SOA-C02 Mock Exam 79 — 25 Questions

Question 1

A company uses Amazon CloudWatch Logs to collect logs from multiple EC2 instances. The SysOps administrator needs to create a metric filter that counts the number of ERROR-level log entries per hour and triggers an alarm when the count exceeds 100 in any 5-minute period. Which metric filter pattern should be used?

Accepted Answer

Use the pattern "ERROR" and set the metric value to 1.. Option B is correct because a CloudWatch Logs metric filter counts each log event that matches the pattern. Setting the metric value to 1 ensures that each matching log entry increments the metric by 1, allowing the alarm to evaluate the sum over a 5-minute period against the threshold of 100. The pattern "ERROR" matches any log entry containing the string "ERROR" anywhere in the message.

Answer

Use the pattern "ERROR" and set the metric value to 100.

Answer

Use the pattern "ERROR *" to match any log entry starting with ERROR.

Answer

Use the pattern "[ERROR, 5]" to match 5 consecutive ERROR entries.

Question 2

A company uses AWS CloudTrail to log all management events. The SysOps administrator needs to be notified when an IAM user creates a new access key. Which configuration is the MOST efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers an SNS notification.. Option C is correct because CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail in real time and trigger an SNS notification. This is the most efficient solution as it requires no additional log analysis or polling, and it reacts immediately when the API call occurs.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

Answer

Use AWS Trusted Advisor to check for excessive access keys.

Answer

Use AWS Config to monitor the 'iam-user' resource type for changes to access keys.

Question 3

A SysOps administrator notices that an Amazon RDS for MySQL instance's CPU utilization is consistently above 80% during business hours. The administrator wants to identify the queries causing the high load without impacting performance. Which action should be taken?

Accepted Answer

Enable Performance Insights on the RDS instance.. Performance Insights provides a database-specific performance schema that visualizes database load and identifies the SQL queries responsible for high CPU utilization. It operates with minimal overhead by sampling the database engine's internal performance data, making it ideal for diagnosing query performance issues without impacting the production workload.

Answer

Enable the MySQL slow query log and store it in CloudWatch Logs.

Answer

Enable Enhanced Monitoring to get OS-level metrics.

Answer

Increase the retention period for CloudWatch metrics to 15 months.

Question 4

A company wants to visualize the geographic distribution of failed login attempts to their web application. The application runs on EC2 instances behind an ALB. They have access logs enabled for the ALB. Which service should be used to create the visualization?

Accepted Answer

Amazon QuickSight with S3 as a data source.. Amazon QuickSight is a fully managed business intelligence service that can directly query ALB access logs stored in Amazon S3, enabling the creation of geospatial visualizations (e.g., heat maps) of failed login attempts. ALB access logs are delivered to S3 in a structured format, and QuickSight can parse and visualize this data without additional processing. This makes QuickSight with S3 as a data source the correct choice for building the required geographic visualization.

Answer

Amazon CloudWatch Dashboard with a custom widget.

Answer

Amazon Kinesis Data Analytics with a Lambda function.

Answer

Amazon S3 Select with Athena.

Question 5

A company is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances. The SysOps administrator needs to ensure that log data is encrypted at rest and in transit. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Encrypt the CloudWatch Logs log group using an AWS KMS customer managed key.. Option A is correct because CloudWatch Logs supports encryption at rest using AWS KMS customer managed keys (CMKs). By associating a KMS key with a log group, all log data stored in that log group is encrypted at rest, meeting the encryption-at-rest requirement. Option D is correct because the CloudWatch Logs agent can be configured to use TLS/SSL (port 443) for log delivery, ensuring encryption in transit between the EC2 instances and CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the CloudWatch Logs log group.

Answer

Apply an S3 bucket policy that requires encryption for objects uploaded to the bucket.

Answer

Install an AWS Certificate Manager (ACM) certificate on the EC2 instances.

Question 6

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for MySQL DB instance. The administrator wants to receive a notification when the average CPU utilization exceeds 80% for 10 consecutive minutes. Which steps should the administrator take to set up this monitoring?

Accepted Answer

Create a CloudWatch alarm on the 'CPUUtilization' metric with a threshold of 80% and an SNS topic for notifications.. Option C is correct because Amazon RDS automatically publishes the 'CPUUtilization' metric to CloudWatch, and a CloudWatch alarm can be configured with a threshold of 80% for the 'Average' statistic over a period of 10 consecutive minutes (e.g., 10 evaluation periods of 1 minute each). The alarm can then trigger an SNS topic to send notifications when the threshold is breached. This directly meets the requirement without additional services.

Answer

Use CloudWatch Logs to monitor the database logs and create an alarm based on log patterns.

Answer

Enable Enhanced Monitoring and create an alarm on the 'CPUUtilization' metric in RDS console.

Answer

Enable CloudTrail and create a metric filter for CPU utilization.

Question 7

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The SysOps administrator needs to detect and automatically replace an instance that is not responding to health checks. Which THREE steps should the administrator take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch alarm to take the action of terminating the instance.. Option B is correct because a CloudWatch alarm configured on the 'StatusCheckFailed' metric can directly trigger an Auto Scaling action to terminate the unhealthy instance. This integrates with the Auto Scaling group's lifecycle to automatically replace the instance without manual intervention, meeting the requirement for automated detection and replacement.

Answer

Manually terminate the unhealthy instance after the alarm triggers.

Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.

Answer

Configure the Auto Scaling group to use ELB health checks.

Question 8

A SysOps administrator notices that an Amazon EC2 instance's CPU utilization is consistently above 90% during business hours. The instance is part of an Auto Scaling group with a simple scaling policy based on average CPU utilization. However, the Auto Scaling group is not launching new instances. What is the most likely cause?

Accepted Answer

The scaling policy is in a cooldown period after a previous scaling activity.. The simple scaling policy in Auto Scaling has a cooldown period (default 300 seconds) that prevents the group from launching or terminating instances immediately after a previous scaling activity. If the policy triggered a scale-out event recently, the cooldown period is still active, so even though CPU utilization remains above 90%, no new instances are launched until the cooldown expires. This is the most likely cause because the cooldown is designed to stabilize metrics and avoid thrashing.

Answer

The Auto Scaling group has a minimum size equal to the current number of instances.

Answer

The Auto Scaling group has a scheduled scaling action that is overriding the dynamic policy.

Answer

The instance is not healthy and is being terminated by the Auto Scaling group.

Question 9

A SysOps administrator is creating a monitoring solution for a web application that uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The administrator wants to monitor the average request count per minute and the number of healthy hosts. Which TWO CloudWatch metrics should the administrator use? (Choose TWO.)

Accepted Answer

AWS/ApplicationELB HealthyHostCount. Option B, AWS/ApplicationELB HealthyHostCount, is correct because it directly reports the number of registered instances that are passing health checks, which is exactly what the administrator needs to monitor the number of healthy hosts behind the ALB. Option E, AWS/ApplicationELB RequestCount, is correct because it tracks the total number of requests handled by the ALB, and by dividing by the time period, the administrator can calculate the average request count per minute.

Answer

AWS/ApplicationELB Latency

Answer

AWS/EC2 CPUUtilization

Answer

AWS/AutoScaling GroupInServiceInstances

Question 10

A SysOps administrator needs to monitor the disk space utilization on a fleet of EC2 instances running Windows Server. Which TWO steps should the administrator take to collect and visualize this data? (Choose TWO.)

Accepted Answer

Install the CloudWatch agent on each EC2 instance to collect disk space metrics.. The CloudWatch agent is required to collect custom metrics like disk space utilization from EC2 instances running Windows Server. Default EC2 monitoring only collects hypervisor-level metrics (CPU, network, disk I/O), not guest OS metrics such as disk space. Installing the CloudWatch agent and configuring it to collect disk space metrics is the correct step. Creating a CloudWatch dashboard then allows visualization of those collected metrics.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log disk space changes.

Answer

Enable default EC2 monitoring to collect disk space metrics automatically.

Question 11

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is unreachable. The instance passes status checks and is in a healthy state. Security groups and network ACLs are configured correctly. CloudWatch metrics show CPU utilization is 5%. The administrator can SSH into the instance but cannot connect to the web server on port 443. What is the most likely cause?

Accepted Answer

The web server service is not running or crashed.. The instance passes both status checks and is healthy, and the administrator can SSH into it, confirming that the operating system and network stack are functional. Since the web server is unreachable on port 443 despite correct security group and network ACL configurations, and CPU utilization is low (5%), the most likely cause is that the web server service (e.g., Apache, Nginx) has stopped or crashed. This would prevent the instance from listening on port 443, even though the underlying infrastructure is sound.

Answer

The security group inbound rule for HTTPS is misconfigured.

Answer

The instance has an incorrect route table entry.

Answer

The instance has insufficient CPU credits.

Question 12

A company is using Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team needs to receive an alert when the number of healthy hosts drops below 50% of the desired capacity for more than 5 minutes. Which CloudWatch metric and alarm configuration should be used?

Accepted Answer

Use the 'HealthyHostCount' metric with a statistic of 'Sum' and a threshold of 0.5 * desired capacity.. The correct answer is B because the 'HealthyHostCount' metric from the Application Load Balancer (ALB) directly reports the number of registered instances that are passing health checks. By setting the statistic to 'Sum' and the threshold to 0.5 * desired capacity, the alarm triggers when the count of healthy hosts falls below 50% of the Auto Scaling group's desired capacity for the specified evaluation period of 5 minutes, meeting the exact requirement.

Answer

Use the 'RequestCount' metric with a statistic of 'Sum' and a threshold of 50% of the average request count.

Answer

Use the 'UnhealthyHostCount' metric with a threshold of 50% of desired capacity.

Answer

Use the 'TargetResponseTime' metric with a statistic of 'p90' and a threshold of 2 seconds.

Question 13

A SysOps administrator is troubleshooting an issue where an Amazon RDS DB instance's storage space is running out. The administrator has enabled CloudWatch alarms for FreeStorageSpace, but the alarm did not trigger before the storage was exhausted. What is the most likely reason?

Accepted Answer

The alarm's evaluation period was too long and the storage filled up faster than the alarm could trigger.. Option C is correct because CloudWatch alarms evaluate metrics based on a specified evaluation period (e.g., 5 minutes). If the storage fills up faster than the alarm's evaluation period, the alarm may not have enough data points to trigger before the storage is exhausted. This is a common issue when the rate of storage consumption exceeds the alarm's evaluation frequency.

Answer

The FreeStorageSpace metric is not available for the selected DB instance class.

Answer

The alarm was configured to use a static threshold but the metric is not emitted during storage operations.

Answer

The alarm was monitoring the wrong metric, such as 'Storage' instead of 'FreeStorageSpace'.

Question 14

A SysOps administrator is investigating a performance issue with an Amazon RDS for PostgreSQL instance. The administrator has enabled Performance Insights. Which TWO metrics from Performance Insights can help identify the root cause of a sudden increase in database load? (Choose TWO.)

Accepted Answer

DB Load by Wait Events.. Performance Insights measures database load in units of Average Active Sessions (AAS). The 'DB Load by Wait Events' metric breaks down this load by the specific wait events (e.g., I/O, locks, CPU) that are causing sessions to wait, directly pinpointing the bottleneck. This is the primary diagnostic view for identifying the root cause of a sudden load increase.

Answer

Read IOPS and Write IOPS.

Answer

Average Active Sessions.

Answer

CPUUtilization percentage.

Question 15

A company uses Amazon CloudWatch to monitor its AWS resources. The operations team needs to receive email notifications when the root user performs any action in the AWS account. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs metric filter, and Amazon SNS.. AWS CloudTrail logs all API activity, including root user actions. By sending these logs to CloudWatch Logs, you can create a metric filter that matches root user events (e.g., `userIdentity.type = "Root"`). When the metric filter triggers a CloudWatch alarm, it publishes a notification to an SNS topic, which sends an email to subscribers. This combination ensures real-time notification of root user actions.

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS).

Answer

AWS Trusted Advisor and Amazon Simple Email Service (SES).

Answer

AWS Config, Amazon CloudWatch Events, and Amazon SNS.

Question 16

A company has an application that writes logs to CloudWatch Logs. The SysOps administrator needs to search for a specific error pattern across multiple log groups. Which solution is the most efficient?

Accepted Answer

Use CloudWatch Logs Insights to query the log groups.. CloudWatch Logs Insights is purpose-built for interactive ad-hoc querying of log data across multiple log groups, enabling efficient pattern matching and filtering without requiring pre-configured infrastructure. It uses a dedicated query language optimized for searching, aggregating, and analyzing log events, making it the most efficient solution for searching a specific error pattern across multiple log groups.

Answer

Create a CloudWatch dashboard to visualize log data.

Answer

Create a metric filter to count the error pattern.

Answer

Create a subscription filter to stream logs to Amazon ES.

Question 17

A company is running a critical application on Amazon EC2 instances. The application performance has degraded over the past week. The SysOps administrator suspects a memory leak. The administrator needs to collect detailed memory usage metrics every minute and store them for 30 days. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. Option D is correct because the CloudWatch agent is specifically designed to collect custom metrics like memory utilization from EC2 instances, which are not available through default or detailed EC2 monitoring. By installing the agent and configuring it to publish memory metrics to CloudWatch every minute, the administrator can meet the requirement for 1-minute granularity and 30-day retention cost-effectively, as CloudWatch retains metric data at 1-minute resolution for 15 days by default, but can be extended to 30 days via a custom metric retention setting.

Answer

Use AWS CloudTrail to log memory usage and store the logs in Amazon S3.

Answer

Enable default EC2 monitoring to collect memory metrics every 5 minutes.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics every 1 minute.

Question 18

Which TWO of the following are features of Amazon Route 53? (Select TWO.)

Accepted Answer

Health checking of resources. Amazon Route 53 is a DNS web service that provides domain name resolution, domain registration, and health checking of resources. Health checking monitors the availability and performance of endpoints (e.g., web servers) via HTTP/HTTPS/TCP requests, and can automatically failover DNS responses to healthy resources, ensuring high availability.

Answer

SSL/TLS termination

Answer

SSL certificate management

Answer

Content caching at edge locations

Question 19

A SysOps administrator is setting up centralized logging for multiple AWS accounts using CloudWatch Logs. Which TWO actions should the administrator take to ensure that logs from all accounts are aggregated in a single account?

Accepted Answer

In the central account, create a CloudWatch Logs destination and attach a resource policy that grants the source accounts permission to write logs.. Option B is correct because a CloudWatch Logs destination in the central account, combined with a resource policy that grants the source accounts permission to write logs, is the standard mechanism for cross-account log aggregation. The destination acts as a target for subscription filters, and the resource policy explicitly allows the source accounts to call the PutLogEvents API against that destination. This setup ensures that log events from source accounts are delivered to the central account without requiring IAM roles or additional infrastructure.

Answer

In the central account, create an IAM role that trusts the source accounts and allows PutLogEvents.

Answer

In the central account, create a log group with the same name as the source accounts' log groups.

Answer

In each source account, create a Kinesis Data Firehose delivery stream that sends logs to the central account's S3 bucket.

Question 20

An organization has a production AWS environment with multiple VPCs and hundreds of EC2 instances. The security team wants to be alerted when any security group is modified. Which approach should a SysOps administrator use to meet this requirement with minimal overhead?

Accepted Answer

Use AWS Config rules to detect security group changes and trigger an SNS notification.. Option B is correct because AWS Config rules can continuously evaluate security group configurations against desired settings and trigger an SNS notification when a change is detected. This approach provides automated, event-driven monitoring with minimal operational overhead, as it does not require custom scripts or manual log analysis.

Answer

Enable CloudTrail and create a CloudWatch alarm for each security group modification event.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena for security group changes.

Answer

Deploy Amazon GuardDuty to monitor for security group modifications.