Question 390
A CloudFormation stack was created six months ago. Operators made emergency console edits to security group ingress rules that never appeared in the template. An audit needs to identify actual deviations from the declared infrastructure baseline before deciding how to reconcile them. What should the team run?
- Create a CloudFormation change set from the unchanged template and treat the empty preview as proof there were no out-of-band console edits.
- Perform CloudFormation drift detection for supported resources and compare the reported property differences with the approved template.
- Run AWS Config compliance rules for broad security group standards but do not compare the deployed group to the CloudFormation stack template.
- Read CloudTrail update events from the six-month period and assume a complete event log automatically shows each current rule difference from the stack model.
Explanation
Correct Answer
B:Drift detection identifies supported resources whose live properties differ from the last declared stack state, exposing out-of-band edits.
Incorrect Answers
A:Change sets preview proposed updates; drift detection compares current deployed resource properties with the stack template to find out-of-band changes.
C:Compliance may flag security policy violations but does not prove exact deviation from the template-managed baseline.
D:CloudTrail can reveal who changed settings, while drift detection evaluates the actual current resource properties against declared template state.
Question 391
A fleet of EC2 Linux servers needs regular OS patching during approved maintenance windows and exception reporting. The team wants standardized patch baselines without granting developers administrative shell access to every instance. Which AWS operational approach is appropriate?
- Run Systems Manager Run Command manually on each instance whenever an administrator remembers the patch window, without patch-baseline compliance.
- Use AWS Systems Manager Patch Manager, patch baselines and maintenance windows with the necessary managed-instance permissions.
- Use EC2 Image Builder to create monthly golden AMIs but leave the existing long-running Linux fleet unpatched until every node is rebuilt.
- Enable AWS Config periodic EC2 rules to report patch drift but no managed patch installation or scheduled maintenance.
Explanation
Correct Answer
B:Patch Manager can scan and install approved patches using managed-instance and schedule controls, reducing ad hoc administrator logins.
Incorrect Answers
A:Run Command can execute patches but manual ad hoc use does not provide standardized patch policy, maintenance windows and compliance reporting.
C:Image Builder helps standardize replacement images but does not by itself run approved patch baselines and compliance on the existing managed instances.
D:Config detects selected configuration posture; Patch Manager and controlled windows are required to deploy and report actual OS patches.
Question 392
A large payment platform emits twenty correlated CloudWatch alarms for the same database event, overwhelming on-call engineers. It wants a single actionable incident signal based on multiple metric conditions while retaining underlying alarms. Which feature should it consider?
- Use CloudWatch alarm action suppression on every original alarm with no replacement composite rule and assume required incident signals remain actionable.
- Increase each underlying metric alarm evaluation period but keep all twenty SNS actions independently notifying the same on-call team.
- Add a separate metric alarm for each original alarm state and publish every alarm to the same SNS topic.
- Use CloudWatch composite alarms to combine underlying alarm states into fewer meaningful notifications.
Explanation
Correct Answer
D:Composite alarms express Boolean combinations of alarm status and can reduce duplicate incident notifications without losing original metrics.
Incorrect Answers
A:Suppressing all notifications without a replacement condition hides incidents rather than reducing duplicate page volume through combined logic.
B:Tuning evaluation periods may change sensitivity, but retains the twenty independent notifications and does not correlate them into one incident.
C:Duplicating alarm states produces additional alerts rather than the requested Boolean aggregation.
Question 393
An EventBridge bus rule routes standardized billing events to an external reconciliation Lambda. The Lambda expects a compact JSON object with only accountId, amount and transactionId, while original bus events include many irrelevant fields. The team wants consistent payload shaping at the rule target without introducing an extra Lambda adapter. What should be configured?
- Use an EventBridge rule target input transformer or supported input path to map the required fields into the expected invocation payload.
- Increase the retry count on the current target without changing the payload format that the Lambda rejects.
- Enable EventBridge archiving only, assuming replay automatically removes the extra fields from the target invocation.
- Configure a second EventBridge rule with the same event pattern and raw event payload, expecting duplicated delivery to remove unwanted fields.
Explanation
Correct Answer
A:EventBridge input transformers can select event fields and construct a target-specific payload, avoiding an additional transform function when mappings are supported.
Incorrect Answers
B:Retries redeliver the same malformed target payload and do not correct its shape.
C:Archiving retains and can replay events, but does not automatically transform a target's input contract.
D:An additional matching rule creates another target invocation but does not transform the original event shape.
Question 394
A security operations team wants to query application logs from dozens of CloudWatch log groups for a specific transaction ID, filter failed requests and calculate average request duration without exporting raw files manually. Which capability is best suited?
- Use CloudWatch Logs Insights with structured log fields and queries over the relevant groups.
- Use CloudWatch Contributor Insights to rank the most frequent request keys while expecting it to reconstruct every matching transaction log line and compute arbitrary duration aggregates.
- Use CloudWatch Metric Streams to export aggregated metric datapoints and expect them to include the full text of every application transaction log.
- Increase log group retention to one year and expect retention alone to provide an interactive SQL-like query over recorded event fields.
Explanation
Correct Answer
A:Logs Insights can filter, parse and aggregate application log events over selected time ranges for operational troubleshooting.
Incorrect Answers
B:Contributor Insights surfaces top contributors from defined keys, whereas flexible per-transaction filtering and calculation over log rows is the Logs Insights query use case.
C:Metric streams deliver metrics rather than arbitrary historical application log body records needed for transaction-ID matching.
D:More retention preserves data but does not run the filtering, parsing and aggregation logic supplied by Logs Insights.
Question 395
A company already reviews CloudFormation change sets to identify replacements. A new security requirement is to reject templates before execution when they define an S3 bucket without encryption or a security group that allows SSH from 0.0.0.0/0, using reusable policy-as-code rules in CI. Which AWS validation tool directly tests those template properties?
- CloudFormation Guard (cfn-guard) with tested rules that validate the submitted YAML/JSON templates before the deployment stage.
- Generate a CloudFormation change set without evaluating any custom template policy rules and treat its replacement preview as a security rule verdict.
- Use AWS Config detective rules to evaluate only live resources after they have been provisioned, not the proposed template before execution.
- Call CloudFormation ValidateTemplate alone and treat schema/syntax validation as proof that every organization-specific property requirement passed.
Explanation
Correct Answer
A:CloudFormation Guard checks structured templates against explicit policy-as-code rules, enabling CI to fail resources with prohibited properties.
Incorrect Answers
B:Change sets show the impact of an update but do not enforce the organization’s encryption or SSH-source assertions by themselves.
C:Post-provisioning detective checks do not reject a noncompliant CloudFormation template during the CI validation step.
D:Syntactic template validation does not evaluate the custom policy assertions needed to reject public SSH or missing encryption.
Question 396
An EC2 fleet runs a critical audit agent that operators occasionally disable while troubleshooting. The security team needs the agent to be re-installed and enabled automatically whenever it drifts from an approved configuration, rather than waiting for the next operating-system patch cycle. Which Systems Manager capability fits?
- Use Systems Manager State Manager associations with an approved document and managed-node targeting to periodically apply and verify the desired agent configuration.
- Use Patch Manager solely to upgrade operating-system packages and assume it always restores every custom audit-agent service configuration.
- Schedule an SSM Patch Manager Scan operation after the next patch window and assume its scan reinstalls a stopped custom audit agent.
- Run a one-time Systems Manager Run Command against currently healthy nodes but configure no recurring association or drift reapplication.
Explanation
Correct Answer
A:State Manager associations enforce desired software/configuration state on targeted managed nodes at a defined cadence, distinct from patch-baseline compliance.
Incorrect Answers
B:Patch Manager focuses on supported patch-baseline installation and does not inherently enforce a custom audit-agent service state.
C:Patch compliance scanning reports approved OS patch status but does not necessarily reinstall or restart arbitrary agent services.
D:A single command can make a temporary change but does not continually enforce desired agent state after future manual edits.
Question 397
An AWS Config rule already has an automatic Systems Manager remediation action for a prohibited security-group ingress rule. The automation role temporarily lost an EC2 permission, and AWS Config recorded a remediation exception for one resource after repeated failures. The IAM error was corrected, but this resource is still not being retried. Which action directly restores automatic remediation eligibility for the blocked resource?
- Delete the specific AWS Config remediation exception for that rule and resource after verifying the repaired Automation permissions and monitoring the next compliance evaluation.
- Increase the automatic remediation maximum attempts and retry interval while leaving the existing rule-resource remediation exception uncleared.
- Use PutRemediationExceptions to add a second exception for the same rule and resource, expecting two exceptions to unblock remediation.
- Temporarily change the remediation type from automatic to manual and back without deleting the recorded remediation exception.
Explanation
Correct Answer
A:AWS Config remediation exceptions can block subsequent automatic remediation for a resource until cleared; deleting the specific exception allows the configured flow to be retried under the now-correct role permissions.
Incorrect Answers
B:Retry thresholds apply to attempted remediation executions; an existing AWS Config remediation exception continues blocking this resource until that exception is cleared.
C:Adding or updating a remediation exception reinforces the resource-level exclusion rather than deleting it; PutRemediationExceptions does not clear the original blocker.
D:Toggling the remediation mode does not itself delete a listed remediation exception for the resource, so it cannot prove automatic eligibility was restored.
Question 398
A security team deploys a standard VPC Flow Logs stack through one CloudFormation StackSet to 55 AWS accounts and four Regions. Its individual stack templates are unchanged, but regional operators sometimes edit deployed properties directly. The team needs a central view identifying which StackSet instances drifted and which properties differ, rather than checking one stack at a time. What should it run?
- Run drift detection on the entire StackSet, then inspect drifted stack instances and resource-property differences across target accounts and Regions.
- Create a CloudFormation change set for one account and assume it identifies uncontrolled live edits in every other account and Region.
- Run AWS Config in the administrator account only and assume it automatically compares every StackSet instance against its template in all Regions.
- Update all 55 StackSet instances to the newest template immediately before checking which accounts have unauthorized property deviations.
Explanation
Correct Answer
A:StackSet-level drift detection performs stack drift checks across its stack instances, reporting which accounts and Regions contain deviations and their supported resource details.
Incorrect Answers
B:A change set predicts a proposed update to a targeted stack; it does not inventory out-of-band drift across all StackSet instances.
C:An organization aggregator can aid compliance visibility but is not equivalent to StackSets template drift detection across each deployed stack instance.
D:Redeploying before investigation can overwrite the evidence and cause unwanted changes; StackSet drift detection should identify discrepancies first.
Question 399
A cloud platform writes a custom AWS Config policy to reject proposed S3 bucket configurations with an unsafe encryption setting before an IaC pipeline deploys them. The developers need a pre-provisioning policy evaluation of resource properties using AWS Config rather than a Lambda-based post-deployment remediation. Which AWS Config mode and rule type fit?
- Create an AWS Config Custom Policy rule using Guard with proactive evaluation and call supported resource-evaluation APIs during the pipeline’s validation stage.
- Create only an organization conformance pack and assume every proposal is automatically blocked without calling a policy evaluation or deployment gate.
- Use detective-only Config evaluation and require the new bucket to be created before any compliance result can be inspected.
- Create an S3 bucket notification for the first ObjectCreated event and assume it blocks a noncompliant bucket template before CloudFormation creates it.
Explanation
Correct Answer
A:A Guard-based Config Custom Policy rule can evaluate a proposed supported resource configuration proactively; a pipeline can inspect the result before allowing deployment.
Incorrect Answers
B:Organization conformance packs group compliance controls but do not by themselves provide an explicit proactive request-time evaluation and pipeline decision.
C:Detective evaluations examine resource configurations after provisioning, too late for the requested predeploy design gate.
D:Object notifications are post-creation data-plane triggers and cannot proactively evaluate the proposed bucket resource properties.
Question 400
Operators need a central place to track operational issues affecting multiple AWS resources, attach related OpsItems and run standard remediation runbooks. Their current process is scattered emails with no owner or incident record. Which AWS capability should they evaluate?
- Use Systems Manager OpsCenter to manage OpsItems with linked resources, assigned owners, runbook context and status history.
- Open AWS Systems Manager Explorer dashboards for aggregated fleet metrics but avoid creating or assigning individual OpsItems to impacted resource owners.
- Use AWS Trusted Advisor findings exclusively as the assigned owner and tracked history of every locally reported runbook incident.
- Use only CloudWatch metrics dashboards, leaving the incident without an OpsItem ID, related AWS resources or remediation owner.
Explanation
Correct Answer
A:OpsCenter tracks individual operational work items and their AWS-resource context through investigation and remediation, matching the required ownership and workflow model.
Incorrect Answers
B:Explorer presents summarized operations data; it does not replace the stated OpsCenter case ownership and linked investigation workflow.
C:Trusted Advisor recommends improvements in supported checks but does not provide the full OpsItem assignment and remediation history required.
D:Metrics reveal technical signals but do not implement tracked operational case management with workflow context.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests