AWS Monitoring, Logging, and Disaster Recovery 2 — Questions and Answers
Question 1: Which AWS service continuously monitors your AWS configurations and evaluates them against desired settings for compliance?
- AWS Inspector
- AWS Config (Correct answer)
- AWS GuardDuty
- AWS Security Hub
Correct answer: AWS Config
AWS Config records configuration changes and evaluates resource configurations against rules to ensure compliance.
Question 2: A solutions architect must ensure that RDS automated backups are retained for 30 days. What is the maximum backup retention period for RDS automated backups?
- 7 days
- 14 days
- 35 days (Correct answer)
- 90 days
Correct answer: 35 days
Amazon RDS automated backups can be retained for a maximum of 35 days.
Question 3: Which CloudWatch metric type must you create custom metrics to monitor (not available by default)?
- EC2 CPU utilization
- EC2 memory utilization (Correct answer)
- EBS read/write ops
- RDS database connections
Correct answer: EC2 memory utilization
EC2 memory utilization is not reported by default; you must install the CloudWatch agent and publish it as a custom metric.
Question 4: Which AWS service provides threat detection by analyzing VPC Flow Logs, CloudTrail, and DNS logs using machine learning?
- AWS Shield
- Amazon Macie
- Amazon GuardDuty (Correct answer)
- AWS WAF
Correct answer: Amazon GuardDuty
Amazon GuardDuty continuously analyzes VPC Flow Logs, CloudTrail events, and DNS logs to detect threats and malicious activity.
Question 5: In the context of disaster recovery, what does RPO (Recovery Point Objective) define?
- The time it takes to restore systems after a failure
- The maximum acceptable amount of data loss measured in time (Correct answer)
- The minimum number of replicas required
- The percentage of availability required per year
Correct answer: The maximum acceptable amount of data loss measured in time
RPO defines how much data loss is acceptable by specifying the maximum age of the data that must be recovered after a disaster.
Question 6: Which AWS service helps you centralize security findings from GuardDuty, Inspector, Macie, and other services into a single dashboard?
- AWS CloudTrail
- AWS Security Hub (Correct answer)
- Amazon Detective
- AWS Artifact
Correct answer: AWS Security Hub
AWS Security Hub aggregates, organizes, and prioritizes security alerts and findings from multiple AWS security services.
AWS Monitoring, Logging, and Disaster Recovery 2
Which AWS service continuously monitors your AWS configurations and evaluates them against desired settings for compliance?