AWS Certified CloudOps Engineer – Associate 1-10

AWS CloudTrail is the reliable service for recording API activity and audit trails across an entire AWS account.
For Amazon Bedrock, it records all user-initiated API calls, including interactions with agents and knowledge bases as well as model parameters.
With CloudTrail Lake, you can store and query the data without exporting it, and generate audit and compliance reports using SQL-like queries.
Audit requirements such as user ID, API usage, timestamps, and agent ID are best satisfied with CloudTrail and CloudTrail Lake.
CloudWatch is intended for operational metrics, while OpenSearch and Flink introduce unnecessary complexity and cost.
AWS CloudTrail Lake – AWS Documentation

AWS Backup natively supports both EC2 and EFS.
By contrast, Amazon DLM does not support backing up EFS, so options C and D are eliminated.
Assigning resources by tag instead of individually listing resource IDs removes the need to edit the plan every time a new instance or file system is created.
If you enforce tagging at creation time with an SCP, future resources are automatically included in the backup scope, meeting the requirement with the least effort.
The plan can run daily and expire backups after 30 days.
AWS Backup Assigning Resources – AWS Documentation

AWS Secrets Manager is designed to store and automatically rotate database credentials, meeting the monthly rotation requirement with no code changes.
KMS is for managing encryption keys and cannot rotate DB credentials, so A and B are inappropriate.
For surging client connections, RDS Proxy is optimal because it pools connections for efficiency and protects the DB in write-heavy workloads.
Read replicas are effective for distributing read load, but they cannot handle surges in write connections or reduce connection overhead.
Rotating Secrets Manager Secrets – AWS Documentation

AWS Systems Manager Session Manager provides secure, auditable interactive access to EC2 instances at scale, without managing bastion hosts or distributing SSH keys.
It can record session activity, including commands and output, to durable destinations such as CloudWatch Logs or S3, directly meeting the requirement.
Turning log patterns into metrics with CloudWatch Logs metric filters and connecting them to alarms and SNS notifications is the standard CloudOps pattern.
Configurations based on a bastion, Run Command, or Athena are less operationally efficient.
AWS Systems Manager Session Manager – AWS Documentation

Amazon ElastiCache for Redis OSS Global Datastore provides fully managed cross-Region replication between one primary cluster and multiple secondary read-only clusters.
This replicates cache data across Regions, so writes are handled in the primary while each Region delivers a consistent read experience.
Memcached does not have Global Datastore or cross-Region replication features, so B and D are not feasible.
Option C, RDS query cache replication, is not a mechanism that exists.
ElastiCache Global Datastore – AWS Documentation

For Amazon ECS where zero downtime and fast rollback are required, a blue/green deployment with AWS CodeDeploy is the correct strategy.
It creates and validates a new task set while keeping the current production task set running, then safely shifts traffic.
Even if a problem occurs with the new version, you can roll back immediately in a single step simply by shifting traffic back to the original task set.
Rolling updates do not offer equivalent immediate rollback, and canary or linear approaches are gradual transitions that do not directly meet the immediate-rollback requirement.
Manual scaling is operationally fragile.
Amazon ECS Blue/Green Deployments – AWS Documentation

Amazon EventBridge supports custom event buses for application-specific events.
An EventBridge archive retains events and can replay them later based on a time range or event pattern, directly meeting the replay requirement.
The combination of a custom event bus, an archive, and a rule is the correct configuration that provides both isolation/governance and replay.
The rule routes events to Lambda without custom code.
Options that use the default bus or a pipe do not fit the custom use case or archive behavior, and CloudWatch Logs has no native replay capability.
EventBridge Archive and Replay – AWS Documentation

The described traffic pattern is a linear deployment, which shifts a fixed percentage of traffic at fixed time intervals until the new version eventually receives 100% of the traffic.
AWS CodeDeploy has a predefined configuration named “CodeDeployDefault.ECSLinear10PercentEvery3Minutes” that shifts 10% every 3 minutes, matching the requirement exactly.
Canary sends a small amount first, then shifts the remainder all at once after a wait, so it is not an evenly repeated incremental increase.
Rolling replaces tasks in batches.
Blue/green is a broader model, and the specific strategy requested is linear.
CodeDeploy Deployment Configurations – AWS Documentation

The requirement is to raise an alert before throttling occurs.
In provisioned-capacity mode DynamoDB, throttling occurs when demand approaches or exceeds the provisioned throughput.
CloudWatch directly provides table metrics such as ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits.
By creating an alarm with a consumed read capacity threshold set close to the provisioned value, you can warn early when the limit is being approached, before actual throttling occurs.
Detecting THROTTLING_EXCEPTION is a reaction after the fact and does not meet the early-warning requirement.
DynamoDB CloudWatch Metrics – AWS Documentation

EventBridge supports negative matching using “anything-but”.
Combining anything-but with equals-ignore-case lets you match EC2 state values other than “terminated” in a case-insensitive way.
The syntaxes “not equals-ignore-case” and “! equals-ignore-case” in options A and B do not exist in EventBridge.
Option C matches “terminated”, which is the opposite of the requirement.
Therefore, option D using anything-but is the correct event pattern.
EventBridge Content-Based Filtering – AWS Documentation