SOA-C02 Mock Exam 85 — 25 Questions

Question 1

A company has an application running on EC2 instances that sends logs to CloudWatch Logs. The operations team wants to receive a notification when a specific error pattern appears in the logs. Which combination of steps should the team take? (Select TWO.)

Accepted Answer

Create a CloudWatch alarm on the metric to trigger an SNS notification.. Option A is correct because a CloudWatch alarm can be configured to trigger an SNS notification when a metric crosses a defined threshold. In this scenario, the metric is derived from a metric filter that counts occurrences of the specific error pattern in the log group. The alarm monitors that metric and sends an SNS notification to subscribed endpoints, such as the operations team's email addresses, providing the required alert.

Answer

Enable CloudTrail to capture the log events and send to S3.

Answer

Create an SNS topic and subscribe the operations team's email addresses.

Answer

Create a subscription filter to send logs to Lambda for analysis.

Question 2

A SysOps administrator wants to be alerted when an EC2 instance is terminated unexpectedly. Which CloudWatch event should be used to trigger a notification?

Accepted Answer

An Amazon EventBridge rule that matches EC2 Instance State-change Notification events.. Option D is correct because Amazon EventBridge can capture EC2 Instance State-change Notification events, which are emitted whenever an EC2 instance transitions between states (e.g., running, stopped, terminated). By creating a rule that matches the 'terminated' state, the administrator can trigger an SNS notification or Lambda function to alert on unexpected termination, providing a real-time, event-driven response.

Answer

A CloudWatch alarm on the CPUUtilization metric dropping to zero.

Answer

A CloudTrail trail that logs TerminateInstances API calls.

Answer

A CloudWatch alarm on the StatusCheckFailed metric.

Question 3

A SysOps administrator is troubleshooting an application that runs on an EC2 instance. The application is experiencing high latency, and the administrator suspects a memory leak. Which metrics should the administrator examine first?

Accepted Answer

Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.. A memory leak causes the application to consume increasing amounts of memory over time, leading to high latency as the OS begins swapping or the kernel reclaims memory. The CloudWatch agent can publish custom metrics like `mem_used_percent`, which directly tracks memory usage percentage and is the most relevant metric to confirm a memory leak. Default EC2 metrics do not include memory utilization, so the administrator must rely on custom metrics from the CloudWatch agent.

Answer

CloudWatch metrics from the Detailed Monitoring feature, such as DiskReadOps.

Answer

CloudWatch metrics for the instance's Elastic Network Interface.

Answer

CloudWatch default EC2 metrics, such as CPUUtilization and NetworkIn.

Question 4

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to send logs to CloudWatch Logs. Which steps are necessary to allow this without traversing the internet? (Select TWO.)

Accepted Answer

Attach an IAM role to the instance with permissions to call PutLogEvents.. Option B is correct because the EC2 instance must have an IAM role attached that includes permissions for `logs:PutLogEvents` to authenticate and authorize log delivery to CloudWatch Logs. Without this role, the instance cannot sign API requests, even if network connectivity exists. Option C is correct because a VPC endpoint for CloudWatch Logs (com.amazonaws.region.logs) provides private connectivity via AWS PrivateLink, allowing the instance to send logs without traversing the internet or a NAT gateway.

Answer

Place the instance in a public subnet with a public IP.

Answer

Ensure the instance is in the default VPC.

Answer

Attach a NAT gateway to the private subnet's route table.

Question 5

A company has a production environment with multiple EC2 instances running a web application. The SysOps administrator wants to automate the remediation of instances that fail the EC2 status check. Which approach should the administrator use?

Accepted Answer

Create an Amazon EventBridge rule that matches EC2 status check failures and triggers an AWS Lambda function to terminate the instance and launch a new one.. Option C is correct because it provides a fully automated, event-driven remediation workflow. When an EC2 instance fails a status check, an EventBridge rule detects the state change and triggers a Lambda function that terminates the unhealthy instance and launches a replacement. This approach directly addresses the requirement to automate remediation without manual intervention.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure an SNS notification to alert the team.

Answer

Use AWS Systems Manager Automation to create a document that runs a script on the instance to fix the issue.

Answer

Configure the Auto Scaling group's health check to use EC2 status checks and set a custom termination policy.

Question 6

A SysOps administrator is investigating a security incident and needs to determine who deleted an S3 bucket. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across AWS services, including S3 bucket deletion events. When a user or role deletes an S3 bucket, CloudTrail logs the `DeleteBucket` API call with details such as the IAM user or role, source IP address, and timestamp, enabling the administrator to identify the responsible entity.

Answer

AWS Trusted Advisor

Answer

S3 server access logs

Answer

CloudWatch Logs for the S3 service

Question 7

A company is using AWS CloudTrail to log API activity. The security team wants to be notified when an IAM user attempts to modify an S3 bucket policy. Which actions should be taken to meet this requirement? (Select THREE.)

Accepted Answer

Create an Amazon EventBridge rule that matches the PutBucketPolicy API call via CloudTrail.. Option C is correct because Amazon EventBridge can match specific API calls (like PutBucketPolicy) by using CloudTrail as an event source. This allows the security team to trigger a notification when an IAM user attempts to modify an S3 bucket policy, without needing to poll or set up custom monitoring.

Answer

Create a CloudWatch alarm on the number of PutBucketPolicy calls.

Answer

Enable CloudTrail data events for S3 to capture bucket policy changes.

Question 8

A SysOps administrator needs to monitor the disk space usage on an EC2 instance running Windows Server. Which actions are required to collect this metric? (Select TWO.)

Accepted Answer

Create an IAM role with permissions to publish custom metrics and attach it to the instance.. Option D is correct because the CloudWatch agent requires permissions to publish custom metrics to CloudWatch. An IAM role with the appropriate policy (e.g., CloudWatchAgentServerPolicy) must be attached to the EC2 instance to allow the agent to send disk space metrics. Option E is correct because the CloudWatch agent must be installed and configured with a JSON configuration file that includes the "disk" section to collect disk space utilization metrics, which are not available by default from EC2.

Answer

Install the CloudWatch Logs agent to monitor disk usage logs.

Answer

Enable EC2 status checks to monitor disk health.

Answer

Use Windows Performance Monitor to track disk space and send to CloudWatch.

Question 9

A company has a CloudWatch dashboard that displays metrics for several EC2 instances. The SysOps administrator wants to share the dashboard with external stakeholders who do not have AWS accounts. Which actions should the administrator take? (Select TWO.)

Accepted Answer

Use the CloudWatch dashboard sharing feature to make the dashboard public.. Option A is correct because CloudWatch dashboards have a built-in sharing feature that allows you to make a dashboard public by generating a shareable URL. This URL can be accessed by anyone, even without an AWS account, and the dashboard data is encrypted in transit using HTTPS. The feature also supports time-range and time-zone customization via URL parameters.

Answer

Create a web application that reads CloudWatch metrics and host it on EC2.

Answer

Create IAM users for each stakeholder and assign appropriate permissions.

Answer

Export the dashboard to Amazon QuickSight and share it via email.

Question 10

A company has a CloudWatch alarm that monitors the CPU utilization of an EC2 instance. The alarm is set to trigger when CPU utilization exceeds 80% for 5 consecutive minutes. The alarm state is 'INSUFFICIENT_DATA'. What does this mean?

Accepted Answer

The alarm does not have enough data to determine the state.. The INSUFFICIENT_DATA state in CloudWatch indicates that the alarm has not received enough metric data points to evaluate whether the threshold (CPU utilization > 80% for 5 consecutive minutes) has been breached. This typically occurs when the EC2 instance is newly launched, the CloudWatch agent is not reporting, or there are gaps in metric collection due to network issues or instance stops. It does not imply any conclusion about the CPU utilization level itself.

Answer

The CPU utilization is below 80% for 5 minutes.

Answer

The CPU utilization has exceeded 80% for 5 minutes.

Answer

The alarm is missing data points for the past 5 minutes.

Question 11

A SysOps administrator needs to set up monitoring for an application that runs on an EC2 instance. The application generates custom metrics that should be available for analysis in CloudWatch. Which steps are required to achieve this? (Select TWO.)

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to call PutMetricData.. Option A is correct because the EC2 instance must have an IAM role attached with permissions to call PutMetricData, which authorizes the instance to publish custom metrics to CloudWatch. Without this IAM role, any attempt to send metrics from the instance will fail due to missing credentials.

Answer

Create an SNS topic and subscribe the application to send metrics.

Answer

Install the CloudWatch Logs agent to send custom metrics.

Answer

Enable detailed monitoring on the EC2 instance to collect custom metrics.

Question 12

A company has a multi-account AWS environment using AWS Organizations. The security team requires that all API calls made in any account be logged to a centralized S3 bucket in the management account. Additionally, the team wants to be alerted when an IAM user in any account creates a new access key. Currently, CloudTrail is enabled in each account but logs are stored locally. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a new CloudTrail organization trail in the management account that logs events to a centralized S3 bucket. Then create an Amazon EventBridge rule in the management account that matches the CreateAccessKey event and sends a notification via SNS.. Option A is correct because an organization trail logs API calls from all accounts to a single S3 bucket, and EventBridge can be set up to alert on CreateAccessKey events across accounts. Option B is wrong because it requires a Lambda function to aggregate logs, adding complexity. Option C is wrong because it replicates the organization trail but uses separate SNS topics per account. Option D is wrong because it uses CloudWatch Logs cross-account subscription, which is more complex.

Answer

Use CloudWatch Logs cross-account subscription to send logs from each account's CloudTrail log group to a central account. Create a metric filter and alarm on CreateAccessKey events.

Answer

Create a CloudTrail trail in each account that sends logs to a centralized S3 bucket in the management account. Create an SNS topic in each account to alert on CreateAccessKey.

Answer

Enable CloudTrail in all accounts and use an AWS Lambda function to copy logs from each account's S3 bucket to the centralized bucket. Create a CloudWatch Events rule in each account to send alerts on CreateAccessKey.

Question 13

A company uses AWS CloudTrail to log API activity. The security team needs to be notified immediately when an IAM user creates a new access key. Which combination of steps should a SysOps administrator take? (Choose TWO.)

Accepted Answer

Create a CloudWatch Logs metric filter for the 'CreateAccessKey' event.. Option A is correct because CloudWatch Logs metric filters allow you to extract specific patterns from CloudTrail log data, such as the 'CreateAccessKey' event, and convert them into a metric. This enables you to monitor for this specific API call and trigger an alarm when it occurs, meeting the requirement for immediate notification.

Answer

Enable AWS Config rules to detect changes to IAM users.

Answer

Configure CloudTrail to send notifications directly to Amazon SNS.

Answer

Create an Amazon EventBridge rule to match the 'CreateAccessKey' API call.

Question 14

A SysOps administrator is responsible for a multi-tier web application running on AWS. The application consists of an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS for MySQL database. Recently, the operations team has been receiving alerts from CloudWatch that the ALB's 'HTTPCode_Target_5XX_Count' metric is spiking periodically. The team has also noticed that the database CPU utilization is high during these spikes. The application logs show that some requests are timing out. The administrator needs to identify the root cause and implement a remediation. After reviewing the architecture, the administrator rules out the database as the bottleneck because the database connections are pooled and the query response times are normal. The administrator suspects that the issue is related to the application server's health. Which course of action should the administrator take to diagnose and resolve the issue?

Accepted Answer

Increase the health check timeout and threshold to allow for transient high CPU usage.. Option A is correct because the periodic spikes in ALB 5xx errors, high database CPU, and application timeouts, combined with normal query response times and pooled connections, strongly suggest that the application servers are becoming overwhelmed and failing health checks. By increasing the health check timeout and threshold, the ALB will allow the EC2 instances more time to recover from transient CPU or memory pressure before being marked unhealthy and removed from service, which prevents unnecessary instance replacement and reduces the cascading load on remaining instances and the database.

Answer

Add an Amazon ElastiCache cluster to cache database queries.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Answer

Increase the idle timeout on the ALB to keep connections open longer.

Question 15

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application experiences intermittent latency spikes. The SysOps administrator has enabled detailed CloudWatch metrics on the ALB and the EC2 instances. The administrator notices that during the latency spikes, the ALB's TargetResponseTime metric increases, but the EC2 instance's CPU utilization and memory usage remain normal. The administrator also observes that the number of concurrent connections to the ALB spikes during these periods. Which action should the administrator take to identify the root cause?

Accepted Answer

Analyze the ALB's ActiveConnectionCount and RequestCountPerTarget metrics to see if the load balancer is reaching its connection limit.. Option A is correct because the ALB's ActiveConnectionCount and RequestCountPerTarget metrics directly indicate whether the load balancer is approaching its connection limit (default 50,000 for ALBs). During latency spikes, if concurrent connections spike but instance CPU/memory are normal, the bottleneck is likely at the load balancer level, not the instances. Analyzing these metrics helps determine if the ALB is queuing or dropping requests due to connection limits, causing increased TargetResponseTime.

Answer

Check the RDS database's DatabaseConnections metric to see if the database is overwhelmed.

Answer

Enable VPC Flow Logs and analyze the traffic patterns for dropped packets.

Answer

Enable detailed monitoring on the EC2 instances to capture CPU credits for burstable instances.

Question 16

A SysOps administrator is managing an AWS environment with multiple VPCs connected via a transit gateway. The administrator needs to monitor network traffic between VPCs for security analysis. The administrator wants to capture metadata about IP traffic going through the transit gateway. The logs should be centralized in a single S3 bucket and retained for 90 days. Which solution should the administrator implement?

Accepted Answer

Use Transit Gateway Network Manager to enable flow logs on the transit gateway attachments and publish them directly to an S3 bucket.. Option D is correct because Transit Gateway Network Manager allows you to enable flow logs directly on transit gateway attachments, capturing IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) and publishing them to a centralized S3 bucket. This meets the requirement for centralized logging in a single S3 bucket with a 90-day retention period, as S3 lifecycle policies can be configured to expire objects after 90 days.

Answer

Enable VPC Flow Logs on each VPC and publish them to a central S3 bucket.

Answer

Use AWS Config to record traffic changes and store the configuration history in S3.

Answer

Enable flow logs on the transit gateway and publish them to a CloudWatch Logs log group, then export to S3 using a subscription filter.

Question 17

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The SysOps administrator notices that the DB instance's CPU utilization spikes to 100% every few minutes. CloudWatch alarms have been set to trigger when CPU exceeds 90% for 5 minutes, but no alarm state changes are observed. The administrator checks the CloudWatch metrics and sees that the CPU utilization metric shows periodic spikes but they last only 2-3 minutes each. What is the most likely cause and what should the administrator do to receive notifications?

Accepted Answer

Set the alarm to evaluate over 1 minute instead of 5 minutes.. The CPU utilization spikes last only 2-3 minutes, which is shorter than the alarm's evaluation period of 5 consecutive minutes. Since the alarm requires the metric to exceed the 90% threshold for 5 minutes before triggering, these brief spikes never satisfy the alarm's duration condition. Setting the alarm to evaluate over 1 minute will match the spike duration and allow the alarm to trigger on these short-lived bursts.

Answer

The Multi-AZ failover is causing the spikes; disable Multi-AZ.

Answer

The DB instance is not publishing CPU metrics at a high enough resolution.

Answer

The CPU metric is not accurate; use the CPU credit metric instead.

Question 18

A company uses Amazon S3 to store sensitive data. The SysOps administrator needs to ensure that any attempt to upload an object with server-side encryption disabled is immediately detected and the administrator is notified. The administrator has enabled AWS CloudTrail and is logging S3 data events. Which approach should the administrator use to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutObject API calls without the encryption header and triggers an SNS notification.. Option B is correct because CloudWatch Events (now Amazon EventBridge) can filter API calls captured by CloudTrail for PutObject operations that lack the x-amz-server-side-encryption header, and then trigger an SNS notification in near real-time. This ensures immediate detection and notification of any upload with server-side encryption disabled, meeting the requirement for instant alerting.

Answer

Enable S3 event notifications to send events to SNS for all PutObject operations.

Answer

Create an AWS Config rule to detect objects without encryption.

Answer

Use S3 Inventory to generate a daily report of unencrypted objects.

Question 19

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

Accepted Answer

Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.. Option C is correct because CloudWatch Logs metric filters can extract numeric values from log events and compute custom metrics. By creating a metric filter that extracts the timestamp of JOB_START and JOB_END, you can use the filter pattern to capture both events and then use a custom metric to compute the duration (e.g., by emitting a metric value representing the time difference). This allows you to set an alarm on the metric when the duration exceeds 1 hour, directly meeting the requirement without additional compute resources.

Answer

Use CloudWatch Logs Insights to run a query every hour and check the duration.

Answer

Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.

Answer

Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.

Question 20

A SysOps administrator is troubleshooting a slow web application running on EC2 instances behind an ALB. The application uses an RDS MySQL database. The administrator checks CloudWatch metrics and sees that the ALB's latency is high, the RDS CPU is high, and the EC2 CPU is moderate. The application team reports that the database queries are slow. The administrator suspects that the database is the bottleneck. However, the RDS instance is already a db.r5.large and the administrator wants to avoid increasing instance size due to cost. What should the administrator do to improve performance without increasing instance size?

Accepted Answer

Enable Performance Insights on the RDS instance to identify slow queries.. Option D is correct because enabling Performance Insights on the RDS instance allows the administrator to identify the specific slow queries causing the bottleneck. This diagnostic tool provides a database load analysis, showing which queries consume the most resources, enabling targeted optimization (e.g., adding indexes or rewriting queries) without increasing instance size. Since the EC2 CPU is moderate and the ALB latency is high due to slow database queries, resolving the query performance directly addresses the root cause.

Answer

Increase the number of EC2 instances to reduce the load on the database.

Answer

Add an ElastiCache Redis cluster to cache database queries.

Answer

Create a Read Replica and offload read traffic to it.