Architecting on AWS Certification Equipment Maintenance & Calibration 2 — Questions and Answers
Question 1: An operations team needs to run patching scripts on 500 EC2 instances during a defined maintenance window without manual intervention. Which AWS service provides native maintenance window scheduling?
- AWS Config
- AWS Systems Manager Maintenance Windows (Correct answer)
- Amazon EventBridge Scheduler
- AWS Batch
Correct answer: AWS Systems Manager Maintenance Windows
AWS Systems Manager Maintenance Windows lets you define recurring schedules to run patching, scripts, and commands across fleets of EC2 instances automatically.
Question 2: A company wants to enforce that all EC2 instances remain compliant with the latest approved AMI. Which AWS Systems Manager capability continuously checks and reports on this compliance status?
- SSM Patch Manager
- SSM State Manager
- SSM Compliance (Correct answer)
- SSM Inventory
Correct answer: SSM Compliance
SSM Compliance aggregates patch and association compliance data, providing a unified view of which instances meet defined configuration baselines.
Question 3: During a blue/green deployment, an architect must ensure old (blue) instances are decommissioned only after health checks confirm the green fleet is fully operational. Which ELB feature supports this gate?
- Connection Draining (Deregistration Delay) (Correct answer)
- Sticky Sessions
- Cross-Zone Load Balancing
- Access Logs
Correct answer: Connection Draining (Deregistration Delay)
Connection Draining (Deregistration Delay) keeps in-flight requests alive on deregistering instances, ensuring clean handoff before the old fleet is terminated.
Question 4: A solutions architect needs to rotate database credentials stored in AWS Secrets Manager every 30 days without application downtime. What is the recommended rotation mechanism?
- Manual rotation via AWS CLI cron job
- Lambda-based automatic rotation built into Secrets Manager (Correct answer)
- AWS Config remediation action
- SSM Parameter Store rotation policy
Correct answer: Lambda-based automatic rotation built into Secrets Manager
Secrets Manager supports automatic rotation using a Lambda function that updates the secret value and propagates the change to the target resource on the defined schedule.
Question 5: An EC2 Auto Scaling group must replace instances whose status checks fail without any human intervention. Which Auto Scaling health check type should be enabled alongside EC2 status checks?
- CloudWatch alarm-based health check
- ELB health check (Correct answer)
- Custom health check via Lambda
- AWS Config health check
Correct answer: ELB health check
Enabling ELB health checks in the Auto Scaling group causes it to terminate and replace instances that the load balancer marks as unhealthy, beyond just EC2 status checks.
Question 6: A team uses AWS Config rules to detect EC2 instances running unsupported OS versions. When a non-compliant instance is found, the remediation should automatically invoke SSM Run Command. What Config feature enables this?
- Config Aggregator
- Config Remediation Actions (Correct answer)
- Config Conformance Packs
- Config Delivery Channel
Correct answer: Config Remediation Actions
AWS Config Remediation Actions allow you to associate an SSM Automation document with a rule so non-compliant resources are automatically corrected.
Question 7: Which AWS service would you use to create a golden AMI pipeline that automatically tests, validates, and distributes a hardened machine image to multiple AWS Regions?
- AWS CodeDeploy
- EC2 Image Builder (Correct answer)
- AWS Elastic Beanstalk
- AWS OpsWorks
Correct answer: EC2 Image Builder
EC2 Image Builder automates the build, test, and distribution of AMIs, enabling a repeatable golden-image pipeline with built-in compliance testing.
Architecting on AWS Certification Equipment Maintenance & Calibration 2
An operations team needs to run patching scripts on 500 EC2 instances during a defined maintenance window without manual intervention.
Which AWS service provides native maintenance window scheduling?