AWS DevOps Incident and Event Response 2 — Questions and Answers
Question 1: An EC2 instance is under memory pressure during an incident. Which CloudWatch metric would reveal this, and what is required to collect it?
- CPUCreditBalance — enabled by default
- MemoryUtilization — requires the CloudWatch Agent (Correct answer)
- NetworkPacketsIn — requires VPC Flow Logs
- DiskReadOps — requires enhanced monitoring
Correct answer: MemoryUtilization — requires the CloudWatch Agent
MemoryUtilization is not published by default because AWS hypervisors cannot see guest OS memory; the CloudWatch Agent must be installed on the instance to collect and publish this metric.
Question 2: Which AWS service uses machine learning to proactively detect anomalies in your application and infrastructure behavior without requiring you to configure manual thresholds?
- Amazon CloudWatch Alarms
- AWS X-Ray
- Amazon DevOps Guru (Correct answer)
- AWS Config
Correct answer: Amazon DevOps Guru
Amazon DevOps Guru applies ML to your CloudWatch metrics, logs, and events to surface anomalous behavior and actionable recommendations without predefined alarm thresholds.
Question 3: During an incident, your runbook must execute shell commands simultaneously on 50 EC2 instances. Which Systems Manager feature is designed for this use case?
- Systems Manager Session Manager
- Systems Manager Run Command (Correct answer)
- Systems Manager Patch Manager
- Systems Manager State Manager
Correct answer: Systems Manager Run Command
Systems Manager Run Command executes commands or scripts across a fleet of managed instances simultaneously without requiring SSH or RDP access.
Question 4: Your incident response plan must automatically page on-call engineers via PagerDuty when a critical CloudWatch alarm fires. Which AWS service provides native integration for this?
- Amazon SNS with HTTPS endpoint
- AWS Systems Manager Incident Manager (Correct answer)
- Amazon EventBridge with API Destinations
- AWS Chatbot
Correct answer: AWS Systems Manager Incident Manager
Systems Manager Incident Manager supports native contact and escalation plan integrations with third-party tools like PagerDuty and OpsGenie through response plans.
Question 5: What is the correct sequence of phases in the AWS incident management lifecycle?
- Detect → Prepare → Respond → Recover → Learn
- Prepare → Detect → Respond → Recover → Learn (Correct answer)
- Detect → Respond → Prepare → Recover → Learn
- Prepare → Respond → Detect → Learn → Recover
Correct answer: Prepare → Detect → Respond → Recover → Learn
The AWS incident lifecycle starts with Prepare (runbooks and plans), then Detect, Respond, Recover, and Learn (post-incident analysis) — you must prepare before you can respond effectively.
Question 6: An AWS Config automatic remediation keeps failing. Which CloudWatch metric should you examine to diagnose the failure count?
- ConfigRuleEvaluationStatus
- FailedRemediationAttempts (Correct answer)
- ComplianceByConfigRule
- NumberOfNonCompliantRules
Correct answer: FailedRemediationAttempts
The FailedRemediationAttempts metric in AWS Config tracks how many remediation executions have failed, helping you identify and debug broken remediation configurations.
Question 7: Which architecture detects AWS root account console logins and sends an SNS alert to the security team?
- Enable AWS Config root login rule → SNS notification
- CloudTrail → CloudWatch Logs → metric filter → CloudWatch Alarm → SNS (Correct answer)
- GuardDuty finding → EventBridge rule → SNS
- AWS Security Hub → automated action → SNS
Correct answer: CloudTrail → CloudWatch Logs → metric filter → CloudWatch Alarm → SNS
The standard pattern is: create a CloudTrail trail delivering to CloudWatch Logs, create a metric filter matching ConsoleLogin events where userIdentity.type is Root, then alarm on that metric and notify via SNS.
AWS DevOps Incident and Event Response 2
An EC2 instance is under memory pressure during an incident.
Which CloudWatch metric would reveal this, and what is required to collect it?