SOA-C02 Monitoring, Logging, and Remediation — 25 Questions

Question 1

A SysOps team needs to monitor application logs in Amazon CloudWatch Logs for specific error codes and automatically invoke an AWS Lambda function for remediation within 5 minutes of an error occurring. Which solution involves the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch metric filter on the log group, create a CloudWatch alarm on the metric, and configure the alarm to post to an SNS topic that triggers the Lambda function.. It uses CloudWatch metric filters and alarms to detect error codes in logs and trigger remediation via SNS and Lambda, all within a fully managed AWS pipeline. This approach requires no custom code or infrastructure to maintain, and the alarm can be configured to evaluate logs within a 1-minute period, easily meeting the 5-minute requirement with minimal operational overhead.

Answer

Create a CloudWatch Logs subscription filter to stream logs directly to an AWS Lambda function.

Answer

Use a third-party log aggregation tool that sends webhook notifications to an API Gateway endpoint to invoke the Lambda function.

Answer

Write a custom script that runs on an EC2 instance to poll CloudWatch Logs every minute and invoke the Lambda function.

Question 2

A company uses an Amazon S3 bucket to store sensitive data. The SysOps administrator needs to be notified within 15 minutes if any object in the bucket becomes publicly accessible. Which solution will meet this requirement with the least operational overhead?

Accepted Answer

Enable Amazon CloudTrail data events for the S3 bucket and create a CloudWatch Logs metric filter for PutObjectAcl (or PutObject with public ACL) and set an alarm.. To be notified when any object becomes publicly accessible, you must detect object-level ACL changes and uploads with public ACLs. Amazon CloudTrail data events record PutObjectAcl and PutObject with x-amz-acl headers, allowing a CloudWatch Logs metric filter to capture these API calls and trigger an SNS alarm within 15 minutes. Option B's AWS Config rule 's3-bucket-public-read-prohibited' only checks bucket policies and bucket ACLs, not individual object ACLs, so it can miss scenarios where a single object is made public.

Answer

Configure an S3 event notification for all object creation events and publish to an Amazon SNS topic that sends an email alert.

Answer

Use an AWS Config managed rule to detect 's3-bucket-public-read-prohibited' and trigger an SNS notification via Amazon EventBridge.

Answer

Configure S3 event notifications for 's3:ObjectCreated:Put' and 's3:ObjectCreated:PutObjectAcl' with a suffix/prefix filter for public grants, sending to an SNS topic.

Question 3

A SysOps administrator manages an application that runs on Amazon EC2 instances and stores critical data in Amazon Elastic Block Store (EBS) volumes. The administrator needs to monitor the EBS volumes for any performance bottlenecks. The key metric of interest is the average number of I/O operations per second (IOPS) that are waiting to be completed. Which Amazon CloudWatch metric should the administrator examine?

Accepted Answer

VolumeQueueLength. The VolumeQueueLength metric measures the number of pending I/O requests waiting to be serviced by an EBS volume. A high value indicates that the volume is unable to keep up with the I/O demand, which is the direct indicator of a performance bottleneck related to IOPS waiting. This makes it the correct metric for the administrator's stated goal.

Answer

VolumeReadOps

Answer

VolumeIdleTime

Answer

VolumeTotalReadTime

Question 4

A company uses Amazon CloudFront to serve content from a custom origin. A SysOps administrator needs to detect IP addresses that generate a high rate of HTTP 403 (Forbidden) errors, which may indicate malicious bots attempting to access restricted content. The administrator wants to automatically add these IP addresses to a AWS WAF IP set to block them. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Enable CloudFront standard logs and stream them to Amazon CloudWatch Logs. Create a metric filter for 403 status codes, grouped by source IP. Set a CloudWatch alarm on the metric that triggers an AWS Lambda function to update the WAF IP set.. To achieve the requirement with minimal overhead, you would need to enable CloudFront access logs to S3, then use S3 events or a Lambda to ingest logs into CloudWatch Logs (or query them directly), and then set up metric filters and alarms to trigger a Lambda that updates WAF. Option D incorrectly implies a native 'standard logs to CloudWatch Logs' capability that does not exist.

Answer

Configure CloudFront access logs to be delivered to an Amazon S3 bucket, and use Amazon Athena to query logs for IPs with many 403 errors. Then manually add those IPs to a WAF IP set.

Answer

Enable AWS CloudTrail for CloudFront and create a CloudWatch metric filter for 'Forbidden' events. Use a CloudWatch alarm to notify the administrator via email, who then manually updates the WAF IP set.

Answer

Use AWS Config to monitor CloudFront distributions and trigger an AWS Lambda function when a high number of 403 errors is detected by evaluating access logs stored in S3.

Question 5

A SysOps administrator needs to view a graph of the average CPU utilization of an Auto Scaling group over the past 24 hours. The administrator wants to share this graph with the team via a link that does not require AWS console login. Which AWS service should be used to create and share this graph?

Accepted Answer

Amazon CloudWatch Dashboard. Amazon CloudWatch Dashboards allow you to create customizable graphs of metrics like average CPU utilization from an Auto Scaling group. You can share a dashboard via a link that does not require AWS console login by using the 'Share' feature, which generates a public URL that grants read-only access to the dashboard without authentication.

Answer

AWS CloudTrail

Answer

Amazon QuickSight

Answer

AWS Trusted Advisor

Question 6

A SysOps administrator manages Amazon EC2 instances in multiple AWS accounts. The administrator needs to collect and analyze network traffic logs to identify the top IP addresses generating the most traffic to the instances. The administrator must centralize this analysis in a single monitoring account that has cross-account access to the logs. Which combination of AWS services should the administrator use?

Accepted Answer

Enable VPC Flow Logs in each account, publish them to an Amazon S3 bucket, and use Amazon Athena to query for top IPs.. Both A and C are valid ways to centralize VPC Flow Logs and identify top IPs. A uses S3 and Athena to query flow logs across accounts; C uses CloudWatch Logs and Contributor Insights with cross-account ingestion. The original explanation incorrectly states that A is not suitable.

Answer

Use AWS Config rules across accounts to aggregate network traffic data and generate a report in Amazon QuickSight.

Answer

Use Amazon CloudWatch Logs Insights with a saved query in the central account and schedule it to run every hour using EventBridge.

Question 7

Match each AWS monitoring tool to its function.

Accepted Answer

Amazon CloudWatch: Collects and tracks metrics, logs, and monitors resources. Amazon CloudWatch collects metrics and logs, AWS CloudTrail records API calls for auditing, and AWS Config evaluates resource configurations for compliance. The incorrect options swap these functions.

Answer

Amazon CloudWatch: Records API calls to track user activity

Answer

AWS CloudTrail: Monitors CPU utilization and network traffic

Answer

Amazon CloudWatch: Assesses resources for compliance with rules

Question 8

A company has a CloudWatch dashboard that displays custom metrics from an application. Some metrics are missing from the dashboard, but the application is publishing them to CloudWatch. The SysOps administrator confirms the metrics are present in the CloudWatch console under the correct namespace. What could be causing the metrics to not appear on the dashboard?

Accepted Answer

The dashboard widget is configured with a period that is longer than the interval at which metrics are published.. If the dashboard widget's period (e.g., 5 minutes) is longer than the metric publication interval (e.g., 1 minute), CloudWatch will aggregate the data points into the larger period. If the metric was published recently, the aggregation may not have completed, or the data points may fall outside the visible range of the widget's period, causing them to not appear even though the raw metrics exist in the namespace.

Answer

The IAM user viewing the dashboard does not have cloudwatch:GetMetricData permission.

Answer

The dashboard's time range is set to the last 1 hour, but the metrics were published 2 hours ago.

Answer

The namespace of the custom metrics is misspelled in the dashboard configuration.

Question 9

A company is running a stateful web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent errors. The SysOps admin notices that the ALB's healthy host count is fluctuating. The admin wants to improve the health check configuration to reduce false positives. Which configuration change is most likely to help?

Accepted Answer

Increase the health check interval. Increasing the health check interval reduces the frequency of health checks, which helps prevent transient issues (e.g., brief CPU spikes or network jitter) from causing false positives. With a longer interval, the ALB waits longer between checks, giving the instance more time to recover before being marked unhealthy. This stabilizes the healthy host count and reduces unnecessary instance replacement.

Answer

Increase the unhealthy threshold count

Answer

Reduce the health check interval

Answer

Lower the healthy threshold count

Question 10

Which THREE metrics from Amazon CloudWatch are most useful for diagnosing an application performance bottleneck on an EC2 instance running a web server? (Choose 3.)

Accepted Answer

CPUUtilization. CPUUtilization (A) is a core EC2 hypervisor-level metric that reveals whether the web server is CPU-bound, which is one of the most common causes of an application performance bottleneck. NetworkIn (B) shows inbound traffic volume and can expose network saturation or unexpected traffic spikes that throttle request handling on the instance. StatusCheckFailed (E) indicates whether the instance has failed its system or instance status checks, which directly signals underlying host or instance-level problems that degrade application performance. DiskReadOps (C) is not among the marked answers and is less directly indicative of a web server bottleneck, since it only counts read operations rather than latency or throughput. MemoryUtilization (D) is not a default CloudWatch metric for EC2 — it requires the CloudWatch agent to be installed — so it is not one of the standard metrics relied on here.

Answer

DiskReadOps

Answer

MemoryUtilization

Question 11

A SysOps admin needs to set up centralized logging for multiple AWS accounts. Which TWO services should be used together to aggregate logs into a single S3 bucket? (Choose 2.)

Accepted Answer

AWS Config. AWS CloudTrail (C) is correct because it records API activity and account events across all accounts and can be configured with an organization trail to deliver log files to a single centralized S3 bucket. AWS Config (B) is correct because it continuously records resource configurations and configuration changes and can aggregate data from multiple accounts into a central account, with its configuration history and snapshots delivered to a centralized S3 bucket. Together, CloudTrail and AWS Config provide the API activity and resource configuration logging needed for centralized multi-account logging into one S3 bucket. VPC Flow Logs (A) only capture IP traffic metadata for a specific VPC, subnet, or ENI and are not a multi-account centralized logging service. S3 cross-region replication (D) replicates existing S3 objects between buckets but does not collect logs from AWS accounts. CloudWatch Logs subscription filters (E) stream log events to services like Kinesis or Lambda but are not the primary multi-account aggregation mechanism for CloudTrail and AWS Config data into S3.

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 cross-region replication

Answer

Amazon CloudWatch Logs subscription filter

Question 12

A company uses CloudWatch Logs to store application logs. The logs must be retained for 3 years for compliance. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Set the log group retention period to 3 years.. Option C is correct because CloudWatch Logs log groups support a retention setting that can be configured to 1096 days (3 years), which prevents the automatic deletion of log events before the compliance period ends. Option E is correct because CloudWatch Logs export tasks copy log data to an Amazon S3 bucket, where S3 durability and lifecycle policies can preserve the logs for 3 years or longer, satisfying compliance archival requirements. Option A is incorrect because transitioning objects to Glacier after 3 years does not itself retain logs for 3 years and assumes data is already in S3, which is not the case for CloudWatch Logs. Option B is incorrect because CloudWatch Logs Insights is only a query and analysis tool and does not affect log retention. Option D is incorrect because streaming logs to Kinesis Firehose is a real-time delivery mechanism, not a retention solution, and Firehose does not by itself guarantee 3-year storage.

Answer

Configure an S3 lifecycle policy to transition objects to Glacier after 3 years.

Answer

Enable CloudWatch Logs Insights.

Answer

Use CloudWatch Logs subscription filter to stream logs to Amazon Kinesis Firehose.

Question 13

A company wants to ensure that all S3 buckets are configured with server access logging. Which TWO AWS services can be used to detect non-compliant buckets? (Choose TWO.)

Accepted Answer

AWS Config. AWS Config (B) is correct because it continuously records S3 bucket configuration changes and can evaluate them against a managed or custom rule (for example, s3-bucket-logging-enabled) to flag buckets that lack server access logging. AWS CloudTrail (C) is correct because it logs S3 API activity such as PutBucketLogging, enabling detection of buckets where logging was never enabled or was disabled, and CloudTrail data/management events can feed analysis to identify non-compliant buckets. Amazon Inspector (A) is incorrect because it scans EC2 instances and container images for software vulnerabilities, not S3 bucket configuration. Amazon Macie (D) is incorrect because it discovers and classifies sensitive data in S3, not whether server access logging is enabled. Amazon GuardDuty (E) is incorrect because it detects threats and anomalous behavior via threat intelligence and ML, not configuration compliance for S3 logging.

Answer

Amazon Inspector

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 14

An application running on Amazon ECS with Fargate is experiencing intermittent failures. The application logs show connection timeouts to an RDS MySQL database. The database is in the same VPC but a different subnet. Which CloudWatch metric should be examined first to diagnose the issue?

Accepted Answer

VPC Flow Logs for the ECS task's elastic network interface.. VPC Flow Logs capture metadata about network traffic at the elastic network interface level, including whether packets were accepted or rejected. Since the application logs show connection timeouts (not authentication or resource exhaustion), the most likely cause is a network path issue, such as a missing route or security group rule blocking traffic between the ECS task's subnet and the RDS subnet. VPC Flow Logs will reveal if packets from the ECS task to the RDS database are being dropped, allowing you to pinpoint the exact network failure.

Answer

DatabaseConnections for the RDS instance.

Answer

MemoryUtilization for the RDS instance.

Answer

CPUUtilization for the ECS tasks.

Question 15

A company stores sensitive data in an S3 bucket. The security team requires that any access to the bucket from outside the corporate network be logged and immediately alerted. Which solution meets these requirements?

Accepted Answer

Enable S3 server access logging, stream logs to CloudWatch Logs, create a metric filter for external IP addresses, and set a CloudWatch alarm.. It combines S3 server access logging with CloudWatch Logs streaming, metric filtering for external IP addresses, and a CloudWatch alarm. This provides both logging and immediate alerting for any access from outside the corporate network, meeting the security team's requirements.

Answer

Enable S3 server access logging and store logs in a separate bucket for later analysis.

Answer

Enable AWS CloudTrail and create a metric filter for 'GetObject' events, then set a CloudWatch alarm.

Answer

Use AWS Config rules to detect when the bucket policy is changed to allow public access.

Question 16

An application running on EC2 instances behind an Application Load Balancer (ALB) sends custom metrics to CloudWatch. The team wants to set an alarm that triggers when the error rate exceeds 5% over a 5-minute period. The alarm must evaluate the metric every minute. Which configuration is required?

Accepted Answer

Period = 60 seconds, Statistic = Average, Evaluation Periods = 5, Datapoints to Alarm = 5. The alarm must evaluate the error rate every minute (period = 60 seconds) over a 5-minute window. With evaluation periods = 5 and datapoints to alarm = 5, the alarm requires all five 1-minute datapoints to exceed the 5% threshold, ensuring the error rate is sustained for the full 5-minute period. The Average statistic is appropriate because the error rate is a percentage metric that should be averaged over each period.

Answer

Period = 300 seconds, Statistic = Average, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 300 seconds, Statistic = Sum, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 60 seconds, Statistic = Sum, Evaluation Periods = 5, Datapoints to Alarm = 5

Question 17

A company has a fleet of EC2 instances that are part of an Auto Scaling group. The SysOps team wants to automatically replace any instance that fails the status check for 2 consecutive minutes. Which configuration should be used?

Accepted Answer

Configure an EC2 Auto Scaling group to use EC2 status checks and set the health check grace period to 2 minutes.. An Auto Scaling group can use EC2 status checks to determine instance health. By setting the health check grace period to 2 minutes, the Auto Scaling group will wait 2 minutes after an instance enters the InService state before starting health checks, and then if the instance fails status checks for 2 consecutive minutes, the Auto Scaling group will mark it as unhealthy and automatically terminate and replace it.

Answer

Use AWS Systems Manager Automation to run a script that reboots the instance.

Answer

Configure an Amazon EventBridge rule to trigger an AWS Lambda function that terminates the instance.

Answer

Configure a CloudWatch Alarm on StatusCheckFailed metric to reboot the instance.

Question 18

A SysOps administrator needs to ensure that an Amazon RDS instance automatically reboots if it becomes unavailable due to an operating system crash. The instance is a Multi-AZ deployment. What is the correct approach?

Accepted Answer

Enable Multi-AZ on the RDS instance to automatically failover to the standby.. Multi-AZ deployments automatically handle failover to a standby replica in a different Availability Zone when the primary instance becomes unavailable due to an OS crash. This built-in mechanism ensures high availability without manual intervention, as the standby takes over with the same endpoint.

Answer

Use AWS Systems Manager Run Command to reboot the instance when a health check fails.

Answer

Create an Amazon EventBridge rule to trigger a Lambda function that reboots the instance.

Answer

Configure a CloudWatch Alarm on the DatabaseConnections metric to reboot the instance.

Question 19

Which THREE actions can be taken to remediate an EC2 instance that has been compromised according to security best practices? (Select THREE.)

Accepted Answer

Terminate the instance after taking a forensic snapshot.. Option A is correct because AWS security best practices for a compromised EC2 instance include capturing a forensic snapshot of the EBS volumes before terminating the instance, so evidence is preserved while the compromised resource is removed from service. Option B is correct because creating an AMI of the instance captures the full instance state, including the root volume and any attached volumes, which can then be used for offline forensic analysis in an isolated environment. Option D is correct because isolating the instance by removing it from its security groups (or replacing them with a restrictive quarantine security group) cuts off network access and prevents lateral movement or data exfiltration while investigation proceeds. Option C is not appropriate because a simple reboot does not remove malware, persistence mechanisms, or attacker access, and may even destroy volatile evidence in memory. Option E is not appropriate because applying patches and restarting the application does not address an active compromise and could allow the attacker to retain access or cause further damage.

Answer

Reboot the instance to clear the compromise.

Answer

Apply any pending patches and restart the application.

Question 20

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps team needs to capture detailed HTTP request-level data, including headers and payload, for troubleshooting purposes. The data should be stored in Amazon S3 for analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable access logs on the ALB and specify an S3 bucket as the destination.. ALB access logs capture detailed HTTP request-level data, including headers and payload, and can be directly delivered to an S3 bucket without any additional agents or configuration on the EC2 instances. This native integration minimizes operational overhead by eliminating the need to install or manage logging agents on each instance.

Answer

Install the CloudWatch Logs agent on each EC2 instance and configure it to send Apache access logs to CloudWatch Logs, then export to S3.

Answer

Enable VPC Flow Logs and send them to an S3 bucket.

Answer

Use AWS CloudTrail with data events enabled for the ALB.