like SQL injection.
• B. Correct. CloudFront has a built-in feature called geolocation restriction (or geo-restriction). This feature allows you to either whitelist (allow) or blacklist (block) countries, enabling you to control which geographic locations can access your content, directly fulfilling one of the requirements.
• C. Incorrect. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior within an AWS account by analyzing logs. It is a detective control, not a preventative one that can block web requests at the CloudFront level.
• D. Correct. AWS WAF is a web application firewall that integrates seamlessly with Amazon CloudFront. It helps protect web applications from common web exploits by allowing you to configure rules to filter and block malicious traffic, such as requests containing SQL injection or cross-site scripting (XSS) attacks.
• E. Incorrect. Network Access Control Lists (NACLs) are stateless firewalls that operate at the subnet level within a VPC to control inbound and outbound traffic. They are not associated with or applicable to Amazon CloudFront, which is a global edge service.

Correct answer: C — Route 53 Resolver DNS Firewall

• A. Incorrect. AWS WAF (Web Application Firewall) operates at the application layer (Layer 7) to protect web applications from common web exploits like SQL injection and cross-site scripting. It does not function at the DNS level and cannot be used to filter or audit DNS queries.
• B. Incorrect. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. While it can detect when an instance makes a DNS query to a known malicious domain and generate a finding, it is a detective control, not a preventative one. It does not block the DNS queries themselves.
• C. Correct. Route 53 Resolver DNS Firewall is a service specifically designed to filter and control outbound DNS queries for VPCs. It allows you to create rule groups with domain lists (including AWS managed lists of malicious domains) and apply actions like BLOCK, ALLOW, or ALERT. It integrates with AWS Firewall Manager to be centrally managed and deployed across an entire AWS Organization, perfectly matching all the requirements.
• D. Incorrect. AWS Network Firewall is a managed, stateful firewall service that filters network traffic at the VPC level. While it can perform domain-based filtering, its primary function is broader network traffic inspection. Route 53 Resolver DNS Firewall is the purpose-built, more efficient, and direct solution for filtering DNS queries specifically.

Correct answer: C — To determine where network traffic from your subnet or gateway is directed.

• A. Incorrect. Filtering traffic at the subnet level is the primary function of Network Access Control Lists (NACLs), which are stateless firewalls. Security Groups also filter traffic, but they operate at the instance level.
• B. Incorrect. Acting as a stateful firewall for associated EC2 instances is the function of Security Groups, not route tables.
• C. Correct. A route table contains a set of rules, called routes, that are used to determine where network traffic originating from a subnet or gateway is directed. It essentially acts as a traffic director for the VPC, guiding packets to their intended destinations.
• D. Incorrect. This function is performed by a NAT (Network Address Translation) Gateway or a NAT instance, which enables instances in a private subnet to connect to the internet or other AWS services while preventing the internet from initiating a connection with those instances.

Correct answers: A, B — It acts as a regional virtual router for traffic between VPCs and on-premises networks.; It supports transitive routing between attached VPCs and VPN connections.

• A. This is correct. AWS Transit Gateway functions as a central, regional hub or virtual router. It simplifies network architecture by connecting multiple VPCs, AWS Direct Connect gateways, and VPN connections within a single AWS Region, enabling centralized routing and management.
• B. This is correct. A primary benefit of Transit Gateway is its support for transitive routing. This means that any network attached to the Transit Gateway (e.g., a VPC) can communicate with any other attached network (e.g., another VPC or a VPN connection) through the gateway, without needing complex, full-mesh peering connections.
• C. This is incorrect. By default, attachments to a Transit Gateway are associated with a default route table that allows full communication between all attachments. To prevent communication, you must implement more advanced configurations, such as creating separate route tables to segment traffic.
• D. This is incorrect. A Transit Gateway is a regional, highly available resource. It creates elastic network interface (ENI) attachments in multiple Availability Zones within its region to ensure resilience and connect resources across those AZs.
• E. This is incorrect. AWS Transit Gateway supports inter-region peering, which allows you to connect Transit Gateways in different AWS Regions. This feature enables you to build a global network that routes traffic between regions over the AWS global network backbone.

Correct answer: B — The ALB's security group is not allowing inbound traffic from CloudFront's IP addresses.

• A. Incorrect. An invalid or missing SSL/TLS certificate on the CloudFront distribution affects the connection between the client and the CloudFront edge location. This would typically result in browser certificate warnings or SSL/TLS handshake failures, not an HTTP 502 error, which signals a problem between CloudFront and its origin.
• B. Correct. An HTTP 502 (Bad Gateway) error from CloudFront indicates that it was unable to connect to or get a valid response from the origin. A common cause is the origin's security group (in this case, the ALB's) not allowing inbound traffic from CloudFront's IP address ranges on the correct port. Since CloudFront uses a large, published set of IP addresses, a misconfiguration here can easily lead to connection failures.
• C. Incorrect. The Time to Live (TTL) for cached objects determines how long they are stored at CloudFront edge locations. A low TTL increases the frequency of requests to the origin, which might increase load, but it does not directly cause a connectivity failure that would result in an HTTP 502 error.
• D. Incorrect. If the DNS record pointed to the wrong CloudFront distribution, users would either fail to resolve the domain or be directed to the wrong content. This would likely cause '404 Not Found' errors, certificate mismatch errors, or other DNS-related issues, not an intermittent 502 error which is specific to the communication between the correct CloudFront distribution and its configured origin.

Correct answer: B — Amazon CloudWatch Network Monitor

• A. Incorrect. VPC Flow Logs capture IP traffic metadata for network interfaces within a VPC. While useful for security analysis and troubleshooting traffic flows (e.g., accepted vs. rejected packets), they do not provide active performance metrics like round-trip time (latency) or packet loss percentage.
• B. Correct. Amazon CloudWatch Network Monitor is a service specifically designed to monitor network health and performance between AWS and on-premises environments. It actively sends probes to measure and report on key network performance indicators, including packet loss and round-trip time, which directly addresses the requirements of the question.
• C. Incorrect. AWS Transit Gateway Network Manager provides a centralized view for managing and monitoring a global network built with AWS Transit Gateway. While it offers visibility into topology and the health of network components (e.g., VPN, Direct Connect), it is not primarily an active monitoring tool for measuring performance metrics like packet loss and round-trip time in the way CloudWatch Network Monitor is.
• D. Incorrect. AWS CloudTrail is a service for governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and account activity, but it does not perform any kind of active network performance monitoring.