SOA-C02 Monitoring, Logging, and Remediation Practice Test 10 — 15 Questions

Question 1

An administrator needs to be notified when the root user signs in to the AWS Management Console. Which method should be used?

Accepted Answer

Create a CloudWatch Events rule for 'AWS Console Sign-In' events and set the target to an SNS topic.. You can create an Amazon CloudWatch Events rule (now called Amazon EventBridge rule) that matches the 'AWS Console Sign-In' event from AWS CloudTrail. When the root user signs in, this event is generated, and the rule can trigger an SNS topic to send a notification to the administrator. This is the recommended approach for real-time alerting on root user activity.

Answer

Enable CloudTrail Insights to detect root login anomalies.

Answer

Create a CloudWatch alarm on the RootAccountUsage metric.

Answer

Use AWS Config to track IAM password policy changes.

Question 2

A SysOps administrator wants to receive an email when the average CPU utilization of an EC2 instance exceeds 90% for 5 minutes. What should the administrator create?

Accepted Answer

A CloudWatch alarm on the CPUUtilization metric with an SNS notification.. A CloudWatch alarm on the CPUUtilization metric can be configured to evaluate the average CPU usage over a 5-minute period and trigger an action when it exceeds 90%. The alarm can send a notification via Amazon SNS, which can deliver an email to subscribed endpoints. This directly meets the requirement for email notification based on a sustained metric threshold.

Answer

A CloudWatch Logs metric filter on the instance logs.

Answer

An AWS Config rule to detect high CPU usage.

Answer

A CloudWatch Events rule on the EC2 instance state change.

Question 3

Refer to the exhibit. The alarm has been in INSUFFICIENT_DATA state for several hours. What is the most likely cause?

Accepted Answer

The EC2 instance is stopped or terminated.. The INSUFFICIENT_DATA state for several hours indicates that CloudWatch has not received any metric data points for the specified period. If the EC2 instance is stopped or terminated, the CloudWatch agent stops sending metrics, and the default CPU utilization metric (which is published by AWS, not the agent) also ceases because the instance is no longer running. This causes the alarm to remain in INSUFFICIENT_DATA indefinitely until the instance is started again or the metric resumes.

Answer

The alarm evaluation period is too long.

Answer

The instance has no CloudWatch agent installed.

Answer

The instance is running but the CPU utilization is below the threshold.

Question 4

A SysOps administrator is investigating why a CloudWatch alarm did not trigger an SNS notification. The alarm state changed to ALARM, but the notification was not sent. The SNS topic has a subscription to an email endpoint. What is the most likely cause?

Accepted Answer

The email subscription to the SNS topic has not been confirmed.. The most likely cause is that the email subscription to the SNS topic has not been confirmed. When an SNS topic has an email subscription, AWS sends a confirmation email to the endpoint, and the subscriber must click the confirmation link before notifications can be delivered. Until the subscription is confirmed, the SNS topic will not send any messages to that endpoint, even if the CloudWatch alarm enters the ALARM state and successfully publishes to the topic.

Answer

The alarm's evaluation period is too short.

Answer

The alarm's actions are not configured to send to the SNS topic.

Answer

The SNS topic is encrypted with a KMS key that the alarm does not have permissions to use.

Question 5

Refer to the exhibit. The command returns no events for RunInstances during the specified time period. The administrator knows that instances were launched during that time. What is the most likely cause?

Accepted Answer

CloudTrail is not configured to log management events.. CloudTrail can be configured to log either management events, data events, or both. If only data events are logged, management events such as RunInstances will not appear in the CloudTrail event history. The command `aws cloudtrail lookup-events` queries the CloudTrail event history, which only contains events that CloudTrail is configured to record. Since the administrator knows instances were launched but no events are returned, the most likely cause is that CloudTrail is not configured to log management events.

Answer

CloudTrail logs are being delivered to an S3 bucket, not to CloudWatch Logs.

Answer

The command is run in the wrong AWS Region.

Answer

The IAM user does not have permission to view CloudTrail events.

Question 6

A company wants to be able to query application logs in near real-time using a SQL-like syntax. Which AWS service should be used?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is the correct service because it enables interactive querying of log data stored in CloudWatch Logs using a purpose-built SQL-like query language. It is designed for ad-hoc analysis of logs in near real-time, allowing users to filter, aggregate, and visualize log events without needing to export data to another analytics platform.

Answer

CloudWatch Metrics Insights

Answer

CloudWatch Events

Answer

CloudWatch Logs subscription filters

Question 7

A company is using Amazon CloudWatch Logs to monitor application logs from EC2 instances. The operations team wants to receive a notification when a specific error pattern appears in the logs. Which solution requires the least operational overhead?

Accepted Answer

Install the CloudWatch agent on EC2 instances and configure it to stream logs to CloudWatch Logs. Create a metric filter for the error pattern and set a CloudWatch alarm that sends an SNS notification.. It uses native CloudWatch capabilities: the CloudWatch agent streams logs to CloudWatch Logs, a metric filter extracts the error pattern, and a CloudWatch alarm directly sends an SNS notification. This approach requires no additional compute resources like Lambda and no custom code, resulting in the least operational overhead. Option C requires creating and managing a Lambda function, which adds complexity and maintenance. Options B and D are more complex with extra services.

Answer

Use Amazon Kinesis Data Firehose to stream all logs to Amazon S3, then run an AWS Glue job to search for the error pattern and trigger an SNS notification.

Answer

Install the CloudWatch agent on EC2 instances, stream logs to CloudWatch Logs, and use a subscription filter to invoke an AWS Lambda function that publishes a message to an SNS topic.

Answer

Configure the application to write logs to a file, use the CloudWatch agent to send logs to CloudWatch Logs, set a metric filter, and use the filter to send data to Amazon EventBridge, which then triggers a Lambda function to send an SNS notification.

Question 8

A SysOps administrator is troubleshooting a slow-running application on an EC2 instance. CloudWatch metrics show high CPU utilization but low disk I/O. The instance type is t3.medium. Which action would most likely improve performance?

Accepted Answer

Change the instance type to c5.large, which provides dedicated CPU performance.. The t3.medium is a burstable instance that relies on CPU credits. High CPU utilization with low disk I/O indicates the application is CPU-bound and the instance has likely exhausted its CPU credits, causing performance throttling. Changing to a c5.large provides dedicated, consistent CPU performance without credit-based limitations, directly addressing the bottleneck.

Answer

Increase the instance memory by changing to r5.large.

Answer

Enable EBS-optimized on the instance and use provisioned IOPS SSD volumes.

Answer

Increase the size of the EBS volume to improve disk throughput.

Question 9

A company has enabled AWS CloudTrail in all regions and is logging to an S3 bucket. The security team needs to be alerted within minutes if any IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs. Create a metric filter for the IAM event 'CreateAccessKey' and set a CloudWatch alarm that sends an SNS notification.. CloudTrail can be configured to deliver events to CloudWatch Logs, where a metric filter can be created to match the 'CreateAccessKey' event. A CloudWatch alarm based on that metric filter can then trigger an SNS notification within minutes, providing the most efficient and native AWS solution for real-time alerting without custom code or polling.

Answer

Enable S3 event notifications on the CloudTrail bucket to trigger a Lambda function that parses logs and sends an alert.

Answer

Use AWS Config rules to detect changes to IAM access keys and trigger an SNS notification.

Answer

Run a script on an EC2 instance that polls CloudTrail API for new events every minute and sends alerts.

Question 10

A company is using AWS Lambda functions to process incoming messages from Amazon SQS. The Lambda function sometimes fails due to a transient error, and the message is not processed. The team wants to automatically retry failed messages and send them to a dead-letter queue (DLQ) after three failed attempts. Which configuration meets these requirements?

Accepted Answer

Configure the SQS queue with a redrive policy that allows three maximum receives before sending to a DLQ.. When SQS is configured as an event source for Lambda, retries are controlled by the SQS queue's redrive policy. The redrive policy with maxReceiveCount determines how many times a message can be received before it is moved to the DLQ. Setting maxReceiveCount to 3 means after three receive attempts (i.e., three failed processing attempts), the message is sent to the DLQ. Option C is incorrect because Lambda's dead-letter configuration is used for asynchronous invocations, not for SQS event source mappings. For SQS-triggered functions, the DLQ must be configured on the SQS queue itself using a redrive policy, not on the Lambda function.

Answer

Set the Lambda function's reserved concurrency to 1 and enable 'maximumRetryAttempts' to 2.

Answer

Create an SQS queue with a visibility timeout that allows three retries before sending to a DLQ.

Answer

Configure the SQS queue as an event source for Lambda with a DLQ specified in the Lambda function's dead-letter configuration.

Question 11

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The application is read-heavy and can tolerate eventual consistency. Which action would MOST effectively reduce CPU load?

Accepted Answer

Create one or more read replicas and direct read traffic to them.. The application is read-heavy and can tolerate eventual consistency, making read replicas the ideal solution. By offloading read traffic to one or more read replicas, the primary RDS instance's CPU load is reduced because it no longer has to process all read queries. This directly addresses the high CPU utilization during peak hours without requiring a larger instance or other changes.

Answer

Increase the instance size from db.r5.large to db.r5.xlarge.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the storage type to Provisioned IOPS.

Question 12

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack update fails. What is the simplest way to achieve this?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's notification options.. CloudFormation natively supports specifying an SNS topic in the stack's notification options, which automatically sends notifications on stack events such as failures, without requiring any additional services or custom code. This is the simplest and most direct method to notify the operations team when a stack update fails.

Answer

Enable CloudTrail and create a metric filter for 'UpdateStack' events, then set an alarm.

Answer

Write a script that periodically checks the CloudFormation console for stack status and sends an email.

Answer

Create an Amazon EventBridge rule that matches CloudFormation events and triggers a Lambda function to send an SNS notification.

Question 13

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 5xx errors. CloudWatch metrics show that the ALB's 'HTTPCode_ELB_5XX_Count' is elevated. What is the MOST likely cause?

Accepted Answer

The load balancer is timing out waiting for a response from the target.. When the ALB's 'HTTPCode_ELB_5XX_Count' is elevated, it indicates that the load balancer itself is generating the 5xx error, not the target. The most common cause is that the load balancer is timing out while waiting for a response from the target instances, which occurs when the target takes longer than the configured idle timeout (default 60 seconds) to respond. This results in the ALB returning a 504 Gateway Timeout error, which is counted in the ELB 5xx metric.

Answer

The target instances are returning HTTP 503 errors.

Answer

The target instances have high latency but are still responding.

Answer

Client requests are malformed and being rejected by the load balancer.

Question 14

A SysOps administrator is investigating a performance issue where an Amazon RDS for MySQL instance's ReadIOPS metric is consistently high. The database is used by a web application. Which THREE actions should the administrator take to improve performance?

Accepted Answer

Increase the InnoDB buffer pool size to cache more data in memory.. Increasing the InnoDB buffer pool size allows more data and indexes to be cached in memory, reducing the need for disk reads and thus lowering ReadIOPS. This is a direct and effective tuning action for MySQL on RDS when read I/O is the bottleneck.

Answer

Change the storage type to Provisioned IOPS for better performance.

Answer

Enable Multi-AZ deployment for high availability.

Question 15

A company uses Amazon CloudWatch to monitor its AWS infrastructure. The operations team wants to receive notifications when any EC2 instance's status check fails. Which TWO steps should be taken to achieve this?

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when the alarm state changes. This allows the operations team to receive immediate notifications (e.g., via email, SMS, or HTTP) when an EC2 instance's status check fails. Option E is also correct because the StatusCheckFailed metric (or StatusCheckFailed_Instance) directly reflects the result of the EC2 status check; setting an alarm with a threshold of greater than 0 triggers when any status check fails.

Answer

Create a CloudWatch alarm on the CPUUtilization metric with a threshold of 90%.

Answer

Enable AWS CloudTrail to capture instance state changes.

Answer

Install the CloudWatch agent on the instance and publish custom memory metrics.