AWS Monitoring, Logging, and Disaster Recovery 5 — Questions and Answers
Question 1: Which AWS service can aggregate security findings from GuardDuty, Inspector, and Macie into a single pane of glass for centralized monitoring?
- AWS Config
- Amazon Detective
- AWS Security Hub (Correct answer)
- Amazon EventBridge
Correct answer: AWS Security Hub
AWS Security Hub aggregates, normalizes, and prioritizes findings from multiple AWS security services into a unified dashboard.
Question 2: A company uses Route 53 health checks with DNS failover for DR. The primary region becomes unhealthy. What happens to in-flight requests that reached the primary ALB before the DNS TTL expires?
- Route 53 immediately drops all in-flight connections to the primary
- In-flight requests continue on the primary; only new DNS resolutions after TTL expiry route to the secondary (Correct answer)
- Route 53 sends a TCP RST to redirect in-flight connections to the secondary
- The primary ALB forwards in-flight requests to the secondary region automatically
Correct answer: In-flight requests continue on the primary; only new DNS resolutions after TTL expiry route to the secondary
DNS failover only affects new name resolutions after the TTL expires; clients with cached DNS entries continue routing to the primary until their TTL lapses.
Question 3: An architect wants to automatically remediate non-compliant AWS Config rules (e.g., S3 buckets with public access enabled). Which feature enables this?
- AWS Config conformance packs
- AWS Config remediation actions using SSM Automation documents (Correct answer)
- AWS Trusted Advisor checks with auto-remediation
- CloudWatch Events with a Lambda remediation function triggered by Config
Correct answer: AWS Config remediation actions using SSM Automation documents
AWS Config supports automatic remediation by associating SSM Automation documents directly with config rules, which execute when a resource becomes non-compliant.
Question 4: Which S3 feature, when enabled on a source bucket, can help achieve an RPO near zero for object-level DR in a secondary region?
- S3 Versioning
- S3 Cross-Region Replication with Replication Time Control (RTC) (Correct answer)
- S3 Transfer Acceleration
- S3 Intelligent-Tiering cross-region
Correct answer: S3 Cross-Region Replication with Replication Time Control (RTC)
S3 RTC provides a predictable replication SLA (99.99% of objects replicated within 15 minutes) with replication metrics, minimizing RPO for cross-region DR.
Question 5: A CloudWatch alarm is in INSUFFICIENT_DATA state after being created. What does this state indicate?
- The metric threshold has been breached
- CloudWatch does not have enough data points yet to determine the alarm state (Correct answer)
- The metric does not exist in CloudWatch
- The alarm has been disabled by an IAM policy
Correct answer: CloudWatch does not have enough data points yet to determine the alarm state
INSUFFICIENT_DATA means CloudWatch has not yet collected enough data points to evaluate whether the threshold is breached, which is normal immediately after alarm creation.
Question 6: An organization wants to capture all API calls made to their AWS account across all regions and store them in a single S3 bucket. Which CloudTrail configuration achieves this?
- Create a regional trail in each region pointing to separate S3 buckets, then use S3 replication
- Create a multi-region trail and specify a single S3 bucket as the destination (Correct answer)
- Enable CloudTrail in the us-east-1 region only, as it captures global service events
- Use AWS Config to record API calls and export to S3
Correct answer: Create a multi-region trail and specify a single S3 bucket as the destination
A multi-region CloudTrail trail automatically captures API activity from all regions and delivers logs to a single designated S3 bucket.
Question 7: A company wants to test their DR plan without impacting production. Which AWS feature allows you to restore an RDS snapshot to a separate environment for DR validation?
- RDS Blue/Green Deployments
- RDS Snapshot Restore to a new DB instance (Correct answer)
- RDS Multi-AZ failover test
- RDS Performance Insights replay
Correct answer: RDS Snapshot Restore to a new DB instance
Restoring an RDS snapshot to a new, isolated DB instance lets teams validate recovery procedures and data integrity without touching the production database.
AWS Monitoring, Logging, and Disaster Recovery 5
Which AWS service can aggregate security findings from GuardDuty, Inspector, and Macie into a single pane of glass for centralized monitoring?