DevOps Engineering on AWS Certification Incident and Event Response on AWS 2

Question 1

A DevOps team wants to automatically recover an EC2 instance when its system status check fails without writing any Lambda code. Which approach accomplishes this most simply?

Accepted Answer

CloudWatch Alarm with a built-in EC2 recover action

Answer

CloudWatch Alarms natively support an EC2 recover action that migrates the instance to healthy hardware when system status checks fail, requiring no additional services.

Question 2

Which Systems Manager document type is specifically designed to define multi-step automated remediation workflows that can include conditional branching and parallel steps?

Accepted Answer

Automation document

Answer

SSM Automation documents (runbooks) define ordered, conditional, and parallel steps for automated workflows such as patching, remediation, or infrastructure changes.

Question 3

A Lambda function must automatically fix security group misconfigurations detected by AWS Config. What is the recommended invocation pattern?

Accepted Answer

Configure a Config remediation action pointing to an SSM Automation document that invokes Lambda

Answer

AWS Config remediation actions natively integrate with SSM Automation runbooks, which can invoke Lambda as one of their steps, providing event-driven and auditable remediation.

Question 4

A DevOps engineer wants to automatically isolate a compromised EC2 instance detected by Amazon GuardDuty by modifying its security groups via Lambda. Which event source should trigger the Lambda function?

Accepted Answer

Amazon EventBridge rule matching GuardDuty finding event patterns

Answer

GuardDuty publishes findings as events to Amazon EventBridge, where a rule can match specific finding types and invoke Lambda automatically for containment actions.

Question 5

What is the maximum number of automatic remediation retries AWS Config allows before stopping to prevent infinite remediation loops?

Accepted Answer

5

Answer

AWS Config limits automatic remediation to 5 retries per non-compliant resource to prevent runaway remediation loops that could cause unintended infrastructure changes.

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification Incident and Event Response on AWS 2