AWS DevOps Automated Incident Response

1. Which SNS message attribute would you use to route incident alerts to different teams automatically?

MessageDeduplicationId

MessageGroupId

MessageAttributes for filtering

Timestamp

2. What is the key advantage of implementing automated rollback mechanisms in incident response?

Increases deployment frequency

Reduces MTTR by reverting failed changes instantly

Improves application logging

Reduces storage costs

3. How would you automatically notify on-call engineers when a critical incident is detected?

Use SNS with SMS and email subscriptions

Send logs to S3 only

Manual email notification

Store alerts in DynamoDB

4. Which AWS service helps you analyze and correlate multiple incident signals into a unified incident record?

AWS CloudFormation

AWS Systems Manager Incident Manager

AWS Elastic Beanstalk

AWS Glue

5. What is the primary purpose of using CloudWatch Alarms in automated incident response?

To display dashboard widgets

To trigger automated actions when thresholds are breached

To store historical logs

To manage user permissions

6. How does AWS Secrets Manager integrate with automated incident response for credential rotation?

It only stores secrets manually

It automatically rotates secrets and triggers Lambda functions

It does not support automation

It requires manual API calls

7. Which metric indicates a network-based incident that requires automated DDoS mitigation?

CPU spike on one instance

Abnormal traffic patterns and connection count surge

Disk usage increase

Memory allocation change

8. What is the benefit of using dead-letter queues (DLQ) in an incident response messaging system?

Faster message delivery

Capture failed messages for analysis and retry

Reduce storage costs

Improve encryption

9. How would you automatically restore a database to a known-good state after detecting corruption?

Manual snapshot and restore

Use AWS Backup with automated recovery runbooks

Delete and recreate the database

Use CloudFormation templates only

10. In an automated incident response setup, what is the role of AWS EventBridge?

To store incident logs

To route events from AWS services to targets for automated action

To manage user identities

To encrypt data in transit

11. Which AWS service allows you to create automated remediation workflows in response to AWS Config rule violations?

AWS Systems Manager

AWS Lambda

AWS CloudFormation

AWS OpsWorks

12. What does AWS GuardDuty detect that would trigger an automated incident response?

Configuration drift only

Malicious IP activity and unauthorized access patterns

Application performance issues

Storage capacity limits

13. How can you ensure that incident response runbooks are version-controlled and auditable?

Store them in S3 only

Use AWS Systems Manager Documents with version control

Keep them in local files

Use email for distribution

14. Which AWS service would you use to automatically isolate a compromised EC2 instance by modifying its security group?

AWS Systems Manager + Lambda

AWS Backup

AWS DataSync

AWS AppConfig

15. What is the main advantage of using Lambda functions in automated incident response workflows?

Lower cost and serverless execution

Better security than EC2 instances

Ability to manage databases

Built-in load balancing

16. In an automated incident response pipeline, which service detects unauthorized IAM permission changes?

AWS CloudTrail

AWS Trusted Advisor

AWS GuardDuty

AWS Security Hub

17. What metric would trigger an automated scaling response if CPU utilization exceeds 80% for 5 minutes?

Network throughput

Memory consumption

CPU utilization

Disk I/O operations

18. How does AWS Systems Manager Automation help in incident response?

It monitors API calls only

It executes predefined remediation runbooks automatically

It stores backup data

It manages DNS records

19. Which combination of services would you use to automatically terminate non-compliant EC2 instances?

CloudWatch + SNS + Manual review

AWS Config + Systems Manager + Lambda

VPC Flow Logs + CloudTrail + IAM

Route 53 + Auto Scaling + RDS

20. What is the primary purpose of AWS CloudWatch Events in an automated incident response architecture?

To store application logs

To trigger automated actions based on AWS resource state changes

To manage user access permissions

To encrypt sensitive data

AWS DevOps Engineer Automated Incident Response Quiz