Incident and Event Response Flashcards
7 cards from real AWS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident and Event Response flashcards as text
An EventBridge rule must trigger a Systems Manager Automation document when an EC2 instance changes to 'stopped' state. Which EventBridge event source and detail-type should the rule match?
Answer: source: aws.ec2, detail-type: EC2 Instance State-change Notification
EC2 state changes publish events with source 'aws.ec2' and detail-type 'EC2 Instance State-change Notification' to EventBridge by default.
During a major incident, a runbook step requires approval from a senior engineer before proceeding with a destructive database rollback. Which Systems Manager Automation feature supports this gate?
Answer: aws:approve action with SNS notification
The aws:approve action pauses automation execution and sends an SNS notification to approvers, waiting for an approval or rejection response.
A Lambda function is producing intermittent errors that are hard to reproduce. Which combination of tools best helps correlate errors with the exact request payload?
Answer: AWS X-Ray active tracing + CloudWatch Logs Insights
X-Ray traces capture the full request context while CloudWatch Logs Insights lets you query log data alongside trace IDs to correlate errors with payloads.
A company wants its incident response runbooks to automatically roll back a CodeDeploy deployment when error rate exceeds 5%. Which deployment configuration setting enables this without custom Lambda functions?
Answer: Automatic rollback on deployment failure with CloudWatch alarm trigger
CodeDeploy supports automatic rollback when a linked CloudWatch alarm enters ALARM state, requiring no custom Lambda or pipeline logic.
Which AWS Health event type should a DevOps team subscribe to in order to receive early warning before scheduled EC2 maintenance that could restart instances?
Answer: AWS_EC2_INSTANCE_REBOOT_MAINTENANCE_SCHEDULED
AWS_EC2_INSTANCE_REBOOT_MAINTENANCE_SCHEDULED is the specific Health event type that provides advance notice of AWS-initiated maintenance reboots.
An incident retrospective reveals that a critical CloudWatch alarm was silenced because someone set the alarm state to INSUFFICIENT_DATA manually during testing and never reverted it. Which preventive control addresses this?
Answer: SCP or IAM policy denying cloudwatch:SetAlarmState except for break-glass roles
Restricting cloudwatch:SetAlarmState via IAM/SCP ensures that alarm states can only be modified by authorized break-glass roles, not regular operators.
A DevOps team wants to ensure that every incident automatically creates a timeline of events using CloudTrail and CloudWatch Logs data. Which Incident Manager feature provides this integrated event timeline?
Answer: Incident Manager timeline with CloudTrail and CloudWatch Logs integration
AWS Systems Manager Incident Manager's incident timeline automatically aggregates events from CloudTrail and CloudWatch Logs into a chronological view.