AWS Certified CloudOps Engineer - Associate

Question 1

A CloudOps engineer manages several Application Load Balancers that use TLS certificates issued by AWS Certificate Manager (ACM). Some certificates were imported into ACM from a third-party certificate authority, while others were requested directly from ACM. The security team wants proactive alerts at least 30 days before any certificate expires so they can renew in time. Which approach requires the LEAST ongoing operational effort to ensure the team is notified before expiration?

Accepted Answer

Create an EventBridge rule that matches the ACM 'ACM Certificate Approaching Expiration' event and routes it to an SNS topic to notify the security team.

Answer

Rely on ACM automatic renewal for all certificates, since ACM renews certificates before they expire without any manual intervention.

Answer

Enable the ACM-managed AWS Config rule and use a Lambda function that runs daily to describe each certificate and calculate days to expiry, then publish to SNS.

Answer

Create a CloudWatch alarm on the ACM DaysToExpiry metric for each certificate ARN and set the threshold to 30 days, sending notifications to SNS.

Question 2

A CloudOps engineer is deploying a global web application that uses Amazon CloudFront as the CDN with a custom domain name. The engineer requests an ACM certificate in the eu-west-1 Region (where the origin ALB resides) and attempts to associate it with the CloudFront distribution, but the certificate does not appear as a selectable option in the CloudFront console. What is the correct action to resolve this?

Accepted Answer

Request or import the ACM certificate in the us-east-1 Region, because CloudFront only accepts certificates from us-east-1.

Answer

Enable cross-region certificate replication on the eu-west-1 certificate so CloudFront can reference it.

Answer

Attach the ACM certificate to the origin ALB first, then CloudFront will automatically inherit it.

Answer

Convert the ACM certificate to an IAM server certificate and upload it to the us-east-1 Region.

Question 3

A company runs internal microservices on EC2 instances within a private VPC. Security policy requires all service-to-service communication to use TLS with certificates issued from a trusted internal certificate authority. The certificates must not be publicly trusted, and the company wants to automate issuance and renewal without managing its own CA infrastructure on servers. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Private CA (AWS Certificate Manager Private Certificate Authority) to issue certificates for internal services, integrating with ACM for automated renewal.

Answer

Request public certificates from AWS Certificate Manager (ACM) and distribute them to each internal service.

Answer

Deploy an OpenSSL-based CA on an EC2 instance and write cron jobs to issue and rotate certificates for each microservice.

Answer

Import self-signed certificates into ACM and reference them from each EC2 instance.

Question 4

A CloudOps engineer deploys an Application Load Balancer (ALB) across three Availability Zones, but each AZ contains a different number of registered targets: AZ-a has 8 instances, AZ-b has 4, and AZ-c has 2. Users report that instances in AZ-c are experiencing significantly higher CPU utilization than instances in the other zones. What is the most likely cause of this uneven load?

Accepted Answer

Cross-zone load balancing has been disabled on the ALB, so traffic is split evenly per AZ, forcing the 2 instances in AZ-c to handle a full one-third of all requests.

Answer

The ALB distributes traffic evenly across all healthy targets regardless of AZ because cross-zone load balancing is always enabled and cannot be disabled for ALBs.

Answer

The ALB is using least-outstanding-requests routing, which always sends more traffic to zones with fewer instances.

Answer

Sticky sessions are enabled, which forces all traffic into the AZ with the fewest instances.

Question 5

A company runs a web application behind an Application Load Balancer (ALB) in a single Availability Zone. All EC2 instances in the Auto Scaling group are also in that one AZ. During a recent AZ impairment, the entire application became unreachable for several hours. The CloudOps team must redesign the architecture to survive the loss of a single Availability Zone with minimal manual intervention. Which change BEST achieves this goal?

Accepted Answer

Enable the ALB in subnets across at least two Availability Zones and configure the Auto Scaling group to launch instances into those multiple AZs.

Answer

Create a second ALB in another Region and use Route 53 failover routing to redirect traffic when the primary AZ fails.

Answer

Increase the desired capacity of the Auto Scaling group in the existing single AZ so more instances are available during an impairment.

Answer

Enable ALB access logging and configure a CloudWatch alarm to notify the team so they can manually launch instances in another AZ.

Question 6

A CloudOps engineer manages a single Application Load Balancer that fronts three microservices running on separate Amazon ECS services. Requests to /api/orders must reach the orders service, /api/inventory must reach the inventory service, and all other requests must reach a default web frontend service. All three services are already registered in separate target groups. What is the correct way to configure the ALB to achieve this routing?

Accepted Answer

Create listener rules on the HTTPS listener that use path-based conditions (/api/orders*, /api/inventory*) to forward to the respective target groups, and set the default action to forward to the web frontend target group.

Answer

Create three separate Application Load Balancers, one per target group, and use Route 53 weighted records to distribute traffic based on the request path.

Answer

Configure a single listener rule with host-based conditions mapping each hostname to a target group, then rely on the security groups to filter requests by path.

Answer

Attach all three target groups to the listener's default action as a weighted forward action so the ALB balances requests across services.

Question 7

A company runs a stateful web application behind an Application Load Balancer (ALB) with a target group of six EC2 instances across three Availability Zones. To keep user sessions on the same backend, the team enabled duration-based cookie stickiness on the target group. After a marketing campaign, users report slow response times, and CloudWatch shows two instances consistently at high CPU while the other four remain nearly idle. What is the MOST likely cause of the uneven load and the BEST corrective action?

Accepted Answer

Session stickiness is binding long-lived client sessions to a subset of instances; the imbalance is expected with stickiness, and the team should scale based on connection distribution or reduce the stickiness duration.

Answer

Cross-zone load balancing is disabled; enable it on the ALB so requests are distributed evenly across all registered targets.

Answer

The health check interval is too long; shorten it so the ALB detects and reroutes traffic away from busy instances faster.

Answer

The target group deregistration delay is too high; lower it so busy instances drain connections and receive fewer new requests.

Question 8

A company runs a stateless web application behind an Application Load Balancer (ALB) with an EC2 Auto Scaling group across three Availability Zones. During scale-in events, users occasionally report failed requests and reset connections. The CloudOps engineer confirms that instances are being terminated while still actively serving in-flight requests. Which configuration change will MOST directly prevent these dropped requests during scale-in?

Accepted Answer

Increase the ALB target group deregistration delay (connection draining) so in-flight requests can complete before instances are terminated

Answer

Enable cross-zone load balancing on the Application Load Balancer

Answer

Change the target group health check protocol from HTTP to HTTPS

Answer

Increase the Auto Scaling group health check grace period

Question 9

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Recently, an instance's web server process crashed, returning HTTP 503 errors to users, but the Auto Scaling group did not replace the instance for a long time. The EC2 instance itself remained running and passed all EC2 system and instance status checks. What should the CloudOps engineer configure so that Auto Scaling replaces instances that fail the application-level check?

Accepted Answer

Change the Auto Scaling group's health check type to ELB and ensure the ALB target group health check targets the application's health endpoint.

Answer

Enable EC2 detailed monitoring so that status checks are evaluated every minute instead of every five minutes.

Answer

Increase the Auto Scaling group's health check grace period so instances have more time to recover before replacement.

Answer

Attach a target-tracking scaling policy based on the ALB request count per target metric.

Question 10

A CloudOps engineer manages an EC2 Auto Scaling group that uses a launch template. The security team releases a hardened AMI monthly, and the engineer updates the launch template by creating a new version each time with the new AMI ID. However, when the Auto Scaling group scales out, newly launched instances continue to use the older AMI from the previous month. The Auto Scaling group is configured to use the launch template with version set to a specific number. What is the MOST appropriate change to ensure new instances always launch with the newest hardened AMI without manual reconfiguration each month?

Accepted Answer

Set the Auto Scaling group's launch template version to '$Latest' so it automatically uses the most recently created template version.

Answer

Enable instance refresh on the Auto Scaling group and rely on it to detect the new AMI automatically.

Answer

Set the Auto Scaling group's launch template version to '$Default' and leave the default version pointing at the original template version.

Answer

Replace the launch template with a launch configuration that references the AMI ID directly.

Question 11

A company runs a stateful application on EC2 instances behind an Application Load Balancer in an Auto Scaling group. During scale-out events, new instances require about 4 minutes to download configuration files, warm a local cache, and register with an internal service registry before they can serve traffic. Currently, the ALB begins routing requests to instances as soon as they pass the EC2 status checks, causing intermittent errors from instances that are not yet fully initialized. Which approach best ensures instances only receive traffic after initialization completes?

Accepted Answer

Add an EC2 Auto Scaling lifecycle hook for the launch (Pending:Wait) state and have the instance signal CompleteLifecycleAction once initialization finishes.

Answer

Increase the Auto Scaling group's default cooldown period to 300 seconds so new instances have time to initialize.

Answer

Change the Auto Scaling group health check type from EC2 to ELB so unhealthy instances are replaced.

Answer

Configure a target-tracking scaling policy with a longer estimated instance warmup value.

Question 12

A CloudOps engineer manages an EC2 Auto Scaling group spanning three Availability Zones behind an Application Load Balancer. After a recent AZ impairment, one AZ was temporarily removed and instances were relaunched in the two remaining AZs. Now that all three AZs are healthy again, the engineer notices the group has 8 instances in AZ-a, 8 in AZ-b, and only 2 in AZ-c, creating an uneven distribution. What is the MOST appropriate way to ensure the group automatically restores balanced capacity across all three AZs going forward?

Accepted Answer

Rely on the Auto Scaling group's built-in Availability Zone rebalancing, which launches instances in under-provisioned AZs and terminates instances in over-provisioned AZs to even out distribution.

Answer

Manually terminate three instances each in AZ-a and AZ-b so the group launches replacements evenly across all AZs.

Answer

Attach a target-tracking scaling policy on CPU utilization so scaling activity redistributes instances across the AZs.

Answer

Create a scheduled action that sets desired capacity to zero nightly and back to 18 each morning to force even redistribution.

Question 13

A CloudOps engineer manages a stateless web tier running on an EC2 Auto Scaling group backed by a single launch template that specifies one instance type and 100% On-Demand capacity. During a regional capacity event, the group failed to launch replacement instances because the specified instance type was temporarily unavailable in two of the three subnets, causing reduced availability. The team wants to improve the group's resilience to capacity shortages while also lowering cost, without managing multiple Auto Scaling groups. What should the engineer do?

Accepted Answer

Configure a mixed instances policy on the Auto Scaling group with multiple instance types and a combination of On-Demand and Spot capacity, using the capacity-optimized allocation strategy.

Answer

Create three separate Auto Scaling groups, one per subnet, each with a different instance type, and place them behind the same load balancer.

Answer

Increase the desired capacity of the existing group and enable predictive scaling so extra instances are pre-provisioned before capacity shortages occur.

Answer

Switch the launch template to use a larger instance type from the same family and enable detailed monitoring to detect launch failures faster.

Question 14

A CloudOps engineer manages an EC2 Auto Scaling group that processes long-running batch jobs. Each instance can take up to two hours to finish a job. During target-tracking scale-in events triggered by low average CPU, the ASG frequently terminates instances that are still mid-job, causing the batch work to be lost and reprocessed. The team wants scale-in to avoid terminating instances that are actively processing a job, while still allowing the group to shrink when instances become idle. What is the MOST appropriate solution?

Accepted Answer

Have the application enable instance scale-in protection on an instance when it starts a job and disable it when the job completes.

Answer

Increase the health check grace period on the Auto Scaling group so instances have more time before termination.

Answer

Switch the scaling policy from target tracking to a step scaling policy based on CPU utilization.

Answer

Set the Auto Scaling group's default cooldown period to two hours to match the maximum job duration.

Question 15

A financial services company runs a production application backed by an Amazon Aurora MySQL-compatible cluster in us-east-1. The compliance team requires a disaster recovery solution in us-west-2 with an RPO of under 1 second and an RTO of a few minutes, with minimal impact on the primary database's write performance. Which approach best meets these requirements?

Accepted Answer

Configure an Aurora global database with a secondary cluster in us-west-2 and promote it during a regional outage.

Answer

Enable AWS Backup with cross-Region copy of Aurora snapshots on an hourly schedule and restore in us-west-2 when needed.

Answer

Create a cross-Region Aurora read replica in us-west-2 using standard binlog-based asynchronous replication.

Answer

Use Aurora Multi-AZ deployment with reader instances spread across three Availability Zones in us-east-1.

Question 16

A CloudOps engineer must ensure that any S3 bucket created without default encryption is automatically remediated within minutes, with no human intervention. AWS Config already has a managed rule (s3-bucket-server-side-encryption-enabled) evaluating bucket compliance. The team wants a low-maintenance, event-driven solution that applies default encryption to noncompliant buckets. Which approach best meets these requirements?

Accepted Answer

Configure the AWS Config rule with an automatic remediation action that invokes the AWS-EnableS3BucketEncryption Systems Manager Automation document.

Answer

Create a CloudWatch alarm on the AWS Config compliance metric that triggers an SNS notification to the security team for manual remediation.

Answer

Enable S3 Event Notifications for bucket creation events and forward them to an SQS queue polled by an EC2 instance running a remediation script.

Answer

Schedule a Lambda function every 5 minutes using EventBridge to scan all buckets and enable encryption on those missing it.

Question 17

A CloudOps engineer manages an AWS Organization with 40 member accounts. Compliance requires that all EBS volumes and RDS databases across every account be backed up on a consistent schedule, with backups stored centrally and protected from deletion by individual account administrators. The team wants to enforce this centrally without deploying scripts into each account. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a delegated administrator account, create a backup policy in AWS Organizations, and assign resources using tags across all member accounts.

Answer

Create an EventBridge scheduled rule in each member account that triggers a Lambda function to invoke EBS and RDS snapshot APIs on the defined schedule.

Answer

Deploy an AWS Backup plan in a single central account and grant that account IAM permissions to snapshot resources in all other member accounts.

Answer

Enable automated RDS backups and EBS Data Lifecycle Manager policies independently in each of the 40 member accounts.

Question 18

A financial services company runs a production Amazon RDS for PostgreSQL database in the us-east-1 Region. Compliance requires that, in the event of a full Regional outage, the company must be able to restore the database in us-west-2 with a Recovery Point Objective (RPO) of no more than 1 hour and a Recovery Time Objective (RTO) of a few hours. The CloudOps team wants a managed, centrally governed solution that requires minimal custom scripting. Which approach best meets these requirements?

Accepted Answer

Create an AWS Backup plan with a backup rule that runs hourly and configure a cross-Region copy action to copy each recovery point to us-west-2.

Answer

Enable automated RDS backups with a 7-day retention period and rely on point-in-time recovery, which automatically replicates to us-west-2.

Answer

Create a cross-Region read replica of the RDS instance in us-west-2 and promote it manually only after a Regional failure is confirmed.

Answer

Write a Lambda function triggered every 6 hours to create a manual DB snapshot and copy it to us-west-2 using the RDS API.

Question 19

A CloudOps engineer manages a production Amazon RDS for PostgreSQL database that supports an order-processing application. The business requires the ability to recover the database to any specific second within the last 5 days in case of accidental data corruption from a bad application deployment. The team currently relies only on daily automated snapshots taken at 2 AM. During a recent incident, a faulty batch job corrupted data at 3 PM, and the team could only restore to the previous night's snapshot, losing 13 hours of transactions. Which action best meets the recovery requirement going forward?

Accepted Answer

Ensure automated backups are enabled with a 5-day retention period and use point-in-time recovery (PITR) to restore to a specific timestamp.

Answer

Increase the automated snapshot frequency to run every hour using an AWS Backup scheduled plan.

Answer

Enable a Multi-AZ deployment so the standby replica can be promoted to the exact moment before corruption.

Answer

Create a cross-Region read replica and promote it to recover data from before the corruption event.

Question 20

A financial services company uses AWS Backup to protect its RDS databases, EBS volumes, and EFS file systems across multiple accounts. Auditors require documented proof that backups can actually be restored within the defined 4-hour RTO. The CloudOps team currently performs manual restores quarterly, but this is time-consuming and inconsistent. Which approach provides an automated, repeatable way to validate that backups are recoverable and meet RTO expectations?

Accepted Answer

Enable AWS Backup restore testing plans that automatically run scheduled restore jobs on selected recovery points and validate completion

Answer

Enable AWS Backup Vault Lock in compliance mode to guarantee that recovery points cannot be altered before restore

Answer

Configure cross-Region copy of all recovery points and rely on the copy job success status as proof of recoverability

Answer

Create an EventBridge rule that alerts when a backup job completes successfully and log the notification for auditors

Question 21

A financial services company must ensure that its RDS and EBS backups cannot be deleted or altered before their retention period expires, even by administrators with full IAM permissions. This is a regulatory requirement to protect against accidental deletion and ransomware. The team already centralizes backups using AWS Backup. Which action best satisfies this requirement?

Accepted Answer

Enable AWS Backup Vault Lock in compliance mode with a defined minimum and maximum retention period on the backup vault.

Answer

Attach an IAM policy to all administrators that denies the backup:DeleteRecoveryPoint action.

Answer

Enable AWS Backup Vault Lock in governance mode on the backup vault.

Answer

Enable versioning and MFA delete on the S3 bucket where AWS Backup stores recovery points.

Question 22

A company runs a batch analytics application in a single AWS Region. The workload is only used for monthly reporting and is not customer-facing. Leadership has approved a disaster recovery plan with an RTO of 24 hours and an RPO of 24 hours, and they want the lowest possible ongoing cost. The application data is stored in Amazon S3 and an Amazon RDS database. Which DR strategy best meets these requirements?

Accepted Answer

Backup and restore — replicate S3 data and copy RDS snapshots to a second Region, and provision infrastructure only when a disaster is declared

Answer

Pilot light — keep a minimal core of infrastructure (such as a stopped RDS instance) always running in the second Region

Answer

Warm standby — run a scaled-down but fully functional copy of the environment in the second Region at all times

Answer

Multi-site active/active — run full production capacity in two Regions simultaneously with Route 53 routing traffic to both

Question 23

A CloudOps engineer is deploying a fleet of EC2 web servers using an AWS CloudFormation template. The requirement is that after each instance launches, it must install packages, write configuration files, and start services in a defined order, and the CloudFormation stack must not report CREATE_COMPLETE until the instances have finished their configuration and signaled success. Which approach best meets these requirements?

Accepted Answer

Use AWS::CloudFormation::Init metadata with cfn-init in UserData, and pair a CreationPolicy on the instance with cfn-signal to report bootstrap completion.

Answer

Place all installation commands in the instance UserData script and rely on the default stack timeout to determine when configuration completes.

Answer

Use a DependsOn attribute between the EC2 instances and a wait resource so CloudFormation pauses until packages are installed.

Answer

Configure an SSM State Manager association to bootstrap the instances after the stack reaches CREATE_COMPLETE.

Question 24

A CloudOps engineer manages a production application using a single AWS CloudFormation stack that includes an RDS instance, an EC2 Auto Scaling group, and several security groups. Before applying an update to the template that modifies the RDS parameter group and instance class, the team wants to know exactly which resources will be modified, replaced, or deleted so they can avoid an unexpected database replacement during the deployment. What should the engineer do?

Accepted Answer

Create a CloudFormation change set from the updated template and review it before executing the update.

Answer

Run CloudFormation drift detection on the stack to identify which resources would be affected by the update.

Answer

Enable termination protection on the stack and then execute the update directly.

Answer

Deploy the updated template to a new stack and manually compare resources against the production stack.

Question 25

A CloudOps engineer uses AWS CloudFormation to launch a single EC2 instance that runs a lengthy application installation script via UserData. Currently CloudFormation marks the stack as CREATE_COMPLETE as soon as the instance launches, but before the application finishes installing, causing downstream resources to fail because the app is not yet ready. The engineer needs the stack to wait until the application setup completes successfully before reporting the resource as created. What is the MOST appropriate way to achieve this?

Accepted Answer

Add a CreationPolicy with a ResourceSignal timeout to the EC2 instance and call cfn-signal from the UserData script once installation succeeds

Answer

Add a DependsOn attribute referencing the EC2 instance to all downstream resources

Answer

Configure a DeletionPolicy of Retain on the EC2 instance so CloudFormation waits before completing

Answer

Enable termination protection on the stack and use drift detection to confirm the application is ready

Question 26

A CloudOps engineer manages infrastructure using multiple CloudFormation stacks. A networking stack creates a VPC and subnets, and several application stacks need to reference the subnet IDs from the networking stack. The engineer wants a solution where application stacks can consume these values by name, and CloudFormation prevents the networking stack from being deleted or its exported values from being changed while they are still in use. Which approach meets these requirements?

Accepted Answer

Use the Outputs section of the networking stack with the Export field, and reference the values in application stacks using the Fn::ImportValue intrinsic function.

Answer

Store the subnet IDs in the Mappings section of each application stack and update them manually whenever the networking stack changes.

Answer

Pass the subnet IDs as CloudFormation parameters to each application stack manually at deployment time.

Answer

Use nested stacks so the networking resources are created as part of each application stack's template.

Question 27

A CloudOps engineer manages a production RDS database that was provisioned as part of a CloudFormation stack. The company has a policy requiring that database data must never be lost when infrastructure is decommissioned or when stacks are updated in ways that would replace the database. During a recent stack update, a change to the DB instance identifier caused CloudFormation to replace the resource, and the original data was deleted. What should the engineer configure to ensure the database and its data are preserved even if the resource is removed or replaced?

Accepted Answer

Set the DeletionPolicy attribute to Retain and the UpdateReplacePolicy attribute to Retain on the RDS resource

Answer

Enable termination protection on the CloudFormation stack

Answer

Add a Snapshot value to the DeletionPolicy attribute only

Answer

Enable drift detection on the stack and configure automatic remediation

Question 28

A CloudOps team maintains a single CloudFormation template that provisions an application stack. They must deploy it to dev, staging, and production, where each environment uses a different EC2 instance type and a different number of instances, but the underlying resource structure is identical across environments. The team wants to keep one template file and avoid hardcoding environment-specific values inside the resource definitions. Which approach best meets these requirements?

Accepted Answer

Use a Parameter for the environment name and a Mappings section that returns the correct instance type and count per environment, referenced with Fn::FindInMap.

Answer

Create three separate CloudFormation templates, one per environment, each with the values hardcoded into the resource properties.

Answer

Use a single template with the production values hardcoded, then manually edit the resources in the console after each dev and staging deployment.

Answer

Store all environment values in the Metadata section and reference them directly from the Resources section using Fn::GetAtt.

Question 29

A CloudOps engineer manages production infrastructure using an AWS CloudFormation stack. During a recent incident, another team member modified a security group's inbound rules directly in the EC2 console instead of updating the template. The engineer needs to identify all resources in the stack whose actual configuration no longer matches the template definition, without modifying or redeploying any resources. Which action should the engineer take?

Accepted Answer

Run drift detection on the stack and review the drift status of each resource in the results

Answer

Perform a stack update with the original template to reset all resources to their defined state

Answer

Enable termination protection on the stack to prevent further manual changes

Answer

Create a change set from the current template and review the proposed changes

Question 30

A CloudOps engineer applies a stack update to a production CloudFormation stack that provisions an RDS database and application tier. During the update, one resource fails to create and CloudFormation begins rolling back. The rollback also fails because a security group cannot be deleted (it is still referenced by a resource created outside the template). The stack is now in UPDATE_ROLLBACK_FAILED state. What is the correct way to recover the stack so future updates can proceed?

Accepted Answer

Manually resolve the underlying issue (remove the external reference to the security group), then call ContinueUpdateRollback, optionally skipping the resource that cannot roll back.

Answer

Delete the stack entirely and redeploy from the template, accepting recreation of the RDS database.

Answer

Run drift detection on the stack to force CloudFormation to reconcile the failed resource automatically.

Answer

Create a change set against the failed stack to preview and apply the corrective update.

Question 31

A CloudOps team maintains a large CloudFormation template that has grown to over 400 resources, including a VPC, subnets, security groups, an RDS database, and an ECS cluster. Deployments now frequently fail because the template exceeds resource limits and is hard to maintain. The team wants to break the template into reusable, independently testable components while keeping a single deployment entry point that provisions everything together. Which approach best meets these requirements?

Accepted Answer

Split the template into separate child templates stored in S3 and reference them from a parent template using nested stacks (AWS::CloudFormation::Stack resources).

Answer

Convert each component into a separate standalone stack and use the AWS CLI to deploy them in sequence with a shell script.

Answer

Use a single CloudFormation StackSet to deploy the components across multiple accounts and regions from one template.

Answer

Export values from each standalone stack with Outputs and import them into other stacks using Fn::ImportValue cross-stack references.

Question 32

A CloudOps team maintains a large CloudFormation template that provisions a standardized logging configuration (a CloudWatch log group, an IAM role, and a subscription filter) reused across dozens of separate application stacks. When they update the logging pattern, they must currently copy the revised resource definitions into every application template and redeploy each one. They want a way to define the logging pattern once, version it in a registry, and reference it as a reusable building block inside each application template so updates propagate through normal stack updates. Which approach best meets this requirement?

Accepted Answer

Package the logging resources as a CloudFormation module, register it in the CloudFormation registry, and reference the module resource type from each application template

Answer

Convert each application template into a StackSet and deploy the logging resources as a stack instance to every account

Answer

Export the logging resource ARNs from a shared stack and use Fn::ImportValue in each application template

Answer

Create a nested stack that hardcodes the logging resources and copy the AWS::CloudFormation::Stack block into every application template

Question 33

A CloudOps engineer manages a web application deployed via a CloudFormation stack that includes an Auto Scaling group and an Application Load Balancer. During stack updates, the team has occasionally deployed a bad application version that passes CloudFormation resource creation but causes elevated HTTP 5xx errors in production. The engineer wants CloudFormation to automatically roll back a stack update if the application's error rate spikes during and shortly after the update completes. Which approach meets this requirement with the least custom code?

Accepted Answer

Configure rollback triggers on the stack update referencing a CloudWatch alarm that monitors ALB 5xx errors, and set a monitoring time period after resources are provisioned.

Answer

Add a CreationPolicy with a wait condition to each Auto Scaling instance so CloudFormation waits for a success signal before completing the update.

Answer

Enable stack termination protection and create an EventBridge rule that deletes the stack when the 5xx alarm fires.

Answer

Use a stack policy to deny updates to the Auto Scaling group unless the CloudWatch alarm is in the OK state.

Question 34

A CloudOps engineer manages an Auto Scaling group of 12 EC2 instances defined in a CloudFormation template. When a new launch configuration with an updated AMI is deployed, the team requires that no more than 3 instances be replaced at a time, that each batch wait for a success signal from the application before continuing, and that the deployment roll back automatically if any batch fails. Which CloudFormation configuration meets these requirements?

Accepted Answer

Add an UpdatePolicy with AutoScalingRollingUpdate specifying MaxBatchSize of 3, MinSuccessfulInstancesPercent, and WaitOnResourceSignals with a PauseTime, and have instances send cfn-signal on successful startup.

Answer

Add a CreationPolicy with ResourceSignal to the Auto Scaling group so that each new instance signals completion during the update.

Answer

Add an UpdatePolicy with AutoScalingReplacingUpdate set to WillReplace true so the entire group is replaced behind a new group only after all instances are healthy.

Answer

Configure a DeletionPolicy of Snapshot on the Auto Scaling group and use a stack policy to limit the number of instances updated per change set.

Question 35

A CloudOps engineer is writing a CloudFormation template to provision an Amazon RDS MySQL instance. Company policy prohibits storing database credentials in plaintext anywhere in the template or in source control, and the master password must be generated automatically and stored securely. Which approach meets these requirements with the least operational effort?

Accepted Answer

Create an AWS::SecretsManager::Secret resource with a GenerateSecretString property, then reference it in the RDS instance's MasterUserPassword using a Secrets Manager dynamic reference (resolve:secretsmanager).

Answer

Pass the master password as a NoEcho CloudFormation parameter at stack creation time and store the value in an encrypted S3 object for later retrieval.

Answer

Store the password as a SecureString parameter in Parameter Store beforehand and hardcode the plaintext ARN and value as a template Mapping.

Answer

Use a Lambda-backed custom resource to generate a random password and return it as a stack output for administrators to copy into the RDS console.

Question 36

A CloudOps engineer manages a production environment using a single CloudFormation stack that includes an Aurora database and several stateless application resources. During routine stack updates to modify the application tier, the team is worried that an accidental change to the template could cause a replacement of the database resource and destroy production data. They still need to allow updates to all other resources in the stack. What is the MOST appropriate way to prevent updates to the database resource while permitting normal updates elsewhere?

Accepted Answer

Apply a stack policy that denies Update actions on the database resource's logical ID while allowing updates to all other resources.

Answer

Set a DeletionPolicy of Retain on the database resource so it cannot be modified during stack updates.

Answer

Enable termination protection on the CloudFormation stack to block any changes to the database.

Answer

Move the database into a separate stack and enable drift detection to alert on unwanted changes.

Question 37

A company manages its AWS accounts through AWS Organizations. The CloudOps team uses a CloudFormation StackSet with service-managed permissions to deploy a baseline security configuration (IAM roles, Config rules, and a logging bucket) to all accounts in a specific organizational unit (OU). New accounts are frequently created and added to this OU. The team wants the baseline StackSet to be deployed automatically to any new account added to the OU, without manual intervention. Which action meets this requirement?

Accepted Answer

Enable automatic deployment on the StackSet so that stack instances are created automatically when accounts are added to the target OU.

Answer

Create an EventBridge rule that triggers a Lambda function to run create-stack-instances whenever a new account joins the OU.

Answer

Switch the StackSet to self-managed permissions and share the template through AWS RAM with the new accounts.

Answer

Enable drift detection on the StackSet so that missing stack instances in new accounts are automatically remediated.

Question 38

A CloudOps engineer manages a security baseline (AWS Config rules, IAM roles, and CloudTrail configuration) deployed to 40 member accounts using a CloudFormation StackSet with service-managed permissions across an AWS Organization. Compliance auditors report that some member accounts have had resources manually modified outside of CloudFormation. The engineer needs to identify which stack instances no longer match the StackSet template's expected configuration, with the least operational effort. What should the engineer do?

Accepted Answer

Run drift detection on the StackSet, which evaluates each stack instance and reports instances with a DRIFTED status.

Answer

Log in to each member account and run drift detection on the individual CloudFormation stack, then manually compile the results.

Answer

Enable AWS Config aggregation in the management account and create a custom Config rule to compare resources against the template.

Answer

Re-deploy the StackSet to all accounts with an updated template to overwrite any manual changes and restore the baseline.

Question 39

A CloudOps engineer must deploy a standardized IAM role and a logging configuration to 40 AWS accounts spread across three Regions. The accounts are all members of an AWS Organizations organization. The engineer wants a repeatable, centrally managed way to deploy and update these resources across all accounts and Regions with the least ongoing administrative effort. Which approach should the engineer use?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions and deploy to the organization's organizational units, enabling automatic deployment to accounts as they join.

Answer

Create a single CloudFormation stack in the management account and use nested stacks that reference each member account's resources.

Answer

Write an AWS Systems Manager Automation runbook that assumes a role in each account and creates the resources sequentially.

Answer

Manually launch the same CloudFormation template in each account and Region, then enable drift detection on every stack.

Question 40

A company serves a website through Amazon CloudFront with an Application Load Balancer origin. Static assets under /static/* are cached correctly, but API responses under /api/* are being served stale and are also ignoring session-specific results because CloudFront caches responses regardless of the Authorization header and query strings. The default cache behavior uses a caching policy with a long TTL. A CloudOps engineer must ensure that /api/* requests always reach the origin with the Authorization header and all query strings forwarded, while keeping /static/* cached. What is the MOST appropriate solution?

Accepted Answer

Create a separate cache behavior for the /api/* path pattern and associate the AWS managed CachingDisabled cache policy along with an origin request policy that forwards the Authorization header and all query strings.

Answer

Reduce the default cache behavior TTL to zero and enable header forwarding for Authorization on the default behavior so both /api/* and /static/* bypass the cache.

Answer

Add an alternate origin for the API and enable origin failover so dynamic requests are routed to the origin only when the cache misses.

Answer

Create a CloudFront function on the viewer request event that deletes cached objects for /api/* and forwards the Authorization header to the origin.

Question 41

A media company serves images through Amazon CloudFront with an Amazon S3 origin. The CloudOps team notices a low cache hit ratio and higher-than-expected S3 request costs. Investigation shows the application appends a unique tracking query string parameter (for example, ?userId=xxxx) to every image URL, though the parameter does not affect which image is returned. What is the MOST effective change to improve the cache hit ratio?

Accepted Answer

Configure the cache policy to not include any query strings in the cache key while still allowing the requests to succeed

Answer

Enable CloudFront to forward all query strings to the origin and include them in the cache key

Answer

Reduce the default TTL on the cache behavior to force more frequent revalidation with S3

Answer

Add a second CloudFront distribution and split traffic between them with Route 53 weighted routing

Question 42

A CloudOps engineer manages a static website hosted in an S3 bucket and served through Amazon CloudFront with a default TTL of 86400 seconds. The web team just deployed updated HTML and CSS files to the S3 origin, but users continue to see the old versions of the pages when browsing the site. The team needs the updated files to be served to all users as quickly as possible without waiting for the TTL to expire. Which action should the engineer take?

Accepted Answer

Create a CloudFront invalidation specifying the paths of the changed files (or /*) to remove them from the edge caches.

Answer

Disable and re-enable the CloudFront distribution to force all edge locations to refresh their cached objects.

Answer

Enable S3 versioning on the origin bucket so CloudFront automatically fetches the newest object versions.

Answer

Lower the distribution's minimum TTL to 0 and wait for the change to propagate to all edge locations.

Question 43

A company serves a single-page web application from an Amazon S3 bucket through Amazon CloudFront. During brief origin outages and deployment windows, users see raw XML error responses returned directly from S3, which harms the user experience. The CloudOps team wants CloudFront to return a branded, friendly HTML error page whenever the origin responds with HTTP 500, 502, 503, or 504 errors, without changing the application code. Which action meets this requirement?

Accepted Answer

Configure a CloudFront custom error response for each 5xx error code that points to a custom HTML object and set an appropriate error caching minimum TTL.

Answer

Attach an AWS WAF web ACL to the distribution with a rule that blocks 5xx responses and returns a custom block page.

Answer

Enable S3 static website hosting on the origin bucket and configure the bucket's error document, then point CloudFront to the website endpoint.

Answer

Add a Lambda@Edge function on the viewer request event to detect origin failures and rewrite the response body to HTML.

Question 44

A media company distributes licensed video content through an Amazon CloudFront distribution backed by an S3 origin. Due to licensing agreements, the content must not be accessible from viewers located in three specific countries. The CloudOps engineer must enforce this restriction at the edge with minimal operational overhead and without modifying the origin. Which approach meets these requirements?

Accepted Answer

Configure CloudFront geographic restrictions (geo-blocking) with a blocklist of the three countries on the distribution.

Answer

Attach a network ACL to the S3 origin subnet denying inbound traffic from the countries' IP ranges.

Answer

Create a Route 53 geolocation routing policy that returns no answer for viewers in the three countries.

Answer

Add an S3 bucket policy condition using aws:SourceIp to deny requests from IP ranges in the three countries.

Question 45

A company serves a static website from an Amazon S3 bucket through an Amazon CloudFront distribution. The bucket has Block Public Access enabled. After migrating from a legacy Origin Access Identity (OAI) to Origin Access Control (OAC), users report that all requests to the site return HTTP 403 Access Denied. The CloudFront origin is correctly configured to use OAC. What is the MOST likely cause that a CloudOps engineer should investigate first?

Accepted Answer

The S3 bucket policy still grants access only to the old OAI principal and was not updated to allow the CloudFront service principal with the distribution's source ARN condition.

Answer

The CloudFront distribution is missing an SSL/TLS certificate from AWS Certificate Manager in the us-east-1 Region.

Answer

Block Public Access must be disabled on the S3 bucket for OAC to retrieve objects from the origin.

Answer

The CloudFront distribution's default root object is not set, causing S3 to reject the requests.

Question 46

A media company serves web assets through Amazon CloudFront with a single Amazon S3 bucket as the origin. During a recent regional S3 disruption, users received 5xx errors because CloudFront could not reach the origin. The company has already replicated all assets to a second S3 bucket in another Region. A CloudOps engineer must configure CloudFront so that requests automatically fail over to the secondary bucket when the primary origin returns specific error responses, without changing the viewer-facing domain name. What should the engineer do?

Accepted Answer

Create a CloudFront origin group containing both S3 buckets as origins, define the failover criteria to include the desired HTTP status codes, and associate the origin group with the cache behavior.

Answer

Create a Route 53 failover routing policy with health checks that point to each S3 bucket, and set the CloudFront distribution origin to the Route 53 record.

Answer

Enable S3 Cross-Region Replication and configure a Lambda@Edge function to rewrite the origin domain when it detects 5xx responses from the primary bucket.

Answer

Add both S3 buckets as separate origins with separate cache behaviors and use CloudFront weighted origin distribution to shift traffic during failures.

Question 47

A media company hosts premium video files in an Amazon S3 bucket served through Amazon CloudFront. The business requires that only authenticated, paying subscribers can access individual video files, and each access link must automatically expire 15 minutes after it is issued. The company wants to enforce this without exposing the S3 bucket publicly. Which approach meets these requirements?

Accepted Answer

Configure CloudFront signed URLs with a short expiration time and use an Origin Access Control (OAC) so the S3 bucket is only accessible via CloudFront.

Answer

Enable AWS WAF on the CloudFront distribution with a rate-based rule that blocks requests after 15 minutes of activity.

Answer

Attach a bucket policy that allows public read access and rely on CloudFront geo-restriction to limit who can view the content.

Answer

Use CloudFront field-level encryption to encrypt the video files and distribute decryption keys to subscribers.

Question 48

A financial services company must be able to prove during audits that its AWS API activity logs have not been altered or deleted after being written. The security team already has a CloudTrail trail delivering logs to an S3 bucket, but auditors require cryptographic proof that no log files were tampered with between delivery and review. Which action provides this assurance with the least operational overhead?

Accepted Answer

Enable CloudTrail log file integrity validation, which generates digest files that let you verify whether log files were modified or deleted.

Answer

Enable S3 default encryption with SSE-KMS on the log bucket so that any unauthorized modification of log files is automatically blocked.

Answer

Turn on S3 Versioning on the log bucket and periodically compare object versions to detect changes.

Answer

Configure an AWS Config rule that checks whether CloudTrail is enabled and alerts when the trail is disabled.

Question 49

A company uses AWS Organizations with 40 member accounts. The security team needs to capture all management event API activity across every existing and future account, delivering logs to a single S3 bucket in a dedicated logging account. Member account administrators must not be able to modify or delete the trail configuration in their own accounts. Which approach meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create an organization trail from the Organizations management account that logs to the centralized S3 bucket in the logging account.

Answer

Instruct each member account administrator to create a trail that delivers logs to the centralized S3 bucket, and audit compliance monthly.

Answer

Create a CloudFormation StackSet that deploys an individual per-account trail to all member accounts and reruns weekly to catch new accounts.

Answer

Enable AWS Config in all accounts and use a conformance pack to forward configuration snapshots to the logging account bucket.

Question 50

A CloudOps engineer manages a fleet of 200 EC2 instances running a Java application. The team wants to centralize application logs in CloudWatch Logs and set an alarm when the number of ERROR entries exceeds a threshold across the fleet. The engineer must minimize custom code and ongoing maintenance. Which approach meets these requirements?

Accepted Answer

Install the CloudWatch agent to stream the application log file to a log group, create a metric filter that matches the ERROR pattern, and set a CloudWatch alarm on the resulting metric.

Answer

Write a cron job on each instance that greps for ERROR and calls PutMetricData with a custom metric, then alarm on the metric.

Answer

Create a Lambda function triggered every minute that connects to each instance via SSM Run Command to read the log file and count ERROR lines.

Answer

Enable EC2 detailed monitoring and create a CloudWatch alarm on the ApplicationErrors metric emitted automatically for each instance.

Question 51

A CloudOps engineer needs to build a CloudWatch dashboard showing memory utilization and disk space usage for a fleet of EC2 Linux instances. After creating the dashboard, they discover that only CPU, network, and disk I/O metrics are available in the CloudWatch console, but no memory or disk-space-used metrics appear. What is the correct way to make these metrics available?

Accepted Answer

Install and configure the CloudWatch agent on the instances to collect memory and disk metrics and publish them as custom metrics

Answer

Enable detailed monitoring on the EC2 instances to reduce the metric interval to 1 minute

Answer

Attach an IAM role with CloudWatchReadOnlyAccess so the console can display the hypervisor-level memory metrics

Answer

Create a CloudWatch metric filter on the instances' system logs to extract memory and disk usage values

Question 52

A CloudOps engineer manages a fleet of EC2 instances running a Java application that emits application-level performance counters (queue depth, active session count) using the StatsD protocol. The team wants these counters visible as CloudWatch custom metrics without modifying application code to call the PutMetricData API directly, and with the least operational overhead. What should the engineer do?

Accepted Answer

Configure the CloudWatch agent with the StatsD plugin enabled so it listens on the local UDP port and forwards the received metrics to CloudWatch.

Answer

Deploy a Lambda function on a schedule that SSH-connects to each instance, reads the StatsD socket, and calls PutMetricData.

Answer

Enable EC2 detailed monitoring so the StatsD counters are automatically collected as one-minute custom metrics.

Answer

Install the AWS Distro for OpenTelemetry Collector and enable the X-Ray exporter to publish the StatsD counters as metrics.

Question 53

A CloudOps engineer manages a fleet of EC2 instances running a custom Java application that writes JSON-formatted application logs to /var/log/app/events.log. The team wants these logs centralized in CloudWatch Logs and needs to create a metric filter that counts log events where the JSON field "level" equals "ERROR". Currently no logs are being collected from the instances. What is the correct sequence of actions to achieve this?

Accepted Answer

Install and configure the CloudWatch agent to stream /var/log/app/events.log to a log group, then create a metric filter using a JSON filter pattern like { $.level = "ERROR" } and set an alarm on the resulting metric.

Answer

Enable EC2 detailed monitoring, which automatically ingests application log files, then create a subscription filter to count ERROR events.

Answer

Configure a CloudWatch dashboard to read the log file directly from the instance, then add a text-based filter widget matching "ERROR".

Answer

Install the CloudWatch agent to collect the logs, then use CloudWatch Logs Insights on a schedule to create a metric because metric filters cannot parse JSON fields.

Question 54

A CloudOps engineer manages a fleet of EC2 instances behind an Application Load Balancer. The team wants an automated response when average CPU utilization across the Auto Scaling group exceeds 70% for 5 minutes: the group should add capacity, and the on-call team should be notified via email. The engineer creates a CloudWatch alarm on the ASGAverageCPUUtilization metric. Which combination of alarm actions should be configured to meet BOTH requirements with the least custom code?

Accepted Answer

Add an Auto Scaling policy action and an SNS topic notification action to the same CloudWatch alarm, with the on-call team subscribed to the SNS topic.

Answer

Configure the alarm to invoke a Lambda function that both calls the Auto Scaling API to add instances and sends an email via Amazon SES.

Answer

Create two separate alarms on the same metric: one with an Auto Scaling action and one with an SNS action, each with different thresholds.

Answer

Attach only an SNS action to the alarm and configure an EventBridge rule on the SNS delivery event to trigger the scaling policy.

Question 55

A CloudOps engineer manages a fleet of EC2 instances running a legacy monolithic application that stores state on the instance's local root volume. Occasionally, an underlying host experiences a hardware failure, causing the instance to become unreachable. The team wants an automated way to recover the affected instance while preserving its instance ID, private IP address, Elastic IP, and attached EBS volumes, without launching a replacement instance. What should the engineer configure?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed_System metric with an EC2 action to recover the instance.

Answer

Create an Auto Scaling group with a minimum and maximum capacity of one so that a failed instance is replaced automatically.

Answer

Create a CloudWatch alarm on the StatusCheckFailed_Instance metric with an EC2 action to reboot the instance.

Answer

Create an EventBridge rule matching EC2 instance state-change events that triggers a Lambda function to launch a new instance from an AMI.

Question 56

A CloudOps engineer manages a three-tier web application. During deployments, individual CloudWatch alarms for high CPU, elevated latency, and increased 5XX errors all fire simultaneously, generating a flood of duplicate notifications to the on-call team. The engineer wants to notify the team only when multiple related conditions indicate a genuine service degradation, while reducing alarm noise. What is the MOST appropriate solution?

Accepted Answer

Create a composite alarm that combines the existing metric alarms using an alarm rule (e.g., AND/OR logic) and send notifications only from the composite alarm

Answer

Increase the evaluation periods and datapoints-to-alarm on each individual metric alarm so they trigger less frequently

Answer

Configure a single metric math alarm that averages CPU, latency, and 5XX error rates into one aggregated metric

Answer

Add all three alarms to a CloudWatch dashboard and disable their SNS notification actions during deployment windows

Question 57

A CloudOps engineer manages a fleet of application servers behind an Application Load Balancer. The team wants a single CloudWatch alarm that triggers when the HTTP 5XX error rate exceeds 5% of total requests, rather than alarming on a raw count of errors. Both HTTPCode_Target_5XX_Count and RequestCount metrics are available. What is the most appropriate way to create this alarm?

Accepted Answer

Create a metric math expression that divides HTTPCode_Target_5XX_Count by RequestCount, multiply by 100, and set the alarm threshold on the resulting expression at 5

Answer

Create a static alarm on HTTPCode_Target_5XX_Count with a threshold of 5 for one evaluation period

Answer

Enable CloudWatch anomaly detection on HTTPCode_Target_5XX_Count and alarm when the value is outside the expected band

Answer

Create a composite alarm combining separate alarms on HTTPCode_Target_5XX_Count and RequestCount

Question 58

A CloudOps engineer configures a CloudWatch alarm on a custom metric that a batch application publishes only when it processes jobs. Between job runs, the application publishes no data points at all. The team notices the alarm frequently enters the INSUFFICIENT_DATA state during idle periods, generating confusing notifications. They want the alarm to remain in the OK state during idle periods and only trigger when actual reported values breach the threshold. What is the most appropriate configuration change?

Accepted Answer

Set the alarm's 'Treat missing data as' setting to 'notBreaching' (treat as good).

Answer

Set the alarm's 'Treat missing data as' setting to 'breaching' (treat as bad).

Answer

Increase the alarm evaluation period to 24 hours to span multiple job runs.

Answer

Enable anomaly detection on the metric so idle periods are learned as normal behavior.

Question 59

A CloudOps engineer manages an e-commerce application whose request rate follows a strong daily and weekly pattern, with predictable spikes during business hours and much lower traffic overnight and on weekends. The team currently uses a static CloudWatch alarm on the RequestCount metric with a fixed threshold, but it generates false alarms during normal daily peaks and fails to catch abnormal drops during off-hours. The engineer needs an approach that adapts the alarm threshold to the metric's expected behavior throughout the day and week with minimal ongoing maintenance. Which solution meets these requirements?

Accepted Answer

Enable CloudWatch anomaly detection on the RequestCount metric and create an alarm based on the anomaly detection band.

Answer

Create multiple static alarms, one for each hour of the day, and use EventBridge scheduled rules to enable or disable them.

Answer

Configure a metric math expression that averages RequestCount over 24 hours and alarm when the current value exceeds that average.

Answer

Increase the static threshold to accommodate peak traffic and set the alarm to trigger only after 15 consecutive breaching datapoints.

Question 60

A CloudOps engineer manages a multi-account AWS Organization with separate accounts for production, staging, and development workloads. Leadership wants a single CloudWatch dashboard in a central monitoring account that displays EC2 and RDS metrics from all three workload accounts in one view. The solution must minimize ongoing operational overhead and avoid custom scripts that copy metric data between accounts. What should the engineer do?

Accepted Answer

Enable CloudWatch cross-account observability by linking the source accounts to the central monitoring account as the monitoring account, then build the dashboard referencing metrics from each linked source account.

Answer

Create a Lambda function in each workload account that uses GetMetricData and PutMetricData to periodically push metrics into the central monitoring account, then build the dashboard on the copied metrics.

Answer

Configure metric streams in each account to send metrics to a Kinesis Data Firehose that writes to a central S3 bucket, then build the dashboard from the S3 data.

Answer

Grant the central account IAM users cross-account roles and manually switch roles to view each account's separate dashboards side by side.

Question 61

A CloudOps engineer manages an Application Load Balancer fronting a fleet of EC2 instances. Users report that some requests are extremely slow even though the CloudWatch dashboard widget showing the Average of the TargetResponseTime metric appears healthy at around 120 ms. The team wants the dashboard to accurately surface the slow-request experience affecting a subset of users. What should the engineer do to the dashboard widget?

Accepted Answer

Change the widget statistic to the p99 percentile of TargetResponseTime to reveal tail latency affecting the slowest requests.

Answer

Change the widget statistic to Sum of TargetResponseTime so the total time reflects the slow requests.

Answer

Add the RequestCount metric to the same widget so spikes in traffic correlate with the average latency.

Answer

Enable detailed monitoring on the ALB to increase the metric resolution to one minute for the average statistic.

Question 62

A CloudOps engineer supports a serverless order-processing application built on AWS Lambda. The team wants to publish custom business metrics (such as order value and processing duration) from within the Lambda function code without adding synchronous API latency, and they need these metrics to be automatically extracted and queryable in CloudWatch. Which approach best meets these requirements?

Accepted Answer

Write structured logs using the CloudWatch Embedded Metric Format (EMF) to stdout, which CloudWatch automatically parses into metrics from the log data

Answer

Call the CloudWatch PutMetricData API synchronously at the end of each function invocation for every metric

Answer

Install the CloudWatch agent inside the Lambda execution environment to collect and push custom metrics

Answer

Create a CloudWatch metric filter on the Lambda log group and manually define a pattern for each numeric value

Question 63

A CloudOps engineer manages a fleet of Lambda functions that write verbose logs to Amazon CloudWatch Logs. The finance team reports that CloudWatch Logs storage costs have grown significantly over the past year. Investigation shows that most log groups were created with the default retention setting and contain years of data, but the compliance team only requires 90 days of retention for these operational logs. What is the MOST cost-effective action to reduce ongoing storage costs while meeting the compliance requirement?

Accepted Answer

Set a 90-day retention policy on the affected log groups so CloudWatch Logs automatically deletes log events older than 90 days.

Answer

Create an EventBridge scheduled rule that triggers a Lambda function every day to delete individual log streams older than 90 days.

Answer

Export all log groups to Amazon S3 with a lifecycle policy and delete the CloudWatch log groups entirely.

Answer

Enable a metric filter on each log group to count old log events and alarm when data exceeds 90 days.

Question 64

A CloudOps engineer manages a fleet of application servers that stream structured JSON logs to a single Amazon CloudWatch Logs log group. During a recent incident, users reported intermittent slowness. The engineer needs to quickly identify, across all log streams in that log group, which API endpoints had a response time greater than 2000 ms during a specific 30-minute window, and count how many times each occurred. Which approach lets the engineer perform this analysis fastest without provisioning additional infrastructure?

Accepted Answer

Run a CloudWatch Logs Insights query on the log group that filters on the response-time field, groups by endpoint, and counts occurrences within the time range.

Answer

Create a CloudWatch metric filter for slow responses, wait for the metric to populate, then graph it on a dashboard.

Answer

Configure a subscription filter to stream the logs to an Amazon Kinesis Data Firehose delivery stream that writes to Amazon S3, then query with Amazon Athena.

Answer

Export the log group to Amazon S3 using a create-export-task, then load the objects into Amazon OpenSearch Service for ad hoc searching.

Exam domain	Exam weight	Practice
Monitoring, Logging, Analysis, Remediation, and Performance Optimization	22%	Practice this topic
Reliability and Business Continuity	22%	Practice this topic
Deployment, Provisioning, and Automation	22%	Practice this topic
Security and Compliance	16%	Practice this topic
Networking and Content Delivery	18%	Practice this topic

AWS Certified CloudOps Engineer - Associate (SOA-C03) practice exam & study guide

Start studying SOA-C03

All SOA-C03 study resources

SOA-C03 exam domains

Sample SOA-C03 questions

Key SOA-C03 terms

SOA-C03 frequently asked questions

Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

Reliability and Business Continuity (22%)

Deployment, Provisioning, and Automation (22%)

Security and Compliance (16%)

Networking and Content Delivery (18%)