SOA-C02 Practice Exam 69 — 20 Questions

Question 1

An EC2 instance runs a Java application. The operations team wants to monitor heap memory utilization in CloudWatch and set alarms when it exceeds 85 percent. EC2 does not natively publish memory metrics to CloudWatch. What is the simplest way to get this metric into CloudWatch?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect mem_used_percent; publish JVM heap metrics from the application using PutMetricData. Option A is correct because the CloudWatch agent can collect custom metrics like memory utilization from the EC2 instance, and the Java application can directly publish JVM heap metrics to CloudWatch using the PutMetricData API. This combination provides the simplest and most direct way to monitor heap memory utilization and set alarms at the 85% threshold, as EC2 does not natively expose memory metrics.

Answer

Enable detailed monitoring on the EC2 instance to increase metric resolution to 1-minute intervals

Answer

Configure a CloudWatch Logs metric filter on the application log stream to count lines containing 'OutOfMemoryError'

Answer

Use AWS Systems Manager Inventory to collect memory data and sync it to CloudWatch

Question 2

Multiple microservices each write structured JSON logs to separate CloudWatch log groups. The operations team needs to find all ERROR-level log entries across all log groups for the past 24 hours and count errors by service name. Which approach achieves this with the least operational overhead?

Accepted Answer

Run a CloudWatch Logs Insights query selecting all relevant log groups, filter where level = 'ERROR', and use stats count(*) by service. CloudWatch Logs Insights natively supports querying multiple log groups in a single query using the `SELECT` and `stats` commands. By specifying all relevant log groups in the query scope, filtering for `level = 'ERROR'`, and using `stats count(*) by service`, the operations team can directly aggregate error counts per service without any data movement, additional infrastructure, or manual scripting. This approach has the least operational overhead because it leverages existing CloudWatch capabilities with no setup or maintenance.

Answer

Export each log group to S3 and run an Athena query joining all exported files

Answer

Subscribe all log groups to a Kinesis Data Firehose stream and query the aggregated data in OpenSearch

Answer

Use the AWS CLI to download and grep log events from each log group separately, then sum the results

Question 3

An environment has 12 individual CloudWatch metric alarms covering CPU, memory, disk, and network. When one instance degrades, all 12 alarms fire simultaneously and send 12 separate notifications to the on-call engineer. The team wants a single notification per incident regardless of how many individual alarms trigger. What CloudWatch feature addresses this?

Accepted Answer

Create a composite alarm that enters ALARM state when any of the 12 child alarms is in ALARM state, and configure a single SNS action on the composite alarm only. Option A is correct because a composite alarm in CloudWatch can aggregate multiple child alarms into a single parent alarm. When any of the 12 child alarms enters the ALARM state, the composite alarm transitions to ALARM and triggers a single SNS notification, thereby reducing alert noise to one notification per incident.

Answer

Increase the alarm evaluation period on all 12 alarms to 30 minutes so they fire less frequently

Answer

Use an SNS topic with a delivery policy that batches notifications sent within a 60-second window

Answer

Configure all 12 alarms to write to the same CloudWatch Events rule and suppress duplicate events with EventBridge deduplication

Question 4

A company uses Amazon CloudWatch Logs to store application logs. The SysOps administrator needs to detect when the number of log entries containing the string 'ERROR' exceeds 100 in any 5-minute window. When this threshold is breached, an email should be sent to the operations team. Which combination of AWS services should be used with the least operational overhead?

Accepted Answer

Create a metric filter on the log group for 'ERROR', then create a CloudWatch alarm on that metric with an SNS action to send email.. Option B is correct because it uses CloudWatch metric filters to extract the count of 'ERROR' log entries as a custom metric, then a CloudWatch alarm on that metric triggers an SNS topic to send email notifications. This approach requires no custom code or additional infrastructure, minimizing operational overhead while meeting the requirement of detecting >100 errors in any 5-minute period.

Answer

CloudWatch Logs Insights scheduled query with SNS action.

Answer

Use a Lambda function that reads the log stream and sends an email via Amazon Simple Email Service (SES) when errors exceed 100.

Answer

Install an agent on the application server that sends logs to Amazon SQS, then poll the queue with a Lambda function to trigger an email.

Question 5

A company uses AWS CloudTrail to log API calls across all regions. The SysOps administrator notices that logs for a specific region are missing from the centralized S3 bucket. What is the most likely cause?

Accepted Answer

The CloudTrail trail is not enabled for that region.. CloudTrail trails can be configured to log API calls from specific regions or all regions. If logs for a particular region are missing from the centralized S3 bucket, the most likely cause is that the trail was not enabled for that region during trail creation or update. By default, a trail applied to all regions will automatically log activity from every region, but if the trail is configured for a single region or a subset, other regions will not have their logs delivered.

Answer

The S3 bucket policy denies write access from CloudTrail for that region.

Answer

CloudTrail log file validation is disabled.

Answer

The IAM role for CloudTrail does not have permissions to write logs from that region.

Question 6

A company uses AWS CloudTrail to log API activity. The SysOps administrator needs to receive an email notification whenever a new IAM user is created. Which AWS services should be used together to meet this requirement with the least operational overhead?

Accepted Answer

CloudTrail, Amazon EventBridge, and Amazon SNS. Option C is correct because Amazon EventBridge can directly capture CloudTrail API events (such as CreateUser) and route them to an SNS topic for email notification without needing any custom code or additional infrastructure. This pattern minimizes operational overhead by using a fully managed event bus with built-in filtering and target routing, eliminating the need for Lambda functions or metric filter configurations.

Answer

CloudTrail, Amazon SNS, and AWS Lambda

Answer

CloudTrail, Amazon CloudWatch Logs, and a metric filter with an alarm

Answer

AWS Config and Amazon SNS

Question 7

A SysOps administrator manages an Application Load Balancer (ALB) that distributes traffic to an Auto Scaling group of EC2 instances. The administrator needs to receive a notification whenever the number of unhealthy targets in the ALB target group exceeds a threshold of 2 for at least 5 consecutive minutes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create a CloudWatch alarm on the 'UnHealthyHostCount' metric for the ALB target group, with a threshold of 2 and an evaluation period of 5 minutes. Configure the alarm to send an Amazon SNS notification.. Option A is correct because CloudWatch natively publishes the 'UnHealthyHostCount' metric for ALB target groups, allowing a direct alarm with a threshold of 2 and an evaluation period of 5 minutes. This alarm can trigger an SNS notification with minimal configuration, requiring no custom scripts or additional services. The requirement for 'at least 5 consecutive minutes' is satisfied by setting the evaluation period to 5 minutes (or using 5 datapoints with a 1-minute period).

Answer

Enable AWS CloudTrail logging for the ALB and create a CloudWatch metric filter for 'UnHealthyHostCount' events. Then create an alarm on that metric to notify via SNS.

Answer

Use an AWS Config rule to evaluate the health of the ALB target group and trigger an SNS notification when non-compliant.

Answer

Create an Amazon EventBridge rule that triggers every minute to call the AWS CLI command describe-target-health and send a notification via Lambda if unhealthy count exceeds 2.

Question 8

A SysOps administrator manages multiple AWS accounts and wants to create a single Amazon CloudWatch dashboard that displays real-time metrics from all accounts in one view. The administrator needs to avoid managing separate dashboards for each account. Which solution should the administrator implement?

Accepted Answer

Use CloudWatch cross-account observability by setting up a monitoring account and sharing metrics from source accounts.. CloudWatch cross-account observability allows you to designate a monitoring account that can view metrics, logs, and traces from multiple source accounts. This feature uses AWS Organizations or CloudWatch cross-account links to share observability data in real time, enabling a single dashboard that aggregates metrics from all accounts without needing separate dashboards.

Answer

Export CloudWatch metrics to Amazon QuickSight and create a dashboard there.

Answer

Use AWS Config aggregator to collect metrics and display in CloudWatch.

Answer

Create a Lambda function that periodically pulls metrics from each account and publishes to a central account's CloudWatch.

Question 9

A SysOps administrator needs to view a graph of the average CPU utilization of an Auto Scaling group over the past 24 hours. The administrator wants to share this graph with the team via a link that does not require AWS console login. Which AWS service should be used to create and share this graph?

Accepted Answer

Amazon CloudWatch Dashboard. Amazon CloudWatch Dashboards allow you to create customizable graphs of metrics like average CPU utilization from an Auto Scaling group. You can share a dashboard via a link that does not require AWS console login by using the 'Share' feature, which generates a public URL that grants read-only access to the dashboard without authentication.

Answer

AWS CloudTrail

Answer

Amazon QuickSight

Answer

AWS Trusted Advisor

Question 10

A SysOps administrator needs to monitor Amazon EC2 instances for disk space usage. Disk space metrics are not available by default in Amazon CloudWatch. The administrator wants to collect disk space metrics from all EC2 instances across multiple AWS accounts and aggregate them in a single CloudWatch dashboard. Which combination of steps should the administrator take?

Accepted Answer

Install the CloudWatch agent on each instance using SSM Run Command, configure the agent to collect disk metrics, and use CloudWatch cross-account observability to aggregate metrics from multiple accounts.. Option A is correct because the CloudWatch agent is required to collect custom metrics like disk space from EC2 instances, as these are not available by default. SSM Run Command enables scalable, agentless installation across instances. CloudWatch cross-account observability allows you to aggregate metrics from multiple AWS accounts into a single monitoring account, meeting the requirement for a unified dashboard.

Answer

Enable detailed monitoring on the EC2 instances, create a custom metric in CloudWatch for disk space, and use CloudWatch Logs to forward logs to a central account.

Answer

Use AWS Config to track disk space and send metrics to CloudWatch.

Answer

Use AWS Trusted Advisor to monitor disk space and send alerts via SNS.

Question 11

A SysOps administrator needs to automatically restart an Amazon RDS DB instance when the 'DatabaseConnections' metric exceeds a threshold of 200 for 5 consecutive minutes. The administrator wants a solution that uses minimal custom code and leverages AWS managed services. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch alarm with an AWS Systems Manager Automation action.. Option C is correct because AWS Systems Manager Automation provides a built-in 'AWSSupport-StartRDSInstance' or 'AWSSystemsManager-RestartRDSInstance' runbook that can be triggered directly by a CloudWatch alarm action, requiring no custom code. This leverages a managed service to restart the RDS instance automatically when the 'DatabaseConnections' metric exceeds 200 for 5 consecutive minutes, meeting the minimal custom code requirement.

Answer

Amazon CloudWatch alarm with an Auto Scaling policy.

Answer

Amazon CloudWatch alarm with an Amazon Simple Notification Service (SNS) topic that triggers an AWS Lambda function to restart the instance.

Answer

Amazon RDS event subscription that triggers an AWS Lambda function.

Question 12

A SysOps administrator needs to audit all API calls made in an AWS account for compliance and security analysis. The logs must be stored securely for at least one year. Which AWS service should the administrator enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This audit log is essential for compliance and security analysis, and CloudTrail can be configured to store logs in an S3 bucket with lifecycle policies to retain them for at least one year.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

A SysOps administrator needs to monitor AWS CloudTrail logs for any calls to the 'CreateUser' API in AWS Identity and Access Management (IAM). When such an API call is detected, the administrator wants to receive a notification within a few minutes and also log the event to a central log group in Amazon CloudWatch Logs. The solution should use minimal custom code. Which combination of services should be used?

Accepted Answer

Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.. Option B is correct because Amazon EventBridge can directly consume CloudTrail events in near-real time via the 'aws.cloudtrail' event source, allowing you to create a rule that matches the 'CreateUser' API call. This rule can then target both an Amazon SNS topic for immediate notification and a CloudWatch Logs log group for centralized logging, all without custom code.

Answer

Configure AWS CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the 'CreateUser' API call, and set up a CloudWatch alarm that sends an Amazon SNS notification.

Answer

Write an AWS Lambda function that is triggered by Amazon S3 events when a new CloudTrail log is delivered to S3. The Lambda parses the log file for 'CreateUser' and if found, sends an SNS notification.

Answer

Enable AWS Config and create a custom rule that evaluates CloudTrail trail configurations for events.

Question 14

A company has a VPC with a public subnet and a private subnet. An Amazon EC2 instance in the private subnet needs to download security patches from the internet, but the instance must not be directly accessible from the internet. The SysOps administrator configured a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The instance's security group allows all outbound traffic. However, the instance still cannot reach the internet. What is the most likely missing configuration?

Accepted Answer

Add a route in the public subnet's route table that directs 0.0.0.0/0 traffic to an internet gateway. The NAT gateway is in the public subnet, but for it to route traffic to the internet, the public subnet must have a route table entry that directs 0.0.0.0/0 traffic to an internet gateway (IGW). Without this route, the NAT gateway cannot forward outbound traffic to the IGW, so the private instance's traffic is dropped. Option C correctly identifies this missing route.

Answer

Attach an Elastic IP to the NAT gateway

Answer

Enable DNS resolution in the VPC

Answer

Modify the network ACL of the private subnet to allow inbound ephemeral ports from the NAT gateway's private IP

Question 15

A company hosts a static website on Amazon EC2 instances behind an Application Load Balancer. They want to improve latency for users around the world by caching content at edge locations. Which AWS service should they use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., HTML, CSS, images) at edge locations worldwide, reducing latency for global users by serving cached responses from the nearest edge rather than the origin EC2 instances behind the Application Load Balancer. It integrates directly with ALB as a custom origin, offloading traffic and improving response times for repeated requests.

Answer

AWS Global Accelerator

Answer

AWS Direct Connect

Answer

Amazon Route 53

Question 16

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to access an Amazon S3 bucket in the same AWS Region. The SysOps administrator wants to ensure the traffic does not traverse the internet. Which solution should be implemented?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet. It uses AWS's internal network, routing traffic through a prefix list in the route table, ensuring data stays within the AWS backbone. This meets the requirement of no internet traversal while providing secure, low-latency access to S3.

Answer

Deploy a NAT Gateway in the public subnet and add a route to the private subnet's route table.

Answer

Attach an Internet Gateway to the VPC and add a default route in the private subnet's route table.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Question 17

A company has a VPC with public and private subnets. The private subnets need outbound internet access to download software updates while preventing any inbound internet traffic. The SysOps administrator must minimize costs. Which solution should the administrator implement?

Accepted Answer

Launch a NAT instance in a public subnet with an Elastic IP and disable source/destination check, then update private subnet route tables. Option B is correct because a NAT instance, when launched in a public subnet with an Elastic IP and source/destination check disabled, can route outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. This solution minimizes costs compared to a NAT Gateway, as NAT instances use existing EC2 instance pricing and can be further reduced with spot instances or smaller instance types.

Answer

Create a NAT Gateway in a public subnet and update the private subnet route table to use it

Answer

Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the private subnets

Answer

Use AWS Transit Gateway with a VPN connection to an on-premises data center for internet access

Question 18

A company has two VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The VPCs are in the same AWS region. The SysOps administrator needs to enable private IP connectivity between the two VPCs so that an EC2 instance in VPC-A can communicate with an EC2 instance in VPC-B using their private IP addresses. The administrator wants a simple, low-cost solution with high throughput. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it enables direct, private IP connectivity between two VPCs in the same AWS region using the existing AWS network infrastructure, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer. It meets the requirements for simplicity, low cost, and high throughput, as traffic stays within the AWS backbone and does not require a separate transit hub or VPN.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 19

A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's IP addresses are used by a third-party service to allowlist traffic. The EC2 instances are part of an Auto Scaling group that may scale up and down. The SysOps administrator needs to ensure that the third-party service always has the current IP addresses of the ALB without requiring manual updates. Which solution should the administrator implement?

Accepted Answer

Use AWS Global Accelerator and provide the static IP addresses to the third party. AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. By pointing the ALB as an endpoint behind Global Accelerator, the third-party service can allowlist these static IPs, and any changes to the underlying EC2 instances (due to Auto Scaling) are handled transparently without requiring updates to the allowlist.

Answer

Use Amazon Route 53 with a simple routing policy pointing to the ALB DNS name

Answer

Use an Amazon CloudFront distribution with the ALB as the origin and provide the CloudFront IP addresses

Answer

Use an AWS Network Load Balancer (NLB) with static IP addresses in front of the ALB

Question 20

A company has two Amazon VPCs in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

Accepted Answer

VPC peering. VPC peering is the correct solution because it establishes private connectivity between two VPCs in the same AWS Region using the AWS backbone network, with no bandwidth limits and no single point of failure. It incurs no additional cost beyond data transfer charges, making it the most cost-effective option for high-throughput connectivity between two VPCs with non-overlapping CIDR blocks.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub