Task 1.2: Identify and remediate issues by using monitoring and availability metrics.

• ARaise the function's timeout to the maximum of 15 minutes so that the invocations can complete

  Incorrect

  The timeout limits how long a running invocation may take. A function that is never invoked is not timing out.

• BAdd a statement to the function's resource-based policy that allows EventBridge to invoke it

  Correct

  Without permission, EventBridge cannot invoke the target. The troubleshooting guide's first check for this symptom is the function's policy (aws lambda get-policy).

• CAdd the events:PutEvents permission to the function's execution role

  Incorrect

  The execution role grants the function permission to call other services. It does not let EventBridge call the function.

• DCreate an archive on the event bus and replay the events from it

  Incorrect

  A replay sends the archived events to the bus again, and the rule would fail to invoke the function for the same reason.

The EventBridge console sets the target's permissions for you; from the CLI the engineer adds them, for example with aws lambda add-permission for the events.amazonaws.com principal. A rule that matches but never reaches its function points first at that permission.

• ADeploy it with an AWS CloudFormation StackSet whose maximum concurrent accounts is set to 15

  Incorrect

  StackSet operation preferences control how many accounts receive a stack at once. They do not run a runbook on instances.

• BBake the change into a new AMI with an EC2 Image Builder pipeline

  Incorrect

  Image Builder creates new images; the running instances would not change until they were replaced.

• CRun it with targets set to the tag Env=prod, a concurrency of 15 and an error threshold of 3

  Correct

  Automation rate controls limit how many targets run at once and stop the rollout after the error threshold is passed: with 3, it stops at the fourth error.

• DAdd it as the remediation action of an AWS Config conformance pack in the account

  Incorrect

  A conformance pack bundles Config rules and remediation for noncompliant resources. It does not offer a controlled one-time rollout across tagged instances.

Targeting by tag creates one child automation per instance, and rate controls (concurrency and error threshold) pace the rollout and halt it when too many fail.

• AAdd the instance-id and state fields to the rule's event pattern

  Incorrect

  The event pattern decides which events match the rule. It does not change the content that is sent to the target.

• BCreate an archive for the event bus with the same event pattern

  Incorrect

  An archive stores events so that they can be replayed later. It does not reformat what the target receives.

• CAdd a subscription filter policy to the email subscription of the SNS topic

  Incorrect

  A filter policy chooses which messages a subscriber receives, not how the message text looks.

• DConfigure an input transformer with an input template on the rule's target

  Correct

  The input transformer reads values from the event with JSON paths and builds the text that EventBridge sends to the target instead of the original event.

Event patterns select, archives keep, filter policies route; only the input transformer rewrites the event before it reaches the target.

• AThe rule has no IAM role that allows EventBridge to read EC2 events

  Incorrect

  EventBridge needs permissions to call a rule's targets. The default event bus receives events from AWS services automatically, so no role is involved in matching them.

• BThe pattern lists the state as an array, "state": ["stopped"]

  Incorrect

  Values in an event pattern are written as arrays; ["stopped"] is the correct form.

• CThe pattern specifies "source": ["ec2"]

  Correct

  EC2 events carry the source aws.ec2. A pattern that asks for ec2 never matches them.

• DThe rule's target has no dead-letter queue configured

  Incorrect

  A dead-letter queue keeps events that failed to reach a target. It plays no part in whether an event matches the rule.

• EThe rule was created on an event bus that the team created, not on the default event bus

  Correct

  AWS services send their events to the default event bus. A rule on another bus never sees EC2 state-change events.

A rule that never matches has a pattern or a bus problem. Compare the pattern with a real event (source aws.ec2, detail-type EC2 Instance State-change Notification) and make sure the rule sits on the default bus.

• ACreate an alarm that uses a CloudWatch anomaly detection model of the metric and fires outside the band

  Correct

  Anomaly detection learns the metric's hourly, daily and weekly patterns and alarms when the value leaves the band of expected values, above it, below it or both.

• BRaise the number of datapoints to alarm on the fixed-threshold alarm so that brief breaches are ignored

  Incorrect

  Datapoints to alarm only sets how many recent data points must breach. The threshold itself still ignores the time of day.

• CCreate a composite alarm from one high-threshold alarm and one low-threshold alarm

  Incorrect

  A composite alarm combines alarm states, but both underlying alarms still use fixed thresholds that do not follow the daily pattern.

• DTurn on CloudTrail Insights events to detect unusual activity in the account

  Incorrect

  CloudTrail Insights looks at the rate of AWS API calls and API errors, not at the traffic an application receives.

A metric with seasonality needs a threshold that moves with it. An anomaly detection alarm compares each value with the model's expected range for that moment.