AWS DevOps Incident and Event Response 5 — Questions and Answers
Question 1: An EventBridge rule must trigger a Systems Manager Automation document when an EC2 instance changes to 'stopped' state. Which EventBridge event source and detail-type should the rule match?
- source: aws.ec2, detail-type: EC2 Instance State-change Notification (Correct answer)
- source: aws.cloudwatch, detail-type: CloudWatch Alarm State Change
- source: aws.ssm, detail-type: EC2 State Manager Association State Change
- source: aws.health, detail-type: AWS Health Event
Correct answer: source: aws.ec2, detail-type: EC2 Instance State-change Notification
EC2 state changes publish events with source 'aws.ec2' and detail-type 'EC2 Instance State-change Notification' to EventBridge by default.
Question 2: During a major incident, a runbook step requires approval from a senior engineer before proceeding with a destructive database rollback. Which Systems Manager Automation feature supports this gate?
- aws:approve action with SNS notification (Correct answer)
- Systems Manager Change Calendar block
- OpsCenter manual OpsItem resolution
- EventBridge rule with SQS delay queue
Correct answer: aws:approve action with SNS notification
The aws:approve action pauses automation execution and sends an SNS notification to approvers, waiting for an approval or rejection response.
Question 3: A Lambda function is producing intermittent errors that are hard to reproduce. Which combination of tools best helps correlate errors with the exact request payload?
- AWS X-Ray active tracing + CloudWatch Logs Insights (Correct answer)
- CloudWatch Metrics + SNS alerting
- AWS Config rules + Lambda@Edge logs
- CloudTrail data events + CloudWatch dashboards
Correct answer: AWS X-Ray active tracing + CloudWatch Logs Insights
X-Ray traces capture the full request context while CloudWatch Logs Insights lets you query log data alongside trace IDs to correlate errors with payloads.
Question 4: A company wants its incident response runbooks to automatically roll back a CodeDeploy deployment when error rate exceeds 5%. Which deployment configuration setting enables this without custom Lambda functions?
- Automatic rollback on deployment failure with CloudWatch alarm trigger (Correct answer)
- CodeDeploy traffic shifting with canary hook
- CodePipeline approval action with rejection handler
- Deployment group with Blue/Green and manual traffic cutover
Correct answer: Automatic rollback on deployment failure with CloudWatch alarm trigger
CodeDeploy supports automatic rollback when a linked CloudWatch alarm enters ALARM state, requiring no custom Lambda or pipeline logic.
Question 5: Which AWS Health event type should a DevOps team subscribe to in order to receive early warning before scheduled EC2 maintenance that could restart instances?
- AWS_EC2_INSTANCE_REBOOT_MAINTENANCE_SCHEDULED (Correct answer)
- AWS_EC2_INSTANCE_STORE_DRIVE_PERFORMANCE_DEGRADED
- AWS_EC2_OPERATIONAL_ISSUE
- AWS_EC2_SYSTEM_REBOOT_REQUIRED
Correct answer: AWS_EC2_INSTANCE_REBOOT_MAINTENANCE_SCHEDULED
AWS_EC2_INSTANCE_REBOOT_MAINTENANCE_SCHEDULED is the specific Health event type that provides advance notice of AWS-initiated maintenance reboots.
Question 6: An incident retrospective reveals that a critical CloudWatch alarm was silenced because someone set the alarm state to INSUFFICIENT_DATA manually during testing and never reverted it. Which preventive control addresses this?
- SCP or IAM policy denying cloudwatch:SetAlarmState except for break-glass roles (Correct answer)
- CloudTrail alert on all CloudWatch API calls
- Config rule checking alarm state hourly
- CloudWatch alarm to monitor another alarm's state
Correct answer: SCP or IAM policy denying cloudwatch:SetAlarmState except for break-glass roles
Restricting cloudwatch:SetAlarmState via IAM/SCP ensures that alarm states can only be modified by authorized break-glass roles, not regular operators.
Question 7: A DevOps team wants to ensure that every incident automatically creates a timeline of events using CloudTrail and CloudWatch Logs data. Which Incident Manager feature provides this integrated event timeline?
- Incident Manager timeline with CloudTrail and CloudWatch Logs integration (Correct answer)
- Systems Manager OpsCenter related items section
- EventBridge Archive and Replay for the incident window
- CloudWatch Logs Insights saved query on incident period
Correct answer: Incident Manager timeline with CloudTrail and CloudWatch Logs integration
AWS Systems Manager Incident Manager's incident timeline automatically aggregates events from CloudTrail and CloudWatch Logs into a chronological view.
AWS DevOps Incident and Event Response 5
An EventBridge rule must trigger a Systems Manager Automation document when an EC2 instance changes to 'stopped' state.
Which EventBridge event source and detail-type should the rule match?