SOA-C02 Monitoring, Logging, and Remediation Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

Accepted Answer

The log group's retention policy is set to 1 day and the data is older than the retention period.. Option D is correct because CloudWatch Logs Insights queries only return results from log events that are still present in the log group. If the log group's retention policy is set to 1 day, any data older than that retention period is automatically deleted. The administrator knows errors occurred in the last hour, but if the query is incorrectly scoped to a time range that includes data beyond the retention period, or if the errors were logged exactly at the boundary and have since been purged, the query will return no results. This is the most likely cause given that the query syntax appears valid and the administrator confirms errors exist.

Answer

The 'stats' command requires a 'by' clause with a field name, but 'bin(5m)' is invalid.

Answer

The log group contains too many log events, causing the query to time out.

Answer

The @message field is not a valid field in CloudWatch Logs Insights.

Question 2

A company uses Amazon RDS for MySQL and wants to monitor the number of database connections in real time. Which CloudWatch metric should the SysOps administrator use?

Accepted Answer

DatabaseConnections. Amazon RDS for MySQL exposes a CloudWatch metric named `DatabaseConnections` that reports the number of client connections to the DB instance. This metric is derived from the MySQL `Threads_connected` status variable and is updated every minute, providing real-time visibility into connection counts for monitoring and alarming.

Answer

CPUUtilization

Answer

ActiveConnections

Answer

ConnectionCount

Question 3

An organization uses AWS CloudTrail to log API calls across multiple accounts in AWS Organizations. The logs are delivered to a central S3 bucket. The security team wants to receive near-real-time notifications whenever an IAM user creates a new access key. Which solution is the MOST operationally efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event from CloudTrail and publishes to an Amazon SNS topic.. Amazon EventBridge can directly consume CloudTrail events (including `CreateAccessKey`) in near-real-time without polling or custom code. By creating a rule that matches this specific event and targets an SNS topic, the security team gets immediate notifications with minimal operational overhead. This approach is serverless, event-driven, and requires no intermediate services or custom functions.

Answer

Enable S3 Event Notifications on the CloudTrail bucket to trigger a Lambda function that scans new objects for access key creation.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and set up a metric filter that triggers an alarm.

Answer

Use Amazon CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 4

A SysOps administrator notices that an Amazon EC2 instance's CPU utilization is consistently above 90% during business hours. The instance is part of an Auto Scaling group with a simple scaling policy based on average CPU utilization. However, the Auto Scaling group is not launching new instances. What is the most likely cause?

Accepted Answer

The scaling policy is in a cooldown period after a previous scaling activity.. The simple scaling policy in Auto Scaling has a cooldown period (default 300 seconds) that prevents the group from launching or terminating instances immediately after a previous scaling activity. If the policy triggered a scale-out event recently, the cooldown period is still active, so even though CPU utilization remains above 90%, no new instances are launched until the cooldown expires. This is the most likely cause because the cooldown is designed to stabilize metrics and avoid thrashing.

Answer

The Auto Scaling group has a minimum size equal to the current number of instances.

Answer

The Auto Scaling group has a scheduled scaling action that is overriding the dynamic policy.

Answer

The instance is not healthy and is being terminated by the Auto Scaling group.

Question 5

Refer to the exhibit. A SysOps administrator created this IAM policy for an application that sends custom metrics to CloudWatch and writes logs to CloudWatch Logs. The application reports that it cannot publish logs. What is the most likely reason?

Accepted Answer

The resource ARN for the logs actions is incorrect; it should include 'log-group:' before the wildcard.. Option A is correct because the IAM policy uses `arn:aws:logs:us-east-1:123456789012:*` for the `Resource` element of the `logs:PutLogEvents` and `logs:CreateLogGroup` actions. For CloudWatch Logs, the resource ARN must include the `log-group:` prefix before the log group name or wildcard, such as `arn:aws:logs:us-east-1:123456789012:log-group:*`. Without this prefix, the ARN does not match any valid CloudWatch Logs resource, causing the application to fail when attempting to publish logs.

Answer

The policy requires a condition key to restrict access to specific log groups.

Answer

The policy does not allow the cloudwatch:PutMetricData action for the specific metric.

Answer

The application must assume an IAM role to write logs.

Question 6

A company wants to monitor the health of its web application running on EC2 instances behind an Application Load Balancer (ALB). Which CloudWatch metric from the ALB can indicate that requests are failing due to server errors?

Accepted Answer

HTTPCode_Target_5XX_Count. The correct answer is A because the HTTPCode_Target_5XX_Count metric from the Application Load Balancer (ALB) specifically counts the number of HTTP response codes in the 5xx range returned by the target (EC2 instances). A 5xx status code indicates a server-side error, such as an internal server error (500), gateway timeout (504), or service unavailable (503), which directly reflects that requests are failing due to issues on the EC2 instances themselves.

Answer

HTTPCode_Target_4XX_Count

Answer

HTTPCode_Target_2XX_Count

Answer

HTTPCode_Target_3XX_Count

Question 7

A SysOps administrator is troubleshooting an issue where an Amazon RDS DB instance's storage space is running out. The administrator has enabled CloudWatch alarms for FreeStorageSpace, but the alarm did not trigger before the storage was exhausted. What is the most likely reason?

Accepted Answer

The alarm's evaluation period was too long and the storage filled up faster than the alarm could trigger.. Option C is correct because CloudWatch alarms evaluate metrics based on a specified evaluation period (e.g., 5 minutes). If the storage fills up faster than the alarm's evaluation period, the alarm may not have enough data points to trigger before the storage is exhausted. This is a common issue when the rate of storage consumption exceeds the alarm's evaluation frequency.

Answer

The FreeStorageSpace metric is not available for the selected DB instance class.

Answer

The alarm was configured to use a static threshold but the metric is not emitted during storage operations.

Answer

The alarm was monitoring the wrong metric, such as 'Storage' instead of 'FreeStorageSpace'.

Question 8

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified if a stack creation fails. Which method is the most efficient way to achieve this?

Accepted Answer

Specify an SNS topic ARN in the 'NotificationARNs' parameter of the stack.. Option B is correct because CloudFormation natively supports specifying an Amazon SNS topic ARN in the 'NotificationARNs' parameter of the stack. When a stack creation fails, CloudFormation automatically publishes a notification to the SNS topic, which can then deliver the message via email, SMS, or other protocols without any custom polling or additional services.

Answer

Use Amazon Simple Email Service (SES) to send emails on stack failure.

Answer

Create a Lambda function that polls the CloudFormation API for stack status changes.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' events.

Question 9

A SysOps administrator is managing a fleet of EC2 instances that run a batch processing job. The job is completed when a certain metric in CloudWatch reaches a value. Currently, the administrator manually checks the metric and terminates the instances. Which AWS service can automate the termination of the instances when the metric threshold is breached?

Accepted Answer

Create a CloudWatch alarm that publishes to an SNS topic, which triggers a Lambda function to terminate the instance.. Option B is correct because CloudWatch alarms can trigger an SNS topic when a metric threshold is breached, and a Lambda function subscribed to that topic can execute custom code to terminate the EC2 instances. This provides a fully automated, event-driven remediation workflow without manual intervention.

Answer

Use AWS Config to detect the metric and terminate the instance.

Answer

Place the instances in an Auto Scaling group and use a lifecycle hook.

Answer

Configure a CloudWatch alarm to terminate the instance directly.

Question 10

A SysOps administrator is setting up centralized logging for multiple AWS accounts using CloudWatch Logs. Which TWO actions should the administrator take to ensure that logs from all accounts are aggregated in a single account?

Accepted Answer

In the central account, create a CloudWatch Logs destination and attach a resource policy that grants the source accounts permission to write logs.. Option B is correct because a CloudWatch Logs destination in the central account, combined with a resource policy that grants the source accounts permission to write logs, is the standard mechanism for cross-account log aggregation. The destination acts as a target for subscription filters, and the resource policy explicitly allows the source accounts to call the PutLogEvents API against that destination. This setup ensures that log events from source accounts are delivered to the central account without requiring IAM roles or additional infrastructure.

Answer

In the central account, create an IAM role that trusts the source accounts and allows PutLogEvents.

Answer

In the central account, create a log group with the same name as the source accounts' log groups.

Answer

In each source account, create a Kinesis Data Firehose delivery stream that sends logs to the central account's S3 bucket.

Question 11

An organization uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. A SysOps administrator needs to be alerted when a canary run fails. Which THREE steps are required to set up this alerting?

Accepted Answer

Configure a CloudWatch alarm on the canary's `SuccessPercent` metric.. Option B is correct because CloudWatch Synthetics canaries automatically publish a `SuccessPercent` metric to CloudWatch. By configuring a CloudWatch alarm on this metric (e.g., when `SuccessPercent` drops below 100), the administrator can trigger an alert whenever a canary run fails. This is the standard method for monitoring canary health without needing custom metrics.

Answer

Create a custom CloudWatch metric for canary failures.

Answer

Enable detailed monitoring on the canary.

Question 12

A SysOps administrator is investigating a security incident where an unauthorized user accessed an S3 bucket. Which TWO AWS services can the administrator use to collect and analyze the relevant logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API calls made to S3, including who made the request, the source IP address, and the time of the action. This allows the administrator to trace the unauthorized access to a specific IAM user or role and identify the exact API operations performed, such as GetObject or PutObject.

Answer

AWS WAF logs

Answer

Amazon VPC Flow Logs

Answer

Amazon Route 53 resolver logs

Question 13

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application experiences intermittent latency spikes. The SysOps administrator has enabled detailed CloudWatch metrics on the ALB and the EC2 instances. The administrator notices that during the latency spikes, the ALB's TargetResponseTime metric increases, but the EC2 instance's CPU utilization and memory usage remain normal. The administrator also observes that the number of concurrent connections to the ALB spikes during these periods. Which action should the administrator take to identify the root cause?

Accepted Answer

Analyze the ALB's ActiveConnectionCount and RequestCountPerTarget metrics to see if the load balancer is reaching its connection limit.. Option A is correct because the ALB's ActiveConnectionCount and RequestCountPerTarget metrics directly indicate whether the load balancer is approaching its connection limit (default 50,000 for ALBs). During latency spikes, if concurrent connections spike but instance CPU/memory are normal, the bottleneck is likely at the load balancer level, not the instances. Analyzing these metrics helps determine if the ALB is queuing or dropping requests due to connection limits, causing increased TargetResponseTime.

Answer

Check the RDS database's DatabaseConnections metric to see if the database is overwhelmed.

Answer

Enable VPC Flow Logs and analyze the traffic patterns for dropped packets.

Answer

Enable detailed monitoring on the EC2 instances to capture CPU credits for burstable instances.

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer, Auto Scaling group, and RDS database. The SysOps administrator receives a notification that a stack update has failed. The administrator wants to investigate the failure and understand which resource caused the issue. The stack is in the UPDATE_ROLLBACK_IN_PROGRESS state. What should the administrator do to identify the failed resource?

Accepted Answer

View the stack events in the CloudFormation console to see which resource failed and the error message.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_IN_PROGRESS, the most direct way to identify the failed resource is to view the stack events in the CloudFormation console. Each event includes a status reason field that contains the specific error message and the logical resource ID of the resource that caused the failure, allowing the administrator to pinpoint the issue without additional investigation.

Answer

Review the stack's template in the CloudFormation console to check for syntax errors.

Answer

Check the CloudWatch Logs for the EC2 instances in the Auto Scaling group.

Answer

Manually re-run the update with the same parameters to see if the error recurs.

Question 15

A SysOps administrator is managing an AWS environment with multiple VPCs connected via a transit gateway. The administrator needs to monitor network traffic between VPCs for security analysis. The administrator wants to capture metadata about IP traffic going through the transit gateway. The logs should be centralized in a single S3 bucket and retained for 90 days. Which solution should the administrator implement?

Accepted Answer

Use Transit Gateway Network Manager to enable flow logs on the transit gateway attachments and publish them directly to an S3 bucket.. Option D is correct because Transit Gateway Network Manager allows you to enable flow logs directly on transit gateway attachments, capturing IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) and publishing them to a centralized S3 bucket. This meets the requirement for centralized logging in a single S3 bucket with a 90-day retention period, as S3 lifecycle policies can be configured to expire objects after 90 days.

Answer

Enable VPC Flow Logs on each VPC and publish them to a central S3 bucket.

Answer

Use AWS Config to record traffic changes and store the configuration history in S3.

Answer

Enable flow logs on the transit gateway and publish them to a CloudWatch Logs log group, then export to S3 using a subscription filter.

SOA-C02 Monitoring, Logging, and Remediation Practice Test 11 — 15 Questions

Exhibit

SOA-C02 Monitoring, Logging, and Remediation Practice Test 11 — 15 Questions

Exhibit