Practice Test #2

A DLQ isolates poison messages after failed receives, but it does not increase normal processing throughput or reduce a healthy-message backlog. Trap: DLQs are good operational hygiene, but the symptom is delay under load.

NumberOfMessagesSent shows producer volume, and a longer visibility timeout does not make Lambda or DynamoDB process messages faster. Trap: Visibility timeout helps prevent duplicate work for long handlers, not backlog from insufficient capacity.

Lambda Throttles is useful to inspect, but increasing timeout changes maximum runtime rather than concurrency or throughput. Trap: Timeout sounds related to slow processing, but this workload needs more parallelism and write capacity.

An S3 deploy action treats reports as deployment content and does not include the required 90-day Lifecycle retention. Trap: S3 is the right storage target, but the pipeline deploy action is the wrong report control loop.

EventBridge and Lambda copying can work, but it is unnecessary custom glue when CodeBuild report handling and S3 Lifecycle cover the requirement. Trap: It includes the right building blocks, but violates the minimal-overhead signal.

CodePipeline does not provide a generic test action with buildspec report expiration as described; retention is enforced with S3 lifecycle policy, not a buildspec expiration field. Trap: It sounds like a native test feature, but the capabilities are not stated correctly.

Route 53 can change where clients resolve, but it cannot make the cross-Region read replica writable; CloudTrail is also not the right source for RDS failure notifications. Trap: DNS health checks help routing, but database role promotion is still required.

Aurora custom endpoints are scoped to a cluster and cannot be updated to point at a newly promoted cluster in another Region. Trap: Custom endpoints sound like endpoint management, but they do not solve cross-Region promotion.

Updating a CloudFormation stack during an incident is slower and more coupled than directly promoting the replica and updating runtime configuration. Trap: CloudFormation manages infrastructure state, but it is not the fastest incident response loop here.

Synthetics canaries test endpoints; they are not the native mechanism to scan a CloudWatch Logs group for JSON events. Trap: The one-minute probe interval looks similar, but it checks service health rather than log content.

GuardDuty analyzes supported telemetry sources and generates GuardDuty findings; it does not alert on this appliance's SEV-1 CloudWatch Logs entries. Trap: It is a security detection service, but it changes the detection source and severity taxonomy.

Firewall Manager manages firewall policies and compliance, not custom JSON log parsing from an IDS log group. Trap: The network-security wording makes it sound relevant, but the required control loop is log-to-alarm.

A management-account IAM user introduces unnecessary long-lived credentials and does not specifically grant only service-linked role creation. Trap: Cross-account roles are useful, but the management-account user and vague service scope violate least privilege.

PowerUserAccess grants broad service permissions and is far wider than the narrow IAM task in the question. Trap: MFA improves sign-in security, but it does not reduce the authorization blast radius.

An SCP that denies iam:* would block the required iam:CreateServiceLinkedRole action and cannot grant permissions. Trap: SCPs are central guardrails, but here the engineer needs a narrow allow, not an account-wide IAM deny.

Per-account IAM policies are local controls that administrators can alter and that do not provide the same organization-wide constraint on root in member accounts. Trap: IAM denies look preventive, but the scope and root-user requirement point to SCPs.

CloudWatch alarms can notify after logging is disabled, but they do not stop a principal from calling StopLogging or DeleteTrail. Trap: Monitoring is useful for detection, but the stem requires prevention.

AWS Config remediation can try to re-enable logging after a violation, but the API call can still succeed briefly and create an audit gap. Trap: Automatic remediation sounds strong, but it is corrective rather than preventive.

A weekly schedule cannot meet a 5-minute response requirement, and hibernation is not the requested stop/start remediation. Trap: It mentions EventBridge and SSM, but uses a polling pattern and the wrong action.

EC2 Auto Recovery responds to system status check failures; it is not the event-driven workflow for scheduled instance retirement. Trap: Auto Recovery sounds like EC2 self-healing, but retirement events require a different control loop.

A weekly reboot of every instance is not targeted, does not stop/start the affected EBS-backed instance, and does not remediate within 5 minutes of the AWS event. Trap: A maintenance window is operationally familiar, but it violates the timing and blast-radius requirements.

AfterBlockTraffic runs around blocking traffic from the original environment, not early setup on replacement instances. Trap: The word traffic sounds relevant, but the task is prerequisite configuration on the green hosts.

BeforeBlockTraffic is for actions before traffic is blocked from old instances, not for installing files on new instances. Trap: It occurs before a traffic operation, but not on the lifecycle path needed for green instance preparation.

DownloadBundle is handled by CodeDeploy and is not a hook you can define in appspec.yml to run a script. Trap: It appears in the lifecycle, but it is not an available custom hook.

ELB health checks observe registered targets after launch, but the question is about instances that fail during launch or initialization and may never become load balancer targets. Trap: Health checks are useful for unhealthy running instances, but not for launch errors.

Failed AttachInstances API calls are not the authoritative signal for failed instance launches, and CloudTrail delivery plus metric filters adds delay and complexity. Trap: CloudTrail is an audit log, but native ASG notifications are the operational event stream.

EC2 status check alarms apply to running instances and are operationally heavy for ephemeral Auto Scaling members; they do not directly detect ASG launch errors. Trap: Instance alarms can catch post-launch health problems, but not the failed launch condition.