SOA-C02 Monitoring, Logging, and Remediation Practice Test 10 — 15 Questions

Question 1

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The SysOps administrator needs to detect and automatically replace an instance that is not responding to health checks. Which THREE steps should the administrator take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch alarm to take the action of terminating the instance.. Option B is correct because a CloudWatch alarm configured on the 'StatusCheckFailed' metric can directly trigger an Auto Scaling action to terminate the unhealthy instance. This integrates with the Auto Scaling group's lifecycle to automatically replace the instance without manual intervention, meeting the requirement for automated detection and replacement.

Answer

Manually terminate the unhealthy instance after the alarm triggers.

Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.

Answer

Configure the Auto Scaling group to use ELB health checks.

Question 2

A SysOps administrator is creating a monitoring solution for a web application that uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The administrator wants to monitor the average request count per minute and the number of healthy hosts. Which TWO CloudWatch metrics should the administrator use? (Choose TWO.)

Accepted Answer

AWS/ApplicationELB HealthyHostCount. Option B, AWS/ApplicationELB HealthyHostCount, is correct because it directly reports the number of registered instances that are passing health checks, which is exactly what the administrator needs to monitor the number of healthy hosts behind the ALB. Option E, AWS/ApplicationELB RequestCount, is correct because it tracks the total number of requests handled by the ALB, and by dividing by the time period, the administrator can calculate the average request count per minute.

Answer

AWS/ApplicationELB Latency

Answer

AWS/EC2 CPUUtilization

Answer

AWS/AutoScaling GroupInServiceInstances

Question 3

A company is using Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team needs to receive an alert when the number of healthy hosts drops below 50% of the desired capacity for more than 5 minutes. Which CloudWatch metric and alarm configuration should be used?

Accepted Answer

Use the 'HealthyHostCount' metric with a statistic of 'Sum' and a threshold of 0.5 * desired capacity.. The correct answer is B because the 'HealthyHostCount' metric from the Application Load Balancer (ALB) directly reports the number of registered instances that are passing health checks. By setting the statistic to 'Sum' and the threshold to 0.5 * desired capacity, the alarm triggers when the count of healthy hosts falls below 50% of the Auto Scaling group's desired capacity for the specified evaluation period of 5 minutes, meeting the exact requirement.

Answer

Use the 'RequestCount' metric with a statistic of 'Sum' and a threshold of 50% of the average request count.

Answer

Use the 'UnhealthyHostCount' metric with a threshold of 50% of desired capacity.

Answer

Use the 'TargetResponseTime' metric with a statistic of 'p90' and a threshold of 2 seconds.

Question 4

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for MySQL DB instance. The administrator wants to receive a notification when the average CPU utilization exceeds 80% for 10 consecutive minutes. Which steps should the administrator take to set up this monitoring?

Accepted Answer

Create a CloudWatch alarm on the 'CPUUtilization' metric with a threshold of 80% and an SNS topic for notifications.. Option C is correct because Amazon RDS automatically publishes the 'CPUUtilization' metric to CloudWatch, and a CloudWatch alarm can be configured with a threshold of 80% for the 'Average' statistic over a period of 10 consecutive minutes (e.g., 10 evaluation periods of 1 minute each). The alarm can then trigger an SNS topic to send notifications when the threshold is breached. This directly meets the requirement without additional services.

Answer

Use CloudWatch Logs to monitor the database logs and create an alarm based on log patterns.

Answer

Enable Enhanced Monitoring and create an alarm on the 'CPUUtilization' metric in RDS console.

Answer

Enable CloudTrail and create a metric filter for CPU utilization.

Question 5

A company is running a critical application on Amazon EC2 instances. The application performance has degraded over the past week. The SysOps administrator suspects a memory leak. The administrator needs to collect detailed memory usage metrics every minute and store them for 30 days. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. Option D is correct because the CloudWatch agent is specifically designed to collect custom metrics like memory utilization from EC2 instances, which are not available through default or detailed EC2 monitoring. By installing the agent and configuring it to publish memory metrics to CloudWatch every minute, the administrator can meet the requirement for 1-minute granularity and 30-day retention cost-effectively, as CloudWatch retains metric data at 1-minute resolution for 15 days by default, but can be extended to 30 days via a custom metric retention setting.

Answer

Use AWS CloudTrail to log memory usage and store the logs in Amazon S3.

Answer

Enable default EC2 monitoring to collect memory metrics every 5 minutes.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics every 1 minute.

Question 6

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance running Amazon Linux 2 is not sending logs to CloudWatch Logs. The CloudWatch agent is installed and configured. Which step should the administrator take FIRST to diagnose the issue?

Accepted Answer

Check the CloudWatch agent status and review its log files on the instance.. The CloudWatch agent is already installed and configured, so the first step is to check its operational status and review its own log files (typically in /var/log/aws/amazon-cloudwatch-agent/). This directly reveals whether the agent is running, encountering configuration errors, or failing to connect to the CloudWatch Logs service endpoint, without making unnecessary changes.

Answer

Reinstall the CloudWatch agent from the AWS Systems Manager.

Answer

Update the IAM role attached to the instance to include CloudWatch Logs permissions.

Answer

Verify the EC2 instance status in the AWS Management Console.

Question 7

A company uses Amazon CloudWatch to monitor its AWS resources. The operations team needs to receive email notifications when the root user performs any action in the AWS account. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs metric filter, and Amazon SNS.. AWS CloudTrail logs all API activity, including root user actions. By sending these logs to CloudWatch Logs, you can create a metric filter that matches root user events (e.g., `userIdentity.type = "Root"`). When the metric filter triggers a CloudWatch alarm, it publishes a notification to an SNS topic, which sends an email to subscribers. This combination ensures real-time notification of root user actions.

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS).

Answer

AWS Trusted Advisor and Amazon Simple Email Service (SES).

Answer

AWS Config, Amazon CloudWatch Events, and Amazon SNS.

Question 8

An organization has a production AWS environment with multiple VPCs and hundreds of EC2 instances. The security team wants to be alerted when any security group is modified. Which approach should a SysOps administrator use to meet this requirement with minimal overhead?

Accepted Answer

Use AWS Config rules to detect security group changes and trigger an SNS notification.. Option B is correct because AWS Config rules can continuously evaluate security group configurations against desired settings and trigger an SNS notification when a change is detected. This approach provides automated, event-driven monitoring with minimal operational overhead, as it does not require custom scripts or manual log analysis.

Answer

Enable CloudTrail and create a CloudWatch alarm for each security group modification event.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena for security group changes.

Answer

Deploy Amazon GuardDuty to monitor for security group modifications.

Question 9

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The administrator needs to investigate which queries are consuming the most CPU. Which action should the administrator take?

Accepted Answer

Enable Performance Insights for the RDS instance and review the top SQL queries.. Performance Insights is the correct tool because it provides a database-specific performance schema that visualizes database load and identifies the top SQL queries consuming resources. By enabling Performance Insights on the RDS instance, the administrator can directly view which queries are responsible for the high CPU utilization during peak hours, allowing targeted optimization.

Answer

Use CloudWatch Logs Insights to query the database error log for slow queries.

Answer

Enable detailed CloudWatch metrics for the RDS instance and analyze the CPUUtilization metric.

Answer

Enable RDS Enhanced Monitoring and review the 'cpuCreditUsage' metric.

Question 10

A company has an Amazon S3 bucket that stores critical data. The security team wants to be notified whenever an object in the bucket is deleted. Which solution should the SysOps administrator implement?

Accepted Answer

Enable CloudTrail data events for the S3 bucket, create a CloudWatch Events rule for 'DeleteObject' API calls, and send notifications via SNS.. Option B is correct because it uses CloudTrail data events to capture 'DeleteObject' API calls specifically for the S3 bucket, then routes those events via CloudWatch Events to an SNS topic for notification. This provides a reliable, real-time notification mechanism for object deletions without requiring custom code or post-hoc analysis.

Answer

Configure an S3 event notification for 's3:ObjectRemoved:*' events to trigger an AWS Lambda function that sends an email.

Answer

Use AWS Config to monitor S3 bucket resources and trigger an SNS notification on configuration changes.

Answer

Enable S3 server access logs and use Amazon Athena to query for delete events, then send notifications.

Question 11

A SysOps administrator is managing a fleet of EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The administrator notices that the 'SurgeQueueLength' metric for the ALB is frequently high. What does this indicate, and what is the BEST remediation action?

Accepted Answer

The targets are not able to handle the request rate; increase the desired capacity or add scaling policies.. The SurgeQueueLength metric measures the number of requests that are queued by the Application Load Balancer (ALB) because no healthy target is available to process them. A frequently high value indicates that the targets (EC2 instances) are overwhelmed and cannot keep up with the incoming request rate. The best remediation is to increase the desired capacity of the Auto Scaling group or add scaling policies (e.g., based on SurgeQueueLength or RequestCountPerTarget) to automatically add more instances to handle the load.

Answer

The targets are unhealthy; decrease the desired capacity to reduce load.

Answer

The load balancer is accepting too many connections; increase the idle timeout.

Answer

The load balancer is overloaded; replace it with a Network Load Balancer.

Question 12

A SysOps administrator needs to monitor the disk space utilization on a fleet of EC2 instances running Windows Server. Which TWO steps should the administrator take to collect and visualize this data? (Choose TWO.)

Accepted Answer

Install the CloudWatch agent on each EC2 instance to collect disk space metrics.. The CloudWatch agent is required to collect custom metrics like disk space utilization from EC2 instances running Windows Server. Default EC2 monitoring only collects hypervisor-level metrics (CPU, network, disk I/O), not guest OS metrics such as disk space. Installing the CloudWatch agent and configuring it to collect disk space metrics is the correct step. Creating a CloudWatch dashboard then allows visualization of those collected metrics.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log disk space changes.

Answer

Enable default EC2 monitoring to collect disk space metrics automatically.

Question 13

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that all API calls across all accounts are logged and retained for at least 7 years. Which THREE steps should the SysOps administrator take to meet this requirement? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail in all AWS accounts and all regions.. AWS CloudTrail is the service designed to record all API calls made within an AWS account. Enabling CloudTrail in all accounts and all regions ensures comprehensive logging of management events across the entire AWS Organization. This is a foundational step for meeting audit and compliance requirements.

Answer

Use AWS Config to record API calls and store them in an S3 bucket.

Answer

Store CloudTrail logs in Amazon CloudWatch Logs with a retention policy of 7 years.

Question 14

A SysOps administrator is investigating a performance issue with an Amazon RDS for PostgreSQL instance. The administrator has enabled Performance Insights. Which TWO metrics from Performance Insights can help identify the root cause of a sudden increase in database load? (Choose TWO.)

Accepted Answer

DB Load by Wait Events.. Performance Insights measures database load in units of Average Active Sessions (AAS). The 'DB Load by Wait Events' metric breaks down this load by the specific wait events (e.g., I/O, locks, CPU) that are causing sessions to wait, directly pinpointing the bottleneck. This is the primary diagnostic view for identifying the root cause of a sudden load increase.

Answer

Read IOPS and Write IOPS.

Answer

Average Active Sessions.

Answer

CPUUtilization percentage.

Question 15

A SysOps administrator is responsible for a multi-tier web application running on AWS. The application consists of an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS for MySQL database. Recently, the operations team has been receiving alerts from CloudWatch that the ALB's 'HTTPCode_Target_5XX_Count' metric is spiking periodically. The team has also noticed that the database CPU utilization is high during these spikes. The application logs show that some requests are timing out. The administrator needs to identify the root cause and implement a remediation. After reviewing the architecture, the administrator rules out the database as the bottleneck because the database connections are pooled and the query response times are normal. The administrator suspects that the issue is related to the application server's health. Which course of action should the administrator take to diagnose and resolve the issue?

Accepted Answer

Increase the health check timeout and threshold to allow for transient high CPU usage.. Option A is correct because the periodic spikes in ALB 5xx errors, high database CPU, and application timeouts, combined with normal query response times and pooled connections, strongly suggest that the application servers are becoming overwhelmed and failing health checks. By increasing the health check timeout and threshold, the ALB will allow the EC2 instances more time to recover from transient CPU or memory pressure before being marked unhealthy and removed from service, which prevents unnecessary instance replacement and reduces the cascading load on remaining instances and the database.

Answer

Add an Amazon ElastiCache cluster to cache database queries.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Answer

Increase the idle timeout on the ALB to keep connections open longer.