AWS CloudOps — 65-Question Study Guide

Scale on a metric that represents pending work. AWS guidance recommends backlog per instance: approximate visible queue messages divided by the number of InService workers. Target tracking can then add capacity as work per worker rises.

A private subnet has no direct route to an internet gateway. To guarantee no internet egress, also ensure its route table has no NAT/egress path, and control alternate egress paths such as proxies or Transit Gateway routes. The other choices do not reliably block outbound traffic.

Trusted Advisor provides security checks, including root-account security posture checks depending on support-plan/features. Independently verify MFA, root access keys, contact details, and recovery controls in the account's security credentials settings. Artifact provides compliance reports, not a live root-user configuration check.

Separate the tiers and use managed multi-AZ database failover plus a horizontally redundant application tier. RDS Multi-AZ provides standby failover; an ALB and Auto Scaling group keep healthy application capacity across AZs. Option B's stopped EC2 copy is not a reliable HA database standby.

First enable S3 server access logging (or use CloudTrail S3 data events when stronger audit detail is required), storing logs separately. Then query the generated log data with Athena for 403/AccessDenied patterns. S3 Storage Class Analysis/Analytics does not provide an access-attempt audit trail.

AWS Config's access-keys-rotated rule can evaluate a configured key-age threshold; a remediation action can run a controlled Automation document to disable noncompliant keys. Treat disabling keys as a potentially disruptive action: notify the owner and confirm the key is not a production dependency before remediation.

Patch Manager can scan and install supported patches on managed nodes under a controlled maintenance window. Plan for package-specific restarts/reboots and roll out gradually. Inspector helps identify vulnerabilities, but does not itself patch the OS.

The Viewer Protocol Policy controls viewer-side HTTP/HTTPS. A custom hostname also requires an alternate domain name and an ACM certificate in the US East (N. Virginia) Region for CloudFront. Origin Shield, WAF, and allowing HTTP do not satisfy the TLS requirement by themselves.

Scaling the instance class vertically adds CPU and memory. Multi-AZ is an HA mechanism, not a general read/write scaling mechanism. For read-heavy workloads, read replicas or caching may help, but they do not transparently distribute normal writes across multiple RDS MySQL writers.

Place an internet-facing ALB in public subnets across AZs. Place target EC2 instances and database resources in private subnets and tightly scope security-group rules from ALB to web tier and web tier to database tier. Ensure private instances have only the egress paths they need.

For eligible EBS-backed instances, a stop/start generally moves the instance to a new host. Plan the downtime, ensure data is on persistent EBS rather than instance store, and verify the replacement host's availability and startup automation.

Both permission and explicit intent are required for a governance-mode bypass. With AWS CLI, use the relevant --bypass-governance-retention option for the supported delete operation. Compliance mode cannot be bypassed before expiry, and extending retention does the opposite of what's requested.

Ensure SSM Agent is installed, current, and running, and attach an instance profile with the standard managed-instance permissions (or a least-privilege equivalent). Also verify endpoint connectivity, tags/state where relevant, and the agent's logs. Inventory is not the mechanism that registers an instance for Session Manager.

IAM Identity Center permission sets define the permission policies and session settings that become IAM roles in assigned accounts. Assign a user/group to one or more AWS accounts and permission sets. SCPs are organization guardrails, not identity assignments.

AWS WAF can use an IP set, rate-based rule, or request-matching conditions to block or challenge abusive requests at an ALB or CloudFront. CloudTrail audits API activity; Inspector finds software vulnerabilities; Shield focuses on DDoS protection.

Failure to access the KMS key for an encrypted EBS volume can prevent launch and lead to termination. Inspect the instance state transition reason, system log, CloudTrail, and KMS permissions/key state before assuming capacity or quota. Those other causes typically surface as launch errors or failed requests.

Scheduled scaling changes desired capacity based on a known schedule and avoids waiting for reactive metrics to cross thresholds. Combine with dynamic scaling for unexpected traffic and choose capacity using measured load/testing.

An S3 gateway endpoint routes S3 traffic over the AWS network without NAT or public IPs. A NAT gateway provides outbound IPv4 connectivity to general public services for private-subnet instances. Use endpoint policies, bucket policies, route tables, and security controls as appropriate.

AWS Config's encrypted-volumes managed rule can assess EBS encryption and, when configured with the key ID parameter, checks whether the specified KMS key is used. SCPs can prevent some API actions but are not a retrospective compliance report. A simple encrypted filter does not prove the correct key is in use.

AWS KMS manages keys used to encrypt data at rest; AWS Certificate Manager issues TLS certificates that applications/endpoints can use to encrypt data in transit. If the requirement specifically calls for an encrypted site-to-site network tunnel, AWS Site-to-Site VPN is also a valid network-layer control—but it does not replace application TLS where end-to-end encryption is required.

Secrets Manager is designed for secret storage, retrieval, versioning, and automatic rotation workflows for supported RDS engines. The rotation mechanism updates the secret and the database credentials; Lambda functions fetch the current value at runtime. Ensure the rotation function can network to the DB and that consumers tolerate rotation safely.

An Elastic IP is a static public IPv4 address that can be associated with an instance; Route 53 A records map the domain name to the IPv4 address. A CNAME target is a DNS name, not an IP. An ALB adds cost and provides a DNS name rather than a static single IP.

Security groups must permit inbound TCP port 22 from the client's actual public source IP/CIDR (unless using VPN/bastion/SSM). A timeout commonly indicates dropped network traffic; IAM roles do not ordinarily govern standard SSH ingress, and key problems usually produce authentication errors rather than a network timeout.

AWS WAF can match strings in specified request components, including headers. Configure the header name and server-ID string, then use rule metrics/logs or labels to count requests. 'ID match' is not a standard AWS WAF rule-statement type, so among the listed choices the usable condition is String match.

For a publicly hosted S3 website, the bucket policy should grant s3:GetObject on object ARNs, not broad bucket administration or upload permissions. Block Public Access settings must permit the intended design. AWS currently recommends using CloudFront with Origin Access Control for a more secure production static site where possible.

Apply consistent user-defined tags to resources, then activate the relevant tag keys in Billing and Cost Management for the organization's consolidated billing view. Tags must be applied to supported resources and activated before they appear in cost reports; activation is not retroactive to all past data.

Follow the supported Storage Gateway appliance maintenance procedure: stop gateway operations cleanly, reboot/maintain the host VM, then ensure the VM and gateway are running and healthy. Avoid abrupt hypervisor actions while active writes or cache synchronization are in progress.

Use the ApplicationELB namespace and the appropriate load-balancer/target-group dimensions for HealthyHostCount; alarm when the count is 0. EC2 status-check metrics don't indicate whether the ALB health checks consider targets healthy. The screenshot's intended first choice is the zero-host condition.

Vault Lock lets you lock a policy that enforces compliance controls such as minimum retention periods for archive vaults. For modern S3 Glacier storage classes in S3 buckets, use S3 Object Lock retention and legal holds as appropriate. Choose the product's actual storage model carefully because S3 Glacier Vault Lock and S3 Object Lock are different mechanisms.

Use resource-tag condition keys in the IAM policy to constrain the target instances, then attach the identity-based policy to the relevant users/groups/roles. An instance profile is for permissions the workload itself uses, not a substitute for authorizing administrators to manage instances.

The Cost and Usage Report provides detailed line-item billing and usage data, including discount allocation information suitable for analysis by account, resource, and usage type when configured with the required detail. Use Cost Explorer for interactive high-level analysis and CUR/Athena for deeper reconciliation.

Create or edit a dashboard, select a widget type, then browse the namespace and metric dimensions that the agent publishes. Logs metric filters are for deriving metrics from log events, not for displaying metrics already emitted by the agent.

S3 scales to high request rates, but a sharp change in workload can temporarily produce 503 Slow Down while S3 optimizes its internal scaling. Use exponential backoff, retries, and well-distributed object prefixes/traffic patterns. A persistent permissions problem typically gives 403, not a throughput-related 503.

VPC Flow Logs record traffic metadata at the relevant ENI/subnet/VPC; query source and destination addresses, bytes, ports, and actions to attribute flows to private instance IPs. CloudTrail records API calls, not each data packet. Cost reports may identify NAT gateway processing charges but not necessarily the top private source instances without network telemetry.

An SCP can set the maximum permissions available to principals in member accounts, including member-account root users, so a deny for Redshift actions at the organization root/OU blocks the service across those accounts. Attach narrowly scoped deny statements and retain the normal allow policy behavior for other services.

AWS Config managed rules evaluate supported resource configurations as they change or on their configured trigger. Configure restricted-common-ports for port 80 and use Config notifications/remediation if needed. Hourly custom scans are not near real time and Inspector is not the primary security-group configuration compliance engine for this use case.

For an S3 gateway endpoint, associate the endpoint with the route tables used by the private subnets. AWS adds routes for the S3 managed prefix list. Also check endpoint policy, bucket policy, DNS, and IAM permissions, but route-table association is the most likely missing piece in this scenario.

Adding an Aurora Replica increases reader capacity and lets read traffic be distributed across replicas or the reader endpoint. If the actual bottleneck is writer CPU/memory, a larger instance class or query tuning may be needed instead; replicas do not fix every writer-bound workload.

CloudWatch compares metric datapoints with configured thresholds over the evaluation period. If breaching datapoints continue, ALARM is expected. Check the metric, statistic, threshold, missing-data treatment, period, and evaluation periods before assuming a service fault.

AWS KMS automatic rotation is not supported for keys with imported key material. Create a new key with the new imported material and move the application alias after a controlled migration. Existing ciphertext encrypted under the old key still needs the old key material/key for decryption, unless data is re-encrypted.

Transfer Acceleration routes uploads/downloads through AWS edge locations and the AWS backbone to the bucket's Region. Test performance with the intended client locations and object sizes. It does not replicate the bucket or change encryption algorithms.

AWS operates data centers, physical networking, and the virtualization layer/hypervisor. Customers manage guest OS patching, security groups, application configuration, data, and most resource-level monitoring. Managed-service responsibility can differ from EC2's model.

Use a CreationPolicy with ResourceSignal and run cfn-signal after the software is installed and healthy. This lets each instance report success/failure and avoids CloudFormation timing out without signals. Check that the instance can reach CloudFormation endpoints and that the signal command reports the intended exit status.

The organization's management account invites existing standalone AWS accounts using their account ID or email. An authorized administrator of each invited account must accept the invitation. Plan billing and governance changes because joining changes consolidated billing/policy relationships.

AWS Config evaluates the security-group configuration; configure remediation using an SSM Automation runbook to revoke the dangerous ingress permission. EventBridge+Lambda can also be engineered, but Config + automatic remediation is the direct, auditable compliance pattern among the options. Deploy regionally and aggregate compliance if needed.

A stack in ROLLBACK_COMPLETE after a failed create generally cannot be updated. Delete it and create a new stack with the corrected template. Preserve diagnostic events/logs before deleting if you need root-cause evidence.

An EC2 instance profile delivers temporary role credentials through instance metadata. Grant only the necessary S3 actions on the target bucket/prefix and optionally combine with a bucket policy. Credentials rotate automatically with the role session.

CloudWatch Agent can collect OS-level memory metrics from EC2 and on-premises/hybrid servers that are configured as managed hosts or agent targets. Publish into a consistent namespace and use the same dashboards/alarms to compare trends.

Network ACLs are stateless; they must allow both the request port and the return traffic's ephemeral port range. Security groups are stateful. If the REJECT record is the target's response toward the client ephemeral port, inspect NACL egress/return-path rules for that range.

Use the ElastiCache cluster modification API/console to change CacheNodeType where supported. Plan the impact: Memcached data is cached and generally can be repopulated, but changing node type can trigger replacement/reconfiguration and application cache misses. Redis replication-group procedures are not interchangeable with Memcached cluster operations.

A NAT gateway in a public subnet can use an Elastic IP and provide a single egress address for instances in private subnets. The third party can whitelist that EIP. Route tables for private subnets must direct default-route internet traffic through the NAT gateway.

S3 now automatically applies SSE-S3 to all new object uploads. For a desired SSE-KMS or DSSE-KMS default, configure bucket default encryption. If policy requires a specific customer-managed key or forbids callers from overriding the encryption choice, use a correctly scoped bucket policy with the relevant condition. A Principal element does not belong in an IAM identity policy.

VPC and related networking resources have service quotas. If the account has reached the VPC quota, another stack's VPC creation fails until resources are removed or the quota increased. Confirm the failed resource and CloudFormation event before concluding that quota is the cause.

Cost Explorer's rightsizing recommendations analyze EC2 usage and identify downsizing/termination opportunities. Current AWS guidance also points to Cost Optimization Hub for broader optimization opportunities. Validate memory, network, disk, seasonality, and performance needs before applying recommendations.

CloudFormation supports replacing the Auto Scaling group while retaining the old group until the new one succeeds, when configured with AutoScalingReplacingUpdate/creation signals. For a normal in-place fleet rollout, a rolling update or Auto Scaling instance refresh may be safer and more efficient. Keep the ALB/DNS name stable and validate new instances before shifting traffic.

Network ACLs are stateless and support explicit DENY entries, so the IP can be blocked at subnet boundaries for inbound and outbound traffic. Security groups are stateful allow-only filters and cannot create explicit deny rules. Ensure rule numbers precede broader allow rules and apply the ACL to every relevant subnet.

If the origin returns different content by User-Agent, configure the cache/origin request policy so the needed header reaches the origin and responses are cached separately where required. Modern best practice is to vary only on necessary headers, cookies, and query strings to avoid fragmenting the cache unnecessarily.

Systems Manager maintenance windows support rate controls, including maximum concurrency as a count or percentage. Limit concurrency (for example, 10%), set an error threshold, and make sure load balancers and Auto Scaling capacity can absorb instances temporarily out of service. The exact percentage depends on fleet size and redundancy.

Auto Scaling adds/removes EC2 application capacity as demand changes. CloudFront caches static objects at edge locations close to users, reducing round trips to S3 and improving latency. Route 53 latency routing is most relevant when multiple regional endpoints are available; it does not cache static content itself.

SSM Agent must reach Systems Manager service endpoints. In private subnets without a NAT route, configure the required VPC interface endpoints, endpoint security groups, DNS, and routes. Validate connectivity to the SSM, SSM Messages, and EC2 Messages endpoints appropriate for the Region/agent features.

Inter-Region VPC peering provides private routing between VPCs without traversing the public internet, and AWS documents AES-256 encryption at the virtual network layer for inter-Region traffic. Update both route tables and security controls. If policy requires application-controlled encryption or complex transitive routing, add TLS or evaluate Transit Gateway/other architectures.

CloudTrail helps reveal the API request and error code for RunInstances; Trusted Advisor service-limit checks can highlight limit problems. Also inspect Auto Scaling activity history, EC2 launch-template configuration, subnet IP capacity, instance-type capacity, and AWS Health when evidence points to a service event.

Route 53 supports alias records targeting an ELB load balancer in another account. Obtain the load balancer DNS name and canonical hosted-zone ID; the console may not list cross-account targets, so enter the target details manually. Alias records work at the zone apex and avoid an extra CNAME hop.

Write a bucket policy that grants/permits the intended same-account principals and excludes or denies cross-account principals, taking other policy mechanisms into account. S3 Object Ownership settings can disable ACLs and simplify authorization. Pre-signed URLs can grant temporary access to other parties, the opposite of the goal.

Network ACLs are stateless, so the return ICMP traffic must be permitted by the outbound NACL rules. Security groups are stateful and automatically allow reply traffic for permitted inbound ICMP, subject to other network controls. The Flow Logs' ACCEPT/REJECT direction points to outbound NACL policy as the issue.