Architecting on AWS Certification Non-Destructive Testing Methods 3 — Questions and Answers
Question 1: When designing an AWS FIS experiment, which component defines the conditions under which the experiment automatically stops to prevent unintended damage?
- IAM permission boundary
- Stop condition using a CloudWatch alarm (Correct answer)
- Service control policy (SCP)
- VPC flow log threshold
Correct answer: Stop condition using a CloudWatch alarm
FIS stop conditions monitor a CloudWatch alarm and automatically halt the experiment if a safety threshold is breached, keeping the test non-destructive.
Question 2: A resilience team wants to test how an application responds to an AZ failure without terminating instances. Which FIS action achieves this with minimal blast radius?
- aws:ec2:terminate-instances targeting all AZs
- aws:ec2:stop-instances with a resource tag filter scoped to one AZ (Correct answer)
- aws:ssm:send-command to delete EBS volumes
- aws:rds:failover-db-cluster targeting the primary
Correct answer: aws:ec2:stop-instances with a resource tag filter scoped to one AZ
Stopping (not terminating) instances scoped by tag to a single AZ simulates AZ loss while keeping instances recoverable and limiting blast radius.
Question 3: Which AWS tool allows you to test Auto Scaling policies by simulating metric changes without generating actual load on your fleet?
- AWS FIS metric override action
- CloudWatch put-metric-data to publish custom metric values that trigger scaling policies (Correct answer)
- AWS Compute Optimizer scaling simulator
- Elastic Load Balancing synthetic request injection
Correct answer: CloudWatch put-metric-data to publish custom metric values that trigger scaling policies
Publishing custom CloudWatch metric values with put-metric-data lets you drive Auto Scaling policy evaluations without real load, enabling safe policy validation.
Question 4: A chaos experiment on RDS needs to test multi-AZ failover. What is the non-destructive way to trigger a failover without data loss?
- Delete the primary DB instance
- Reboot the primary DB instance with 'Failover' option checked (Correct answer)
- Modify the instance class to force a replacement
- Take a snapshot and restore to a different AZ
Correct answer: Reboot the primary DB instance with 'Failover' option checked
Rebooting with failover performs a synchronous multi-AZ switchover with no data loss and the primary automatically becomes available after the test.
Question 5: Which pattern ensures that a chaos experiment's impact is limited only to resources under test and cannot cascade to unrelated services?
- Apply SCPs to deny all API calls during the experiment
- Scope FIS resource targets using resource tags and set concurrency limits (Correct answer)
- Disable VPC route tables for the duration of the experiment
- Set S3 bucket ACLs to block cross-service access
Correct answer: Scope FIS resource targets using resource tags and set concurrency limits
Resource tags combined with FIS concurrency limits (e.g., percentage-based targeting) ensure the experiment touches only the intended resources.
Question 6: An architect wants to validate that an application degrades gracefully when DynamoDB throttling occurs, without exceeding read capacity in production. What is the safest approach?
- Temporarily lower the table's provisioned capacity and observe the application
- Use FIS to inject DynamoDB throttle errors on a test table that mirrors production schema (Correct answer)
- Disable DAX caching to amplify read load
- Switch the billing mode from on-demand to provisioned with a low cap
Correct answer: Use FIS to inject DynamoDB throttle errors on a test table that mirrors production schema
FIS can simulate DynamoDB throttle exceptions on a dedicated test table, letting you observe graceful degradation without touching the production table.
Question 7: During a GameDay exercise, the team discovers the application does not recover automatically after an FIS network disruption experiment. What is the immediate non-destructive remediation step?
- Terminate all affected instances and redeploy from AMIs
- Stop the FIS experiment to restore connectivity, then implement exponential back-off and retry logic in the application (Correct answer)
- Delete and recreate the VPC
- Fail over to a different region immediately
Correct answer: Stop the FIS experiment to restore connectivity, then implement exponential back-off and retry logic in the application
Stopping the FIS experiment instantly removes the injected fault; then the team can fix retry/back-off logic and re-run the experiment to verify the fix.
Architecting on AWS Certification Non-Destructive Testing Methods 3
When designing an AWS FIS experiment, which component defines the conditions under which the experiment automatically stops to prevent unintended damage?