Question 400
Operators need a central place to track operational issues affecting multiple AWS resources, attach related OpsItems and run standard remediation runbooks. Their current process is scattered emails with no owner or incident record. Which AWS capability should they evaluate?
- Use Systems Manager OpsCenter to manage OpsItems with linked resources, assigned owners, runbook context and status history.
- Open AWS Systems Manager Explorer dashboards for aggregated fleet metrics but avoid creating or assigning individual OpsItems to impacted resource owners.
- Use AWS Trusted Advisor findings exclusively as the assigned owner and tracked history of every locally reported runbook incident.
- Use only CloudWatch metrics dashboards, leaving the incident without an OpsItem ID, related AWS resources or remediation owner.
Explanation
Correct Answer
A:OpsCenter tracks individual operational work items and their AWS-resource context through investigation and remediation, matching the required ownership and workflow model.
Incorrect Answers
B:Explorer presents summarized operations data; it does not replace the stated OpsCenter case ownership and linked investigation workflow.
C:Trusted Advisor recommends improvements in supported checks but does not provide the full OpsItem assignment and remediation history required.
D:Metrics reveal technical signals but do not implement tracked operational case management with workflow context.
Question 401
A multi-account financial group already enabled AWS Health organizational view and can see affected accounts centrally. However, operations still copies console screenshots into a chat channel by hand during regional service degradations. It needs an automated notification containing event category and affected account context for approved organization events. What should be added?
- Create an EventBridge rule in an appropriate management or delegated administrator account to match organizational AWS Health events and deliver them to a supported incident notification target.
- Disable AWS Health organizational view, since account-level AWS Health console checks are required for any automated event feed.
- Enable AWS Health organizational view a second time in each application VPC and expect VPC endpoint creation to deliver chat notifications.
- Create a CloudWatch metric alarm on EC2 CPU but do not subscribe to AWS Health organizational events or carry affected-account metadata.
Explanation
Correct Answer
A:With organizational view enabled, AWS Health events can be routed through EventBridge from an authorized central account to operations targets for timely notifications.
Incorrect Answers
B:Disabling organizational aggregation would remove the centralized account context the architecture already relies on.
C:Organizational Health is account-level event aggregation; VPC endpoint networking does not configure event routing to the incident channel.
D:A host metric alarm cannot transport the original service Health event category and its affected account context.
Question 402
A networking team has a Transit Gateway attachment to a VPC containing an inspection appliance. It wants to know whether the TGW attachment is actually receiving and forwarding traffic after a route change, without placing an agent in every workload. Which telemetry should it enable?
- Configure Transit Gateway Flow Logs to the approved destination and correlate attachment-level flow records with routing decisions.
- Enable VPC Flow Logs only on a non-attached S3 gateway endpoint and assume those logs report Transit Gateway attachment five-tuples.
- Run Reachability Analyzer as the only telemetry source and treat its modeled path analysis as live traffic volume evidence.
- Review only Transit Gateway CloudWatch aggregate byte counters and assume they identify every source/destination five-tuple and flow action.
Explanation
Correct Answer
A:TGW Flow Logs supply attachment and gateway network-flow metadata that helps diagnose where routed traffic is observed.
Incorrect Answers
B:A separate VPC endpoint cannot provide Transit Gateway attachment-level flow records for the stated route.
C:Reachability Analyzer models possible paths; it does not measure observed TGW flow records after the change.
D:Aggregate counters indicate volume but do not provide the attachment-level flow context supplied by TGW Flow Logs.
Question 403
A multi-account platform team has incident dashboards scattered across separate CloudWatch accounts. It wants a central observability account that can query approved metrics, logs and traces without copying every application resource into one AWS account. Which AWS capability is appropriate?
- Configure CloudWatch cross-account observability with appropriate source account links and monitoring account permissions.
- Export all source-account CloudWatch metrics manually into a shared S3 bucket and treat periodic CSV copies as interactive cross-account metric/log/trace observability.
- Give the monitoring account AdministratorAccess in every member account without configuring cross-account CloudWatch source links.
- Share only SNS alarm notification topics and assume every raw log event and trace becomes queryable across accounts.
Explanation
Correct Answer
A:Cross-account observability makes supported telemetry accessible centrally while accounts retain workload ownership.
Incorrect Answers
B:Manual exports add delay and copy operations, rather than granting supported real-time cross-account access to original telemetry.
C:Broad IAM grants are excessive and do not substitute for required cross-account observability linking and data-sharing configuration.
D:Alarm notifications do not federate logs and traces or create the CloudWatch source/monitoring-account relationship.
Question 404
An API team needs to detect whether p95 request latency rises above an agreed threshold, even though average latency looks normal because most requests are fast. Which CloudWatch metric alarm configuration is appropriate?
- Create an alarm only for the average request duration and exclude p95 data because the average stays within its threshold.
- Track p95 but alarm on the all-time minimum instead of the SLA threshold and evaluation window.
- Create an alarm on a supported p95 statistic or appropriately emitted percentile metric with adequate data coverage and evaluation periods.
- Alarm only on average CPU utilization and assume it always identifies customer request tail latency.
Explanation
Correct Answer
C:A percentile-focused alarm detects the slow tail of requests that an average can conceal.
Incorrect Answers
A:The scenario already shows that average latency masks the affected slow tail; the metric must retain a supported percentile statistic.
B:A minimum-derived threshold is unrelated to whether current p95 breaches the stated customer-latency limit.
D:CPU utilization is not a reliable substitute for measured p95 application request duration.
Question 405
A CloudWatch metric alarm for a production API pages on a single one-minute latency spike, even though transient spikes are acceptable. The team wants an alarm only when at least three of the most recent five evaluated one-minute datapoints exceed the existing p95 threshold, retaining the original metric and without combining separate alarms. Which evaluation setting should it use?
- Create a composite alarm requiring three unrelated alarm resources; leave the original latency alarm at one breaching point.
- Set EvaluationPeriods to five and DatapointsToAlarm to three for the latency metric alarm, with an explicit missing-data treatment.
- Increase the alarm period to five minutes and assume it now verifies three distinct breached one-minute observations automatically.
- Reduce the alarm threshold to zero and keep one out of one evaluation periods so even harmless spikes produce an alert.
Explanation
Correct Answer
B:CloudWatch metric alarms support an M-out-of-N condition using DatapointsToAlarm and EvaluationPeriods, so three breaches among five evaluated periods can trigger without needing every single sample to breach.
Incorrect Answers
A:A composite alarm combines the states of multiple alarm resources; the requirement is an M-of-N evaluation on the same metric.
C:A single five-minute aggregated datapoint does not enforce a count of three breaching one-minute periods.
D:Making the threshold more permissive to noise or keeping one-of-one cannot suppress isolated transient spikes.
Question 406
A security team needs a near-real-time copy of selected structured CloudWatch Logs from many application log groups in S3 for long-term forensic analytics. It has already deployed an approved Amazon Data Firehose delivery stream. Which CloudWatch Logs feature connects these without every app team building a second logging client?
- Create CloudWatch Logs subscription filters on the source log groups that deliver selected events to the supported Firehose destination with the necessary roles and limits.
- Use Logs Insights queries alone and assume every query writes a continuous event stream to S3 by default.
- Increase each source log group retention while omitting a subscription filter and expect the Firehose stream to receive log events.
- Enable a one-time CloudWatch Logs export task for last week’s log history and assume it streams each newly arriving event continuously.
Explanation
Correct Answer
A:Subscription filters can stream matching CloudWatch log events to supported destinations such as Firehose for downstream storage, subject to subscription quotas and permissions.
Incorrect Answers
B:Logs Insights is an interactive query facility and is not a persistent near-real-time subscription to S3.
C:Retention determines when data expires; it does not create a delivery subscription to an external stream.
D:Export tasks are batch history transfer, not the near-real-time subscription required for ongoing events.
Question 407
A regulated payments application already limits unnecessary CloudWatch Logs ingestion and has approved retention settings. During an incident, investigators must query full audit events, but normal viewers must not see customer account numbers or personal identifiers embedded in those events. The team needs configurable detection and masking in CloudWatch Logs without deleting the evidence. Which control fits?
- Define CloudWatch Logs data protection policies using appropriate managed/custom data identifiers, audit findings, and masking for viewers without unmask permission.
- Reduce the log retention period to one hour so unauthorized viewers cannot see sensitive data after sixty minutes.
- Enable encryption at rest for the CloudWatch log group but give every log reader the same ability to view unmasked sensitive fields.
- Add an optional Logs Insights query that filters one example account number while leaving the underlying log-view permissions unchanged.
Explanation
Correct Answer
A:CloudWatch Logs data protection policies can audit and mask detected sensitive fields for normal viewing while allowing appropriately authorized investigation of retained raw data.
Incorrect Answers
B:Short retention destroys required investigation evidence and does not protect sensitive fields during the retention window.
C:Encryption at rest protects storage media; it does not mask sensitive values from an IAM principal authorized to read normal log events.
D:A voluntary query filter cannot guarantee masking across other queries and direct log access.
Question 408
Systems Manager State Manager already maintains approved agent configuration on the fleet. A compliance auditor instead needs to identify which managed EC2 nodes across multiple accounts and Regions still have an obsolete database client package installed, without making any configuration changes. The team can synchronize metadata into a central queryable S3 dataset. Which Systems Manager capability provides the evidence?
- Run State Manager document associations that continually reinstall the database client but collect no package names or versions for audit evidence.
- Enable Systems Manager Inventory collection of application and package metadata, and use supported resource data sync for cross-account/Region querying.
- Use Session Manager interactive shells on a convenience sample of hosts and assume the resulting list is a complete, repeatable fleet-wide inventory.
- Use Systems Manager Patch Manager to replace every package immediately, before collecting evidence of which nodes installed the obsolete client.
Explanation
Correct Answer
B:Systems Manager Inventory gathers package, agent and system metadata from managed nodes and can aggregate it for query across accounts and Regions.
Incorrect Answers
A:Enforcement does not itself provide the cross-account installed-software census the auditor requests without configuration changes.
C:Ad hoc sessions can inspect nodes but lack automated coverage and consolidated package metadata for all managed instances.
D:Patching can change software but would alter the environment before the audit establishes the actual affected package versions.
Question 409
An operations team runs a common Systems Manager Automation runbook against many EC2 instances. One wrong parameter could restart the entire production fleet instead of a selected staging set. Which runbook safeguard should it add?
- Rely on the Automation runbook description containing the word staging while still allowing unrestricted wildcard production targets.
- Use validated input parameters, scoped execution roles, reviewed target selection and appropriate automation approval or rate controls.
- Grant the runbook administrator rights in every account and omit target validation to minimize setup work.
- Create an EventBridge schedule for the runbook but leave target selection and execution role permissions unrestricted.
Explanation
Correct Answer
B:Parameters and role/target boundaries constrain which resources the automation can change and limit blast radius.
Incorrect Answers
A:Text descriptions do not enforce runtime target selection, parameters or the IAM authority of the automation role.
C:Unscoped credentials and unvalidated targets increase the risk of an erroneous fleet-wide change.
D:Scheduling when automation runs is distinct from validating the subset of hosts and privileges it may alter.
Question 410
A business deploys EC2 workloads from manually maintained AMIs. The operating system and security agents become inconsistent because image patching and testing depend on one operator. What AWS service can standardize image build/test distribution?
- Continue copying the same old AMI forever and require application teams to patch it independently after launch.
- Enable AWS Compute Optimizer recommendations for deployed EC2 instance size but never build or validate a new AMI.
- Create manual EBS snapshots of existing unpatched AMIs without pipeline components, policy checks or target account distribution.
- Use EC2 Image Builder pipelines with approved components, tests and controlled AMI distribution.
Explanation
Correct Answer
D:Image Builder automates repeatable creation, validation and distribution of golden images instead of manual drift-prone builds.
Incorrect Answers
A:Unmanaged image reuse perpetuates inconsistent OS and agent baselines.
B:Rightsizing suggestions do not automate the OS/agent installation, test and distribution of approved machine images.
C:Raw snapshots preserve existing images but do not establish a reproducible tested image build workflow.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests