Practice Set 3: every answer explained.

Why C

Only the V2 pipeline type carries trigger configuration, and its push filters accept git tags with wildcard include and exclude patterns, so a filter on v*.*.* starts a run for a release tag and for nothing else. Setting a V1 source action branch field to a tag name does not work — that field names a branch, accepts no wildcards, and would need a pipeline edit for every release. Adding a build action that inspects the commit still starts and bills a full execution for every push and leaves a trail of failed runs that the team has to interpret. Repository tag events from a third-party provider reached through a connection are not delivered to EventBridge, so a rule built on them never fires.

Why B

Multi-AZ replication is synchronous — RDS does not acknowledge a commit until the write is durable on the standby as well — so an automatic failover is effectively a zero-RPO event, and the cost is availability time while the endpoint is remapped, not data. A cross-Region read replica ships changes asynchronously, so anything still in flight when the primary is lost is gone once the replica is promoted, making its RPO equal to the replica lag at the moment of failure. Describing both as synchronous misstates the replica, and describing both as asynchronous misstates the standby. The claim that the standby is rebuilt from a snapshot describes neither mechanism: the standby is continuously updated block for block.

Why C

AWS Health publishes account-specific events to the default EventBridge bus in the Region where the event occurs, so a rule per Region filtering on the aws.health source and the scheduledChange category captures retirement notices the moment AWS raises them, with no polling code and no missed mail. Polling DescribeEvents works but requires a Business or Enterprise Support plan, a scheduler, and a deduplication table that the team then owns and must operate. Setting an alternate contact only redirects email and still leaves a human to open the ticket. A system status check alarm is reactive rather than predictive: it fires once the host is already impaired, which is precisely the outage the team is trying to avoid.

Why A

The Docker layer cache mode of CodeBuild local caching keeps the layer store on the build host so a following build on that host reuses the eight unchanged layers, and the documented requirement for it is a Linux environment with privileged mode enabled. S3 caching copies declared paths in and out of a bucket between builds, and the Docker storage directory is not a supported cache path — the upload and download of a multi-gigabyte layer store would also erase the saving. Baking the layers into a custom build image does cut the work, but it adds an image to rebuild and re-publish whenever a package changes. A larger compute type shortens the same work rather than skipping it.

Why C

A subscription filter is the only mechanism that streams matching log events out of CloudWatch Logs continuously, and Amazon Data Firehose is a managed destination that can both index into OpenSearch Service and write every record to S3 in one delivery stream, so a single configuration satisfies the search requirement and the archive requirement. Polling FilterLogEvents on a schedule reintroduces latency, paging logic, and checkpoint state that must be maintained. Export tasks are batch jobs with per-account concurrency limits and delivery measured in minutes to hours, which cannot meet a one-minute target. A metric filter only produces a numeric count, it does not carry the log line, and OpenSearch Service cannot subscribe to an SNS topic.

Why A

EC2 publishes MetadataNoToken to CloudWatch for each instance, counting metadata requests served over IMDSv1. A sustained zero across a window that covers the application's full workload is the evidence needed to flip HttpTokens to required safely. VPC flow logs never help here because link-local traffic to 169.254.169.254 is not captured by flow logs at all. CloudTrail does not record instance metadata requests: the metadata service is answered locally on the instance and is not an AWS API call, so no data event type exists for it. Running curl through Run Command only proves the endpoint still accepts token-less requests, which every instance does until enforcement, and says nothing about which applications depend on that behavior.

Why B

A cross-stack export is locked for as long as any stack imports it, which is exactly the deadlock described, and the lock is by design. Parameter Store breaks the coupling: the networking stack writes the current IDs as parameters, and each application template declares a parameter of an SSM parameter type that resolves the value at deploy time, so the producer can change without asking permission from the consumers. Nesting the application stacks makes one enormous stack whose every deployment is coupled to the network. DependsOn only orders resources inside a single template and has no effect on export locking. Hardcoding the IDs into Mappings guarantees drift and twelve manual edits.

Why A

An Aurora global database replicates at the storage layer to the secondary Region with typical lag well under a second, and the secondary cluster is a live, readable cluster that can be promoted in minutes — which is exactly the combination of sub-second RPO, low RTO, and local reads the requirement describes. Adding a reader in a second Availability Zone improves availability inside us-east-1 and does nothing for the loss of the whole Region. An hourly cross-Region backup copy caps the RPO at an hour, an order of magnitude worse than required. Replicated automated backups still require a full restore into a brand-new cluster, which takes far longer than a few minutes for a cluster of any size and leaves Europe with no local reads.

Why B

Incident Manager is the managed service that models contacts, engagement plans, and time-boxed escalation stages, and a response plan can also open a chat channel and attach Systems Manager Automation runbooks while recording a timeline for the postmortem. A CloudWatch alarm can start an incident from that plan directly. An SNS topic has no acknowledgement or escalation semantics, so both engineers are notified at once and nobody is guaranteed to respond. The Lambda re-publishing loop reimplements escalation and acknowledgement as code the team must maintain, and still produces no incident record. Chatbot delivers the alarm into Slack but has no paging, no escalation timer, and no way to detect that the message went unread.

Why A and B

Cross-account artifact access needs permission on both the object and the key that encrypts it, and because both resources live in the tooling account each needs a resource policy naming the production role — a bucket policy for the object reads and a KMS key policy statement for the decrypt. Moving to the AWS managed key makes the problem permanent, because the key policy of an AWS managed key cannot be edited to trust another account. Replicating the bucket copies objects but does not change which principal CodePipeline hands to the deploy action, and the replica is not what the action reads. Writing artifacts into a production bucket reverses the flow and leaves the deploy action still reading the tooling bucket.

Why D

CloudWatch Logs charges for ingestion and then for stored data indefinitely when no retention is set, so the fix is a retention policy on every group plus a cheaper destination for the small subset that genuinely needs seven years — S3 with a lifecycle transition costs a fraction of CloudWatch Logs storage — and an automation rule keeps newly created groups from silently reverting to Never expire. Deleting whole log groups by hand is manual, destroys recent data along with old, and the groups reappear on the next invocation. A blanket three-day retention loses the audit data outright, and Logs Insights can only query events still inside the retention window. Stripping logging permissions removes the troubleshooting signal entirely.

Why D

IAM Access Analyzer has two analyzer types that map onto the two questions: an external access analyzer, which evaluates resource and trust policies and reports grants to principals outside the chosen zone of trust, and an unused access analyzer, which reports roles, users, and permissions idle beyond a configured tracking period. Creating both from the delegated administrator covers every member account with no per-account work. Access Advisor shows only which services a principal used and never identifies external access. The custom job reimplements automated reasoning and runs only monthly. Choosing the account as the zone of trust would flag routine cross-account access inside the organization as external, burying the real findings.

Why D

A canary configuration shifts a fixed first slice, holds it for a named interval, then moves everything that is left, which is the two-step pattern described; the ten percent slice and the ten-minute bake period name the configuration precisely. The linear configuration instead adds ten percent every minute until the shift completes, so traffic keeps climbing during the window rather than resting at ten percent. The all-at-once configuration moves the alias in a single step and gives the alarm nothing to observe before full exposure. The five-minute canary has the right shape but halves the bake window, which would let the deployment complete before a slow-burning error alarm reaches its threshold.

Why B

Backtrack rewinds an Aurora MySQL cluster in place to a point inside the backtrack window, typically in minutes and without creating a new cluster, so the existing endpoints keep working and no application reconfiguration is needed — which makes it the fastest path when the feature was enabled ahead of time, as it was here. Restoring the latest automated snapshot loses every change made since that snapshot and still produces a new cluster with a new endpoint. A point-in-time restore reaches the right moment but provisions an entirely new cluster from backup, which takes far longer and forces a cutover. Failing over to an Aurora Replica changes nothing, because replicas read the same shared storage volume and see the same deleted rows.

Why A and B

AWS Config evaluates existing resources when a rule is first enabled and again on every configuration change, so the managed restricted-ssh rule covers pre-existing groups as well as new ones, and the evaluation history is the audit record. Attaching the automation document as a remediation action with automatic remediation turned on closes the finding within minutes, with no function to maintain. The CloudTrail-driven EventBridge rule reacts only to new API calls, so it would never touch groups that were already open. A policy denying the ingress action blocks legitimate rule changes too. GuardDuty reports suspicious behavior, not configuration drift, and raises no finding for an open security group.

Why A

A stack policy is evaluated by CloudFormation during an update and is the only one of these controls that can allow most updates while refusing specific update actions on a named logical resource, which is precisely the requirement. DeletionPolicy with Retain does not stop a replacement — it only governs what happens to the physical resource when CloudFormation removes it, so the database would still be replaced and the old instance simply left behind. Denying UpdateStack blocks every change to the stack, including the routine ones the team still needs. Termination protection refuses stack deletion and says nothing about an update that replaces a resource inside a stack that continues to exist.

Why A

A composite alarm evaluates a rule expression over other alarms, so the child alarms keep evaluating and stay visible on dashboards while only the composite carries the paging action — exactly one notification per correlated incident, configured declaratively with no code. Pushing every alarm to 15 of 15 datapoints does not deduplicate anything; it simply delays all 40 pages by a quarter of an hour and hides short real incidents. Collapsing 300 alarms into one anomaly detection alarm on CPU discards nearly all of the service's coverage and would miss error-rate and latency regressions entirely. A deduplicating Lambda in front of the paging provider is custom code to write, test, and maintain for a problem the service already solves.

Why A

Security Hub integrates with Organizations: the management account designates a delegated administrator, and that account can auto-enable Security Hub and the chosen standards in existing and future member accounts. Cross-Region aggregation is separate and explicit, so the aggregation Region must be configured with its linked Regions before findings appear in one place. Manual invitations produce the same membership but must be repeated for every new account and Region, the toil being removed. Findings are never forwarded between Regions on their own, so enabling only the aggregation Region leaves five Regions unassessed. A Config aggregator collects configuration items and Config rule compliance, not Security Hub standard findings.

Why B

GitHub Actions can present a signed OIDC token that describes the repository, the branch and the workflow; registering GitHub as an IAM identity provider and conditioning a role trust policy on the sub claim yields temporary credentials scoped to exactly one repository and branch, with no stored secret at all. Nightly rotation still leaves a valid long-lived key sitting in the repository for up to a day and adds a function to run. Storing the key in Secrets Manager only moves it, and the workflow still needs a credential to read the secret. A self-hosted runner does remove the key but introduces an EC2 fleet to patch and scale, which the team ruled out.

Why C

RDS Proxy sits between the function and the database and multiplexes many short-lived client connections onto a small pool of persistent database connections, which absorbs exactly this kind of burst; the only application change is the hostname in the connection string. Raising max_connections far beyond what the instance class can support trades a connection error for memory pressure and instability, because each MySQL connection consumes server memory. Multi-AZ maintains a standby that accepts no client connections at all, so it adds availability and no connection capacity. Reserved concurrency would cap connections but does so by throttling the function, which drops the legitimate customer requests the scenario says must be served.

Why A

An EventBridge archive captures events that match its filter from the moment the archive exists, and a replay re-sends them to the same bus for chosen rules over a chosen time window, which is exactly the recovery path here because the archive predates the outage. Adding a dead-letter queue now changes nothing retroactively: a DLQ only captures deliveries that fail after the queue exists, and there is nothing in it to redrive. The retry settings are also forward-looking and are capped at 24 hours of event age, so raising them cannot resurrect events whose delivery attempts already ended. CloudTrail does not record the event payloads that flow through an event bus, so there is nothing in the trail to rebuild the events from.

Why C

A State Manager association is the Systems Manager feature built for keeping instances in a defined state: it targets by tag so newly launched instances are picked up without any registration step, it reapplies on a schedule, and it records association compliance per instance. User data runs once at launch and cannot repair an instance that drifts hours later. A scheduled Run Command invocation reapplies the state but has no association compliance record and no automatic handling of instances that appear between runs. A custom Config rule detects the problem and then hands it to a human, which is neither continuous enforcement nor low overhead.

Why B

Anomaly detection trains a model on up to two weeks of history and learns the daily and weekly seasonality, producing a band that is wide overnight and tight at midday; alarming on LessThanLowerThreshold against that band therefore ignores the expected nightly trough and catches a 30 percent midday shortfall without anyone maintaining numbers. Twenty-four per-hour alarms encode the seasonality by hand and have to be re-derived every time traffic grows. Summing over a 24-hour period smooths the trough away but also smooths away the outage — a 30 percent dip for a few hours barely moves a daily total. A composite alarm evaluates other alarms and has no notion of time of day, so it cannot express a business-hours window on its own.

Why B and E

Secrets Manager is the only option here that both stores the credential and rotates it on a schedule, and CodeBuild's SECRETS_MANAGER environment variable type resolves the secret at build time so the value never appears in the project definition, the repository, or the build log. A plaintext project environment variable is visible to anyone who can read the project and is echoed in logs, and it still never rotates. Parameter Store SecureString solves the storage problem but has no rotation of its own, so the 30-day requirement would go unmet. Committing KMS ciphertext keeps a long-lived secret in the repository, where anyone with decrypt permission and the repository can recover it, and the value is still never rotated.

Why C and E

A CodeBuild build inside a VPC runs behind an elastic network interface that never receives a public IP address, so outbound access has to come from either a NAT gateway or VPC endpoints. A NAT gateway in a public subnet gives the build general outbound reachability, and interface endpoints for the two ECR services plus the S3 gateway endpoint carry the image layer and artifact traffic privately. Routing the private subnets straight at an internet gateway does not help, because an interface with no public address cannot use it. There is no public IP assignment option for VPC-configured builds. Security groups are stateful, so the replies to outbound requests are already allowed and an inbound rule changes nothing.

Why D

Vault Lock in compliance mode is the only one of these that survives an administrator: once the cooling-off period expires, the lock and its retention floor cannot be changed or removed by any principal, including the account root user and AWS Support, which is precisely the evidence an auditor asks for. An IAM deny on operator roles is edited away by anyone holding administrative permissions. A service control policy is stronger but is still mutable by the organization's management account, and it does not apply to that account's own principals. S3 Object Lock is a real immutability control, but AWS Backup recovery points live in service-managed vaults rather than in a customer bucket, so there is no bucket on which to set it.

Why D

Lambda asynchronous invocation destinations cover both halves of the requirement: an on-failure destination receives an invocation record for events that exhaust their retries, and an on-success destination receives one for events that complete, each record carrying the request context and the response or error payload. A Lambda dead-letter queue is the older mechanism and carries only the event payload, with no error detail and no success path. A dead-letter queue on the EventBridge rule target captures only events EventBridge failed to deliver, which is a different failure from a function that was invoked and then threw. The try/catch approach is code the team maintains and cannot capture timeouts or out-of-memory terminations.

Why D

CloudFormation treats removal on stack deletion and removal caused by a replacing update as two separate events governed by two separate attributes, and both accept Snapshot for a resource type that supports snapshots, such as an Aurora cluster. Setting both to Snapshot produces a restorable copy in each case and lets CloudFormation delete the old cluster afterward, so nothing keeps billing. DeletionPolicy alone leaves the replacement path uncovered, and the replaced cluster would be deleted with no snapshot. UpdateReplacePolicy with Retain covers only the update and leaves the old cluster running. Retain on both preserves the data but abandons two live clusters that nobody is tracking.

Why A

Embedded metric format lets the application emit one structured log line that carries both the metric values and the high-cardinality context; CloudWatch parses the declared dimension sets into metrics out of band, so the request path only writes a log line and never calls the CloudWatch API, which removes both the added latency and the throttling. Batching PutMetricData reduces call volume but still puts an API call, its retries, and its failure modes on the critical path. Per-tenant metric filters collapse immediately against the metric-filter-per-log-group quota, and 4,000 of them would be unmanageable in any case. Dropping the tenant dimension keeps the raw data but gives up alarmable, chartable per-tenant metrics.

Why B

Multi-Region keys exist for this case: a primary and its replicas share key ID and key material, so ciphertext produced under one can be decrypted by another without a cross-Region call, while each replica keeps its own editable key policy. Two independent keys have different key material and different key IDs regardless of their aliases, so a decrypt attempt in the other Region fails. AWS managed keys are per-Region and per-service, cannot be made interoperable, and give the security team no policy control. KMS never allows the key material of a KMS-generated key to be exported, and imported material placed in two keys still produces two distinct key ARNs, so ciphertext bound to one cannot be decrypted by the other.

Why A

Actions in the same stage that share a runOrder value run in parallel, and CodePipeline does not begin a higher runOrder until every action at the lower value has succeeded, so one stage with the deploys at runOrder 1 and the test at runOrder 2 gives both the concurrency and the barrier the team asked for. Splitting the deploys into separate stages serializes them and roughly doubles the stage time for no benefit. Giving the deploys different runOrder values inside one stage serializes them just as thoroughly. Two pipelines plus a timed test removes the dependency guarantee entirely — a slow deploy would let the smoke test run against a half-updated fleet.

Why C and E

Failover routing is what makes the switch automatic: Route 53 returns the primary answer while the health check attached to the primary record is healthy and returns the secondary answer once it is not, with no human editing records. The TTL is what decides how long resolvers keep serving the old answer after that switch, so a 3,600-second TTL is the direct cause of the 40-minute tail and lowering it to 60 seconds is the other half of the fix. Raising the TTL makes the tail dramatically worse. A health check on the secondary record alone gives Route 53 nothing to evaluate for the failover decision, which is driven by the primary. A private hosted zone only answers inside associated VPCs and would take the public name offline.

Why C

Asynchronous invocation is at-least-once by design, so the fix belongs in the function's own write path: a key derived deterministically from the object's identity, combined with a condition that the item does not exist, makes a repeated invocation a no-op instead of a second row. Setting retries to 0 removes duplicates by removing the recovery the team still wants, so a single throttled write would silently lose the object. Raising the timeout and write capacity reduces how often retries happen but does nothing about the ones that still occur. Reserved concurrency of 1 only serializes invocations, and a retried invocation running alone writes the duplicate just as readily.

Why B

CodeArtifact is the managed package repository for exactly this shape: builds authenticate to one endpoint, an upstream external connection fetches a public package the first time it is requested, and the package is then retained in the domain so later builds resolve it internally and reproducibly, while internal libraries are published to the same repository. An S3 bucket does not implement the npm registry protocol, so an npm client cannot resolve metadata or versions against it. ECR stores container images and OCI artifacts, not npm packages an install step can resolve. Committing node_modules bloats the repository, breaks native modules across platforms, and gives no provenance record at all.

Why D

X-Ray sampling rules are evaluated in priority order and can match on service name, HTTP method, URL path, and host, so a high-priority rule scoped to the checkout path with a generous reservoir and a full fixed rate traces essentially every checkout request while all other traffic continues to fall through to the default rule — targeted coverage without a platform-wide cost increase. Setting the default rule to 100 percent traces all 9,000 requests per second, which is the expense the scenario rules out. An Application Load Balancer does not sample traces; it only injects or forwards a trace header. A metric filter produces a count from log data and cannot add trace segments or nodes to the service map.

Why A

A gateway endpoint keeps S3 traffic on the AWS network instead of the NAT path, and its endpoint policy decides which buckets that traffic may address, so scoping it to the organization's bucket ARNs blocks exfiltration to an attacker-owned bucket. A security group referencing the S3 prefix list restores private connectivity only alongside an endpoint and cannot distinguish one bucket from another, because every bucket shares the same addresses. A bucket policy with a source endpoint condition protects the company's own buckets from outside callers but says nothing about what the instances may reach, the exfiltration path in question. Network ACL rules built on published IP ranges are brittle and again cannot express bucket identity.

Why B and C

AutoScalingRollingUpdate controls the shape of the rolling replacement, and the batch size of two with ten instances kept in service is the direct expression of the capacity requirement. Turning on WaitOnResourceSignals makes CloudFormation hold each batch until the new instances signal success within the pause time, and a batch that times out fails the update and rolls it back, which is the safety net the team is missing. Setting MinInstancesInService to the full desired capacity is rejected, because it must be lower than the group maximum size for any instance to be replaced. A CreationPolicy applies only when the group is first created and is ignored during updates. A stack policy denial blocks the update rather than making it safe.

Why A

A termination lifecycle hook is the supported way to insert custom work between the scale-in decision and the actual termination: the instance sits in Terminating:Wait for the heartbeat timeout, an EventBridge rule drives the drain-and-upload automation, and CompleteLifecycleAction releases the instance as soon as the work is done. Deregistration delay only governs how long a load balancer keeps draining existing connections, and these workers pull from a queue rather than receiving load balancer traffic, so nothing is deregistered. Termination protection does not apply to Auto Scaling scale-in. Cooldown controls how soon the next scaling activity may start, not what happens to an instance already being terminated.

Why D

Amazon Q Developer in chat applications (formerly AWS Chatbot) is the managed integration for this: it renders CloudWatch alarm notifications from an SNS topic into a formatted Slack message with links, and its channel IAM role plus channel guardrail policies bound which commands members may run from the channel, which is how read-only diagnostics are made safe. The Lambda and webhook approach delivers the notification but is code the team maintains, and it offers no way to run commands back into the account. An email subscription pointed at a channel address loses the formatting and the links and again supports no commands. An EventBridge API destination calling Slack directly means owning the bot token, the connection, and the message payloads, with the same missing command path.

Why C

A reports section in the buildspec tells CodeBuild to ingest the named result files into a report group after the build, and the console then shows per-test outcomes, durations and the pass-rate trend for the group across builds — no extra service and no code. Writing the XML to S3 and querying it with Athena reproduces that view by hand, complete with a table, a schema and a query to maintain. A pair of CloudWatch metrics gives a trend line but throws away every individual test name and failure message. Failing the build on a nonzero exit code is worth doing anyway, but it reports only that something broke, not which test or how the rate is moving.

Why B

A Synthetics canary generates its own traffic on a schedule and can assert far more than a status code, so it turns an unused endpoint into a continuously measured one and produces a SuccessPercent metric that alarms within a couple of intervals regardless of customer activity. An alarm on 5XX counts is defeated by exactly the condition described: with no requests there are no datapoints, so the alarm sits in INSUFFICIENT_DATA and never fires. CloudWatch RUM instruments real browser sessions and is therefore just as blind during a quiet weekend. Repointing the target group health check at the settlement path would mark otherwise healthy targets as unhealthy the moment that code path broke, turning one broken endpoint into a full outage.

Why C

Object-level S3 calls and Lambda Invoke calls are data events, which CloudTrail does not log by default and bills separately, so they must be requested explicitly. Advanced event selectors narrow data events by resource ARN, which keeps the cost to one bucket and two functions instead of the whole account. Management events never include GetObject, PutObject, or Invoke, so the existing trail cannot answer the auditor. S3 server access logs are best-effort with no integrity guarantee, and function logs show what the code printed rather than who called it. CloudTrail Insights analyzes call-rate anomalies on top of events already being logged and records no per-object history of its own.

Why D

The Secrets Manager dynamic reference is resolved by CloudFormation when the resource is created or updated, and the resolved value is never stored in the template, in the parameter list or in the change set, which is exactly the set of exposures the security requirement names. A NoEcho parameter hides the value in the console but the deployment tooling still handles the plaintext and passes it over the API, so it is present in the caller command history. Stack exports are plaintext by design and are readable by anything in the account, so exporting a password is the worst option here. The plain ssm dynamic reference does not support SecureString parameters, so that reference fails rather than decrypting anything.

Why C

A warm pool keeps instances that have already booted, joined the domain, and warmed their cache in a stopped state, so a scale-out only has to start them — seconds to a couple of minutes instead of eleven — and stopped instances incur storage cost rather than full instance cost, which is what keeps the steady-state bill down. Larger step adjustments change how many instances are requested, not how long each one takes to become useful, so the eleven-minute initialization still dominates. Raising the minimum to peak solves the latency at exactly the cost the business rejected. Predictive scaling forecasts from historical cyclical patterns and has nothing to learn from spikes driven by unpredictable news events.

Why C and D

Service Quotas publishes usage metrics for supported quotas and can create a CloudWatch alarm against the applied quota value, so an 80 percent threshold warns the team while there is still headroom rather than after requests are rejected. Raising the quota through Service Quotas before the event is the other half, and a quota request template propagates the same value to accounts created later. An alarm on the Throttles metric is by definition too late, because throttling is the customer-visible failure. Trusted Advisor limit checks refresh on their own cadence and require someone to look, the manual step that failed last time. Reserved concurrency carves capacity out of the same account quota rather than adding any.

Why A

The minimum healthy percent is the floor the scheduler must keep running, and the maximum percent is the ceiling of running plus pending tasks, so a floor of one hundred with a ceiling of two hundred lets Amazon ECS start replacement tasks alongside all eight existing ones and only drain an old task once a new one is healthy. A floor of fifty allows half the tasks to be stopped first, which is the dip the team is trying to remove. A floor and a ceiling both at one hundred leaves no headroom to launch anything, so a rolling deployment cannot make progress. A floor of zero permits the scheduler to stop every task before starting replacements, which is a full outage.

Why D

CloudWatch cross-account observability is purpose-built for this: source accounts are linked to a monitoring account through the organization, and the monitoring account can then search logs, graph metrics, and view service maps across every linked account in one console, without copying telemetry anywhere or writing code. Cross-account role switching is what the team already does and is the problem being solved. Centralizing every log event with subscription filters duplicates ingestion and storage cost for 60 accounts and still leaves metrics and traces stranded in the source accounts. A scheduled Lambda that re-publishes metrics creates a fragile pipeline to own, doubles custom metric charges, and loses the original resource context.

Why B

A cross-account role removes long-lived credentials, and the external ID condition addresses the confused deputy problem that multi-tenant vendors create: without it, any other customer of the vendor could persuade the vendor's platform to assume this company's role, because the role ARN is all that is needed. Requiring the vendor-issued identifier ties an assume-role call to this specific customer relationship. An IAM user hands out static keys the company must rotate and cannot easily revoke. A role that trusts the vendor account with no condition is the confused deputy case itself. Storing user keys in Secrets Manager only moves the same long-lived credentials somewhere else.

Why A and D

StackSets operations from anywhere other than the management account require the account to be registered as a delegated administrator for the service, which is the first half of the requirement. Service-managed permissions are what allow an organizational unit to be used as a target and are the prerequisite for automatic deployment, which puts the stack into accounts that join that unit later. Self-managed permissions cannot target an organizational unit and force an execution role to be created in every account, including future ones. Service-managed permissions with automatic deployment disabled misses new accounts. A conformance pack deploys Config rules and remediation configurations, not an arbitrary detection stack.

Why A and C

The duplicates come from a visibility timeout shorter than the processing time: at 30 seconds the message becomes visible again while the first consumer is still rendering it, so a second consumer picks it up, and raising the timeout past the worst-case duration ends that. The perpetual retries need a redrive policy, which moves a message to a dead-letter queue once the receive count exceeds the configured maximum, isolating poison messages for inspection. A FIFO queue shortens nothing and would let one malformed message stall an entire message group. Cutting retention to an hour discards legitimate backlog along with the bad messages. Long polling reduces empty receives and request cost, and does not affect redelivery or poison messages.

Why A

Containment here has three parts, and an Automation runbook driven by an EventBridge rule on the GuardDuty finding performs all of them in one documented, repeatable step: removing the instance from the target group stops customer traffic, an isolation security group with no rules cuts the network path, and EBS snapshots preserve the disks for the investigation. Terminating the instance contains the threat but destroys the evidence the team was asked to keep. GuardDuty has no remediation capability of its own; it produces findings and leaves the response to EventBridge targets. Replacing the subnet's network ACL isolates every instance in that subnet, not just the compromised one, so it converts a contained incident into a wider outage.

Why B

Every CodePipeline action publishes output variables under a namespace, and a source action exposes CommitId there, so a later action can reference it with the namespaced syntax in its own configuration. Pipeline-level variables are a V2 feature whose values are supplied when a release is started and are referenced the same way, which covers the label without a pipeline edit. Writing the commit ID to Parameter Store adds a component and races between concurrent executions. The CodeBuild resolved source version does give the commit but leaves the label hardcoded, so the second requirement fails. The two invented CodePipeline environment variables do not exist and nothing would be injected.

Why A

CloudTrail Lake is a managed, immutable event data store with its own SQL query engine and a retention period configurable up to seven years or more, and an organization-level store collects events from every member account without any per-account wiring — there is no table, crawler, or partition scheme to own. The Glue-and-Athena route works and is cheaper per query, but it is precisely the partitioning and cataloging maintenance the team is trying to escape. CloudTrail Insights only surfaces anomalies in API call rates and error rates; it is not a general query facility. Forwarding through EventBridge sees management events as they occur but not three years of history, and it adds an OpenSearch cluster to size, secure, and pay for.

Why D

Account-level block public access applies to every existing and future bucket in the account, and denying the API that changes it through a service control policy is what turns the setting into a guarantee rather than a default someone can undo. An access point with its own policy then carries the partner's prefix-scoped access without reopening the bucket policy. Bucket-level settings alone leave every newly created bucket to be configured again. A Config rule is detective: it reports the exposure after it exists rather than preventing it. Denying only the bucket ACL API leaves bucket policies and object ACLs as open paths to a public object, and a partner IAM user means issuing long-lived credentials the company must rotate.

Why C

CloudFormation Guard evaluates a template against declarative rules written in its own policy language, so the governance team can express both conditions as rules, keep them in a repository, and fail a build action on any violation before a stack is touched. AWS Config rules evaluate resources that already exist, which is detection after the fact rather than prevention in the pipeline. cfn-lint validates templates against the resource specification and catches malformed properties and bad references, but it does not express organization-specific policy such as a required encryption block. A stack policy governs which existing logical resources may be changed by an update and cannot inspect resource properties at all.

Why B

Provisioned concurrency keeps initialized environments ready so bursts hit warm code, Application Auto Scaling scheduled actions raise it just before the predictable hourly peak and lower it afterwards to control cost, and reserved concurrency is a separate setting that caps the function at 200 — the two solve different halves of the requirement. Reserved concurrency alone only sets a limit and pre-initializes nothing, so every burst still pays the 2.5-second cold start. Provisioned concurrency cannot be configured on $LATEST at all — it requires a published version or an alias — and that option also leaves the partner limit unenforced. Scheduled warm-up invocations keep one or two environments alive, nowhere near 150.

Why C

Session Manager reaches the instance through an outbound connection the SSM Agent makes, so no inbound port and no bastion are needed, and the three interface endpoints keep that connection inside the VPC for instances with no internet route. Access is granted through IAM rather than keys, and session logging to S3 and CloudWatch Logs produces the command record the compliance team requires. A bastion is forbidden outright by the policy. EC2 Instance Connect still speaks SSH on port 22 and therefore needs inbound access to the instance, and it produces no keystroke record. Client VPN plus a shared private key reintroduces exactly the long-lived key the policy bans and again logs nothing about what was typed.

Why D

In an ECS blue/green deployment the replacement task set becomes reachable on the test listener partway through, and the hook that fires at that point is the one whose Lambda function is meant to validate the new task set; returning a failed status from it stops the deployment and rolls back before any production traffic shifts. The hook that runs after production traffic has already moved is too late to protect customers. ApplicationStart belongs to EC2 and on-premises deployments driven by an AppSpec script section, not to ECS. The hook that runs before installation fires before the replacement task set exists, so there is nothing for the contract test to call.

Why A and E

A VPC flow log at the network interface level records the IP traffic metadata that settles the argument — source, destination, port, protocol, packet and byte counts, and an action of ACCEPT or REJECT — and it is enabled entirely from the VPC console with no agent and no restart. Logs Insights then turns those records into the actual answer, because grouping by action on destination port 8443 distinguishes packets that never arrived from packets that arrived and were rejected by a security group or network ACL. S3 server access logging describes bucket requests, not TCP traffic to an instance. CloudTrail data events for EBS are not a way to observe network flow. AWS Config captures configured rules, not dropped packets.

Why A and D

Amazon Inspector is the continuous scanner: activated for the organization, it covers ECR images, EC2 instances, and Lambda functions, and it re-evaluates existing resources when new vulnerabilities are published rather than only at push time. The gate is a separate job, so a pipeline stage that queries the findings for the exact image digest and fails on a critical severity is what actually stops the deployment. ECR basic scanning runs only on push, covers operating system packages, and does not rescan as new CVEs appear. A weekly third-party scan is code and schedule the team owns and leaves a six-day window. Security Hub aggregates and normalizes findings from scanners such as Inspector but performs no scanning and blocks no deployment.

Why A

EC2 Image Builder is the managed image pipeline service, and each requirement maps to one of its parts: build components install and harden, test components gate the release of the image, a distribution configuration copies the finished AMI into named Regions and shares it with named accounts, and the pipeline schedule runs the whole thing monthly. A Packer pipeline reproduces all of that but leaves the team owning a template, a build project, a test harness and the copy and share calls. A Systems Manager Automation runbook can build an image but has no test gate or distribution model, so both would be hand-written. Doing it interactively every month is unrepeatable and produces no record of what was applied.

Why C

Global Accelerator gives clients two static anycast IP addresses that never change, satisfying the allow-listing requirement, and it makes failover a network-layer decision rather than a DNS one: when an endpoint group's health checks fail, traffic is withdrawn and rerouted over the AWS backbone within seconds, so a client that caches DNS forever still lands on a healthy Region. Lowering the TTL does not help clients that already ignore it, and load balancer DNS names resolve to changing addresses. CloudFront is optimized for HTTP caching, its origin failover covers only specific request methods and status codes, and its published address ranges are large and change. Failover routing is still DNS and inherits the same caching problem.

Why D

Macie is the managed sensitive data discovery service: it inventories buckets, scans objects on a schedule, ships managed data identifiers for card numbers and national identifiers, accepts a custom data identifier for a house-specific pattern such as the employee format, and publishes findings that Security Hub picks up. The Glue and Athena approach sees only data that can be crawled into a table, misses everything unstructured, and makes the compliance team own a library of regular expressions. GuardDuty S3 protection analyzes API activity for anomalous access and never inspects object content. Amazon Inspector scans instances, images, and functions for software vulnerabilities and performs no data classification.

Why B

A V2 pipeline trigger can be built on pull request events rather than pushes, and the event list distinguishes a pull request being opened from one being updated with a new commit, which together give the refresh behavior reviewers asked for. The branch filter on a pull request trigger matches the destination branch, so scoping it to main ignores pull requests aimed elsewhere, and the file path exclusion suppresses documentation-only changes. A push trigger on feature branches starts runs for exactly the pushes that should start nothing. A push trigger on main fires after a merge rather than before review. Periodic change detection polls the branch and knows nothing about pull requests.

Why B and D

A metric filter is what turns a text pattern in a log group into a numeric CloudWatch metric, and a metric alarm on that metric expresses the threshold of 20 in five minutes; treating missing data as not breaching keeps the alarm quiet during periods with no matching lines. CloudWatch alarms support a Systems Manager OpsCenter action, so entering ALARM can create an OpsItem directly, which is the no-code half of the requirement. Logs Insights saved queries run on demand and cannot be scheduled to raise alerts. A subscription filter into Firehose moves the raw lines to S3 but leaves counting and alerting to something else. Container Insights collects CPU, memory, and task-level performance metrics, not application error strings.

Why B

A permissions boundary caps the effective permissions of a principal, and the iam:PermissionsBoundary condition key lets the platform team require that any role a lead creates carries the AppBaseline boundary, while denying changes to the policy itself closes the obvious bypass. Because the constraint sits in the leads' own policies, the platform team's automation is untouched. Attaching AppBaseline as a plain managed policy sets a floor rather than a ceiling, since a lead can add an inline policy that grants more, and the weekly review finds that only afterward. A service control policy applies to every principal in the account, so it would clamp the platform automation too. IAM groups apply only to users and have no effect on roles.

Why B and E

Which patches are approved is decided by a baseline approval rule, and how long after release they are approved is the auto-approval delay, so two baselines with different delays is the only way to express the two policies. A baseline reaches instances through a patch group, and an instance joins one by carrying the Patch Group tag key with the matching value, after which each group patches in its own window and reports compliance. A single baseline with a seven-day delay withholds patches from development whenever the window runs, because a window controls timing rather than approval. The predefined baseline has one delay for everyone. A package upgrade run from State Manager abandons baselines and patch compliance data.

Why C

ACM renews the certificates it issues, and it does so without human action only when the validation method keeps proving domain ownership on its own, which is what leaving the DNS validation CNAME in the Route 53 zone provides; the load balancer then picks up the renewed certificate with no change. Private certificates issued through ACM from a private CA are managed the same way, retiring the annual self-signed replacement. Imported certificates are never renewed by ACM, so the expiration event produces only a better-timed ticket for the same manual work. Email validation asks a human to act on renewal mail, the step that failed over a holiday. The certbot job is custom infrastructure reimplementing what ACM already does.

Why C

Enhanced scanning is the ECR mode backed by Amazon Inspector and is the one that covers language package vulnerabilities alongside operating system packages, which the requirement names explicitly. Scanning is asynchronous, so the gate has to be an action that waits for completion, reads the findings, and fails the stage on a critical severity, which stops the pipeline before the deploy stage runs. Basic scanning covers operating system packages only, and reading results the instant the push succeeds usually finds the scan still running. Lifecycle policy rules select images by tag pattern, age or count, and cannot reference scan findings. A tag convention blocks nothing unless something applies the tag, and nothing here does.

Why D

The CDK stores assets and the roles it assumes during deployment in a per-environment toolkit stack, and the missing version parameter is the marker the toolkit uses to detect that the environment was never bootstrapped. Bootstrapping the account and Region creates the staging bucket, the asset repository for Docker images, the deployment roles and the version parameter, and the trust option authorizes the tooling account to assume those roles later. Disabling staging does not remove the need for a repository to hold image assets. Hand-building a bucket produces none of the roles or the version parameter that the toolkit looks for. The failure is a missing stack rather than a missing permission, so broad administrator rights change nothing.

Why A

A CodePipeline action that runs in a Region other than the pipeline Region needs an artifact bucket in that Region, declared in the pipeline artifact stores, and CodePipeline then copies the input artifact there before the action runs — the failure described is exactly the missing Regional store. Three separate pipelines work but triple the definitions to keep in step and lose the single release view, and they rebuild the artifact rather than promoting one. Bucket replication does not register a Regional artifact store, so the action still has nowhere to read from. AWS::Region is a read-only pseudo parameter that reports where the stack is being created and cannot be set to redirect a deployment.

Why B

A conformance pack is a packaged collection of Config rules and remediation actions deployed as a unit, and the organization form of it fans out from the management account or a delegated administrator to every member account, reporting compliance at the pack level as well as per rule — both the single-edit requirement and the single score follow directly. Sixty stacks of individual rules deliver the same evaluations but leave the team updating sixty stacks and aggregating the results by hand. A Security Hub standard has a fixed control set that cannot be replaced by an arbitrary list of 40 rules. Service control policies prevent actions rather than evaluate configuration, and they produce no compliance record at all.

Why C

A CodeConnections connection starts in a pending state and is completed through a one-time browser handshake that installs the AWS connector application on the GitHub organization, so the trust is owned by the organization, no token is stored in AWS, and the connection manages repository event delivery for the pipeline. A machine-user token is still a long-lived secret that somebody has to rotate and that a repository administrator can revoke by accident. An S3 source plus an uploader workflow works but discards commit metadata and adds a bundle-publishing step to maintain. A scheduled mirror into another repository service introduces a second copy of the truth and a delay between push and pipeline start.

Why A and C

SAM implements gradual deployment by handing a function alias to AWS CodeDeploy, and the alias only exists when AutoPublishAlias is set — without it the deployment preference has nothing to shift and the setting is ignored. The deployment preference itself supplies the canary shape and the alarm list that CodeDeploy watches, and a breaching alarm during the shift reverts the alias to the previous version. The all-at-once type moves everything in one step and gives the alarm no window. Provisioned concurrency changes cold-start behavior and plays no part in traffic shifting. An API Gateway canary stage splits only HTTP traffic through that stage and offers no automatic rollback of the function version.

Why D

A manual approval action halts the stage until an authorized principal approves or rejects, publishes the request to the configured SNS topic so subscribers receive it by email, and carries a review URL, while the approver identity and comment are recorded in the execution history for the auditors. Passing the build stage output artifact into all three deploy actions is what guarantees that the bits deployed to production are the bits staging tested. Rebuilding from the same commit produces a different artifact from a different toolchain state, which is what the auditors forbade. A DynamoDB polling function reinvents approval with no audit identity. Three pipelines that each rebuild break artifact identity as well.