I85PREP
⌘ K
AWS SysOps Administrator study materials
AWS SysOps Administrator study resources

AWS SysOps Administrator practice questions

One question at a time. Build your AWS SysOps Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Monitoring, Logging, and Remediation

A CloudWatch alarm on an EC2 instance's CPUUtilization metric has entered the INSUFFICIENT_DATA state. What does this state mean?

  1. The alarm was disabled automatically after repeated breaches.
  2. The monitored resource was deleted from the account.
  3. The metric has breached the threshold but no action has run yet.
  4. Not enough data points exist to evaluate the threshold. Correct answer.

Explanation

INSUFFICIENT_DATA means CloudWatch has fewer usable data points than the alarm's evaluation configuration requires. It is common for newly created alarms, sparse custom metrics, or metrics that stopped being published, and it does not by itself indicate that a threshold was breached.

Question 2Monitoring, Logging, and Remediation

A team creates a new CloudWatch Logs log group and sets no retention policy. How long are the log events kept?

  1. 90 days, after which they are archived to Amazon S3.
  2. Indefinitely, until a retention setting is applied. Correct answer.
  3. 7 days, the default retention period for all new log groups.
  4. 30 days, after which they are deleted automatically.

Explanation

CloudWatch Logs log groups have no default retention, so events are stored indefinitely and you pay for stored data until a retention period is configured. Retention is set per log group and can be changed at any time.

Question 3Monitoring, Logging, and Remediation

Which AWS service records API calls made in an account so an administrator can determine who terminated an EC2 instance?

  1. VPC Flow Logs
  2. AWS CloudTrail Correct answer.
  3. Amazon CloudWatch metrics
  4. AWS Config

Explanation

CloudTrail captures API activity, including the identity, source IP, and time of each call, which is what is needed to attribute a TerminateInstances call. CloudWatch is for metrics and alarms, while Config tracks resource configuration state over time.

Question 4Monitoring, Logging, and Remediation

A CloudWatch alarm must email an on-call distribution list when a threshold is breached. What should be configured?

  1. An AWS Lambda function that is subscribed to the application log group.
  2. An Auto Scaling lifecycle hook attached to the alarm's target group.
  3. A CloudWatch Logs metric filter that publishes directly to email.
  4. An SNS topic with email subscribers set as the alarm action. Correct answer.

Explanation

CloudWatch alarm actions invoke Amazon SNS topics, and an email subscription on the topic delivers the notification to the distribution list. Metric filters create metrics from logs; they do not send email themselves.

Question 5Monitoring, Logging, and Remediation

An administrator needs one console page that shows metrics from EC2 instances in three different Regions. Which CloudWatch feature should be used?

  1. A CloudTrail organization trail
  2. A CloudWatch Logs Insights query
  3. A cross-Region CloudWatch dashboard Correct answer.
  4. An AWS Config aggregator

Explanation

CloudWatch dashboards can include widgets that reference metrics from multiple Regions, giving a single consolidated view. Logs Insights, Config aggregators, and CloudTrail serve entirely different purposes.

Question 6Monitoring, Logging, and Remediation

Memory and disk utilization metrics are not published for EC2 instances by default. What is required to collect them?

  1. Enable enhanced networking for the instance.
  2. Attach an IAM role with the CloudWatchFullAccess policy.
  3. Enable detailed monitoring on the instance.
  4. Install and configure the CloudWatch agent on the instance. Correct answer.

Explanation

The hypervisor-level metrics EC2 publishes natively cover CPU, network, and disk I/O, but not guest OS memory or filesystem usage. The CloudWatch agent runs inside the instance and publishes those guest-level metrics.

Question 7Monitoring, Logging, and Remediation

Which AWS tool reports events and scheduled changes that affect only the resources in a specific account, such as upcoming maintenance on an instance?

  1. AWS Health Dashboard (Personal Health Dashboard) Correct answer.
  2. AWS Compute Optimizer recommendations
  3. AWS Trusted Advisor core checks for cost optimization
  4. AWS Service Catalog portfolio constraints

Explanation

The AWS Health Dashboard surfaces account-specific events, including scheduled maintenance and service issues affecting your resources. Trusted Advisor and Compute Optimizer give best-practice and rightsizing advice rather than operational event notifications.

Question 8Monitoring, Logging, and Remediation

An engineer needs to run ad-hoc queries that filter and aggregate events already stored in a CloudWatch Logs log group. Which feature fits?

  1. CloudWatch metrics filters
  2. CloudWatch Logs subscription filters
  3. CloudWatch Logs export tasks to Amazon S3
  4. CloudWatch Logs Insights Correct answer.

Explanation

Logs Insights provides a query language for interactively searching, filtering, and aggregating log events already stored in log groups. Subscription and metric filters instead act on the stream of incoming events.

Question 9Monitoring, Logging, and Remediation

A web application writes log events to CloudWatch Logs. The operations team wants a CloudWatch metric that counts events containing the word ERROR so it can be alarmed on. What should be created?

  1. A subscription filter that sends matching events to Amazon SNS.
  2. A CloudTrail trail with data events enabled on the log group.
  3. A metric filter with the matching pattern and a metric value. Correct answer.
  4. An AWS Config rule that evaluates the log group retention.

Explanation

A metric filter scans incoming log events for a pattern and increments a custom metric when the pattern matches, which can then be alarmed on. Subscription filters route events elsewhere and do not produce metric time series.

Question 10Monitoring, Logging, and Remediation

An alarm evaluates a metric that is only published when traffic exists. During quiet periods the alarm repeatedly flips to INSUFFICIENT_DATA and pages the on-call team. Which change resolves this?

  1. Disable the alarm actions during business hours.
  2. Increase the alarm's evaluation period to 24 hours.
  3. Create a metric filter that backfills gaps in the metric data.
  4. Set the alarm's missing data treatment to notBreaching. Correct answer.

Explanation

The missing data treatment controls how a gap in datapoints is evaluated; setting it to notBreaching keeps the alarm in the OK state when nothing is published. This is the intended mechanism for metrics that are naturally sparse or intermittent.

Question 11Monitoring, Logging, and Remediation

A company must deploy an identical CloudWatch agent configuration to hundreds of EC2 instances and keep it updated centrally. Which approach requires the least operational effort?

  1. Store the file in S3 and send it to instance owners.
  2. Bake the configuration into the AMI and rebuild the fleet.
  3. Use SSH to edit the agent configuration on each instance.
  4. Use a State Manager association that reads from Parameter Store. Correct answer.

Explanation

Storing the agent configuration in Systems Manager Parameter Store and applying it with a State Manager association lets you update one parameter and have the change applied across the fleet. It avoids rebuilding instances or touching hosts individually.

Question 12Monitoring, Logging, and Remediation

An auditor needs proof that CloudTrail log files delivered to S3 have not been altered after delivery. Which CloudTrail feature provides this?

  1. S3 Object Lock in governance mode on the destination bucket
  2. Log file integrity validation with digest files Correct answer.
  3. An organization trail with all Regions enabled
  4. CloudTrail Insights events

Explanation

Log file integrity validation produces signed digest files that let you verify log files were not changed or deleted after CloudTrail delivered them. Insights and multi-Region trails improve detection and coverage but do not provide tamper evidence.

Question 13Monitoring, Logging, and Remediation

A Lambda function must run whenever any EC2 instance in the account enters the stopped state. What should be configured?

  1. A CloudWatch alarm on the StatusCheckFailed metric with an SNS action.
  2. A CloudWatch Logs metric filter applied to the instance's system log group.
  3. An EventBridge rule matching EC2 state-change events for stopped. Correct answer.
  4. An AWS Config rule that checks whether instances are in the running state.

Explanation

EC2 emits state-change notifications to EventBridge, so a rule matching the EC2 Instance State-change Notification detail type with state stopped can invoke the Lambda function. This reacts to the event itself rather than to monitored metrics.

Question 14Monitoring, Logging, and Remediation

AWS Config detects that several S3 buckets allow public read access. The security team wants automatic remediation without manual steps. What should be configured?

  1. A CloudWatch alarm on the BucketSizeBytes metric with an SNS action.
  2. An automatic remediation action on the rule using SSM Automation. Correct answer.
  3. A Trusted Advisor check for S3 bucket permissions with weekly reports.
  4. An S3 bucket policy on each bucket that denies public read access.

Explanation

Config remediation actions can run automatically when a resource is evaluated as noncompliant, and SSM Automation documents such as the managed document for removing public S3 access perform the fix. This ties detection to correction without human involvement.

Question 15Monitoring, Logging, and Remediation

Log events from a log group must be delivered in near real time to Amazon Kinesis Data Streams for processing. Which CloudWatch Logs feature should be used?

  1. A log group retention policy of one day.
  2. A subscription filter on the log group. Correct answer.
  3. A metric filter with a custom namespace.
  4. An export task scheduled with Amazon EventBridge.

Explanation

Subscription filters push log events as they arrive to a supported destination such as Kinesis Data Streams, Lambda, or Firehose. Metric filters and export tasks do not provide real-time streaming.

Question 16Monitoring, Logging, and Remediation

A company wants log events from application accounts delivered in near real time to a central logging account. Which combination supports this with the least custom code?

  1. Export each log group to Amazon S3 and replicate the bucket every night.
  2. A subscription filter pointed at a destination in the central account. Correct answer.
  3. Enable CloudTrail in every account and read all trails from the central account.
  4. Run a scheduled Logs Insights query in each account and email the results.

Explanation

CloudWatch Logs destinations allow a subscription filter in a source account to deliver events to a destination in another account, which is the built-in cross-account streaming mechanism. It requires a destination policy but no custom processing code.

Question 17Monitoring, Logging, and Remediation

A security team wants an alert whenever the root user of the account is used. What is the most direct way to detect this?

  1. Enable VPC Flow Logs and alarm on any rejected inbound traffic.
  2. Alarm on the CPUUtilization metric of every instance that the root user launched.
  3. Deliver CloudTrail to CloudWatch Logs and alarm on a root metric filter. Correct answer.
  4. Rely on AWS Trusted Advisor to email a weekly summary of root activity.

Explanation

CloudTrail records root sign-in and API activity, and delivering those events to CloudWatch Logs allows a metric filter on the root identity to drive an alarm. This produces a near real-time alert rather than a periodic report.

Question 18Monitoring, Logging, and Remediation

A SysOps administrator must run a diagnostic script on 200 EC2 instances without opening SSH ports or storing keys. Which approach is appropriate?

  1. Run Command with the AWS-RunShellScript document. Correct answer.
  2. An Auto Scaling lifecycle hook that runs a user data script.
  3. AWS Systems Manager Session Manager port forwarding to each host.
  4. AWS Config custom rules that invoke an SSM document.

Explanation

Run Command executes commands on managed instances through the SSM agent and an IAM role, with no inbound ports or SSH keys needed. It accepts target lists and can run on hundreds of instances at once.

Question 19Monitoring, Logging, and Remediation

A team wants to detect when a public web endpoint becomes unreachable and measure its latency from several locations on a schedule. Which CloudWatch feature is designed for this?

  1. CloudWatch Container Insights
  2. CloudWatch Logs subscription filters
  3. CloudWatch ServiceLens
  4. CloudWatch Synthetics canaries Correct answer.

Explanation

Synthetics canaries are configurable scripts that run on a schedule from multiple managed locations and record success, latency, and screenshots as CloudWatch metrics. They are purpose-built for endpoint availability and performance monitoring.

Question 20Monitoring, Logging, and Remediation

An administrator wants to count how many connections to a subnet were rejected by security groups over the past week. Which combination provides this?

  1. Enable AWS Config and review the subnet configuration history.
  2. A metric filter for REJECT records in the flow log group. Correct answer.
  3. Enable detailed monitoring on all instances in the subnet.
  4. Enable CloudTrail data events on the subnet's network interfaces.

Explanation

VPC Flow Logs capture accept and reject decisions for network traffic, and a metric filter over those records turns the rejects into a countable CloudWatch metric. Config, CloudTrail, and detailed monitoring do not record packet-level decisions.

Question 21Monitoring, Logging, and Remediation

A metric follows a predictable daily cycle, and fixed thresholds produce false alarms during peak hours. Which CloudWatch alarm configuration adapts to the pattern?

  1. A percentile statistic with a single evaluation period.
  2. A static threshold set to the highest value observed in the previous month.
  3. Anomaly detection on the metric with an alarm outside the band. Correct answer.
  4. Detailed monitoring on the instances with a one-minute period.

Explanation

Anomaly detection learns the metric's normal pattern, including daily and weekly cycles, and generates a dynamic band; the alarm triggers only when values fall outside that band. Static thresholds cannot adapt to recurring seasonal patterns.

Question 22Monitoring, Logging, and Remediation

A metric filter parses JSON log events using the selector $.latency. Some events lack the latency field, and the resulting metric drops below the alarm threshold intermittently. What should be changed?

  1. Set a default value in the metric filter for missing fields. Correct answer.
  2. Change the filter to a space-delimited pattern.
  3. Enable detailed monitoring on the log group.
  4. Lower the alarm threshold to zero.

Explanation

CloudWatch metric filters support a default value that is published when the selected field is absent, which prevents gaps in the metric. Without it, events missing the field produce no datapoint, so the metric becomes sparse rather than zero.

Question 23Monitoring, Logging, and Remediation

A CPU alarm fires repeatedly because a single one-minute datapoint above the threshold triggers it. The team wants the alarm to fire only when three of the last five datapoints breach. Which configuration achieves this?

  1. Create five separate alarms and combine them with SNS fan-out.
  2. Set evaluation periods to 5 and datapoints to alarm to 3. Correct answer.
  3. Set the threshold to the average of the last five datapoints.
  4. Set the period to five minutes and the statistic to Maximum.

Explanation

CloudWatch alarms support M-of-N evaluation: evaluation periods define the number of datapoints considered and datapoints to alarm define how many must breach before the state changes. Setting 5 periods with 3 breaching datapoints produces the required behavior.

Question 24Monitoring, Logging, and Remediation

An alarm in account A must publish to an SNS topic owned by account B, but the alarm action fails. What is the most likely cause?

  1. CloudWatch alarms cannot invoke SNS topics owned by another account.
  2. Account A has reached the limit of alarm actions per alarm.
  3. The topic policy does not allow CloudWatch in account A to publish. Correct answer.
  4. The metric is in a Region that does not support cross-account SNS.

Explanation

Cross-account alarm actions work when the destination SNS topic policy grants the CloudWatch service principal permission scoped to the source account. Without that statement the publish call is denied and the action fails.

Question 25Monitoring, Logging, and Remediation

A company must keep CloudWatch Logs data for seven years in Amazon S3, queryable with Athena, with minimal delay and no custom code. Which design meets this?

  1. A subscription filter to Firehose delivering into Amazon S3. Correct answer.
  2. A one-day retention policy on the log group.
  3. A nightly Logs Insights query that writes its results into an S3 bucket.
  4. An S3 lifecycle policy attached directly to the CloudWatch log group.

Explanation

A subscription filter can stream log events to Kinesis Data Firehose, which buffers and delivers them to S3 where Athena can query them. This requires no custom code and keeps delivery near real time.

Question 26Monitoring, Logging, and Remediation

A log group receives application logs and the compliance team requires that events older than 90 days be deleted automatically. What is the simplest way to meet this requirement?

  1. Set the log group's retention setting to 90 days. Correct answer.
  2. Add an S3 lifecycle rule to the log group that expires objects after 90 days.
  3. Schedule a Lambda function that calls DeleteLogStream on old streams every night.
  4. Create a subscription filter that discards events after they are 90 days old.

Explanation

CloudWatch Logs keeps events indefinitely unless a retention period is configured on the log group, and any events older than the configured value are deleted automatically. Setting retention is a single attribute change, so it is the simplest control that satisfies the requirement.

Question 27Monitoring, Logging, and Remediation

An administrator wants to review recent management API activity in an account without creating any trail or configuring any storage. How far back does the CloudTrail event history view retain events by default?

  1. Indefinitely
  2. 7 days
  3. 90 days Correct answer.
  4. 1 year

Explanation

CloudTrail event history provides a lookback of the last 90 days of management events for the account with no configuration required. Retaining events beyond that window requires a trail that delivers log files to S3 or CloudWatch Logs.

Question 28Monitoring, Logging, and Remediation

A team needs CPU utilization for an EC2 instance at one-minute granularity so that a scaling alarm can react faster. What should the administrator do?

  1. Enable detailed monitoring for the instance. Correct answer.
  2. Configure a metric filter on the instance's system log to extract CPU values.
  3. Install the CloudWatch agent and publish a custom CPU metric from the instance.
  4. Use AWS Config to record the instance's CPU configuration every minute.

Explanation

Basic monitoring publishes EC2 metrics every five minutes, while detailed monitoring publishes them at one-minute intervals. Enabling detailed monitoring changes the metric resolution without requiring any agent.

Question 29Monitoring, Logging, and Remediation

A nightly cleanup job must invoke a Lambda function every day at 02:00 UTC. Which configuration provides this schedule?

  1. An S3 bucket event notification triggered by the cleanup job's output files.
  2. A CloudWatch alarm on a custom metric that is published at 02:00 UTC.
  3. An EventBridge rule that uses a cron schedule expression as its event source. Correct answer.
  4. A CloudTrail trail that delivers events to the function when the day changes.

Explanation

EventBridge (CloudWatch Events) scheduled rules support cron and rate expressions and can invoke a Lambda function directly as a target. This gives time-based invocation without any external trigger.

Question 30Monitoring, Logging, and Remediation

An EC2 instance runs a stateful application on an EBS-backed volume. The team wants the instance to be recovered automatically, keeping the same instance ID, private IP address, and attached volumes, when AWS detects a failure of the underlying physical host. Which configuration achieves this?

  1. An Auto Scaling group with a minimum size of one that replaces unhealthy instances.
  2. A Lambda function triggered by CloudTrail that stops and starts the instance on a schedule.
  3. A CloudWatch alarm on the CPUUtilization metric with an SNS notification to the operations team.
  4. A CloudWatch alarm on the StatusCheckFailed_System metric with the EC2 recover action. Correct answer.

Explanation

The recover action starts the instance on new hardware while preserving its instance ID, private IP address, Elastic IP addresses, and attached EBS volumes. It is intended for system status check failures caused by the underlying host, so the alarm must watch StatusCheckFailed_System.

Question 31Monitoring, Logging, and Remediation

A security team must record which IAM principal called GetObject on specific objects in an S3 bucket, including the object key. Trails are already delivering management events. What must be added?

  1. CloudTrail Insights enabled on the trail.
  2. S3 server access logging enabled on the bucket.
  3. An S3 event notification that targets a CloudWatch Logs log group.
  4. CloudTrail data events configured for the bucket. Correct answer.

Explanation

Object-level API calls such as GetObject and PutObject are data events, which are not recorded by default on a trail. Enabling data events for the bucket causes those calls to be logged with the requesting principal and object key.

Question 32Monitoring, Logging, and Remediation

A database team needs operating-system level metrics for an RDS instance, such as memory, swap, and running processes, refreshed about once per minute. Which feature provides these metrics?

  1. Performance Insights with a seven-day retention period.
  2. AWS CloudTrail data events on the DB instance.
  3. Amazon CloudWatch basic monitoring for the DB instance.
  4. RDS Enhanced Monitoring. Correct answer.

Explanation

Enhanced Monitoring collects metrics from an agent on the DB instance host at a granularity as fine as one second, including memory, swap, and process-level statistics. Standard CloudWatch metrics for RDS do not expose OS-level counters.

Question 33Monitoring, Logging, and Remediation

An operations team receives dozens of individual alarm notifications during a single database incident. They want a single alert that fires only when several related alarms are simultaneously in the ALARM state. Which feature should they use?

  1. A composite alarm that references the existing alarms. Correct answer.
  2. Anomaly detection bands on each metric.
  3. Metric math expressions on the underlying metrics.
  4. Increased evaluation periods on each alarm.

Explanation

A composite alarm combines the states of up to 100 existing alarms using AND/OR logic and reports a single state, which reduces alert noise during correlated incidents. Only the composite alarm needs an action configured to notify the team once.

Question 34Monitoring, Logging, and Remediation

A company with 40 accounts across three regions needs a single, centralized view of AWS Config rule compliance for all of them. Which feature provides this?

  1. An SNS topic in each account that forwards Config findings to a central queue.
  2. An AWS Config aggregator in a central account with the member accounts added as sources. Correct answer.
  3. A CloudWatch dashboard in each account combined into a cross-account dashboard.
  4. A CloudTrail organization trail that delivers logs to one bucket.

Explanation

An aggregator collects Config configuration and compliance data from multiple accounts and Regions into one account for centralized querying. Source accounts can be added individually or through AWS Organizations.

Question 35Monitoring, Logging, and Remediation

A security team wants an alert whenever a console sign-in attempt fails in the account. CloudTrail logs are already delivered to a CloudWatch Logs log group. What should be configured?

  1. An AWS Config managed rule for IAM password policy.
  2. A metric filter on the log group that matches failed ConsoleLogin events, plus an alarm with an SNS action. Correct answer.
  3. A CloudTrail Insights event selector on the trail.
  4. An EventBridge rule that matches the AWS Health sign-in event source.

Explanation

A metric filter scans incoming CloudTrail log events for the ConsoleLogin event with a Failure response element and increments a custom metric. A CloudWatch alarm on that metric then publishes to SNS when failures occur.

Question 36Monitoring, Logging, and Remediation

A company wants to be notified when API call volume or error rates in its account deviate from normal patterns, without defining explicit thresholds. Which CloudTrail feature should be enabled?

  1. CloudTrail event history.
  2. A multi-Region trail with log file delivery to CloudWatch Logs.
  3. Log file integrity validation.
  4. CloudTrail Insights. Correct answer.

Explanation

CloudTrail Insights continuously analyzes write management events to establish a baseline and then generates insight events when API call rates or error rates deviate significantly. No manual threshold definition is required.

Question 37Monitoring, Logging, and Remediation

An application runs behind an Application Load Balancer, and the team wants Auto Scaling to keep roughly 1,000 requests per target per minute. Which scaling configuration should they choose?

  1. A step scaling policy triggered by the group's networkIn metric.
  2. A scheduled scaling action that adds capacity at the start of each business day.
  3. A simple scaling policy based on the group's average CPU utilization.
  4. A target tracking policy using the ALBRequestCountPerTarget predefined metric. Correct answer.

Explanation

Target tracking adjusts capacity automatically to hold a chosen metric at the target value, and ALBRequestCountPerTarget is a predefined metric for groups attached to an Application Load Balancer. This matches the requirement to maintain a fixed request rate per target.

Question 38Monitoring, Logging, and Remediation

A monitoring account must display CloudWatch metrics and Logs Insights results from ten source accounts on a single dashboard. What is the recommended setup?

  1. Enable detailed monitoring in each source account and recreate every metric in the monitoring account.
  2. Deploy an identical dashboard in each source account and have operators switch between them.
  3. Configure an organization trail that delivers all accounts' logs to a bucket owned by the monitoring account.
  4. Create a sink in the monitoring account and link the source accounts to it using CloudWatch cross-account observability. Correct answer.

Explanation

CloudWatch cross-account observability uses Observability Access Manager: the monitoring account creates a sink and each source account creates a link to it. Linked accounts' metrics, log groups, and traces then become searchable from the monitoring account's dashboards and queries.

Question 39Monitoring, Logging, and Remediation

GuardDuty reports that an EC2 instance is communicating with a known command-and-control host. The security team wants the instance to be isolated automatically within seconds of the finding. Which approach meets this requirement?

  1. Schedule a Lambda function every five minutes to list and evaluate GuardDuty findings.
  2. Use CloudTrail Insights to detect the anomalous network calls and send an SNS notification.
  3. Enable AWS Config rules that mark the instance as noncompliant and wait for the operations team to remediate.
  4. Create an EventBridge rule that matches GuardDuty finding events and targets a Lambda function that changes the instance's security groups. Correct answer.

Explanation

GuardDuty publishes findings to the default event bus, so an EventBridge rule can match on the GuardDuty source and finding type and invoke a remediation target immediately. This event-driven path acts within seconds without polling.

Question 40Monitoring, Logging, and Remediation

A team must alarm when the ratio of HTTP 5xx responses to total requests on an Application Load Balancer exceeds 5 percent over five minutes. The two counts are published as separate CloudWatch metrics. What is the most efficient solution?

  1. Publish both metrics to a custom namespace and combine them with a metric filter on the load balancer access logs.
  2. Create an alarm on a metric math expression that divides the 5xx metric by the request-count metric and multiplies by 100. Correct answer.
  3. Create two independent alarms and ask the on-call engineer to compare them during an incident.
  4. Create one alarm per metric with thresholds set to 5 percent of the expected request volume.

Explanation

CloudWatch alarms can evaluate a metric math expression that references multiple metrics in the same account and Region, so a ratio can be computed and compared to a single threshold. This produces one alarm that directly tracks the error percentage.

Question 41Reliability and Business Continuity

A company's disaster recovery plan states that no more than 15 minutes of transaction data may be lost in a regional outage. Which metric expresses this requirement?

  1. Mean time to recovery (MTTR)
  2. Recovery point objective (RPO) Correct answer.
  3. Recovery time objective (RTO)
  4. Service level agreement (SLA) target

Explanation

The recovery point objective defines the maximum acceptable amount of data loss measured as time before the failure, which drives backup and replication frequency. The recovery time objective instead measures how quickly service must be restored.

Question 42Reliability and Business Continuity

What does a Multi-AZ deployment of Amazon RDS provide?

  1. A cross-Region copy of backups taken every five minutes
  2. A read-only standby in another Region used for reporting
  3. An asynchronous replica that serves read traffic within the same Region
  4. A synchronous standby replica in a different Availability Zone with automatic failover Correct answer.

Explanation

Multi-AZ maintains a synchronous standby in a separate Availability Zone and performs automatic failover of the DNS endpoint if the primary fails. The standby does not serve read or write traffic while the primary is healthy.

Question 43Reliability and Business Continuity

Which Amazon S3 feature keeps previous copies of an object so that an overwritten or deleted object can be restored?

  1. S3 Object Lock in governance mode
  2. S3 Transfer Acceleration
  3. S3 Versioning Correct answer.
  4. S3 Intelligent-Tiering

Explanation

S3 Versioning assigns a version ID to each object and retains prior versions when an object is overwritten or deleted, allowing restoration. Object Lock prevents deletion of specified versions but is not the general mechanism for keeping every prior version.

Question 44Reliability and Business Continuity

Which Route 53 routing policy sends traffic to a standby endpoint only when the primary endpoint is unhealthy?

  1. Latency-based routing
  2. Failover routing Correct answer.
  3. Weighted routing
  4. Geolocation routing

Explanation

Failover routing designates a primary and a secondary record and requires a health check on the primary; traffic moves to the secondary when the primary is unhealthy. The other policies distribute traffic continuously rather than switching only on failure.

Question 45Reliability and Business Continuity

After the initial snapshot, how are subsequent Amazon EBS snapshots stored?

  1. As full copies of the entire volume each time
  2. As a differential against the original volume only
  3. Only in the Availability Zone of the source volume
  4. Incrementally, storing only blocks that changed since the previous snapshot Correct answer.

Explanation

EBS snapshots are incremental: after the first full snapshot, each later snapshot stores only the blocks that changed since the prior one, while restores always produce a complete volume. Snapshots are stored in Amazon S3 managed by AWS and are Regional resources.

Question 46Reliability and Business Continuity

An Auto Scaling group uses the EC2 health check type, and instances that fail Elastic Load Balancing health checks are not being replaced. What change resolves this?

  1. Increase the group's cooldown period
  2. Set the Auto Scaling group health check type to ELB Correct answer.
  3. Attach a second target group to the load balancer
  4. Enable termination protection on the group

Explanation

With the EC2 health check type, Auto Scaling considers only instance status checks, so load-balancer failures go unnoticed. Changing the health check type to ELB makes the group replace instances that the load balancer reports as unhealthy.

Question 47Reliability and Business Continuity

Which service offers a centralized, policy-based way to back up EBS volumes, RDS databases, DynamoDB tables and EFS file systems?

  1. AWS CloudTrail
  2. AWS Backup Correct answer.
  3. AWS Config
  4. Amazon Inspector

Explanation

AWS Backup centralizes backup plans, retention and vaults across multiple supported services through a single console and policy model. The other services provide auditing, configuration tracking or vulnerability assessment rather than backup orchestration.

Question 48Reliability and Business Continuity

Which metric defines the maximum acceptable elapsed time to restore service after an outage?

  1. Backup window
  2. Retention period
  3. Recovery point objective
  4. Recovery time objective Correct answer.

Explanation

The recovery time objective specifies how long service restoration may take after a disruption, which drives choices such as warm standby or active-active architectures. The recovery point objective instead bounds tolerable data loss.

Question 49Reliability and Business Continuity

A disaster recovery design keeps only the database and core networking running in a second Region, and application servers are launched from AMIs during a failover. Which strategy is described?

  1. Warm standby
  2. Pilot light Correct answer.
  3. Multi-site active-active
  4. Backup and restore

Explanation

Pilot light keeps a minimal core of the workload, typically data stores and networking, running in the recovery Region and scales up the rest at failover time. Warm standby would keep a scaled-down but fully functional copy of the application running.

Question 50Reliability and Business Continuity

Which capability provides an Aurora cluster with a cross-Region secondary that has sub-second replication lag and can be promoted in under a minute?

  1. Aurora Backtrack
  2. Aurora Global Database Correct answer.
  3. A cross-Region read replica created with binary log replication
  4. Aurora Multi-AZ

Explanation

Aurora Global Database uses dedicated replication infrastructure to keep secondary Regions typically within about one second of the primary and supports fast promotion during a regional failure. Multi-AZ keeps standbys within one Region and does not provide cross-Region recovery.