A SaaS startup wants evidence that its incident response works before a real failure happens. When a web server instance stops responding, an Amazon EventBridge rule starts an AWS Systems Manager Automation runbook that replaces the instance and pages the on-call engineer.
The test must run monthly in a staging account that mirrors production. It must stop automatically if the customer-facing error rate in staging rises above a set threshold, and it must produce a repeatable record that the team can review.
Which approach should the security team use to validate the runbook?
Choose one answer.
AA. Stop the tagged instance by hand in the staging console during a weekday meeting, then check whether the runbook and the pager fired, and note the result in the meeting minutes.
BB. Run the experiment against the production web tier during a low-traffic window, since production is the only place where the real instances exist and the load is realistic.
CC. Send a test event that matches the EventBridge rule each month, and treat the runbook start and the page as proof, without stopping any instance or watching the error rate.
DD. Create an AWS FIS experiment template in staging that stops tagged web instances, with a CloudWatch alarm on the error rate as the stop condition, and run it monthly.
Show the answer and explanation
Answer: D
A. Wrong: A manual stop is not repeatable, and nothing halts the test if the error rate rises. A meeting-time test also leaves no defined record for the team to review later.
B. Wrong: Production is not the staging account the requirement names, and the plan has no safe stop condition. A failed test could cause the customer impact that the stop condition exists to prevent.
C. Wrong: A test event proves that the rule starts the runbook, but no instance actually fails, so the replacement is never exercised under real conditions. There is also no stop condition tied to the customer-facing error rate.
Fault Injection Service runs a controlled, repeatable experiment against tagged resources in staging. A stop condition based on a CloudWatch alarm halts the test if customers are affected, and each run gives a record for review. Manual tests, production runs and synthetic events each miss a stated requirement.
Want more on Testing incident response (Fault Injection Service, Resilience Hub, game days)? The 5 full-length practice sets have 7 more Testing incident response (Fault Injection Service, Resilience Hub, game days) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →