DevOps Engineering on AWS Certification Incident and Event Response on AWS 2 — Questions and Answers
Question 1: A DevOps team wants to automatically recover an EC2 instance when its system status check fails without writing any Lambda code. Which approach accomplishes this most simply?
- CloudWatch Alarm → SNS → Lambda → EC2 reboot API call
- CloudTrail event → EventBridge → SQS → EC2 restart
- CloudWatch Alarm with a built-in EC2 recover action (Correct answer)
- Config Rule → SSM Automation → EC2 instance restart
Correct answer: CloudWatch Alarm with a built-in EC2 recover action
CloudWatch Alarms natively support an EC2 recover action that migrates the instance to healthy hardware when system status checks fail, requiring no additional services.
Question 2: Which Systems Manager document type is specifically designed to define multi-step automated remediation workflows that can include conditional branching and parallel steps?
- Command document
- Policy document
- Automation document (Correct answer)
- Session document
Correct answer: Automation document
SSM Automation documents (runbooks) define ordered, conditional, and parallel steps for automated workflows such as patching, remediation, or infrastructure changes.
Question 3: A Lambda function must automatically fix security group misconfigurations detected by AWS Config. What is the recommended invocation pattern?
- Schedule Lambda every minute using CloudWatch Events to poll Config
- Configure a Config remediation action pointing to an SSM Automation document that invokes Lambda (Correct answer)
- Stream CloudTrail logs to Lambda via Kinesis for every API call
- Manually trigger Lambda via AWS CLI after each Config evaluation cycle
Correct answer: Configure a Config remediation action pointing to an SSM Automation document that invokes Lambda
AWS Config remediation actions natively integrate with SSM Automation runbooks, which can invoke Lambda as one of their steps, providing event-driven and auditable remediation.
Question 4: A DevOps engineer wants to automatically isolate a compromised EC2 instance detected by Amazon GuardDuty by modifying its security groups via Lambda. Which event source should trigger the Lambda function?
- CloudWatch Logs subscription filter on VPC Flow Logs
- Amazon EventBridge rule matching GuardDuty finding event patterns (Correct answer)
- AWS Config change notification on security group resources
- SNS topic subscribed to CloudTrail management events
Correct answer: Amazon EventBridge rule matching GuardDuty finding event patterns
GuardDuty publishes findings as events to Amazon EventBridge, where a rule can match specific finding types and invoke Lambda automatically for containment actions.
Question 5: What is the maximum number of automatic remediation retries AWS Config allows before stopping to prevent infinite remediation loops?
- 3
- 5 (Correct answer)
- 10
- 25
Correct answer: 5
AWS Config limits automatic remediation to 5 retries per non-compliant resource to prevent runaway remediation loops that could cause unintended infrastructure changes.
Question 6: Which AWS service enables DevOps teams to receive CloudWatch alarm notifications and execute SSM runbooks directly from Slack or Microsoft Teams channels?
- Amazon Chime SDK
- AWS Chatbot (Correct answer)
- Amazon Connect
- Amazon WorkDocs
Correct answer: AWS Chatbot
AWS Chatbot integrates with Slack and Microsoft Teams to deliver CloudWatch alarm notifications and allows team members to run approved SSM Automation runbooks from within the chat interface.
Question 7: A company uses Amazon EventBridge to route events to multiple targets during incident response. Which EventBridge feature allows filtering events so that only specific patterns invoke a target?
- Event archives
- Schema registry
- Event rules with event patterns (Correct answer)
- EventBridge Pipes
Correct answer: Event rules with event patterns
EventBridge rules include event pattern matching that filters incoming events by source, detail-type, and field values, ensuring only matching events invoke the configured target.
DevOps Engineering on AWS Certification Incident and Event Response on AWS 2
A DevOps team wants to automatically recover an EC2 instance when its system status check fails without writing any Lambda code.
Which approach accomplishes this most simply?