DevOps Engineering on AWS Certification Incident and Event Response on AWS 1 — Questions and Answers
Question 1: Which AWS service is primarily used to create alarms based on CloudWatch metrics and trigger automated responses when thresholds are breached?
- Amazon SNS
- AWS CloudTrail
- Amazon CloudWatch Alarms (Correct answer)
- AWS Config
Correct answer: Amazon CloudWatch Alarms
CloudWatch Alarms monitor metric values against defined thresholds and trigger actions such as SNS notifications, Auto Scaling policies, or EC2 recovery when breached.
Question 2: A DevOps team wants to automatically invoke a Lambda function whenever an EC2 instance enters an unhealthy state. Which service should capture this state-change event and route it to Lambda?
- Amazon CloudWatch Logs
- Amazon EventBridge (Correct answer)
- AWS CloudTrail
- AWS X-Ray
Correct answer: Amazon EventBridge
Amazon EventBridge captures EC2 state-change events and can route them to Lambda functions, enabling automated remediation without manual intervention.
Question 3: Which AWS Systems Manager feature defines multi-step automated workflows (runbooks) used to respond to operational incidents?
- OpsCenter
- Parameter Store
- Run Command
- Automation (Correct answer)
Correct answer: Automation
Systems Manager Automation allows you to author and execute runbooks as automation documents, each containing ordered steps for incident response or operational tasks.
Question 4: What is the primary purpose of AWS Systems Manager OpsCenter in an incident response workflow?
- Store encrypted operational parameters and secrets
- Aggregate and resolve operational issues as OpsItems (Correct answer)
- Run shell commands across a fleet of EC2 instances
- Monitor distributed application traces and latency
Correct answer: Aggregate and resolve operational issues as OpsItems
OpsCenter aggregates operational issues called OpsItems and provides a centralized interface for engineers to view, investigate, and remediate incidents.
Question 5: A DevOps engineer needs non-compliant resources detected by AWS Config to be fixed automatically. Which Config feature enables this without manual intervention?
- AWS Config aggregators
- AWS Config remediation actions (Correct answer)
- AWS CloudFormation drift detection
- AWS Systems Manager Patch Manager
Correct answer: AWS Config remediation actions
AWS Config remediation actions allow you to associate an SSM Automation document with a Config rule so that non-compliant resources are automatically corrected.
Question 6: Which AWS service provides a comprehensive audit trail of API calls and management console actions used to investigate security incidents?
- Amazon CloudWatch
- AWS X-Ray
- AWS CloudTrail (Correct answer)
- Amazon Inspector
Correct answer: AWS CloudTrail
AWS CloudTrail records every API call and user activity across your AWS account, creating an immutable audit trail that is essential for forensic incident investigation.
Question 7: An application is experiencing increased latency and a CloudWatch alarm is triggered. Which AWS service should be configured as the alarm action to send SMS and email notifications to the on-call team?
- Amazon SES
- Amazon SNS (Correct answer)
- Amazon SQS
- AWS Chatbot
Correct answer: Amazon SNS
Amazon SNS is the standard notification target for CloudWatch Alarms, supporting SMS, email, HTTP, and Lambda endpoints to alert subscribers when an alarm state is reached.
DevOps Engineering on AWS Certification Incident and Event Response on AWS 1
Which AWS service is primarily used to create alarms based on CloudWatch metrics and trigger automated responses when thresholds are breached?