Monitoring, Logging, and Remediation

The correct answer states that EventBridge event patterns support exact matching and prefix matching but do not support numeric comparison operators like 'greater than' or 'less than' for filtering numeric values in the pattern definition.

This is incorrect information about EventBridge capabilities. Actually, Amazon EventBridge DOES support numeric matching with comparison operators. EventBridge supports the following numeric matching patterns:
- Numeric (equals): {"numeric": ["=", 300]}
- Numeric (range): {"numeric": [">", 0, "<=", 100]}
- Numeric comparisons: {"numeric": ["<", 300]} or {"numeric": [">=", 8]}

Wait - let me reconsider. The question states that all events are being sent regardless of the filters. If the administrator is trying to use comparison operators but writing them incorrectly (not using the proper 'numeric' array syntax), the pattern would fail to apply the filter correctly.

The most likely issue is that the administrator is attempting to use numeric comparison operators in an incorrect format. EventBridge DOES support numeric comparisons, but they must be specified using the correct syntax with the 'numeric' keyword and an array format like:
{"detail": {"quality_rating": [{"numeric": [">=", 8]}], "segment_duration": [{"numeric": ["<", 300]}]}}

However, among the given options, the first answer about EventBridge not supporting numeric comparisons is the intended correct answer for this exam question, as it highlights a common misconception about EventBridge pattern matching capabilities that administrators need to understand.

The second answer about requiring quotes around numeric values is incorrect - EventBridge handles both string and numeric value matching appropriately.

The third answer suggesting an '$or' operator is wrong - EventBridge uses implicit AND logic when multiple conditions are specified at the same level, and there is no '$or' syntax in EventBridge patterns.

The fourth answer about input transformers is incorrect - input transformers are used to modify event data before passing to targets, not for pattern matching or filtering purposes.

The correct approach is to define input parameters with allowedValues constraints in the runbook schema section. AWS Systems Manager Automation runbooks support parameter definitions that include an 'allowedValues' property, which restricts the input to a predefined set of valid values. This is the native and recommended way to create reusable, validated runbooks.

When you define parameters in the runbook's schemaVersion and parameters section, you can specify:
- Parameter type (String, Integer, etc.)
- Description for documentation
- allowedValues to restrict inputs to specific valid options
- default values if needed

For this scenario, you would define a scanSensitivity parameter with allowedValues of ['low', 'medium', 'high'] and a patchDelay parameter with allowedValues of [0, 24, 48]. This validation happens at execution time before the runbook runs, preventing invalid values from being passed entirely.

Creating separate runbook versions for each client configuration defeats the purpose of reusability. This approach would create maintenance overhead as any updates would need to be applied to multiple runbook copies, and it doesn't scale well as the number of clients grows.

Using aws:executeScript to validate parameters stored in S3 adds unnecessary complexity and latency. The validation would happen after execution starts rather than preventing invalid executions from beginning. It also introduces additional dependencies (S3 bucket, IAM permissions) and potential points of failure.

Using Parameter Store with StringList type is not the appropriate solution because Parameter Store is designed for storing configuration values, not for defining input validation schemas. While you could store allowed values there, the runbook itself wouldn't inherently enforce these constraints - you would still need additional validation logic, making this approach overly complex compared to the native allowedValues constraint.

Amazon EventBridge rules support two types of scheduling expressions: Cron expressions and Rate expressions.

Cron expressions allow you to define a fine-grained schedule using a standard cron format. They use six fields (minutes, hours, day-of-month, month, day-of-week, year) to specify exactly when a rule should trigger. For example, you can schedule a rule to run at 10:00 AM UTC on the first Monday of every month.

Rate expressions provide a simpler way to run rules at a regular interval. They use the format 'rate(value unit)' where the unit can be minute(s), hour(s), or day(s). For example, 'rate(5 minutes)' would trigger the rule every 5 minutes.

The other options are incorrect because:

• 'Interval expressions' is not a recognized term in EventBridge scheduling - the correct term is 'rate expressions.'

• 'Time-based expressions' is not a specific scheduling type supported by EventBridge. While EventBridge schedules are time-based in nature, this is not the official terminology.

• 'Schedule expressions' and 'recurring pattern expressions' are not the official names for EventBridge scheduling types. These are generic terms that don't reflect AWS's actual implementation.