Incident and Event Response on AWS Flashcards

Which AWS service is primarily used to create alarms based on CloudWatch metrics and trigger automated responses when thresholds are breached?

Answer: Amazon CloudWatch Alarms

CloudWatch Alarms monitor metric values against defined thresholds and trigger actions such as SNS notifications, Auto Scaling policies, or EC2 recovery when breached.

A DevOps team wants to automatically invoke a Lambda function whenever an EC2 instance enters an unhealthy state. Which service should capture this state-change event and route it to Lambda?

Answer: Amazon EventBridge

Amazon EventBridge captures EC2 state-change events and can route them to Lambda functions, enabling automated remediation without manual intervention.

Which AWS Systems Manager feature defines multi-step automated workflows (runbooks) used to respond to operational incidents?

Answer: Automation

Systems Manager Automation allows you to author and execute runbooks as automation documents, each containing ordered steps for incident response or operational tasks.

What is the primary purpose of AWS Systems Manager OpsCenter in an incident response workflow?

Answer: Aggregate and resolve operational issues as OpsItems

OpsCenter aggregates operational issues called OpsItems and provides a centralized interface for engineers to view, investigate, and remediate incidents.

A DevOps engineer needs non-compliant resources detected by AWS Config to be fixed automatically. Which Config feature enables this without manual intervention?

Answer: AWS Config remediation actions

AWS Config remediation actions allow you to associate an SSM Automation document with a Config rule so that non-compliant resources are automatically corrected.

Which AWS service provides a comprehensive audit trail of API calls and management console actions used to investigate security incidents?

Answer: AWS CloudTrail

AWS CloudTrail records every API call and user activity across your AWS account, creating an immutable audit trail that is essential for forensic incident investigation.

An application is experiencing increased latency and a CloudWatch alarm is triggered. Which AWS service should be configured as the alarm action to send SMS and email notifications to the on-call team?

Answer: Amazon SNS

Amazon SNS is the standard notification target for CloudWatch Alarms, supporting SMS, email, HTTP, and Lambda endpoints to alert subscribers when an alarm state is reached.