DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 5 — Questions and Answers
Question 1: A DevOps engineer needs to prevent any IAM user in a member account from disabling AWS CloudTrail logging. Which mechanism enforces this across all accounts in an AWS Organization?
- IAM permission boundaries on all users
- An SCP (Service Control Policy) attached at the root or OU level (Correct answer)
- A CloudWatch Events rule that re-enables CloudTrail
- AWS Config auto-remediation with a Lambda function
Correct answer: An SCP (Service Control Policy) attached at the root or OU level
SCPs attached at the root or OU level enforce guardrails that even account root users cannot override, including denying cloudtrail:StopLogging.
Question 2: A CodeBuild project intermittently fails with 'BUILD_GENERAL1_SMALL out of memory' errors during large test suites. What is the MOST appropriate fix?
- Increase the build timeout setting
- Switch to a larger compute type such as BUILD_GENERAL1_MEDIUM or LARGE (Correct answer)
- Enable CodeBuild caching for dependencies
- Add a swap file in the buildspec.yml install phase
Correct answer: Switch to a larger compute type such as BUILD_GENERAL1_MEDIUM or LARGE
CodeBuild compute types have fixed RAM allocations; upgrading to a larger compute type (MEDIUM or LARGE) directly increases available memory for the build environment.
Question 3: Which CloudFormation resource type allows you to run custom provisioning logic during stack create, update, and delete operations using a Lambda function?
- AWS::CloudFormation::Macro
- AWS::CloudFormation::CustomResource (Correct answer)
- AWS::Lambda::EventSourceMapping
- AWS::CloudFormation::StackSet
Correct answer: AWS::CloudFormation::CustomResource
AWS::CloudFormation::CustomResource (or Custom::MyType) invokes a Lambda function during stack lifecycle events for arbitrary custom provisioning logic.
Question 4: A team wants to ensure that every push to the main branch triggers a security scan using Amazon Inspector before allowing a CodePipeline stage to proceed. What is the correct integration pattern?
- Add an Amazon Inspector scan as a CodeBuild build step in the pipeline (Correct answer)
- Use EventBridge to trigger Inspector and poll for results with a Lambda approval action
- Configure Inspector to write scan results to S3 and add a manual approval gate
- Use AWS Security Hub findings as a CodePipeline source stage
Correct answer: Add an Amazon Inspector scan as a CodeBuild build step in the pipeline
Running the Amazon Inspector CLI or API call inside a CodeBuild step integrates scanning into the pipeline and fails the build if critical findings are detected.
Question 5: An Auto Scaling group uses a step scaling policy. The CloudWatch alarm fires when CPU exceeds 70%. What happens if CPU jumps to 95% while a previous scaling activity is still in cooldown?
- The new scaling action is ignored entirely until cooldown expires
- Step scaling overrides the cooldown and adds instances immediately based on the step adjustment for the 95% breach (Correct answer)
- The ASG terminates instances instead of adding them
- A second alarm fires and queues behind the first
Correct answer: Step scaling overrides the cooldown and adds instances immediately based on the step adjustment for the 95% breach
Step scaling policies bypass cooldown periods when a new alarm breach maps to a different (higher) step, allowing aggressive scale-out during rapidly increasing load.
Question 6: A DevOps team manages 500 EC2 instances and needs to run a patching script on all Linux instances in us-east-1 without SSH access. Which Systems Manager capability is MOST appropriate?
- Systems Manager Run Command (Correct answer)
- Systems Manager Session Manager
- Systems Manager State Manager
- Systems Manager Patch Manager baseline
Correct answer: Systems Manager Run Command
Systems Manager Run Command executes scripts or documents on fleets of managed instances without requiring SSH, with output logged to CloudWatch or S3.
Question 7: A company needs to enforce that all new S3 buckets created in any account have server-side encryption enabled. They want automatic remediation, not just detection. Which combination achieves this?
- AWS Config rule + AWS Config auto-remediation with an SSM Automation document (Correct answer)
- AWS CloudTrail + Lambda function polling CreateBucket API events
- S3 Block Public Access at the organization level
- AWS Macie + EventBridge rule
Correct answer: AWS Config rule + AWS Config auto-remediation with an SSM Automation document
An AWS Config managed rule (s3-bucket-server-side-encryption-enabled) with an auto-remediation action using an SSM Automation document enforces encryption automatically on non-compliant buckets.
DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 5
A DevOps engineer needs to prevent any IAM user in a member account from disabling AWS CloudTrail logging.
Which mechanism enforces this across all accounts in an AWS Organization?