Q: 8
A company is running an application on several Amazon EC2 instances in an Auto Scaling group
behind an Application Load Balancer. The load on the application varies throughout the day, and EC2
instances are scaled in and out on a regular basis. Log files from the EC2 instances are copied to a
central Amazon S3 bucket every 15 minutes. The security team discovers that log files are missing
from some of the terminated EC2 instances.
Which set of actions will ensure that log files are copied to the central S3 bucket from the terminated
EC2 instances?
Options
Discussion
My pick: B here.
Option B here. The key is using the lifecycle hook plus SSM SendCommand, so you can pause termination and run your log copy reliably before shutting down. Option A looks tempting but has the ABANDON trap, which would leave instances orphaned. Open to corrections but pretty sure B matches AWS best practice.
B . D trips up folks because ABANDON isn't as clean for autoscaling, could leave orphaned instances. B with CONTINUE is standard for this AWS use case, unless I'm missing something.
Maybe D, just because it also uses lifecycle hooks and SSM SendCommand. I've seen practice exams recommend ensuring log scripts are automated, and the SNS part seemed like a solid trigger. Not totally confident since ABANDON could leave stray instances, but worth double-checking in the official guide.
D
B tbh, that's the more reliable AWS pattern. D is tempting but using ABANDON can leave EC2s running if something fails which is messy for auto scaling. B's use of CONTINUE ensures everything gets cleaned up after logs are copied. Anyone disagree?
B no question. CONTINUE makes sure the instance gets terminated after copying logs so there’s no orphan EC2s hanging around. Pretty sure that’s the AWS standard pattern for auto scaling groups.
So with B, isn’t that the clean AWS lifecycle hook + SSM SendCommand combo? CONTINUE lets ASG handle shutdown properly. ABANDON in D could leave resources stuck, I think. Open to other takes if I’m missing something.
B
Do you think D really works here? I see the ABANDON action in D might stop auto scaling from terminating the instance, possibly leaving EC2s running if the log copy fails. The question wants the process to finish cleanly every time, so CONTINUE (like in B) makes more sense, right?
Be respectful. No spam.
