AWS DevOps Incident and Event Response 4 — Questions and Answers
Question 1: An AWS Systems Manager OpsCenter OpsItem is created automatically when a CloudWatch alarm enters ALARM state. Which Systems Manager feature is responsible for this integration?
- OpsCenter EventBridge rule (Correct answer)
- Systems Manager Automation runbook
- CloudWatch Events to OpsCenter connector
- Systems Manager Explorer aggregation
Correct answer: OpsCenter EventBridge rule
An EventBridge rule targeting OpsCenter is used to automatically create OpsItems when CloudWatch alarms fire.
Question 2: During an incident, an operator needs to execute a pre-approved set of remediation steps across 500 EC2 instances simultaneously. Which AWS service provides the fastest path to do this with full audit logging?
- AWS Systems Manager Run Command (Correct answer)
- AWS Lambda with EC2 API calls
- AWS Config remediation actions
- AWS CodeDeploy in-place deployment
Correct answer: AWS Systems Manager Run Command
Systems Manager Run Command executes commands across many instances simultaneously and automatically logs output to S3 and CloudWatch Logs.
Question 3: A DevOps team wants CloudWatch to automatically restart an EC2 instance when CPU utilization stays at 100% for 15 minutes. What is the correct alarm action to configure?
- EC2 reboot action (Correct answer)
- EC2 recover action
- Lambda function invocation
- Auto Scaling terminate and launch
Correct answer: EC2 reboot action
CloudWatch EC2 reboot alarm actions restart the instance OS, which clears CPU-bound processes.
Question 4: A pipeline failure event must trigger both a PagerDuty alert and an internal Slack notification simultaneously. What is the most scalable architecture for this requirement?
- EventBridge rule → SNS topic with two subscriptions (HTTPS endpoints) (Correct answer)
- CodePipeline notification → two separate Lambda functions
- CloudWatch alarm → two SNS topics in sequence
- CodeBuild webhook → direct HTTP calls to both services
Correct answer: EventBridge rule → SNS topic with two subscriptions (HTTPS endpoints)
An SNS topic with multiple HTTPS subscriptions fans out a single event to multiple endpoints simultaneously without additional Lambda overhead.
Question 5: What does AWS Systems Manager Incident Manager's 'engagement plan' define?
- The ordered list of contacts and escalation timing for notifying responders (Correct answer)
- The runbook steps to remediate the incident
- The CloudWatch metrics to monitor during the incident
- The post-incident analysis report template
Correct answer: The ordered list of contacts and escalation timing for notifying responders
An engagement plan specifies which contacts to notify, in what order, and after how many minutes to escalate if there is no acknowledgment.
Question 6: A team needs to capture all API calls made during an incident for a forensic audit. Which AWS service provides a tamper-evident, continuous record of API activity?
- AWS CloudTrail with log file validation enabled (Correct answer)
- Amazon CloudWatch Logs with metric filters
- AWS Config configuration history
- VPC Flow Logs with S3 delivery
Correct answer: AWS CloudTrail with log file validation enabled
CloudTrail with log file validation uses SHA-256 hashing to detect if log files were modified or deleted after delivery.
Question 7: Which AWS X-Ray feature helps identify which downstream service is causing latency spikes during a live incident in a microservices architecture?
- Service map with response time distribution (Correct answer)
- X-Ray sampling rules adjustment
- X-Ray groups filter expressions
- Trace ID propagation headers
Correct answer: Service map with response time distribution
The X-Ray service map visually shows each service node's average latency and error rate, making it easy to pinpoint the bottleneck.
AWS DevOps Incident and Event Response 4
An AWS Systems Manager OpsCenter OpsItem is created automatically when a CloudWatch alarm enters ALARM state.
Which Systems Manager feature is responsible for this integration?