Incident and Event Response

188. An AWS Health event indicating a scheduled instance retirement must automatically create a remediation task rather than only notifying the team. Which solution meets these requirements?

1. A Match the Health event with an EventBridge rule and invoke a Systems Manager Automation runbook that replaces the affected instance.
2. B Match the Health event with an EventBridge rule and publish it to an email distribution list.
3. C Create a CloudWatch alarm on the instance's status check metric and notify the team.
4. D Review the AWS Health Dashboard each morning and schedule the replacement manually.

189. A high volume of events must be processed by several independent consumers, each receiving every event. Which solution meets these requirements?

1. A Send the events to an Amazon SQS FIFO queue with one message group.
2. B Send the events to one Amazon SQS queue that all consumers poll.
3. C Publish the events to an Amazon SNS topic and subscribe an Amazon SQS queue for each consumer.
4. D Invoke each consumer in sequence from a single Lambda function.

190. A specific EventBridge event must trigger a predefined sequence of remediation steps whose execution is auditable. Which solution meets these requirements?

1. A Invoke a Lambda function that connects to the instances over SSH and runs the steps.
2. B Invoke a Systems Manager Automation runbook from the rule and review the per-step execution history.
3. C Record the event in a CloudWatch dashboard annotation for later action.
4. D Publish the event to an Amazon SNS topic that emails the remediation steps to the on-call engineer.

191. A fleet's configuration must be corrected automatically when it drifts from the desired state. Which solution meets these requirements?

1. A Run a Systems Manager Run Command document whenever drift is reported.
2. B Create an AWS Config rule that reports the drift for manual correction.
3. C Recreate the instances from a golden image whenever drift is detected.
4. D Create a Systems Manager State Manager association that reapplies the desired state on a schedule.

192. A remediation must not run twice for the same event even when the event is delivered more than once. Which design meets these requirements?

1. A Require a manual approval before each remediation execution.
2. B Place a FIFO queue between the rule and the remediation.
3. C Increase the EventBridge retry interval so duplicate deliveries are spaced further apart.
4. D Record an idempotency key derived from the event and exit without acting when the key has already been handled.

193. A CodePipeline execution failed at the deployment stage, and the team must establish why. Which approach is appropriate?

1. A Review the pipeline's overall execution duration for the failed run.
2. B Review the CloudWatch billing metrics for the deployment period.
3. C Review the deployment's lifecycle event logs and the deployment group's failure details for the specific instances that failed.
4. D Review the source repository's commit history for the failed run.

194. An Amazon ECS service fails to reach its desired task count, and tasks stop shortly after starting. Which source should be examined first?

1. A Review the cluster's CPU and memory reservation metrics.
2. B Review the stopped task's reason and its container exit code and logs.
3. C Review the task definition's revision history.
4. D Review the Application Load Balancer's request count metric.

195. An event processing workflow must preserve the order of events that relate to the same entity. Which approach is appropriate?

1. A Timestamp each event and sort them after processing.
2. B Partition the events by entity identifier so each partition is processed in order while partitions proceed in parallel.
3. C Increase the consumer count so events are processed faster.
4. D Process all events serially through a single consumer.

196. An event source occasionally delivers the same event twice. Which approach is appropriate?

1. A Disable retries on the event source.
2. B Make the processing idempotent by recording a deterministic event identifier and skipping events already handled.
3. C Process every event and accept the duplicate side effects.
4. D Increase the delivery retry interval so duplicates are spaced further apart.

197. A remediation must modify a resource's configuration and record what changed for audit. Which approach is appropriate?

1. A Execute the change through an Automation runbook so each step, its inputs, and its outputs are recorded in execution history.
2. B Execute the change and rely on AWS Config to record the resulting state.
3. C Execute the change from a Lambda function and log a summary message.
4. D Execute the change manually and record it in the incident ticket.

198. A fleet configuration change must be applied progressively so a faulty change does not affect every instance. Which approach is appropriate?

1. A Apply the change to one instance and roll it out immediately if that instance survives.
2. B Apply the change to a subset first, verify the outcome, and proceed only when the subset is healthy.
3. C Apply the change and monitor for issues over the following week.
4. D Apply the change to every instance simultaneously during a maintenance window.

199. A CloudFormation stack update fails and rolls back, and the team must find the cause. Which source should be examined first?

1. A The stack events for the first resource failure, since later events describe the rollback rather than the cause.
2. B The template diff between the two versions.
3. C The CloudTrail record of the update call.
4. D The final stack event, which reports the rollback completing.

200. An Auto Scaling group repeatedly launches and terminates instances. Which cause should be investigated first?

1. A Whether the group's maximum size is set too low.
2. B Whether new instances are failing their health check before the grace period allows them to finish starting.
3. C Whether the group spans too few Availability Zones.
4. D Whether the launch template specifies an unsupported instance type.

201. An event-driven workflow must process events in the order they were produced for a given entity. Which mechanism is appropriate?

1. A A standard queue with several consumers.
2. B An SNS topic with several subscribers.
3. C A FIFO queue with a message group identifier per entity, so ordering holds within each entity.
4. D A standard queue with a single consumer.

202. An event source must deliver to several targets with different processing requirements and independent failure handling. Which pattern is appropriate?

1. A Publish once to a topic with a queue subscribed per target, so each target has its own buffer and retry behaviour.
2. B Deliver to a single shared queue all targets poll.
3. C Invoke each target directly from the producer.
4. D Write the events to a database each target polls.

203. A configuration change applied by automation must be reversible if it proves incorrect. Which approach is appropriate?

1. A Test the change in a development account first and then apply it.
2. B Apply the change only during a maintenance window.
3. C Apply the change and rely on the next deployment to correct it.
4. D Capture the prior configuration before changing it and include a documented path to restore it.

204. An automated response must apply a change to many resources without exceeding an API rate limit. Which approach is appropriate?

1. A Process all resources in parallel as fast as possible.
2. B Request a rate limit increase before every run.
3. C Process the resources one at a time with no rate control.
4. D Process the resources in batches with a controlled rate and backoff on throttling.

205. A Lambda function invoked by EventBridge is not executing, and no invocation appears in its metrics. Which cause should be investigated first?

1. A Whether the function's code contains an error.
2. B Whether the rule's event pattern matches the events being published and whether the rule has permission to invoke the function.
3. C Whether the function's memory allocation is too low.
4. D Whether the function's log retention is too short.

206. An ECS task fails to start with an error indicating the image could not be pulled. Which cause should be investigated first?

1. A Whether the task's CPU allocation is too low.
2. B Whether the container's application code has a bug.
3. C Whether the task execution role permits pulling from the registry and whether the task has a network path to it.
4. D Whether the service's desired count is set correctly.

207. An API Gateway endpoint returns 502 errors while the backing Lambda function reports successful invocations. Which cause should be investigated first?

1. A Whether the function's timeout is too short.
2. B Whether the function's reserved concurrency is too low.
3. C Whether the function's response matches the format the integration expects, since a malformed response produces a gateway error.
4. D Whether the API's throttling limit has been reached.

208. A configuration change applied in response to an event must be recorded so its effect can be reviewed later. Which approach is appropriate?

1. A Execute the change through an automation whose execution history records the inputs, the steps, and the resulting state.
2. B Apply the change and log a summary message.
3. C Apply the change and rely on AWS Config to record the resulting state.
4. D Apply the change and note it in the incident ticket.

209. An event-driven configuration change must be applied to resources across several Regions. Which approach is appropriate?

1. A Apply the change manually in each Region.
2. B Create a rule and automation in each Region separately.
3. C Apply the change in one Region and replicate the resources.
4. D Invoke a multi-Region automation from the rule so the change is applied consistently in each Region.