Question 410
A business deploys EC2 workloads from manually maintained AMIs. The operating system and security agents become inconsistent because image patching and testing depend on one operator. What AWS service can standardize image build/test distribution?
- Continue copying the same old AMI forever and require application teams to patch it independently after launch.
- Enable AWS Compute Optimizer recommendations for deployed EC2 instance size but never build or validate a new AMI.
- Create manual EBS snapshots of existing unpatched AMIs without pipeline components, policy checks or target account distribution.
- Use EC2 Image Builder pipelines with approved components, tests and controlled AMI distribution.
Explanation
Correct Answer
D:Image Builder automates repeatable creation, validation and distribution of golden images instead of manual drift-prone builds.
Incorrect Answers
A:Unmanaged image reuse perpetuates inconsistent OS and agent baselines.
B:Rightsizing suggestions do not automate the OS/agent installation, test and distribution of approved machine images.
C:Raw snapshots preserve existing images but do not establish a reproducible tested image build workflow.
Question 411
A financial organization enrolled in AWS Systems Manager Change Manager in 2024 and continues to use that existing account deployment in November 2026. It must require an approved change request before a reviewed Systems Manager Automation runbook modifies production and must retain approval and execution history. Which approach uses its existing entitlement correctly?
- Use the organization’s already enabled Change Manager change templates, designated approvers and Automation runbook workflow; do not assume the feature can be newly enrolled in other accounts after November 7, 2025.
- Create a fresh Change Manager enrollment in a never-enrolled AWS account in November 2026 and assume unrestricted new-customer onboarding remains supported.
- Configure a Maintenance Window schedule with no approval workflow, then treat allowed execution times as proof that an authorized manager approved each request.
- Enable Change Calendar only and infer that an OPEN calendar state separately establishes named individual approval and change-request audit history.
Explanation
Correct Answer
A:AWS closed new Change Manager onboarding November 7, 2025, but existing users retain approved change-request and runbook workflows; this company is explicitly an existing customer.
Incorrect Answers
B:New customers cannot onboard to Systems Manager Change Manager after the documented restriction date.
C:Maintenance Windows govern permitted times and task scheduling, not the complete multi-step change-request approval record.
D:Change Calendar can gate allowed operating windows but does not itself provide the requested individually approved change request and execution history.
Question 412
An operations team wants to see which API caller changed a security group rule at 09:30, and then compare that event with the application outage start. CloudWatch metrics show the failure but not the caller identity. Which AWS audit dataset is relevant?
- Query Route 53 Resolver DNS logs from the incident minute and treat domain lookups as the API caller identity for EC2 security group changes.
- Query VPC Flow Logs for the security group IP and assume each flow contains the IAM role that modified ingress.
- Search CloudTrail management events for the matching EC2 API call and correlate eventTime, principal and request parameters with the incident.
- Read AWS Config resource history only and assume it always provides the exact API caller identity without a correlated CloudTrail event.
Explanation
Correct Answer
C:CloudTrail records supported control-plane API actions and caller context, unlike aggregate resource utilization metrics.
Incorrect Answers
A:DNS request logs describe name resolution, not the principal and request parameters of an EC2 control-plane API call.
B:Network flow records do not log the identity or API parameters of the administrator who authorized new ingress rules.
D:Config history can show recorded resource changes but CloudTrail management events are needed to attribute the API call to a principal.
Question 413
A team uses AWS X-Ray for an application that sends millions of requests per hour. Full trace capture becomes unnecessarily expensive, but operations still needs statistically useful end-to-end timing and errors during peak demand. Which tracing control should be tuned?
- Configure suitable X-Ray or OpenTelemetry sampling policies, retaining high-value error coverage and measured trace representativeness.
- Disable all tracing permanently and assume CloudWatch CPU graphs identify every failing application dependency.
- Capture every request indefinitely without examining telemetry budget or storage implications.
- Increase CloudWatch Logs retention on unrelated application log groups and assume this reduces the percentage of requests collected by X-Ray.
Explanation
Correct Answer
A:Sampling can bound tracing overhead while preserving useful distributed request diagnosis when carefully designed.
Incorrect Answers
B:CPU metrics lack request span attribution and cannot replace distributed tracing for intermittent failures.
C:Unbounded trace capture increases overhead and may be unnecessary for the stated diagnostic goals.
D:Log retention is distinct from X-Ray sampling and does not directly control distributed trace sampling rates.
Question 414
An API receives sporadic malformed requests that trigger application errors, and the team needs to identify which client IP addresses or request attributes contribute disproportionately to the error volume. Metrics already exist in CloudWatch Logs. Which analysis service can surface high-contributing dimensions?
- Use a CloudWatch Metrics Insights aggregate query over CPU utilization while never extracting the source IP or request attribute dimensions from application logs.
- Use CloudWatch Contributor Insights with suitable log-field rules or published metrics to identify top contributors.
- Use Logs Insights to inspect one matching request interactively but never build top-contributor rules or time-series contributor analysis.
- Configure anomaly detection on global request count with no per-client dimensions and infer which IP caused the errors.
Explanation
Correct Answer
B:Contributor Insights can rank high-impact keys and patterns, helping isolate clients or request classes driving failures.
Incorrect Answers
A:CPU metrics alone cannot rank client IDs driving malformed API requests because the relevant dimensions are in log fields.
C:Ad hoc log queries can help investigation, but Contributor Insights directly maintains ranked high-contributor keys across incoming events.
D:A global count anomaly cannot identify which client or request attribute contributes disproportionately to the errors.
Question 415
A production API has a daily traffic pattern, and fixed alarm thresholds either page on expected morning peaks or miss abnormal nighttime request spikes. The team wants a dynamic threshold based on observed historical behavior. Which CloudWatch feature should be evaluated?
- Use CloudWatch metric anomaly detection bands with appropriate training and operational review of expected deviations.
- Keep a single static request-rate limit above the largest morning peak and accept that smaller unusual night spikes will not alert.
- Remove application metrics during busy hours and assume the model becomes more accurate without real demand data.
- Calculate a manual daily average once a month and use it as the same fixed alarm threshold at all times of day.
Explanation
Correct Answer
A:Anomaly detection models historical metric behavior and can identify deviations without one static threshold for all hours.
Incorrect Answers
B:An excessively high fixed threshold ignores the daily baseline variation and misses the specified unexpected off-hours spike.
C:Suppressing expected observations biases detection and hides important behavior.
D:A static monthly mean is unable to learn the expected time-of-day range the anomaly detection model needs.
Question 416
A cloud operations team already tracks incidents as Systems Manager OpsCenter OpsItems with assigned owners and remediation runbooks. A separate compliance notification service must receive a message when an OpsItem is created or updated, including its OpsItem ID and status, without repeatedly polling OpsCenter or replacing the existing issue-management workflow. What event integration should the architect configure?
- Keep the OpsCenter console as the only incident view and require users to manually copy each status change to the external notification service.
- Create an Amazon EventBridge rule that matches the Systems Manager OpsItem Create and OpsItem Update event types, forwarding supported details to an authorized notification target.
- Increase the Systems Manager Inventory package-collection interval, assuming software inventories automatically publish every OpsItem lifecycle transition.
- Read only EC2 instance CPU metrics to infer the identity and status of every OpsCenter issue when an analyst changes its severity.
Explanation
Correct Answer
B:Systems Manager emits EventBridge OpsItem Create and OpsItem Update events with supported OpsItem metadata, enabling targeted notifications independent of console polling.
Incorrect Answers
A:An OpsCenter dashboard helps engineers manage work but does not deliver an automatic notification event to an external consumer.
C:Software inventory gathers managed-node metadata and does not describe OpsItem create/update lifecycle events.
D:EC2 CPU metrics neither identify OpsItem IDs nor carry OpsCenter status updates or incident fields.
Question 417
An online bank has passing CloudWatch Synthetics canaries from three test locations. Real customers using older mobile browsers still report slow login pages and intermittent JavaScript errors. Engineering needs browser-, device- and geography-specific evidence from actual user sessions, not more periodic scripted transactions. Which observability capability fills the gap?
- Increase the synthetic canary interval but continue collecting only results from synthetic test sessions rather than actual browsers.
- Enable CloudWatch Real User Monitoring for the public web application with appropriate privacy controls and analyze client-side load times, errors and user-session dimensions.
- Query CloudWatch Logs Insights only on backend authentication errors, without instrumenting client-side browser timing or exceptions.
- Use AWS X-Ray tracing only inside backend Lambda services and infer all older-mobile-browser rendering errors from backend spans.
Explanation
Correct Answer
B:CloudWatch RUM instruments client-side experiences and aggregates actual page latency, browser errors, locations and device patterns, matching the observed blind spot.
Incorrect Answers
A:More scripted availability checks cannot provide representative telemetry from the affected real device and browser combinations.
C:Server logs can diagnose backend failures but cannot directly show device- or browser-specific user-side JavaScript errors and paint timing.
D:Backend traces do not supply the frontend execution context or browser and device details reported in real customer sessions.
Question 418
A multi-account application has a known fleet of EC2 instances that should all register as Systems Manager managed nodes. Several new instances are missing from Fleet Manager because they lack a working instance profile and SSM agent connectivity. What should be repaired?
- Only rename the EC2 instance tags and assume the missing SSM agent automatically installs and registers.
- Disable instance metadata access entirely without an alternative supported credential delivery path for the managed instance.
- Enable AWS Config recording on the account and assume its compliance history grants missing SSM agent registration credentials.
- Supply scoped SSM instance permissions, a supported running agent and reachable SSM service endpoints, then verify managed-node registration.
Explanation
Correct Answer
D:Managed node visibility requires the agent, credentials and network path; a fleet dashboard cannot invent missing registrations.
Incorrect Answers
A:Tags may aid inventory but do not provide the agent and credential/network prerequisites.
B:Removing credentials without a replacement can prevent the SSM agent from authenticating.
C:Config records supported resource properties; it does not supply the managed-node instance role, agent execution or network path.
Question 419
A customer wants to understand whether a proposed migration of a workload from a single AZ to multi-AZ architecture would meet its published reliability objectives before paying for the change. Which AWS assessment workflow can help prioritize the improvements?
- Use the AWS Well-Architected Tool review with relevant workload risk findings and recommended improvement actions, validating them against measurements.
- Use AWS Compute Optimizer to rightsize CPU and claim the recommendations alone prove the workload meets multi-AZ recovery objectives.
- Use only AWS Budgets forecasts to estimate additional AZ cost and declare reliability targets achieved if approved.
- Run a single EC2 status check on the current single-AZ instance and equate its healthy state with full AZ resilience.
Explanation
Correct Answer
A:A structured Well-Architected review identifies design risks and helps prioritize remediations, rather than assuming all changes are equally valuable.
Incorrect Answers
B:Compute sizing findings cannot validate a design’s entire fault-tolerance behavior or recovery time without architecture and testing.
C:Financial estimates inform budget but are not architectural risk assessment or proof of RTO/RPO performance.
D:A passing current instance check does not measure whether the multi-AZ design survives an availability-zone outage.
Question 420
An on-call engineering team has created automated remediation for repeated AWS Config findings, but the runbook changes EC2 network settings. It wants to ensure the automation does not run in parallel across every production instance during a broad incident. Which control must be configured?
- Set unlimited automation concurrency and use the broadest wildcard target to minimize execution time.
- Attach an unrestricted Systems Manager Automation IAM role while leaving target concurrency and error thresholds at their broadest settings.
- Use a CloudWatch composite alarm to monitor remediation failures after the entire fleet changes, with no execution concurrency limit.
- Use scoped Systems Manager Automation execution controls including rate limiting, concurrency and error thresholds for target sets.
Explanation
Correct Answer
D:Controlled automation concurrency and failure thresholds limit the blast radius of repetitive configuration repairs.
Incorrect Answers
A:Unbounded simultaneous network changes can amplify an outage across the entire production fleet.
B:IAM permission scope does not constrain how many targets the automation changes simultaneously without rate-control settings.
C:An alarm can detect failures, but it does not throttle concurrent runbook operations or cap the number of changed hosts.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests