Lab 2B — EventBridge schedule

15 timed scenario questions (~24 min, ~96 sec each). Reinforces night-12-eventbridge-schedule.md and night-12-lab-eventbridge-schedule.sh. Answer without peeking at night-12-quiz-answers.json first.

1. 1.A monthly one-shot Fargate batch job runs in private subnets with no HTTP endpoint. Manual ecs:RunTask already works. What is the best way to trigger it on the 1st of each month without an always-on EC2 instance?

   A.Application Load Balancer health check that invokes ecs:RunTaskB.EventBridge schedule rule with an ECS RunTask target and cronC.NAT Gateway scheduled maintenance window that starts the Fargate taskD.CloudFront origin request trigger writing to the S3 output bucket

2. 2.You create an EventBridge rule targeting ecs:RunTask. The rule shows FailedInvocations in CloudWatch. The task definition and cluster names are correct. What is the most common IAM fix?

   A.Attach AmazonEC2FullAccess to the default event bus IAM resourceB.Grant the rule permission to assume the task role directly onlyC.Target IAM role trusted by events.amazonaws.com with RunTask + PassRoleD.Move the schedule rule to a custom event bus named ecs.amazonaws.com

3. 3.An EventBridge ECS target sets AssignPublicIp to DISABLED and passes private subnet IDs. Why must the scheduled target include the same networkConfiguration as a manual RunTask?

   A.Scheduled RunTask still creates an awsvpc ENI — needs subnets and SGB.EventBridge always launches tasks in the default VPC public subnetC.AssignPublicIp ENABLED is required only for EventBridge-started tasksD.The cron schedule expression must match the private subnet CIDR block

4. 4.Which schedule expression runs a batch pipeline at 06:00 UTC on the first day of every month?

   A.cron(0 6 1 * ? *) — 06:00 UTC on day 1 each monthB.rate(1 month) — EventBridge monthly rate expressionC.cron(6 0 1 * * *) — hour and minute fields swapped from UTCD.cron(0 0 ? * 1 *) — every Monday at midnight UTC only

5. 5.CI already has ecs:RunTask and iam:PassRole for a Fargate task. After adding EventBridge, why can the rule not reuse the CI IAM user credentials?

   A.EventBridge assumes a dedicated target role — not CI long-lived keysB.Fargate rejects any task started by a human IAM user principalC.PassRole is valid only when the target type is Lambda, not ECSD.CI credentials always expire every 15 minutes and cannot be reused

6. 6.An exam question describes decoupling microservices so a spike in orders does not overwhelm the inventory API. The inventory team wants to process at their own pace with at-least-once delivery. Which service fits better than an EventBridge schedule rule?

   A.EventBridge cron expression targeting ECS RunTask monthlyB.AWS Config conformance pack evaluating inventory API driftC.Amazon SQS standard queue between producer and consumerD.VPC peering between the orders VPC and inventory VPC only

7. 7.A CloudWatch alarm watches FailedInvocations on an EventBridge rule and fires. The Invocations metric is zero. What most likely happened?

   A.The container exited with code 1 after the task started successfullyB.S3 rejected the upload after the Fargate task began writing outputC.NAT Gateway billing threshold was exceeded for the private subnet pathD.EventBridge could not invoke the ECS target (IAM or invalid config)

8. 8.What is the trust policy principal for the IAM role used by an EventBridge rule that calls ecs:RunTask?

   A.ecs-tasks.amazonaws.com — same trust as the Fargate task roleB.events.amazonaws.com — EventBridge assumes the target roleC.lambda.amazonaws.com — required for any EventBridge rule targetD.scheduler.amazonaws.com only — classic rules cannot assume roles

9. 9.You need a one-time reminder to run a migration at 2026-07-01 03:00 UTC with flexible delivery within a 15-minute window and automatic retries. Which option is most purpose-built?

   A.Classic EventBridge rate(1 day) rule repeating every day foreverB.CloudWatch Logs subscription filter matching migration log linesC.EC2 instance user-data cron job waiting for that exact UTC timestampD.Amazon EventBridge Scheduler with a flexible time window schedule

10. 10.A batch ETL pipeline is not a long-running web service. Which statement about load balancers is correct for scheduled ECS RunTask?

    A.An internal ALB is required so EventBridge can health-check the taskB.Network Load Balancer must front Fargate for EventBridge RunTask triggersC.No load balancer is needed — RunTask starts the batch task directlyD.Gateway Load Balancer inspects scheduled ECS Fargate tasks by default

11. 11.An EventBridge target role scopes ecs:RunTask with a Condition on ecs:cluster. Why scope RunTask to one cluster ARN?

    A.Fargate tasks can only run in one ECS cluster per AWS account everB.Least privilege — the role should not start tasks on other clustersC.EventBridge ignores RunTask unless cluster name equals the rule nameD.PassRole requires the cluster name string to match the IAM role name

12. 12.A rule on the default event bus matches {"source":["aws.ecs"],"detail-type":["ECS Task State Change"]}. What type of rule is this compared to a monthly cron pipeline rule?

    A.Schedule expression rule — identical to cron(0 6 1 * ? *) monthlyB.API destination rule — calls an external HTTPS webhook endpointC.Cross-Region replication rule copying events onto another event busD.Event pattern rule — reacts to AWS service events, not a timetable

13. 13.For a quick validation you temporarily set an EventBridge rule to rate(1 minute), then restore cron(0 6 1 * ? *) after success. What cost should you expect compared to leaving rate(1 minute) enabled?

    A.Identical — schedule expression does not affect Fargate run costB.Higher — cron rules incur per-invocation charges that rate rules skipC.Lower — monthly cron runs the expensive Fargate task far less oftenD.Zero in both cases — Fargate is free when EventBridge starts the task

14. 14.Which iam:PassRole condition key should appear when EventBridge passes an ECS execution role to ECS?

    A.iam:PassedToService = ecs-tasks.amazonaws.com for ECS task rolesB.iam:PassedToService = events.amazonaws.com for the target roleC.iam:PassedToService = s3.amazonaws.com for pipeline output uploadsD.No condition is allowed — PassRole cannot be constrained by service

15. 15.You later add SQS so the pipeline publishes a completion message instead of chaining synchronously. How does that differ from EventBridge schedule → RunTask?

    A.SQS replaces the need for ECS Fargate tasks in this architectureB.EventBridge schedules the batch; SQS buffers producers and consumersC.EventBridge cannot target ECS if an SQS queue exists in the accountD.SQS only works with API Gateway WebSocket APIs, not with batch jobs