Monitoring, Logging, and Remediation practice questions

Answer: A) Edit the rule's remediation action, select the Automatic remediation option, and specify the number of retry attempts and the retry time period in seconds

AWS Config remediation actions can be manual or automatic. To fix noncompliant resources without an operator, select Automatic remediation on the rule and optionally set retry attempts and a time window.

• ACorrect. Every Config remediation action can be set to manual or automatic. When you choose automatic remediation, Config runs the associated Automation runbook against noncompliant resources. You can also set retries and a time window (for example, 5 retries in 300 seconds) for cases where remediation fails.
• BIncorrect. The trigger type and frequency control only how often Config evaluates resource compliance. They don't change whether the remediation action is manual or automatic, so remediation would still need an operator to start it.
• CIncorrect. A maintenance window runs tasks on a schedule against its registered targets regardless of Config compliance results. It isn't linked to the rule's noncompliance findings, and it would run the fix against compliant resources too. Config's built-in automatic remediation setting handles this directly.
• DIncorrect. Configuration recording controls which resource changes Config captures and evaluates. It doesn't change how remediation actions are invoked. Remediation remains manual until automatic remediation is selected on the rule.

Answer: A) Deploy the AWS Config managed rule s3-default-encryption-kms in the account

AWS Config managed rules evaluate resource configurations continuously and flag noncompliant resources. The s3-default-encryption-kms rule checks specifically that S3 buckets are encrypted with AWS KMS keys.

• ACorrect. This managed AWS Config rule checks whether S3 buckets are encrypted with AWS KMS and marks a bucket NON_COMPLIANT if it is not encrypted with a KMS key. It runs when configurations change, and it can be limited to specific key ARNs.
• BIncorrect. CloudTrail data events record object-level API activity for auditing. They do not compare bucket configurations with a policy or produce a compliance status.
• CIncorrect. Trusted Advisor's S3 check looks at bucket permissions such as open access. It does not evaluate whether default encryption uses AWS KMS keys against a custom policy.
• DIncorrect. IAM Access Analyzer finds buckets that are shared publicly or with external principals. It does not evaluate encryption settings.

Answer: A) The AWS Config delivery channel, which specifies the S3 bucket and an optional SNS topic

The AWS Config delivery channel is required. It names the S3 bucket that receives configuration snapshots and history files, plus an optional SNS topic for notifications. The configuration recorder only controls what gets recorded.

• ACorrect. AWS Config sends configuration history files, snapshots and notifications through the delivery channel. The delivery channel names the S3 bucket and an optional SNS topic. You can have one per Region per account, and AWS Config needs it to work. The console setup wizard creates one for you, but it still has to exist.
• BIncorrect. The configuration recorder controls which resource types are recorded and how often. It does not set the S3 bucket or SNS topic. The delivery channel does that.
• CIncorrect. An aggregator gathers configuration and compliance data from several accounts or Regions into an aggregator account so you can view it in one place. It does not set the S3 bucket where snapshots and history files are delivered.
• DIncorrect. A CloudTrail trail delivers API activity logs to the trail's own bucket. AWS Config delivers its files only to the bucket named in its delivery channel, which you configure separately.

Answer: A) A subscription filter on the log group with the Lambda function set as the destination

To push log events to Lambda continuously, use a CloudWatch Logs subscription filter. Metric filters, S3 exports and Logs Insights queries only produce metrics or work on stored data after the fact.

• ACorrect. A subscription filter gives a real-time feed of matching log events to a destination such as Lambda, Kinesis Data Streams or Firehose. Events usually arrive in less than three minutes after ingestion.
• BIncorrect. A metric filter turns matching log events into numeric CloudWatch metric data. It doesn't forward the log events themselves, so the function would never see the event content.
• CIncorrect. Exporting to S3 is a batch operation for archiving or later analysis. It doesn't stream each event as it's ingested, and it adds a lot of delay and operational work.
• DIncorrect. Logs Insights queries already-stored log data after the fact. The function would have to poll, and events wouldn't be pushed to it as they arrive.

Answer: C) Systems Manager Compliance, which reports patch and association compliance status for each node

By default, Systems Manager Compliance shows Patch Manager patch compliance and State Manager association compliance for managed nodes, so the administrator can drill into nodes that are not compliant.

• AIncorrect. Inventory collects metadata such as installed applications and updates. It does not check nodes against a patch baseline or report whether State Manager associations are compliant.
• BIncorrect. Run Command history shows whether individual commands succeeded or failed. It does not give a summary of patch compliance against a baseline or association compliance across the fleet.
• CCorrect. By default, Systems Manager Compliance shows current patching compliance data from Patch Manager and association compliance data from State Manager. You can drill down into individual nodes that are not compliant.
• DIncorrect. Trusted Advisor checks accounts against general best practices. It does not report each node's patch compliance against a Patch Manager baseline or the status of State Manager associations.

Answer: A) Create an Amazon EventBridge rule that matches the alarm's state change to ALARM and targets a Systems Manager Automation runbook that restarts the service

For automatic remediation, have EventBridge match the CloudWatch alarm's state change and start a Systems Manager Automation runbook that performs the known fix. SNS notifications and OpsItems still need a person to act.

• ACorrect. CloudWatch sends alarm state change events to EventBridge. An EventBridge rule can use a Systems Manager Automation runbook as its target, so the known fix runs automatically every time the alarm enters ALARM.
• BIncorrect. An SNS email only tells someone about the failure. An engineer still has to log in and restart the service, so the fix is not automatic.
• CIncorrect. Creating an OpsItem records the issue so that an operator can investigate and work on it. The alarm action itself does not restart the service.
• DIncorrect. CloudTrail records AWS API activity. It does not see a hung process inside the instance, and a metric filter only produces a metric. Neither one restarts the service.

Answer: A) Supply the tag key for each deployment through the conformance pack input parameters

Conformance pack templates can declare parameters, and ConformancePackInputParameters supplies their values at deployment. This lets one template be deployed with different rule settings, such as a required tag key.

• ACorrect. Conformance pack templates can declare parameters, and ConformancePackInputParameters supplies values for them at deployment time. The same template can therefore be deployed with different rule inputs without editing it.
• BIncorrect. A remediation action fixes resources the rule finds noncompliant. It does not change which tag key the rule evaluates.
• CIncorrect. An aggregator collects configuration and compliance data from multiple accounts and Regions. It does not set the inputs a rule uses when it evaluates resources.
• DIncorrect. Recording frequency controls how often configuration changes are recorded. It has no effect on which tag key a rule checks.

Answer: A) An on-failure destination for the function's asynchronous invocation, pointing to an Amazon SQS queue

EventBridge invokes Lambda asynchronously, so errors raised inside the function after Lambda's retries are handled by Lambda. To keep those events, use an on-failure destination (or a dead-letter queue) on the function. The EventBridge target DLQ only catches events that EventBridge failed to deliver.

• ACorrect. EventBridge invokes Lambda asynchronously. When an event fails all of Lambda's processing attempts, an on-failure destination receives an invocation record that contains the request payload and response details such as the function error.
• BIncorrect. An EventBridge target DLQ only stores events that EventBridge could not deliver to the target, for example because of missing permissions, throttling, or a target that no longer exists. Here delivery succeeded and the function failed afterward, so the target DLQ would not receive the event.
• CIncorrect. The EventBridge retry policy only controls retries of delivery to the target. Delivery already succeeds, so more retries would not keep events that fail inside the function.
• DIncorrect. CloudTrail data events record that an Invoke API call happened. They do not store the failed event payload or the function's error response for later reprocessing or investigation.

Answer: A) The AWS Health API, called through the AWS SDK or AWS CLI

The AWS Health API, used directly or through the SDKs and CLI, gives programmatic access to account-specific Health events. It requires a qualifying AWS Support plan. EventBridge rules are the event-driven alternative.

• ACorrect. The AWS Health API is a REST service that applications can call directly or through the AWS SDKs and AWS CLI to retrieve events and affected entities. It requires a Business Support+, Enterprise Support, or Unified Operations plan (or a legacy Business, Enterprise On-Ramp, or Enterprise plan). Accounts without one get a SubscriptionRequiredException error.
• BIncorrect. CloudTrail records API activity made in the account. It is not where AWS Health publishes its service and scheduled-change events, so it cannot list the account's Health events.
• CIncorrect. Trusted Advisor checks resources against best practices for cost, security, fault tolerance, and limits. It does not return AWS Health events.
• DIncorrect. AWS Health does not automatically write events to a CloudWatch Logs log group. For an event-driven alternative, you can create an Amazon EventBridge rule that matches AWS Health events and sends them to a target such as Lambda or SNS.

Answer: A) Create a composite alarm with an AND rule over the two alarms, and remove the actions from the two underlying alarms

Composite alarms combine the states of existing alarms with rules such as AND, so a single notification goes out only when both conditions are true. Moving actions to the composite alarm stops the separate, noisy alerts.

• ACorrect. A composite alarm sets its state from the states of other alarms using Boolean rules. ALARM(cpu) AND ALARM(latency) goes into ALARM only when both are in ALARM. AWS documents setting actions only on the composite alarm, with no actions on the underlying alarms, as a way to reduce alarm noise.
• BIncorrect. Here the anomaly detection alarm compares one metric against a band of expected values. With the latency alarm deleted, nothing checks whether latency is also high, so the both-at-once requirement isn't met.
• CIncorrect. M-out-of-N settings make each alarm less sensitive to short spikes, but each alarm still checks only its own condition and notifies on its own. They don't link the two alarms with AND logic.
• DIncorrect. A dashboard alarm status widget only displays alarm states. A dashboard has no alarm state of its own, can't evaluate a combined condition, and can't send notifications.