Incident and Event Response — DOP-C02 Practice Quiz

Question 1

A company must ensure that no S3 bucket in its production account ever allows public read access. The security team wants an automated, event-driven mechanism that detects when a bucket becomes publicly readable and immediately reverts it to a private (blocked) state without any human intervention. The solution should also produce an audit trail of both the violation and the remediation action. Which approach best meets these requirements with the least custom code?

Accepted Answer

Create an AWS Config managed rule (s3-bucket-public-read-prohibited) and attach an automatic remediation action that invokes the AWS-DisableS3BucketPublicReadWrite Systems Manager Automation document; AWS Config records both the noncompliance and the remediation execution.

Answer

Enable S3 server access logging on every bucket and run a scheduled Lambda function every 5 minutes that parses the logs, detects public access, and calls PutPublicAccessBlock to remediate.

Answer

Create a CloudWatch alarm on the S3 BucketSizeBytes metric that triggers an SNS notification to the security team, who then manually apply a bucket policy to block public access.

Answer

Use an EventBridge scheduled rule that runs nightly to invoke a Lambda function which lists all buckets, checks their ACLs, and rewrites any public ones to private.

Question 2

A DevOps team runs an automated incident-response workflow: an EventBridge rule matches CloudTrail management events for security-group ingress changes and invokes a Lambda function that reverts non-compliant rules. During a recent audit, the team found that some non-compliant rule additions were reverted several minutes late, and a few were never reverted at all. CloudWatch Logs show the Lambda function was invoked far fewer times than the number of AuthorizeSecurityGroupIngress API calls recorded in CloudTrail. The EventBridge rule pattern and Lambda IAM permissions are confirmed correct. What is the MOST likely root cause of the missed and delayed remediations?

Accepted Answer

CloudTrail management events are delivered to the default event bus on a best-effort basis and can be delayed or, in rare cases, not delivered, so relying solely on CloudTrail events for time-sensitive remediation is unreliable.

Answer

The EventBridge rule is matching against a CloudTrail trail's S3 delivery events, which are batched and delivered with delay, so many API calls never generate a matching event.

Answer

The Lambda function's reserved concurrency is set too low, causing EventBridge to drop events once concurrency is exhausted rather than retrying them.

Answer

EventBridge deduplicates identical event payloads within a 5-minute window, so repeated AuthorizeSecurityGroupIngress calls with similar parameters are collapsed into a single invocation.

Question 3

A financial services company must detect and respond to any AWS Management Console sign-in using the root user account within their production account. When a root login occurs, the security team requires immediate paging notification AND an automatic audit record captured for compliance. The team wants a fully event-driven solution with no polling and the least operational overhead. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching CloudTrail 'ConsoleLogin' events where userIdentity.type is 'Root', targeting an SNS topic subscribed to PagerDuty and a Lambda function that writes an audit record to a compliance DynamoDB table.

Answer

Enable AWS Config with a managed rule that checks for root account usage, and configure a remediation action that publishes to an SNS topic when the rule is non-compliant.

Answer

Create a CloudWatch metric filter on the CloudTrail log group that matches root console logins, then create a CloudWatch alarm that notifies an SNS topic when the metric exceeds zero.

Answer

Schedule a Lambda function every 5 minutes via EventBridge Scheduler to query CloudTrail Lookup for root ConsoleLogin events and send an SNS notification if any are found.

Question 4

A DevOps team runs a customer-facing checkout API behind an ALB. They want an automated incident triage workflow: when the API's p99 latency alarm enters ALARM state, the system should automatically capture diagnostics (recent application logs, target group health, and a thread dump from the affected EC2 instances) and post the collected artifacts to a Slack channel used by the on-call engineer. The team wants the diagnostics gathering to run across all impacted instances in the Auto Scaling group without writing custom fleet-iteration code, and to only be triggered by the specific latency alarm. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching the CloudWatch Alarm State Change event for that specific alarm ARN with state ALARM, targeting an SSM Automation runbook that uses aws:runCommand with a tag-based target to collect logs and thread dumps fleet-wide, then invokes a Lambda to post artifacts to Slack.

Answer

Configure the CloudWatch alarm to send directly to an SNS topic subscribed by a single Lambda function that SSHes into each instance sequentially to run diagnostic commands and uploads results to Slack.

Answer

Enable CloudWatch Application Insights on the ALB and rely on its automatic problem detection to open findings, then manually copy the findings into Slack when the on-call engineer is paged.

Answer

Create an EventBridge Scheduler schedule that runs every minute to poll the alarm state via the CloudWatch API and, when ALARM, triggers a Step Functions workflow that iterates over instance IDs with custom code to run diagnostics.

Question 5

A company runs a critical order-processing service on Amazon ECS with Fargate. During a recent deployment, tasks began stopping repeatedly with the stopped reason 'Essential container in task exited' and exit code 1, creating a crash loop that generated hundreds of task state change events. The operations team wants an automated response that captures diagnostic details (task ARN, stopped reason, and the failing container's exit code) and posts them to an incident channel, but only when a task stops for a NON-deployment reason — routine scale-in and successful deployment stops should be ignored. Which approach BEST meets these requirements?

Accepted Answer

Create an EventBridge rule matching the 'ECS Task State Change' event with an event pattern that filters on lastStatus 'STOPPED' and a stoppedReason that is anything-but the scale-in and deployment reasons, targeting a Lambda function that parses the detail and posts to the incident channel.

Answer

Configure a CloudWatch alarm on the ECS RunningTaskCount metric with a threshold of the desired count, and use an alarm action to invoke an SNS topic that notifies the incident channel whenever the count drops.

Answer

Enable ECS Container Insights and create a Contributor Insights rule on stopped task logs, then schedule an EventBridge rule every five minutes to invoke a Lambda that queries the rule and posts summaries to the incident channel.

Answer

Create an EventBridge rule matching all 'ECS Task State Change' events and target a Lambda function that inspects every event, calls DescribeTasks to determine the exit code, and decides in code whether the stop was deployment-related before notifying.

Question 6

A financial services company runs nightly batch reconciliation using AWS Batch. When a Batch job fails, the operations team learns about it only the next morning from downstream reports, causing missed SLAs. The team wants an automated response that (1) captures every job that reaches the FAILED state, (2) automatically resubmits the job once if the failure reason indicates a transient host error, and (3) if the retry also fails or the failure is non-transient, opens an incident by publishing to an SNS topic that pages on-call. The solution must require no polling and add minimal custom infrastructure. What is the MOST appropriate design?

Accepted Answer

Create an EventBridge rule matching the AWS Batch Job State Change event where status is FAILED, targeting a Lambda function that inspects the failure reason, resubmits the job once for transient host errors, and publishes to the SNS topic for non-transient failures or exhausted retries.

Answer

Configure a CloudWatch alarm on the Batch FailedJobs metric that triggers an SSM Automation runbook to resubmit all failed jobs and notify SNS whenever the metric exceeds zero.

Answer

Schedule a Lambda function every 5 minutes with EventBridge Scheduler to call ListJobs with a FAILED filter, resubmit qualifying jobs, and publish to SNS for the rest.

Answer

Enable Batch job retry strategy with maxAttempts set to 2 and add an EventBridge rule on the Job State Change event that always publishes directly to SNS on FAILED so on-call is paged for every failure.

Question 7

A company runs a critical VPC that hosts a public-facing application. Recently, an operator accidentally detached the Internet Gateway (IGW) during a maintenance window, causing a 20-minute outage. The DevOps team wants an automated response that immediately re-attaches the IGW to the VPC whenever it is detached, and notifies the on-call engineer. All API activity is already captured in a multi-region CloudTrail trail. Which approach meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an EventBridge rule that matches the CloudTrail 'DetachInternetGateway' management event, targeting a Lambda function that calls AttachInternetGateway with the affected IGW and VPC IDs from the event detail, and publishes to an SNS topic subscribed by the on-call engineer.

Answer

Enable AWS Config with a custom rule that evaluates IGW attachment status every 24 hours and triggers an SSM Automation runbook to re-attach the IGW when found non-compliant.

Answer

Create a CloudWatch metric filter on the CloudTrail log group for 'DetachInternetGateway', set an alarm, and email the on-call engineer so they can manually re-attach the gateway.

Answer

Schedule an EventBridge rule to run every 5 minutes invoking a Lambda function that describes all IGWs, compares attachment state to a stored baseline in DynamoDB, and re-attaches any detached gateway.

Question 8

A company runs a fleet of EC2-based web servers behind an Application Load Balancer. Operations wants automated remediation: whenever a specific CloudWatch alarm named 'HighUnhealthyHostCount' transitions to ALARM state, a Lambda function should immediately gather diagnostics (recent target group health, application logs) and post a summary to a Slack channel. The team wants the reaction to occur as soon as the alarm changes state, without polling, and they must be able to filter so that only transitions to the ALARM state (not OK or INSUFFICIENT_DATA) trigger the workflow. Which approach meets these requirements with the least custom code?

Accepted Answer

Create an EventBridge rule that matches the 'CloudWatch Alarm State Change' event source, with an event pattern filtering on the alarm name and detail.state.value equal to ALARM, and set the diagnostics Lambda function as the target.

Answer

Configure the CloudWatch alarm to send notifications to an SNS topic, subscribe the Lambda function to the topic, and have the Lambda parse the message body to check whether the new state is ALARM before running diagnostics.

Answer

Create a scheduled EventBridge rule that invokes the Lambda every minute to call DescribeAlarms and, when the state is ALARM, run diagnostics and post to Slack.

Answer

Enable CloudWatch alarm actions to trigger an EC2 recovery action, and add a Systems Manager Automation runbook that captures diagnostics and calls a Slack webhook after recovery completes.

Question 9

A DevOps team runs 40 CodePipeline pipelines across multiple applications. When a pipeline stage fails, engineers currently discover it hours later. Leadership wants an automated system that, within seconds of any pipeline stage entering a FAILED state, posts a message to a Slack channel that includes the pipeline name, the failed stage, and the failed action's execution ID so the on-call engineer can jump straight to troubleshooting. The solution must require no code changes to individual pipelines and must scale as new pipelines are added. What is the MOST operationally efficient approach?

Accepted Answer

Create a single EventBridge rule matching the 'CodePipeline Action Execution State Change' event with state FAILED on the default event bus, targeting a Lambda function that parses the event detail and posts the pipeline name, stage, and action execution ID to Slack via an incoming webhook.

Answer

Add a manual approval action with an SNS topic to the end of each pipeline so that failures trigger an email that engineers forward to Slack.

Answer

Enable CloudTrail data events for CodePipeline and configure a CloudWatch Logs metric filter with an alarm that publishes to an SNS topic subscribed by a Lambda function that posts to Slack.

Answer

Create a separate EventBridge rule for each pipeline that polls the CodePipeline GetPipelineState API every minute using a scheduled rule and invokes Lambda when a stage reports Failed.

Question 10

A company runs a serverless order-processing system where an EventBridge custom event bus routes 'OrderPlaced' events to a Lambda function that writes to DynamoDB. During a recent 30-minute regional degradation, the Lambda target repeatedly failed and the DLQ was not configured, so an unknown number of order events were lost. Leadership now requires that the team be able to recover and reprocess any events that fail to reach or be successfully processed by targets during future incidents, with no code changes to producers. Which combination of EventBridge features BEST meets this requirement?

Accepted Answer

Enable EventBridge archive on the event bus with an appropriate retention period, and configure an SQS dead-letter queue plus a retry policy on the Lambda target; use archive replay to reprocess events after an incident.

Answer

Increase the Lambda function's reserved concurrency and enable provisioned concurrency so no invocations are dropped during regional degradation.

Answer

Add a second EventBridge rule that forwards all events to an S3 bucket via Kinesis Data Firehose, then write a custom Lambda to parse and replay S3 objects during incidents.

Answer

Enable CloudTrail data events for the event bus and use Athena to query and manually re-emit lost events through the PutEvents API.

Question 11

A company uses an EventBridge rule that targets a Lambda function to auto-remediate non-compliant S3 buckets detected by AWS Config. During an incident review, the team discovers that several remediation events silently failed and were never retried, leaving buckets publicly accessible for hours. Investigation shows the Lambda function was throttled due to a spike in events, and EventBridge exhausted its retries. The team needs to ensure that no remediation event is ever lost and that failed events can be reprocessed after the throttling condition clears. What should the DevOps engineer implement?

Accepted Answer

Configure a dead-letter queue (SQS) on the EventBridge target for the Lambda function, and add an SQS-triggered process to reprocess failed events.

Answer

Increase the Lambda function's reserved concurrency to the account maximum so EventBridge invocations are never throttled.

Answer

Enable Lambda destinations with an on-failure destination pointing to an SNS topic so operators are notified of each failed remediation.

Answer

Change the EventBridge rule to increase the maximum retry attempts to 185 and set the maximum event age to 24 hours.

Question 12

A company runs a mission-critical DynamoDB table with provisioned capacity. During unpredictable traffic spikes, the application experiences ReadThrottleEvents that cause API timeouts. The DevOps team wants an automated response that increases the table's provisioned read capacity when sustained throttling occurs, but only after confirming the condition persists for several minutes to avoid reacting to brief bursts. The solution must require no standing infrastructure and must log every remediation action for auditing. Which approach best meets these requirements?

Accepted Answer

Create a CloudWatch alarm on the ReadThrottleEvents metric with an evaluation period spanning several minutes; on ALARM, trigger an EventBridge rule that invokes a Lambda function to update the table's provisioned capacity, and write structured log entries to CloudWatch Logs.

Answer

Enable DynamoDB auto scaling with a target utilization, and configure an EventBridge rule on the scaling activity to notify the team via SNS.

Answer

Create an EventBridge rule that matches every ReadThrottleEvents data point emitted to CloudWatch and directly invokes a Systems Manager Automation runbook to raise capacity.

Answer

Schedule a Lambda function every minute using EventBridge Scheduler to poll the ReadThrottleEvents metric with GetMetricData and adjust capacity when any throttling is detected.

Question 13

A company runs a stateful order-processing service on EC2 instances behind an Application Load Balancer. AWS sometimes issues scheduled maintenance events (planned retirement or reboot) for these instances. Operations wants an automated response that, upon receiving an AWS Health scheduled-change notification for a specific instance, gracefully deregisters that instance from the target group, waits for in-flight orders to complete, and then triggers a replacement before the maintenance window begins. Which approach BEST meets these requirements with the least custom infrastructure?

Accepted Answer

Create an EventBridge rule matching AWS Health events with detail-type 'AWS Health Event' and the relevant event type code, targeting a Lambda function that deregisters the affected instance from the target group, polls until connection draining completes, and marks the instance unhealthy so the Auto Scaling group launches a replacement.

Answer

Enable ALB connection draining and rely on the Auto Scaling group's built-in health checks to detect and replace the instance automatically once the maintenance reboot occurs.

Answer

Configure a CloudWatch alarm on the EC2 StatusCheckFailed_System metric that invokes an SSM Automation runbook to stop and start the instance before AWS performs maintenance.

Answer

Create an EventBridge rule for EC2 instance-state-change 'stopping' events that triggers a Lambda function to move the instance out of the target group after the maintenance stop begins.

Question 14

A security team discovers that a developer accidentally scheduled deletion of a customer-managed KMS key that encrypts several production RDS databases and S3 buckets. The organization wants an automated safeguard so that any future ScheduleKeyDeletion API call for keys tagged 'Protected=true' is immediately reversed and the on-call team is alerted, without manual intervention. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an EventBridge rule matching the CloudTrail 'ScheduleKeyDeletion' event, filter on the resource ARN, and trigger a Lambda function that calls CancelKeyDeletion and publishes to an SNS topic; verify the key's 'Protected' tag inside the function before acting.

Answer

Enable an AWS Config managed rule to detect KMS keys pending deletion and configure an SSM Automation remediation that re-enables the key on a 24-hour evaluation cycle, notifying via SNS.

Answer

Create a CloudWatch alarm on the KMS 'KeyDeletionScheduled' metric and attach an SNS action that emails the on-call team so they can manually cancel the deletion.

Answer

Attach an SCP that denies the kms:ScheduleKeyDeletion action for all principals in the organization, preventing any key deletion scheduling entirely.

Question 15

A financial services company uses Amazon Macie to scan S3 buckets for sensitive data. When Macie discovers objects containing personally identifiable information (PII) in buckets that are not approved for PII storage, the security team wants an automated response that blocks further access to the specific offending objects within minutes, records the action for audit, and notifies the security channel — all without disabling access to the entire bucket or blocking legitimate objects. Which approach BEST meets these requirements?

Accepted Answer

Create an EventBridge rule matching Macie 'SensitiveData' findings that targets a Lambda function which applies a restrictive object-level ACL/S3 Object Lock or tags the object and updates a deny statement scoped to those object keys, writes the action to a DynamoDB audit table, and publishes to an SNS topic subscribed by the security channel.

Answer

Configure Macie to publish findings to Security Hub, then enable an S3 bucket policy that denies all GetObject requests on the entire bucket whenever any finding exists.

Answer

Schedule an EventBridge rule every 5 minutes to invoke a Lambda that lists all Macie findings via the API and deletes any object flagged as containing PII, logging deletions to CloudWatch Logs.

Answer

Enable Macie automated sensitive data discovery and rely on its built-in remediation to move flagged objects to a quarantine bucket and notify the team through Macie's native alerting.

Question 16

A financial services company runs a critical order-processing Lambda function that is invoked asynchronously from an EventBridge rule. During a marketing spike, the DevOps team notices that many events are being lost and the function's Throttles metric is spiking. Investigation shows the account's unreserved concurrency pool was exhausted by an unrelated batch-processing Lambda function that scaled up aggressively. The team must ensure the order-processing function always has capacity available AND that any events it cannot process immediately are retained for later reprocessing, without losing data. Which combination of actions BEST meets these requirements?

Accepted Answer

Configure reserved concurrency on the order-processing function to guarantee capacity, and configure an on-failure destination (or dead-letter queue) on the function's asynchronous invocation settings to capture events that exhaust retries.

Answer

Configure provisioned concurrency on the batch-processing function so it stops consuming the unreserved pool, and enable EventBridge rule retries with a longer maximum event age.

Answer

Increase the account-level concurrency limit via a service quota request and rely on EventBridge's built-in 24-hour retry to redeliver throttled events.

Answer

Set reserved concurrency on the batch-processing function to zero during the spike, and configure an EventBridge archive on the bus to replay lost events later.

Question 17

A DevOps team runs an automated compliance workflow. Every night at 02:00 UTC, an EventBridge scheduled rule (cron expression) triggers a Lambda function that scans EC2 instances for missing patches and starts an SSM Automation runbook to remediate. The team notices that during nights when the AWS account experiences a large burst of unrelated events, the nightly patch scan sometimes fires several minutes late or, on rare occasions, is skipped entirely. They need the patch scan to fire reliably at a precise time, support a configurable time zone for regional maintenance windows, and avoid running when a maintenance flag is disabled — without maintaining the scheduling logic inside Lambda. Which change best meets these requirements?

Accepted Answer

Migrate the trigger to Amazon EventBridge Scheduler with a cron schedule that specifies the target time zone, enable the schedule's flexible time window as 'off' for precise firing, and use the schedule's enable/disable state to gate execution.

Answer

Keep the EventBridge scheduled rule but increase the Lambda function's reserved concurrency and add a retry policy with a dead-letter queue so missed invocations are replayed.

Answer

Replace the scheduled rule with a CloudWatch alarm on a custom 'PatchScanDue' metric published every minute, and trigger the Lambda when the alarm enters ALARM state.

Answer

Convert the cron rule to an EventBridge rule that matches SSM State Manager association status-change events, so the scan runs whenever an association reports drift.

Question 18

A company runs a fleet of 200 EC2 instances behind an Application Load Balancer. When a shared backend dependency degrades, dozens of instances simultaneously breach a CloudWatch alarm for high 5xx rates. Each alarm state change triggers an EventBridge rule that invokes a Lambda function, which in turn starts a Systems Manager Automation runbook to collect diagnostics and restart the affected service. During the last incident, the flood of concurrent Automation executions exhausted the account's SSM Automation concurrency, and the diagnostics runbook itself failed to complete on many instances. The DevOps team wants the automated response to still gather diagnostics and remediate, but without launching a redundant execution per instance for what is fundamentally a single upstream incident. Which approach BEST addresses this?

Accepted Answer

Replace the per-instance CloudWatch alarms with a single composite alarm that aggregates the fleet's 5xx metric, and have the EventBridge rule invoke one Automation execution that uses a rate control targeting the instances by tag with a MaxConcurrency and MaxErrors setting.

Answer

Increase the account's SSM Automation concurrent execution quota via a Service Quotas request so all per-instance executions can run in parallel without throttling.

Answer

Add a Lambda reserved concurrency limit of 1 so only one diagnostics runbook can be started at a time, queuing the remaining alarm events.

Answer

Configure an EventBridge dead-letter queue on the rule so throttled Automation invocations are retried later once concurrency frees up.

Question 19

A DevOps team runs an auto-remediation workflow: a CloudWatch alarm on excessive disk usage triggers an EventBridge rule that invokes a Systems Manager Automation runbook to expand the EBS volume and extend the filesystem. Security requires that any remediation touching production instances (tagged Environment=prod) receive human approval before execution, while non-production remediation must remain fully automatic. The team wants to keep a single runbook and avoid maintaining separate Lambda approval logic. What is the MOST appropriate way to implement this?

Accepted Answer

Add an aws:approve step in the Automation runbook guarded by a conditional aws:branch step that routes prod-tagged instances through approval while non-prod instances skip directly to the remediation steps.

Answer

Configure two EventBridge rules with tag-based event pattern filtering so prod alarms invoke a Lambda that emails the team and non-prod alarms invoke the runbook directly.

Answer

Enable a manual approval action in an EventBridge Pipe between the alarm source and the SSM Automation target for all instances.

Answer

Attach an IAM permissions boundary to the Automation service role that denies EBS modifications on prod instances until an administrator manually assumes an elevated role.

Question 20

A company must ensure that no S3 bucket in any account ever has its account-level Block Public Access setting disabled without immediate reversal. When an engineer runs PutPublicAccessBlock to weaken the setting, a security team wants automated remediation within seconds and a durable record of who triggered the change. CloudTrail is enabled in all accounts and management events flow to a central account. Which approach BEST meets these requirements with the least ongoing operational effort?

Accepted Answer

Create an EventBridge rule that matches the CloudTrail management event for PutPublicAccessBlock, target an SSM Automation runbook that re-applies the fully-restricted Block Public Access configuration, and rely on the CloudTrail event record for attribution.

Answer

Enable AWS Config with the s3-account-level-public-access-blocks managed rule and configure periodic evaluation with an SSM automatic remediation to fix noncompliant accounts.

Answer

Schedule a Lambda function every 5 minutes using EventBridge Scheduler to call GetPublicAccessBlock in each account and re-apply the restricted configuration when drift is detected.

Answer

Create a CloudWatch metric filter on the central log group for PutPublicAccessBlock and an alarm that triggers an SNS notification to the security team to manually revert the change.

More DOP-C02 practice