AWS Certified CloudOps Engineer – Associate — Practice Set 1

Question 1

A company's operations team needs to monitor the CPU utilization of all Amazon EC2 instances across multiple AWS accounts and receive an alert when any instance exceeds 85% CPU for more than 5 minutes. Which AWS service and feature combination MOST directly achieves this?

Accepted Answer

Amazon CloudWatch natively collects EC2 CPU utilization metrics. CloudWatch cross-account observability allows a central monitoring account to view metrics from multiple linked accounts. A CloudWatch Alarm with a 5-minute evaluation period and 85% threshold triggers an Amazon SNS notification to the operations team. AWS CloudTrail captures API calls, not performance metrics. AWS Config evaluates resource configurations, not real-time performance metrics. Amazon Inspector assesses vulnerabilities, not CPU performance.

Question 2

A company's application logs are being written to Amazon CloudWatch Logs from multiple Amazon EC2 instances. The security team wants to be alerted whenever a log entry contains the text 'ERROR: Unauthorized' in the application log group. Which solution achieves this with LEAST operational overhead?

Accepted Answer

A CloudWatch Logs metric filter continuously scans log events in real time and increments a custom metric counter when a pattern matches. A CloudWatch Alarm fires when the metric exceeds 0, triggering an SNS notification — this is the native, no-code AWS solution for log-based alerting. Exporting to S3 and querying with Athena introduces up to an hour's delay and requires ongoing query management. A Lambda polling function requires custom code and may miss events between polls. Amazon Detective investigates security incidents using existing findings from GuardDuty and Security Hub, not raw CloudWatch Logs pattern matching.

Question 3

A company's operations team receives an alert that an Amazon EC2 instance's disk space is at 92%. The instance runs an application that writes large temporary files. The team wants to automatically remediate future disk space alerts by triggering a cleanup script on the affected instance without manual intervention. Which solution provides automated remediation with LEAST operational overhead?

Accepted Answer

Chaining a CloudWatch Alarm (on custom disk metric) → Amazon SNS → AWS Lambda → AWS Systems Manager Run Command creates a fully automated event-driven remediation pipeline: when disk usage exceeds the threshold, the cleanup script runs automatically on the affected instance with no human intervention and no agents beyond the SSM Agent (pre-installed on most AMIs). A per-instance cron job requires configuration on every instance and runs regardless of need. EventBridge scheduling runs cleanup for all instances even when not needed, wasting compute. Manual SSH is the highest-overhead option.

Question 4

A company wants a centralized view of operational health across all AWS services and resources in its account, including application performance metrics, infrastructure metrics, log insights, and ServiceLens traces, in a single dashboard. Which AWS service provides this unified operational visibility?

Accepted Answer

Amazon CloudWatch is the unified observability platform for AWS, providing metrics, logs, dashboards, alarms, Container Insights, Lambda Insights, Application Insights, ServiceLens (combining traces and metrics), and Log Insights — all in a single service. AWS CloudTrail tracks API call history for auditing but is not an operations dashboard. AWS Config records resource configuration states and compliance. AWS Systems Manager OpsCenter aggregates operational issues (OpsItems) for remediation but does not provide the full metrics/logs/traces observability stack.

Question 5

A company's Amazon RDS for PostgreSQL instance is experiencing intermittent slow query performance. The database administrator wants to identify the specific SQL queries consuming the most database resources without installing third-party monitoring agents. Which native AWS capability provides query-level performance insights?

Accepted Answer

Amazon RDS Performance Insights is a native RDS feature that provides a database load dashboard showing which SQL queries, wait events, and users are consuming the most resources — enabling immediate identification of slow queries without third-party agents. CloudWatch Enhanced Monitoring provides OS-level metrics (CPU, memory, disk) from inside the DB instance, not query-level data. AWS X-Ray traces application-level requests and can show time spent on RDS calls from the application side, but does not show internal database query details. CloudWatch Logs subscription filters route logs to other services but do not provide structured query performance analysis.

Question 6

A company has deployed AWS Lambda functions that process financial transactions. The operations team wants to track the number of Lambda invocations, errors, throttles, and duration in a central dashboard and be alerted if the error rate exceeds 1% over a 5-minute window. Which combination of AWS services achieves this with LEAST operational overhead?

Accepted Answer

Amazon CloudWatch Lambda Insights automatically collects detailed Lambda metrics (invocations, errors, throttles, duration, cold starts) and publishes them to CloudWatch Metrics. CloudWatch Alarms can evaluate a math expression comparing the Errors metric to Invocations over 5-minute periods, triggering an SNS notification when the ratio exceeds 1%. Exporting to S3 and QuickSight adds significant latency and complexity. AWS X-Ray provides tracing but is not designed for aggregate error rate alerting. CloudTrail tracks API calls (InvokeFunction API), not the function's internal error count.

Question 7

A company's Amazon EC2 Auto Scaling group serves a web application. A health check failure causes an EC2 instance to be terminated. The operations team wants to ensure a replacement instance is automatically launched when this happens. Which Auto Scaling group feature provides this automatic replacement?

Accepted Answer

Amazon EC2 Auto Scaling performs periodic health checks (EC2 status checks or ELB health checks) and automatically terminates unhealthy instances, launching replacement instances to maintain the desired capacity. Scheduled scaling changes capacity on a time-based schedule, not in response to health failures. CloudWatch alarm-based scaling changes capacity based on metric thresholds (e.g., CPU usage), not health check status. EC2 instance recovery restarts a single specific instance on healthy hardware after a system failure, but does not provide Auto Scaling group management.

Question 8

A company runs a production workload on Amazon EC2 instances and must be able to recover specific files that were deleted from an Amazon EBS volume within the past 7 days. The company needs an automated backup solution with LEAST operational overhead. Which solution BEST meets this requirement?

Accepted Answer

AWS Backup provides centralized, policy-driven backup management for Amazon EBS volumes (and other AWS services) with configurable retention periods and no custom code required. A 7-day retention policy meets the requirement automatically. A custom snapshot script requires developing, testing, and maintaining code — higher operational overhead. Amazon DLM also automates EBS snapshots with retention policies and is a valid approach, but AWS Backup provides broader cross-service coverage and centralized auditing. EBS Fast Snapshot Restore improves the speed of restoring from snapshots — it does not create backups.

Question 9

A company's critical application runs on Amazon EC2 instances behind an Application Load Balancer in a single AWS Region. The disaster recovery plan requires the application to fail over to a second AWS Region within 10 minutes if the primary Region becomes unavailable. Which approach MOST cost-effectively achieves this RTO?

Accepted Answer

Amazon Route 53 failover routing with health checks redirects DNS to the warm standby environment in the secondary Region within minutes of detecting a primary Region failure. A warm standby maintains scaled-down but running infrastructure that scales up rapidly on failover — achieving a 10-minute RTO at lower cost than a full active-active setup. Running full-scale environments in both Regions doubles infrastructure cost. Daily AMI snapshots require time to restore instances in the secondary Region, likely exceeding a 10-minute RTO. AWS Elastic Disaster Recovery is excellent for server replication but adds cost and complexity beyond what is needed when the infrastructure blueprint (CloudFormation) is already defined.

Question 10

A company has an Amazon RDS for MySQL database with automated backups enabled and a retention period of 7 days. A developer accidentally ran a DELETE statement without a WHERE clause at 14:30 today, removing all rows from a critical table. The operations team must recover the deleted data with LEAST data loss. Which recovery approach BEST meets this requirement?

Accepted Answer

Amazon RDS point-in-time restore (PITR) uses automated backups and transaction logs to restore the database to any second within the retention period — restoring to 14:29 recovers all data up to one minute before the accidental deletion. Restoring from last night's backup loses approximately 14.5 hours of data. Re-importing from an S3 export loses all data since the last export. Promoting a Read Replica creates an independent instance but the replica already received the DELETE statement from the primary and contains the same deletion.

Question 11

A company wants to test the resiliency of its multi-AZ application by intentionally terminating random Amazon EC2 instances to verify the Auto Scaling group replaces them correctly and the application remains available. The operations team wants to run these experiments in a controlled and repeatable way. Which AWS service MOST directly supports this chaos engineering use case?

Accepted Answer

AWS Fault Injection Service (AWS FIS) is AWS's managed chaos engineering service that allows teams to run controlled fault injection experiments — including terminating EC2 instances, introducing latency, and stopping processes — on AWS resources using predefined experiment templates with stop conditions to maintain safety. Amazon CloudWatch Synthetics creates canary scripts that monitor application endpoints from the outside but does not inject faults. AWS Trusted Advisor provides best practice recommendations. Amazon Inspector assesses vulnerability in compute workloads.

Question 12

A company needs to deploy a standardized Amazon VPC network configuration — including subnets, route tables, internet gateways, and NAT Gateways — consistently across 20 AWS accounts. The team wants to avoid manual console clicks and ensure all accounts have identical configurations. Which approach achieves this with LEAST operational overhead?

Accepted Answer

AWS CloudFormation StackSets allows a single CloudFormation template to be deployed simultaneously to multiple AWS accounts and Regions from a central administrator account, ensuring identical, repeatable, and version-controlled VPC configurations with minimal manual effort. Manual console configuration is error-prone and does not scale to 20 accounts. Amazon VPC sharing allows sharing subnets within an AWS Organization but does not deploy identical VPC configurations to separate accounts. AWS Config is a configuration compliance and assessment service, not an infrastructure provisioning tool.

Question 13

A company uses AWS Systems Manager to manage its Amazon EC2 fleet. The operations team needs to run a patch compliance scan on all Linux instances in the production environment and apply approved patches during a maintenance window on Sundays at 2 AM, with a limit of 20% of instances being patched simultaneously. Which AWS Systems Manager capability MOST directly meets this requirement?

Accepted Answer

AWS Systems Manager Patch Manager defines patch baselines (which patches are approved) and integrates with Maintenance Windows to schedule patching at specific times (Sunday 2 AM) with configurable concurrency (20% of targets) to limit impact on production availability. Run Command can execute scripts on EC2 instances but requires custom script development for patch management and does not natively manage patch baselines or concurrency during maintenance windows. State Manager maintains desired state configurations continuously, not on a specific one-time schedule. Session Manager provides interactive shell access but is not a patching service.

Question 14

A company's operations team manages 500 Amazon EC2 instances and needs to run an ad hoc Python script on all instances tagged Environment=Production simultaneously to collect custom metrics. The instances do not have public IP addresses. Which AWS service enables running this script without SSH access or bastion hosts?

Accepted Answer

AWS Systems Manager Run Command allows executing scripts on managed EC2 instances using the pre-installed SSM Agent, targeting instances by tags (Environment=Production), with no SSH or public IP required. The SSM Agent communicates with Systems Manager via AWS endpoints. AWS OpsWorks uses Chef/Puppet for configuration management but requires cookbook development and ongoing OpsWorks layer management. EC2 User Data runs only at instance launch, not on-demand for existing running instances. Lambda running scripts remotely would require network access to each instance and cannot execute native OS commands without SSH.

Question 15

A company's infrastructure team maintains AWS CloudFormation templates for its production environment. During a stack update, a change to an Auto Scaling group launch template causes all existing EC2 instances to be replaced simultaneously, briefly interrupting service. The team wants to prevent disruptive simultaneous replacements during future stack updates. Which CloudFormation feature controls the update behavior of the Auto Scaling group?

Accepted Answer

The CloudFormation UpdatePolicy attribute with the AutoScalingRollingUpdate configuration controls how instances in an Auto Scaling group are replaced during a stack update — specifying maximum batch size (e.g., 1 at a time) and minimum instances in service to prevent simultaneous replacement and maintain availability. DependsOn controls resource creation ordering, not update behavior. DeletionPolicy Retain preserves the Auto Scaling group on stack deletion, not during updates. CreationPolicy with WaitCondition waits for signals during initial resource creation, not subsequent update operations.

Question 16

A company wants to enforce that every Amazon EC2 instance launched in any account within its AWS Organization must use an approved Amazon Machine Image (AMI) from an internal catalog. If an unapproved AMI is detected, the instance should be automatically terminated. Which AWS solution implements this guardrail with LEAST custom code?

Accepted Answer

The AWS Config managed rule approved-amis-by-id continuously evaluates EC2 instances against an approved AMI list. When a non-compliant instance is detected, Config auto-remediation triggers an AWS Systems Manager Automation document (such as AWS-TerminateEC2Instance) to terminate it — requiring no custom code. A Lambda function with EventBridge achieves the same but requires writing and maintaining code. SCPs on ec2:RunInstances would be the most proactive control but the IAM condition key aws:RequestedRegion must be used carefully, and managing a full AMI ID allowlist in SCPs is complex and brittle. Quarterly Config reporting is a detective-only control without automatic remediation.

Question 17

A company uses AWS CloudFormation to manage its infrastructure. After a failed stack update, the CloudFormation stack is in the UPDATE_ROLLBACK_FAILED state and cannot be deleted or updated. The operations team must return the stack to a stable state. Which action resolves this situation?

Accepted Answer

The ContinueUpdateRollback API call is the AWS-supported method for resolving the UPDATE_ROLLBACK_FAILED state. It retries the rollback for the resources that failed. If a specific resource continues to fail, the team can specify it in the ResourcesToSkip parameter to bypass it and complete the rollback to the last stable state. Deleting the stack removes all stack-managed resources unnecessarily. Manually correcting resources via the console may help if done before retrying the rollback, but alone will not unstick the stack. Drift detection identifies configuration differences but does not resolve the UPDATE_ROLLBACK_FAILED state.

Question 18

A company must demonstrate compliance with its requirement that no Amazon S3 buckets in its AWS account are publicly accessible. The operations team needs a continuous, automated check that alerts them whenever a public bucket is created. Which AWS service MOST directly provides this continuous compliance monitoring?

Accepted Answer

The AWS Config managed rule s3-bucket-public-read-prohibited continuously evaluates S3 bucket ACLs and bucket policies, flagging any bucket that allows public read access as non-compliant and generating a notification via Amazon SNS or EventBridge. Amazon Macie discovers and classifies sensitive data in S3 — it does not check bucket public access configuration. AWS CloudTrail records PutBucketAcl API calls but requires a custom EventBridge rule or CloudWatch Logs metric filter to evaluate whether the resulting ACL is public. Amazon GuardDuty detects threats and malicious activity, not bucket configuration compliance.

Question 19

A company's security team wants to ensure that all Amazon EC2 instances in its production environment have the SSM Agent installed and are managed by AWS Systems Manager. Any instance not registered with Systems Manager within 30 minutes of launch should trigger an alert. Which approach provides this detection?

Accepted Answer

The AWS Config managed rule ec2-instance-managed-by-systems-manager checks that all EC2 instances are registered as managed nodes in AWS Systems Manager. A non-compliant result triggers a Config notification via Amazon SNS or EventBridge, enabling alerting within minutes of launch. A daily Lambda check introduces up to 24 hours of detection delay — far beyond the 30-minute requirement. Manual verification is the highest operational overhead and most error-prone. Amazon Inspector assesses vulnerability of running instances but does not check SSM Agent presence or Systems Manager registration status.

Question 20

A company's security team receives a finding from Amazon GuardDuty indicating that an Amazon EC2 instance in the production VPC is communicating with a known malicious IP address. The operations team must isolate the instance immediately to stop the attack while preserving forensic evidence. Which sequence of actions MOST effectively achieves this?

Accepted Answer

Replacing the instance's security groups with a quarantine security group (no inbound/outbound rules) isolates the instance at the network layer without destroying evidence. Taking an EBS snapshot immediately preserves disk state and memory artifacts for forensic investigation. Terminating the instance destroys evidence. Rebooting interrupts the session but the instance returns to the same compromised state. Revoking IAM permissions prevents AWS API abuse but does not stop network-level malicious communication to external IPs.

Question 21

A company must ensure that all IAM users in its AWS account have multi-factor authentication (MFA) enabled. The security team wants a continuous automated check and wants to be notified within minutes if a new IAM user is created without MFA. Which solution achieves this?

Accepted Answer

The AWS Config managed rule iam-user-mfa-enabled continuously evaluates all IAM users and flags any user without MFA as non-compliant. Config triggers near-real-time notifications via Amazon SNS or EventBridge when a user is found non-compliant — including newly created users. A weekly credential report review introduces up to 7 days of delay. Amazon GuardDuty detects security threats and anomalous behavior, not IAM configuration compliance. AWS Security Hub aggregates findings but relies on Config or other services to generate the IAM MFA check — and daily dashboard review is reactive, not automated notification within minutes.

Question 22

A company has deployed an Application Load Balancer in front of its Amazon EC2 web servers. The operations team notices that some user requests are being routed to different instances between requests, breaking session-based authentication. The team wants requests from the same user to always be routed to the same instance. Which Application Load Balancer feature resolves this issue?

Accepted Answer

Application Load Balancer sticky sessions (using duration-based or application-based cookies) bind a user's session to a specific target instance, ensuring subsequent requests from that user are routed to the same instance. Network Load Balancers operate at Layer 4 and also support persistence by client IP, but switching the load balancer type is unnecessary when the ALB already provides sticky sessions. Cross-zone load balancing distributes requests evenly across instances in all AZs — it does not bind sessions to specific instances. Weighted target groups route proportional traffic to different target groups for A/B testing, not for session affinity.

Question 23

A company runs a web application on Amazon EC2 instances in a private subnet. The application must be accessible from the internet via HTTPS on port 443. The operations team needs to configure the Amazon VPC components correctly. Which combination of components is required to allow inbound HTTPS traffic to reach the EC2 instances?

Accepted Answer

To allow internet users to reach EC2 instances in a private subnet: an internet gateway enables public internet connectivity to the VPC, a public subnet with a route to the IGW hosts the Application Load Balancer, the ALB receives HTTPS traffic on port 443 from the internet and forwards it to the private subnet EC2 instances, with security groups configured appropriately. A NAT Gateway enables outbound internet access from private subnets — not inbound access from the internet. Private subnets cannot have direct routes to an internet gateway by definition. AWS Direct Connect connects on-premises to AWS, not internet users to private subnets.

Question 24

A company operates multiple Amazon VPCs across three AWS Regions and needs all VPCs to communicate with each other and with an on-premises data center through a single managed hub. As the number of VPCs grows, managing individual VPC peering connections is becoming unmanageable. Which AWS service simplifies this network architecture?

Accepted Answer

AWS Transit Gateway acts as a cloud router hub that connects multiple VPCs and on-premises networks in a star topology, eliminating the O(n²) full-mesh peering complexity. Inter-Region peering between Transit Gateways extends this connectivity across multiple AWS Regions. VPC peering creates point-to-point connections that do not scale — n VPCs require n(n-1)/2 peering connections with no transitive routing. AWS PrivateLink creates private service endpoints between VPCs but does not provide general network routing between all VPCs. Direct Connect with per-VPC virtual private gateways requires a separate VGW attachment per VPC and still requires peering between VPCs.

Question 25

A company's web application is experiencing intermittent connectivity issues. Amazon VPC Flow Logs show that TCP connections to the application's Amazon EC2 instances on port 8080 are being REJECTED. The instances are in a private subnet behind an Application Load Balancer. The team has verified that the ALB security group allows inbound traffic on port 443. Which is the MOST likely cause of the REJECT entries?

Accepted Answer

VPC Flow Log REJECT entries indicate that a security group or network ACL is denying the traffic. Since the flow logs show traffic reaching the EC2 instances' ENIs on port 8080 and being rejected, the most likely cause is that the EC2 instance security group does not have an inbound rule allowing port 8080 from the ALB's security group. Security group rules are stateful — if no rule matches, traffic is implicitly denied (REJECT). A missing internet gateway route would prevent traffic from reaching the ALB, not the instances. ALB HTTPS termination is an ALB configuration issue and would not cause flow log REJECTs on the instance. CloudFront would show connection errors at the edge, not flow log REJECTs in the VPC.

SOA-C03 — AWS Certified CloudOps Engineer - Associate