Operational excellence pillar in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a CloudWatch alarm that monitors CPU utilization.

AWS

resource "aws_cloudwatch_metric_alarm" "cpu_alarm" {
  alarm_name          = "HighCPU"
  comparison_operator = "[1]"
  evaluation_periods  = 2
  metric_name         = "CPUUtilization"
  namespace           = "AWS/EC2"
  period              = 300
  statistic           = "Average"
  threshold           = 80
  alarm_description   = "Alarm when CPU exceeds 80%"
}

Drag options to blanks, or click blank then click option'

ALessThanThreshold

BNotEqualToThreshold

CEqualToThreshold

DGreaterThanThreshold

Attempts:

3 left

💡 Hint

Common Mistakes

Using LessThanThreshold will alert when CPU is low, which is not desired here.

Using EqualToThreshold is too strict and rarely triggers.

The alarm triggers when CPU utilization is greater than the threshold, so GreaterThanThreshold is correct.

2fill in blank

medium

Complete the code to enable detailed monitoring on an EC2 instance.

AWS

resource "aws_instance" "web" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"
  monitoring    = [1]
}

Drag options to blanks, or click blank then click option'

A"enabled"

Bfalse

Ctrue

D"detailed"

Attempts:

3 left

💡 Hint

Common Mistakes

Using string values like "enabled" or "detailed" instead of boolean true.

Setting monitoring to false disables detailed monitoring.

Setting monitoring = true enables detailed monitoring on the EC2 instance.

3fill in blank

hard

Fix the error in the CloudFormation snippet to correctly create an S3 bucket with versioning enabled.

AWS

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-app-bucket
      VersioningConfiguration:
        Status: [1]

Drag options to blanks, or click blank then click option'

AEnabled

Benabled

CTrue

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Using lowercase 'enabled' causes deployment failure.

Using boolean true or True is invalid here.

The Status property must be Enabled with a capital E in CloudFormation.

4fill in blank

hard

Fill both blanks to create an IAM policy statement that allows reading objects from a specific S3 bucket.

AWS

Statement:
  - Effect: Allow
    Action: [1]
    Resource: [2]

Drag options to blanks, or click blank then click option'

A"s3:GetObject"

B"s3:PutObject"

C"arn:aws:s3:::example-bucket/*"

D"arn:aws:s3:::example-bucket"

Attempts:

3 left

💡 Hint

Common Mistakes

Using PutObject action instead of GetObject.

Specifying the bucket ARN without /* does not cover objects.

The action to read objects is s3:GetObject, and the resource must include the bucket path with /* to specify objects inside the bucket.

5fill in blank

hard

Fill all three blanks to define a CloudWatch Logs subscription filter that sends error logs to a Lambda function.

AWS

resource "aws_cloudwatch_log_subscription_filter" "error_filter" {
  name            = "ErrorFilter"
  log_group_name  = [1]
  filter_pattern  = [2]
  destination_arn = [3]
}

Drag options to blanks, or click blank then click option'

A"/aws/lambda/my-function"

B"ERROR"

C"arn:aws:lambda:us-east-1:123456789012:function:my-lambda-function"

D"/aws/logs/my-log-group"

Attempts:

3 left

💡 Hint

Common Mistakes

Using the Lambda function name as log group name.

Using incorrect filter pattern syntax.

Confusing destination ARN with log group name.

The log_group_name must be the log group to monitor, filter_pattern is the keyword to filter logs (like 'ERROR'), and destination_arn is the Lambda function ARN receiving the logs.

Practice

1. What is the main goal of the Operational Excellence pillar in AWS Well-Architected Framework?

easy

A. To optimize costs and reduce spending

B. To secure data and control access to resources

C. To improve and automate processes for better system reliability and efficiency

D. To design systems for high availability and fault tolerance

Solution

1. Step 1: Understand the focus of Operational Excellence

   Operational Excellence focuses on running and monitoring systems to deliver business value and continually improve processes.

2. Step 2: Differentiate from other pillars

   Security focuses on protection, Cost Optimization on spending, Reliability on availability. Operational Excellence is about process improvement and automation.

3. Final Answer:

   To improve and automate processes for better system reliability and efficiency -> Option C

4. Quick Check:

   Operational Excellence = process improvement and automation [OK]

Hint: Operational Excellence = improve processes + automation [OK]

Common Mistakes:

• Confusing Operational Excellence with Security or Cost Optimization
• Thinking it only covers system uptime
• Ignoring the importance of continuous improvement

2. Which AWS service is primarily used to automate operational tasks and workflows?

easy

A. AWS Systems Manager

B. Amazon S3

C. Amazon RDS

D. AWS CloudTrail

Solution

1. Step 1: Identify services for automation

   AWS Systems Manager provides automation for operational tasks like patching, configuration, and runbook execution.

2. Step 2: Exclude unrelated services

   Amazon S3 is storage, Amazon RDS is database, CloudTrail is for logging API calls, not automation.

3. Final Answer:

   AWS Systems Manager -> Option A

4. Quick Check:

   Automation service = AWS Systems Manager [OK]

Hint: Automation in AWS? Think Systems Manager [OK]

Common Mistakes:

• Choosing storage or database services for automation
• Confusing logging services with automation
• Not knowing AWS Systems Manager capabilities

3. Consider this AWS CloudWatch alarm configuration snippet:

{
  "AlarmName": "HighCPU",
  "MetricName": "CPUUtilization",
  "Namespace": "AWS/EC2",
  "Statistic": "Average",
  "Period": 300,
  "EvaluationPeriods": 2,
  "Threshold": 80,
  "ComparisonOperator": "GreaterThanThreshold"
}

What happens when the average CPU utilization exceeds 80% for 10 minutes?

medium

A. The alarm triggers after two consecutive 5-minute periods above 80%

B. The alarm triggers immediately when CPU exceeds 80%

C. The alarm never triggers because threshold is too high

D. The alarm triggers only if CPU stays above 80% for 30 minutes

Solution

1. Step 1: Understand EvaluationPeriods and Period

   The alarm evaluates CPU utilization every 5 minutes (Period=300 seconds) and requires 2 consecutive periods above threshold.

2. Step 2: Calculate total time to trigger

   2 periods x 5 minutes = 10 minutes of CPU > 80% triggers the alarm.

3. Final Answer:

   The alarm triggers after two consecutive 5-minute periods above 80% -> Option A

4. Quick Check:

   EvaluationPeriods x Period = trigger time [OK]

Hint: Alarm triggers after EvaluationPeriods x Period time above threshold [OK]

Common Mistakes:

• Thinking alarm triggers immediately on threshold breach
• Ignoring EvaluationPeriods count
• Misunderstanding Period as total time

4. You have an AWS Lambda function that fails intermittently. Which step helps you debug and improve operational excellence?

medium

A. Remove error handling code to simplify the function

B. Enable detailed CloudWatch Logs and set up alarms on error metrics

C. Manually restart the Lambda function every hour

D. Disable all logging to improve performance

Solution

1. Step 1: Use monitoring to detect issues

   Enabling detailed logs and alarms helps identify failure causes and patterns.

2. Step 2: Avoid harmful practices

   Disabling logs hides problems, manual restarts are inefficient, removing error handling worsens reliability.

3. Final Answer:

   Enable detailed CloudWatch Logs and set up alarms on error metrics -> Option B

4. Quick Check:

   Monitoring + alarms = better debugging [OK]

Hint: Use logs and alarms to find and fix errors [OK]

Common Mistakes:

• Turning off logs to 'speed up' functions
• Ignoring automated monitoring tools
• Relying on manual fixes instead of automation

5. A company wants to improve operational excellence by automating incident response for their EC2 fleet. Which combination of AWS services best achieves this?

hard

A. Amazon RDS + Amazon DynamoDB + AWS Elastic Beanstalk

B. Amazon S3 + AWS Glue + Amazon Athena

C. AWS IAM + AWS KMS + AWS Shield

D. AWS Systems Manager Automation + Amazon CloudWatch Events + AWS Lambda

Solution

1. Step 1: Identify services for automation and event-driven response

   AWS Systems Manager Automation runs operational tasks, CloudWatch Events detect incidents, Lambda executes custom code.

2. Step 2: Exclude unrelated services

   S3, Glue, Athena are for data analytics; IAM, KMS, Shield focus on security; RDS, DynamoDB, Elastic Beanstalk are for databases and app deployment.

3. Final Answer:

   AWS Systems Manager Automation + Amazon CloudWatch Events + AWS Lambda -> Option D

4. Quick Check:

   Automation + event detection + code execution = incident response [OK]

Hint: Combine automation, events, and Lambda for incident response [OK]

Common Mistakes:

• Choosing unrelated data or security services
• Not combining event detection with automation
• Ignoring Lambda's role in custom logic