SOA-C02 Monitoring, Logging, and Remediation Practice Test 10 — 15 Questions

Question 1

A SysOps administrator is investigating a security incident where an unauthorized user accessed an S3 bucket. Which TWO AWS services can the administrator use to collect and analyze the relevant logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API calls made to S3, including who made the request, the source IP address, and the time of the action. This allows the administrator to trace the unauthorized access to a specific IAM user or role and identify the exact API operations performed, such as GetObject or PutObject.

Answer

AWS WAF logs

Answer

Amazon VPC Flow Logs

Answer

Amazon Route 53 resolver logs

Question 2

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application experiences intermittent latency spikes. The SysOps administrator has enabled detailed CloudWatch metrics on the ALB and the EC2 instances. The administrator notices that during the latency spikes, the ALB's TargetResponseTime metric increases, but the EC2 instance's CPU utilization and memory usage remain normal. The administrator also observes that the number of concurrent connections to the ALB spikes during these periods. Which action should the administrator take to identify the root cause?

Accepted Answer

Analyze the ALB's ActiveConnectionCount and RequestCountPerTarget metrics to see if the load balancer is reaching its connection limit.. The ALB's ActiveConnectionCount and RequestCountPerTarget metrics directly indicate whether the load balancer is approaching its connection limit (default 50,000 for ALBs). During latency spikes, if concurrent connections spike but instance CPU/memory are normal, the bottleneck is likely at the load balancer level, not the instances. Analyzing these metrics helps determine if the ALB is queuing or dropping requests due to connection limits, causing increased TargetResponseTime.

Answer

Check the RDS database's DatabaseConnections metric to see if the database is overwhelmed.

Answer

Enable VPC Flow Logs and analyze the traffic patterns for dropped packets.

Answer

Enable detailed monitoring on the EC2 instances to capture CPU credits for burstable instances.

Question 3

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer, Auto Scaling group, and RDS database. The SysOps administrator receives a notification that a stack update has failed. The administrator wants to investigate the failure and understand which resource caused the issue. The stack is in the UPDATE_ROLLBACK_IN_PROGRESS state. What should the administrator do to identify the failed resource?

Accepted Answer

View the stack events in the CloudFormation console to see which resource failed and the error message.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_IN_PROGRESS, the most direct way to identify the failed resource is to view the stack events in the CloudFormation console. Each event includes a status reason field that contains the specific error message and the logical resource ID of the resource that caused the failure, allowing the administrator to pinpoint the issue without additional investigation.

Answer

Review the stack's template in the CloudFormation console to check for syntax errors.

Answer

Check the CloudWatch Logs for the EC2 instances in the Auto Scaling group.

Answer

Manually re-run the update with the same parameters to see if the error recurs.

Question 4

A SysOps administrator is managing an AWS environment with multiple VPCs connected via a transit gateway. The administrator needs to monitor network traffic between VPCs for security analysis. The administrator wants to capture metadata about IP traffic going through the transit gateway. The logs should be centralized in a single S3 bucket and retained for 90 days. Which solution should the administrator implement?

Accepted Answer

Enable flow logs on the transit gateway and publish them to a CloudWatch Logs log group, then export to S3 using a subscription filter.. VPC Flow Logs can be enabled on a transit gateway or transit gateway attachment, capturing IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts). The logs are published to a CloudWatch Logs log group. A subscription filter can then export these logs to a central S3 bucket, where an S3 lifecycle policy can expire objects after 90 days, meeting the centralized logging and retention requirements. Option A is incorrect because VPC Flow Logs on individual VPCs only capture traffic at the VPC level, not traffic routed through the transit gateway. Option B is incorrect because AWS Config records configuration changes, not network traffic metadata. Option D is incorrect because Transit Gateway Network Manager does not enable flow logs; flow logs on transit gateway attachments are enabled through VPC Flow Logs, and while they can be published directly to S3, Network Manager is not involved in that process.

Answer

Enable VPC Flow Logs on each VPC and publish them to a central S3 bucket.

Answer

Use AWS Config to record traffic changes and store the configuration history in S3.

Answer

Use Transit Gateway Network Manager to enable flow logs on the transit gateway attachments and publish them directly to an S3 bucket.

Question 5

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is unreachable. The instance passes status checks and is in a healthy state. Security groups and network ACLs are configured correctly. CloudWatch metrics show CPU utilization is 5%. The administrator can SSH into the instance but cannot connect to the web server on port 443. What is the most likely cause?

Accepted Answer

The web server service is not running or crashed.. The instance passes both status checks and is healthy, and the administrator can SSH into it, confirming that the operating system and network stack are functional. Since the web server is unreachable on port 443 despite correct security group and network ACL configurations, and CPU utilization is low (5%), the most likely cause is that the web server service (e.g., Apache, Nginx) has stopped or crashed. This would prevent the instance from listening on port 443, even though the underlying infrastructure is sound.

Answer

The security group inbound rule for HTTPS is misconfigured.

Answer

The instance has an incorrect route table entry.

Answer

The instance has insufficient CPU credits.

Question 6

A SysOps administrator sets up an alarm to monitor the CPU utilization of an Auto Scaling group. The alarm should trigger a scaling policy when CPU exceeds 80% for 5 consecutive minutes. The alarm state remains 'INSUFFICIENT_DATA' even though instances are running. Which THREE are possible causes?

Accepted Answer

The EC2 instances are not sending CPU utilization metrics to CloudWatch.. If EC2 instances are not sending CPU utilization metrics to CloudWatch, the alarm will remain in INSUFFICIENT_DATA state. This can happen if the CloudWatch agent is not installed or configured on the instances, or if the instances lack the necessary IAM permissions to publish metrics. Without metric data, CloudWatch cannot evaluate the alarm condition.

Answer

The Auto Scaling group does not have a health check grace period configured.

Answer

The Auto Scaling group uses ELB health checks.

Question 7

An IAM policy is attached to an EC2 instance role to allow sending logs to CloudWatch Logs. The application running on the instance fails to send logs to the log group 'MyAppLogGroup'. Which change is required to fix the issue?

Accepted Answer

Add a new statement allowing logs:PutLogEvents on 'arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogGroup:log-stream:*'.. The IAM policy attached to the EC2 instance role is missing the `logs:PutLogEvents` permission for the specific log stream within the log group. Even if the policy allows `logs:CreateLogStream` and `logs:DescribeLogGroups`, the application cannot send log events without `logs:PutLogEvents` on the log stream resource. Option C adds the required statement with the correct ARN pattern to resolve the failure.

Answer

Install the CloudWatch agent on the instance.

Answer

Attach the policy to the EC2 instance instead of the instance role.

Answer

Change the log group ARN in the policy to include the log stream name.

Question 8

A company wants to receive a notification when the root account is used to perform any action in the AWS account. Which service should be used to monitor this?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. AWS CloudTrail logs all API activity in the account, including root user actions. By creating a CloudTrail trail and sending those logs to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that matches the `RootAccess` event or any API call where `userIdentity.type` is `Root` and trigger a notification via SNS or Lambda. This combination provides real-time monitoring and alerting for root account usage.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 9

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack enters a ROLLBACK_IN_PROGRESS state. Which TWO methods can achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the CloudFormation stack status change.. Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack status changes, including ROLLBACK_IN_PROGRESS, by matching the 'CloudFormation Stack Status Change' event pattern. This allows you to trigger a notification action (e.g., via SNS or Lambda) in real time when the stack enters that state.

Answer

Use AWS Config rules to evaluate the stack state.

Answer

Configure a CloudWatch Logs subscription filter to detect the stack state.

Answer

Create a CloudTrail trail and monitor the UpdateStack API call.

Question 10

A SysOps administrator is troubleshooting a Lambda function that is not processing messages from an SQS queue. The function is subscribed to the queue via an event source mapping. The function has a reserved concurrency of 0. Which TWO actions will resolve the issue?

Accepted Answer

Set the reserved concurrency to a value greater than 0.. Reserved concurrency of 0 means the Lambda function has no available execution capacity, so it cannot process any invocations, including those from SQS. Setting reserved concurrency to a value greater than 0 (e.g., 1 or more) allocates the necessary execution slots for the function to run. This directly resolves the issue because the event source mapping will successfully invoke the function only when concurrency is available.

Answer

Add SQS permissions to the Lambda execution role.

Answer

Configure a dead-letter queue for the Lambda function.

Answer

Increase the batch size in the event source mapping.

Question 11

A company hosts a web application on multiple EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator receives a report that the application is experiencing intermittent 503 errors. The ALB target group health checks are configured to check the /health endpoint every 30 seconds with a healthy threshold of 2 and an unhealthy threshold of 2. The administrator checks the ALB metrics and notices that the number of healthy hosts occasionally drops to zero. The EC2 instances are normal and the application logs show no errors. What is the most likely cause and solution?

Accepted Answer

Increase the health check timeout to 10 seconds.. The intermittent 503 errors and healthy hosts dropping to zero indicate that health checks are timing out before the application can respond. With a default health check timeout of 5 seconds and a 30-second interval, if the /health endpoint occasionally takes longer than 5 seconds (e.g., due to transient load), the ALB marks instances unhealthy after two consecutive failures (unhealthy threshold of 2). Increasing the timeout to 10 seconds gives the endpoint more time to respond, preventing false negatives without changing the check frequency.

Answer

Increase the health check interval to 60 seconds.

Answer

Add more EC2 instances to the target group.

Answer

Decrease the healthy threshold to 1.

Question 12

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The SysOps administrator notices that the DB instance's CPU utilization spikes to 100% every few minutes. CloudWatch alarms have been set to trigger when CPU exceeds 90% for 5 minutes, but no alarm state changes are observed. The administrator checks the CloudWatch metrics and sees that the CPU utilization metric shows periodic spikes but they last only 2-3 minutes each. What is the most likely cause and what should the administrator do to receive notifications?

Accepted Answer

Set the alarm to evaluate over 1 minute instead of 5 minutes.. The CPU utilization spikes last only 2-3 minutes, which is shorter than the alarm's evaluation period of 5 consecutive minutes. Since the alarm requires the metric to exceed the 90% threshold for 5 minutes before triggering, these brief spikes never satisfy the alarm's duration condition. Setting the alarm to evaluate over 1 minute will match the spike duration and allow the alarm to trigger on these short-lived bursts.

Answer

The Multi-AZ failover is causing the spikes; disable Multi-AZ.

Answer

The DB instance is not publishing CPU metrics at a high enough resolution.

Answer

The CPU metric is not accurate; use the CPU credit metric instead.

Question 13

A company uses Amazon S3 to store sensitive data. The SysOps administrator needs to ensure that any attempt to upload an object with server-side encryption disabled is immediately detected and the administrator is notified. The administrator has enabled AWS CloudTrail and is logging S3 data events. Which approach should the administrator use to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutObject API calls without the encryption header and triggers an SNS notification.. CloudWatch Events (now Amazon EventBridge) can filter API calls captured by CloudTrail for PutObject operations that lack the x-amz-server-side-encryption header, and then trigger an SNS notification in near real-time. This ensures immediate detection and notification of any upload with server-side encryption disabled, meeting the requirement for instant alerting.

Answer

Enable S3 event notifications to send events to SNS for all PutObject operations.

Answer

Create an AWS Config rule to detect objects without encryption.

Answer

Use S3 Inventory to generate a daily report of unencrypted objects.

Question 14

A SysOps administrator is troubleshooting a slow web application running on EC2 instances behind an ALB. The application uses an RDS MySQL database. The administrator checks CloudWatch metrics and sees that the ALB's latency is high, the RDS CPU is high, and the EC2 CPU is moderate. The application team reports that the database queries are slow. The administrator suspects that the database is the bottleneck. However, the RDS instance is already a db.r5.large and the administrator wants to avoid increasing instance size due to cost. What should the administrator do to improve performance without increasing instance size?

Accepted Answer

Enable Performance Insights on the RDS instance to identify slow queries.. Enabling Performance Insights on the RDS instance allows the administrator to identify the specific slow queries causing the bottleneck. This diagnostic tool provides a database load analysis, showing which queries consume the most resources, enabling targeted optimization (e.g., adding indexes or rewriting queries) without increasing instance size. Since the EC2 CPU is moderate and the ALB latency is high due to slow database queries, resolving the query performance directly addresses the root cause.

Answer

Increase the number of EC2 instances to reduce the load on the database.

Answer

Add an ElastiCache Redis cluster to cache database queries.

Answer

Create a Read Replica and offload read traffic to it.

Question 15

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The stack creation fails with the error 'The maximum number of VPCs has been reached.' The SysOps administrator needs to deploy the stack as soon as possible. What should the administrator do?

Accepted Answer

Request a VPC limit increase from AWS Support.. The error 'The maximum number of VPCs has been reached' indicates the AWS account has hit the default VPC limit (5 per region). Requesting a service limit increase from AWS Support is the fastest way to raise this soft limit without modifying existing infrastructure or templates, allowing the stack to deploy in the same region.

Answer

Delete unused VPCs to free up capacity.

Answer

Modify the CloudFormation template to use an existing VPC.

Answer

Deploy the stack in a different AWS region.