Free practice · No sign-up required
20 questions with answer explanations. Choose an answer below to begin.
A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application experiences variable traffic patterns. The operations team wants to scale out based on CPU utilization. Which CloudWatch metric and threshold combination should be used in a simple scaling policy?
Set up and maintain scalable environments
0/20 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
AWS sample integrations for learning how serverless services work together. Useful supporting practice for architecture and developer study.
Try it: Choose a two-service pattern. Sketch its event path, identify the execution role, and explain what should happen if processing fails. Deploy only after reviewing its prerequisites and cleanup steps.
Code is free to read. Deploying AWS resources can incur charges.
Find the certification owner's exam pages and preparation resources before choosing topics to study.
Try it: Open your target certification and its exam guide. Mark each objective as explain, practice, or revisit; map your next missed question to one of those objectives.
Public exam information is free. Training, exams, and lab access may have separate charges.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application experiences variable traffic patterns. The operations team wants to scale out based on CPU utilization. Which CloudWatch metric and threshold combination should be used in a simple scaling policy?
Average CPU Utilization > 70% for 2 consecutive periods of 1 minute
Sum CPU Utilization > 70% for 2 consecutive periods of 5 minutes
Maximum CPU Utilization > 70% for 2 consecutive periods of 1 minute
Average CPU Utilization > 70% for 1 period of 5 minutes
Correct answer
Average CPU Utilization > 70% for 2 consecutive periods of 1 minute
Simple scaling policies evaluate the specified CloudWatch metric. For CPU-based scaling, using the average over a period provides a stable measure. A threshold of 70% over two consecutive 1-minute periods reduces false positives from short spikes. Sum would be incorrect as CPU utilization is already a percentage; using Max might trigger on transient spikes.
A DevOps engineer needs to grant an IAM user in Account A access to an S3 bucket in Account B. Which policy configuration will achieve this?
Attach only a bucket policy in Account B allowing access to the user's ARN.
Attach a bucket policy in Account B allowing access to the user's ARN, and attach an IAM user policy in Account A allowing S3 actions on the bucket.
Attach only an IAM user policy in Account A allowing S3 actions on the bucket.
Attach a bucket ACL in Account B granting access to the user's canonical ID, and an IAM policy in Account A allowing S3 actions.
Correct answer
Attach a bucket policy in Account B allowing access to the user's ARN, and attach an IAM user policy in Account A allowing S3 actions on the bucket.
Cross-account S3 access requires both a bucket policy in the resource account that grants access to the user (or role) from the other account, and an IAM policy in the user's account that permits the S3 actions. Without the IAM policy, the user has no permissions to attempt the action. Bucket ACLs are deprecated for granting cross-account access. The bucket policy alone is insufficient because the user must also have explicit allow in their own account.
A company uses AWS CloudFormation to deploy resources. They have a template that defines an EC2 instance and an Elastic IP address. The Elastic IP must be associated with the EC2 instance before the next resource that depends on the association is created. What should be added to the template to ensure this order?
Use a DependsOn attribute on the EC2 instance to wait for the Elastic IP.
Use a DependsOn attribute on the Elastic IP association to wait for the EC2 instance.
Use a DependsOn attribute on the next resource to wait for the Elastic IP association.
Use a DependsOn attribute on the Elastic IP to wait for the EC2 instance.
Correct answer
Use a DependsOn attribute on the next resource to wait for the Elastic IP association.
CloudFormation uses DependsOn to specify resource creation order. The next resource that needs the association should declare a dependency on the Elastic IP association resource (which itself depends on the instance). This ensures the association is complete before proceeding. The EC2 instance does not need to depend on the Elastic IP; the association depends on the instance. The Elastic IP resource itself does not depend on the instance.
An EC2 instance in a private subnet needs to access the internet to download patches. Which configuration will allow this without a public IP?
Add an internet gateway to the VPC and update the private subnet's route table to point 0.0.0.0/0 to the internet gateway.
Add a VPC endpoint for S3 and attach it to the private subnet.
Assign an Elastic IP to the instance and add a default route to the internet gateway.
Add a NAT gateway in a public subnet and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.
Correct answer
Add a NAT gateway in a public subnet and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.
Instances in a private subnet without a public IP cannot directly access the internet via an internet gateway. A NAT gateway in a public subnet provides outbound internet access while preventing inbound connections. Adding a route in the private subnet's route table to the NAT gateway enables this. An internet gateway alone would not work without a public IP. A VPC endpoint for S3 only provides access to S3, not general internet. Assigning an Elastic IP to the instance would make it public, which is not desired.
A company is using AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails because the new instances launched by the Auto Scaling group are not registered with the target group. What should be done to ensure new instances are automatically registered?
Configure the Auto Scaling group to attach to the target group.
Configure the CodeDeploy deployment group to include the target group.
Configure the launch template to register the instance with the target group on boot.
Configure the Application Load Balancer to automatically register any instance in the VPC.
Correct answer
Configure the Auto Scaling group to attach to the target group.
Auto Scaling groups can be configured to automatically register new instances with a target group by specifying the target group in the Auto Scaling group configuration. This ensures that as instances launch, they are immediately registered. CodeDeploy does not handle registration; it only deploys to instances. The launch template does not register instances; that is a function of the Auto Scaling group. The ALB does not automatically register instances; it relies on target groups that are updated by the Auto Scaling group.
A DevOps engineer needs to capture all API calls made to a specific S3 bucket for compliance purposes. The logs must be stored in CloudWatch Logs for real-time analysis. Which configuration should be used?
Enable CloudTrail management events for the S3 bucket and send events to CloudWatch Logs.
Enable CloudTrail data events for the S3 bucket and send events to CloudWatch Logs.
Enable S3 server access logs and stream them to CloudWatch Logs using Kinesis.
Create an S3 event notification for all object operations and send to CloudWatch Logs.
Correct answer
Enable CloudTrail data events for the S3 bucket and send events to CloudWatch Logs.
CloudTrail data events track object-level operations on an S3 bucket (e.g., GetObject, PutObject). These can be configured to be sent to CloudWatch Logs for real-time analysis. Management events track bucket-level operations (e.g., CreateBucket) but not object operations. S3 server access logs provide similar information but are not sent directly to CloudWatch Logs; they are delivered to another S3 bucket. S3 event notifications can trigger Lambda or other services but do not natively send to CloudWatch Logs.
A company runs a stateful web application on EC2 instances behind an Application Load Balancer (ALB). During deployment, the DevOps engineer wants to ensure that in-flight requests are completed before instances are terminated. What should be configured?
Enable sticky sessions on the ALB.
Set the Auto Scaling group's health check grace period to a high value.
Enable connection draining on the target group and set a sufficient timeout.
Use a lifecycle hook to delay termination until all connections drain.
Correct answer
Enable connection draining on the target group and set a sufficient timeout.
Connection draining (also called deregistration delay) on the target group allows the ALB to stop sending new requests to an instance that is about to be deregistered, while completing existing requests within the specified timeout. This ensures in-flight requests are not interrupted. Sticky sessions alone do not handle graceful termination. Health check grace period delays the start of health checks but does not drain connections. Lifecycle hooks can be used to delay termination but require custom logic to drain connections; connection draining is the built-in solution for ALB.
An operations team needs to centrally manage and automate patching of EC2 instances across multiple AWS accounts and regions. Which AWS service should be used?
AWS Config rules to enforce patch compliance.
Amazon Inspector to scan for vulnerabilities and apply patches.
AWS OpsWorks for Chef Automate to run patch recipes.
AWS Systems Manager Patch Manager with multi-account management via AWS Organizations.
Correct answer
AWS Systems Manager Patch Manager with multi-account management via AWS Organizations.
AWS Systems Manager Patch Manager allows you to automate patching across instances. When integrated with AWS Organizations, you can manage patches across multiple accounts and regions from a central administrator account. AWS Config can assess compliance but does not apply patches. Amazon Inspector identifies vulnerabilities but does not patch. OpsWorks provides configuration management but Patch Manager is the dedicated service for patching at scale.
A company has a production RDS MySQL database with a read replica. The primary instance fails unexpectedly. What is the fastest way to restore database write operations?
Promote the read replica to a standalone instance.
Create a new RDS instance from the latest snapshot.
Modify the read replica to be multi-AZ.
Reboot the primary instance from the AWS Management Console.
Correct answer
Promote the read replica to a standalone instance.
Promoting a read replica makes it a standalone DB instance that accepts writes. This is typically the fastest recovery because the replica already has recent data from replication. Creating a new instance from a snapshot would take longer due to storage restoration and data loss from the time of the snapshot. Making the replica multi-AZ does not promote it. Rebooting the primary would not resolve the failure if it is unrecoverable.
A DevOps engineer is designing a VPC with multiple subnets. The engineering team needs a subnet where EC2 instances can be accessed directly from the internet over SSH. Which VPC configuration is required?
A private subnet with a route table that has a default route (0.0.0.0/0) to a NAT gateway.
A public subnet with a route table that has a default route (0.0.0.0/0) to an internet gateway, and instances have public IPs.
A public subnet with a route table that has a default route (0.0.0.0/0) to a NAT gateway.
A private subnet with a route table that has a default route (0.0.0.0/0) to an internet gateway.
Correct answer
A public subnet with a route table that has a default route (0.0.0.0/0) to an internet gateway, and instances have public IPs.
A public subnet is defined as one that has a route to an internet gateway. For instances to be reachable from the internet, they must have a public IP (either assigned automatically or via an Elastic IP). The route table must direct 0.0.0.0/0 to the internet gateway. A NAT gateway is used for outbound internet only. Instances in a private subnet cannot be directly accessed from the internet.
A company wants to use AWS CloudTrail to monitor access to an S3 bucket. They need to know who accessed a specific object and when. What type of event should they enable?
Management events for the S3 bucket
Insights events for the S3 bucket
Data events for the S3 bucket
Configuration recorder for the S3 bucket
Correct answer
Data events for the S3 bucket
CloudTrail data events capture object-level API operations such as GetObject, PutObject, and DeleteObject. These events include details like the user, time, and source IP. Management events cover bucket-level operations (e.g., CreateBucket) but not object access. Insights events identify unusual activity but do not track individual access. AWS Config records configuration changes, not API access.
An Auto Scaling group uses a lifecycle hook to perform custom actions before an instance is terminated. After the action is complete, what must the Auto Scaling group do to proceed with termination?
Wait for the lifecycle hook timeout to expire.
Manually terminate the instance from the EC2 console.
Delete the lifecycle hook from the Auto Scaling group.
Call the complete-lifecycle-action API with the lifecycle hook token.
Correct answer
Call the complete-lifecycle-action API with the lifecycle hook token.
Lifecycle hooks put instances in a wait state. To proceed, you must call complete-lifecycle-action with the lifecycle hook token and the desired result (ABANDON or CONTINUE). Waiting for the timeout will result in the default action (specified when the hook was created), which is usually to terminate, but this is not under your control. Manual termination would bypass the hook. Deleting the hook does not complete the current action.
A company runs a production workload on EC2 instances in an Auto Scaling group. To ensure high availability, the instances are distributed across multiple Availability Zones. The workload is stateless. What is the most cost-effective way to store session data that can be accessed by any instance?
Store session data in Amazon ElastiCache for Redis.
Store session data in an EC2 instance store.
Store session data in Amazon EFS.
Store session data in an S3 bucket with versioning enabled.
Correct answer
Store session data in Amazon ElastiCache for Redis.
For stateless applications, session data should be stored externally. ElastiCache for Redis provides low-latency, in-memory storage that can be accessed from any instance. It is cost-effective compared to EFS for this use case because it is faster and does not require file system overhead. Instance store is ephemeral and lost on termination. S3 has higher latency and is not ideal for frequent read/write session data. EFS is file-level storage and may be overkill for session data.
A DevOps engineer is troubleshooting an issue where an EC2 instance behind a Network Load Balancer (NLB) is not receiving traffic. The instance passes health checks. What could be the problem?
The NLB is configured in a different subnet than the instance.
The security group for the instance does not allow traffic from the NLB
The route table for the subnet does not include a route to the NLB.
The instance is in a different Availability Zone than the NLB.
Correct answer
The security group for the instance does not allow traffic from the NLB
Network Load Balancers do not have associated security groups; therefore, the instance's security group must allow traffic from the NLB (typically by allowing the VPC CIDR or the NLB's private IP addresses). The NLB and instance can be in different subnets (within the same VPC) but that is not an issue. Route tables do not need specific routes to the NLB; the NLB forwards traffic using internal IPs. The NLB cross-zone load balancing allows instances in different AZs to receive traffic.
A company needs to back up an RDS database to meet compliance requirements that dictate backups must be stored in a different AWS region. Which backup strategy should be used?
Enable automated backups with cross-region copy.
Use RDS read replicas in the other region.
Take manual snapshots and copy them to the other region using AWS Backup.
Create an EventBridge rule to trigger Lambda that copies backups to the other region.
Correct answer
Take manual snapshots and copy them to the other region using AWS Backup.
Automated backups cannot be directly copied across regions; only manual snapshots can be copied. AWS Backup can be configured to copy snapshots to another region after they are taken. This provides a managed solution. Read replicas are for read scaling, not backups. EventBridge and Lambda could work but are more complex and less reliable than AWS Backup's managed cross-region copy.
A company is using AWS Key Management Service (KMS) to encrypt EBS volumes. They want to automatically rotate the KMS key every year. Which action should they take?
Manually create a new key and update all resources to use it.
Use an AWS managed key, which rotates automatically.
Enable automatic key rotation for the AWS managed key.
Enable automatic key rotation for the customer managed key.
Correct answer
Enable automatic key rotation for the customer managed key.
Customer managed KMS keys can be configured for automatic annual rotation. AWS managed keys (like aws/ebs) rotate automatically every year, but you cannot manage them yourself. Since the company wants to control the key and ensure rotation, enabling automatic rotation on a customer managed key is appropriate. Manual rotation would be error-prone. The question implies they want to manage the key, so using an AWS managed key might not meet their governance needs.
A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline must deploy to an EC2 instance fleet. The deployment must be performed in-place with minimal downtime. Which deployment strategy should be used?
Rolling deployment with a fixed number of instances at a time.
Blue/green deployment with a new Auto Scaling group.
Canary deployment with a Lambda function.
All-at-once deployment to all instances simultaneously.
Correct answer
Rolling deployment with a fixed number of instances at a time.
Rolling deployment updates a batch of instances at a time, keeping the rest available. This minimizes downtime while allowing in-place updates. Blue/green is not in-place; it creates a new environment. Canary is typically used for Lambda or weighted routing. All-at-once causes downtime as all instances are updated simultaneously.
An EC2 instance running Linux has high memory usage. The operations team wants to be alerted when memory utilization exceeds 90%. How can they achieve this?
Create a CloudWatch alarm based on the standard EC2 metric 'MemoryUtilization'.
Install the CloudWatch agent and configure a custom metric for memory utilization with an alarm.
Use AWS Systems Manager to run a script that checks memory and publishes to CloudWatch.
Configure an EventBridge rule to monitor EC2 memory metrics.
Correct answer
Install the CloudWatch agent and configure a custom metric for memory utilization with an alarm.
Standard EC2 metrics do not include memory utilization; memory is a custom metric. The CloudWatch agent must be installed on the instance to collect and publish memory metrics. An alarm can then be created on that custom metric. Systems Manager can be used to install the agent, but the alarm itself is on CloudWatch. EventBridge does not have memory metrics by default.
A company has a legacy application that runs on a single EC2 instance. The company wants to improve reliability without significant re-architecture. Which action will provide the highest availability?
Create a second instance in a different Availability Zone and use Amazon Route 53 weighted routing.
Attach the instance to an Application Load Balancer and create a target group with the instance.
Place the instance in an Auto Scaling group with a minimum size of 1 and a launch template that replicates the instance.
Create an AMI from the instance and store it in multiple regions.
Correct answer
Place the instance in an Auto Scaling group with a minimum size of 1 and a launch template that replicates the instance.
Using an Auto Scaling group with a minimum of 1 ensures that if the instance fails, a new one is automatically launched. The launch template replicates the configuration. This provides automatic recovery without re-architecture. A second instance with weighted routing requires application changes to handle state and data. An ALB alone does not provide recovery; it only distributes traffic. Creating AMIs is a backup strategy, not a high availability solution.
A DevOps engineer needs to enforce that all S3 buckets in the account have versioning enabled. Which AWS service can be used to automatically remediate noncompliant buckets?
AWS CloudTrail to detect violations and trigger a Lambda function.
AWS Trusted Advisor to check for versioning and send alerts.
AWS Service Catalog to enforce versioning on all new buckets.
AWS Config with an auto-remediation rule using AWS Systems Manager Automation.
Correct answer
AWS Config with an auto-remediation rule using AWS Systems Manager Automation.
AWS Config rules can evaluate S3 buckets for versioning compliance. With remediation actions, you can use Systems Manager Automation to enable versioning automatically. CloudTrail logs API calls but does not enforce. Trusted Advisor provides checks but only alerts; it does not remediate. Service Catalog controls what users can create but does not enforce on existing buckets.
Recall the answer before opening each card.
Average CPU Utilization > 70% for 2 consecutive 1-minute periods. This avoids false spikes.
Bucket policy in target account granting access to user ARN, plus IAM user policy in source account allowing S3 actions on bucket.
Add DependsOn attribute on dependent resource to wait for the prerequisite resource (e.g., Elastic IP association).
Attach NAT gateway in public subnet, update private subnet route table to send 0.0.0.0/0 to the NAT gateway.
Configure the Auto Scaling group to attach to the target group; instances are then automatically registered.
Enable CloudTrail data events for the bucket and send events to CloudWatch Logs.
Enable connection draining on the target group with sufficient timeout.
Use AWS Systems Manager Patch Manager with multi-account management via AWS Organizations.
Promote the read replica to a standalone instance – it already has recent replicated data.
A subnet with a route table entry pointing 0.0.0.0/0 to an internet gateway, and instances have public IPs.
Data events (e.g., GetObject, PutObject).
Call complete-lifecycle-action with the lifecycle hook token and desired result (CONTINUE or ABANDON).
Amazon ElastiCache for Redis – low-latency, in-memory, shared across instances.
Security group of instance must allow traffic from NLB (NLB has no security group).
Take manual snapshots and copy them to the other region using AWS Backup.
Enable automatic key rotation on the customer managed KMS key.
Rolling deployment – updates a batch of instances at a time.
Install CloudWatch agent to publish custom memory metric, create alarm on that metric.
Use Auto Scaling group with min=1 and launch template; instance is automatically replaced on failure.
Use AWS Config rule with auto-remediation via Systems Manager Automation to enable versioning.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This section covers decisions for Auto Scaling groups, load balancing, and stateless application design. Questions require selecting the correct CloudWatch metric (Average CPU over two 1‑minute periods) to avoid false positives, configuring connection draining on an ALB target group to complete in‑flight requests, and placing session data in ElastiCache for Redis to maintain statelessness. Lifecycle hooks and Auto Scaling group target group attachments ensure proper instance registration and graceful termination. Understanding the difference between public and private subnets, and when to use NAT gateways versus internet gateways, is critical for secure outbound access.
This section focuses on cross‑account access, encryption key rotation, and compliance enforcement. A bucket policy in the resource account plus an IAM user policy in the caller account is required for cross‑account S3 access. KMS customer managed keys can enable automatic annual rotation to meet security policies. AWS Config rules with auto‑remediation (via Systems Manager Automation) can enforce S3 bucket versioning or other compliance checks. CloudTrail data events capture object‑level API calls for auditing, while management events are insufficient for tracking object access.
Effective operations rely on proper monitoring and logging setup. CloudTrail data events must be enabled to log S3 object access, and those events can be sent to CloudWatch Logs for real‑time analysis. Standard EC2 metrics do not include memory; the CloudWatch agent must be installed to publish custom memory metrics, then an alarm can be created. RDS read replica promotion is the fastest recovery for a failed primary. For backups, manual snapshots can be copied across regions using AWS Backup for compliance. Understanding these logging and recovery strategies is essential for incident response.
CloudFormation templates use DependsOn to explicitly order resource creation, ensuring dependencies like an Elastic IP association complete before dependent resources. AWS CodePipeline with a rolling deployment strategy minimizes downtime for in‑place EC2 updates. AWS Systems Manager Patch Manager integrates with AWS Organizations to manage patching across accounts. CloudFormation also enables automated resource provisioning. Understanding how to define dependencies and deployment strategies is key for reliable infrastructure automation.
Study workflow
Create a CloudWatch alarm on the Average CPU Utilization metric for the Auto Scaling group, evaluate over 2 consecutive 1‑minute periods at a threshold of 70%. In the scaling policy, set the adjustment type to add a fixed number or percentage of instances. This avoids reacting to short spikes while scaling out when sustained load occurs.
In Account B (bucket owner), attach a bucket policy that grants the IAM user ARN from Account A the desired S3 actions. In Account A, attach an IAM user policy allowing the same S3 actions on the bucket. Both policies are required; the user must have explicit allow in their own account to attempt the action.
Identify the resource that must be created after the Elastic IP association (e.g., a dependent EC2 instance or load balancer). Add a DependsOn attribute to that resource referencing the Elastic IP association resource. CloudFormation will wait for the association to complete before creating the dependent resource.
On the target group attached to your ALB, enable connection draining (deregistration delay). Set the timeout to a value that allows most in‑flight requests to complete (e.g., 300 seconds). This ensures the ALB stops sending new requests to terminating instances while completing existing ones.
Deploy the CloudWatch agent on your EC2 instances using AWS Systems Manager Run Command or a launch template. Configure the agent to collect memory metrics (e.g., mem_used_percent). Then create a CloudWatch alarm on the custom metric to trigger when memory exceeds 90% for a specified period.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Use Average for metrics that already represent a percentage or rate, like CPU Utilization. Sum is appropriate for count metrics (e.g., request count). Average over multiple periods evens out short peaks for more stable scaling decisions.
No. The bucket policy alone allows the user to attempt the action, but the user must also have an IAM policy in their own account that permits the same action. Both policies must allow the operation for access to succeed.
You can promote a read replica to a standalone DB instance using the AWS Console, CLI, or API. This makes the replica accept writes immediately. It is faster than restoring from a snapshot because the replica already has recent replicated data.
Management events log bucket‑level operations like CreateBucket, while data events log object‑level operations like GetObject and PutObject. To track who accessed a specific object, you must enable data events for that bucket.
Not by default. AWS Config evaluates rules and can trigger remediation actions using Systems Manager Automation or Lambda. You must configure a remediation action for the rule to automatically fix noncompliant resources like S3 buckets with versioning disabled.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
