DevOps Engineering on AWS Certification Incident and Event Response on AWS 2

Question 1

A DevOps team wants to automatically recover an EC2 instance when its system status check fails without writing any Lambda code. Which approach accomplishes this most simply?

Accepted Answer

CloudWatch Alarm with a built-in EC2 recover action

Answer

CloudWatch Alarm → SNS → Lambda → EC2 reboot API call

Answer

CloudTrail event → EventBridge → SQS → EC2 restart

Answer

Config Rule → SSM Automation → EC2 instance restart

Question 2

Which Systems Manager document type is specifically designed to define multi-step automated remediation workflows that can include conditional branching and parallel steps?

Accepted Answer

Automation document

Answer

Command document

Answer

Policy document

Answer

Session document

Question 3

A Lambda function must automatically fix security group misconfigurations detected by AWS Config. What is the recommended invocation pattern?

Accepted Answer

Configure a Config remediation action pointing to an SSM Automation document that invokes Lambda

Answer

Schedule Lambda every minute using CloudWatch Events to poll Config

Answer

Stream CloudTrail logs to Lambda via Kinesis for every API call

Answer

Manually trigger Lambda via AWS CLI after each Config evaluation cycle

Question 4

A DevOps engineer wants to automatically isolate a compromised EC2 instance detected by Amazon GuardDuty by modifying its security groups via Lambda. Which event source should trigger the Lambda function?

Accepted Answer

Amazon EventBridge rule matching GuardDuty finding event patterns

Answer

CloudWatch Logs subscription filter on VPC Flow Logs

Answer

AWS Config change notification on security group resources

Answer

SNS topic subscribed to CloudTrail management events

Question 5

What is the maximum number of automatic remediation retries AWS Config allows before stopping to prevent infinite remediation loops?

Accepted Answer

5

Answer

3

Answer

10

Answer

25

Question 6

Which AWS service enables DevOps teams to receive CloudWatch alarm notifications and execute SSM runbooks directly from Slack or Microsoft Teams channels?

Accepted Answer

AWS Chatbot

Answer

Amazon Chime SDK

Answer

Amazon Connect

Answer

Amazon WorkDocs

Question 7

A company uses Amazon EventBridge to route events to multiple targets during incident response. Which EventBridge feature allows filtering events so that only specific patterns invoke a target?

Accepted Answer

Event rules with event patterns

Answer

Event archives

Answer

Schema registry

Answer

EventBridge Pipes