Architecting on AWS Certification Equipment Maintenance & Calibration 4 — Questions and Answers
Question 1: A company must decommission thousands of S3 objects older than 365 days to reduce storage costs while retaining newer objects indefinitely. Which feature handles this automatically?
- S3 Replication
- S3 Lifecycle policies with Expiration actions (Correct answer)
- S3 Object Lock
- S3 Intelligent-Tiering
Correct answer: S3 Lifecycle policies with Expiration actions
S3 Lifecycle Expiration actions automatically delete objects after a configured number of days, eliminating the need for manual cleanup scripts.
Question 2: An architect needs to validate that all newly launched EC2 instances comply with a CIS benchmark before they serve production traffic. Which service can scan AMIs and running instances for security benchmark compliance?
- AWS Shield
- Amazon Inspector (Correct answer)
- AWS Trusted Advisor
- Amazon Macie
Correct answer: Amazon Inspector
Amazon Inspector automatically assesses EC2 instances and container images against security benchmarks and CVE databases, providing findings with severity scores.
Question 3: During a planned ECS cluster maintenance event, tasks must be gracefully stopped before the underlying EC2 instances are drained. Which ECS feature controls the grace period for in-flight task shutdown?
- Task placement constraints
- ECS task stopTimeout in the task definition (Correct answer)
- Service Auto Scaling cooldown
- ECS capacity provider managed termination protection
Correct answer: ECS task stopTimeout in the task definition
The stopTimeout field in an ECS task definition specifies how long ECS waits for a task to exit gracefully before forcibly stopping it.
Question 4: A DevOps team wants CloudFormation stacks to automatically detect and report configuration drift without manual intervention. What is the most scalable way to trigger drift detection across dozens of stacks periodically?
- Run detect-stack-drift CLI command in a cron job on a bastion host
- EventBridge rule triggering a Lambda function that calls the CloudFormation drift detection API (Correct answer)
- AWS Config rule for CloudFormation stacks
- AWS Trusted Advisor weekly report
Correct answer: EventBridge rule triggering a Lambda function that calls the CloudFormation drift detection API
An EventBridge scheduled rule can invoke a Lambda function that calls the CloudFormation DetectStackDrift API across all stacks, providing automated, serverless periodic drift detection.
Question 5: A production Aurora cluster must undergo minor version upgrades with zero downtime. Which Aurora feature allows applying upgrades without interrupting read/write operations?
- Aurora Backtrack
- Aurora Zero-Downtime Patching (ZDP) (Correct answer)
- Aurora Global Database failover
- Aurora Serverless v2 auto-pause
Correct answer: Aurora Zero-Downtime Patching (ZDP)
Aurora Zero-Downtime Patching preserves existing connections and in-flight transactions during minor version upgrades, enabling maintenance with no observable downtime.
Question 6: An architect must ensure that CloudWatch Alarms auto-remediate high memory utilization on EC2 instances by restarting the application service via SSM. Which integration connects the alarm action directly to SSM?
- CloudWatch Alarm → SNS → Lambda → SSM Run Command
- CloudWatch Alarm → SSM Run Command directly
- CloudWatch Alarm → EventBridge → SSM Automation (Correct answer)
- CloudWatch Alarm → SQS → Lambda → SSM
Correct answer: CloudWatch Alarm → EventBridge → SSM Automation
CloudWatch Alarms can trigger EventBridge events, which in turn invoke SSM Automation documents to perform remediation actions on the affected resources.
Question 7: A solutions architect needs to ensure that Elastic Load Balancer SSL/TLS certificates are renewed before expiration without manual tracking. Which AWS service automates this?
- AWS Certificate Manager (ACM) with auto-renewal (Correct answer)
- AWS Secrets Manager with Lambda rotation
- AWS KMS key rotation
- IAM certificate rotation policy
Correct answer: AWS Certificate Manager (ACM) with auto-renewal
ACM automatically renews certificates issued by ACM before they expire and deploys the renewed certificate to associated AWS services like ALB with no manual action required.
Architecting on AWS Certification Equipment Maintenance & Calibration 4
A company must decommission thousands of S3 objects older than 365 days to reduce storage costs while retaining newer objects indefinitely.
Which feature handles this automatically?