SOA-C02 Monitoring, Logging, and Remediation Practice Test 11 — 15 Questions

Question 1

A company needs to monitor the CPU and memory utilization of its EC2 instances. Which TWO services can be used to collect and visualize these metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the native AWS monitoring service that collects and stores metrics such as CPU utilization and memory utilization from EC2 instances. However, by default, CloudWatch only captures hypervisor-level metrics (like CPU) and not in-guest metrics (like memory utilization). To collect memory utilization, you must install the Amazon CloudWatch Agent on the instance, which sends custom metrics to CloudWatch. Together, CloudWatch and the CloudWatch Agent provide both collection and visualization of CPU and memory metrics.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Systems Manager

Question 2

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to configure this monitoring and alerting?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it allows you to monitor a specific metric, such as EC2 CPUUtilization, and trigger an action (e.g., an SNS notification) when the metric crosses a defined threshold (80%) for a specified number of consecutive evaluation periods (10 minutes, which with the default 1-minute period equals 10 datapoints). This directly fulfills the requirement for threshold-based alerting on a single metric over a sustained duration.

Answer

Amazon EventBridge

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 3

A company's application running on EC2 instances is experiencing intermittent errors. The SysOps team needs to collect and analyze application logs from all instances centrally. The logs must be stored durably and searchable with minimal latency. Which solution meets these requirements?

Accepted Answer

Install the CloudWatch Logs agent on each EC2 instance and stream logs to Amazon CloudWatch Logs.. The CloudWatch Logs agent (or unified CloudWatch agent) installed on each EC2 instance can stream application logs in near real-time to Amazon CloudWatch Logs, which provides durable storage, automatic encryption at rest, and a searchable interface via the console, CLI, or API with minimal latency. This centralized logging solution meets the requirements for collecting logs from all instances, storing them durably, and enabling immediate querying without additional infrastructure.

Answer

Enable AWS CloudTrail and store logs in an S3 bucket.

Answer

Use Amazon Kinesis Data Firehose to send logs directly from each instance to Amazon Redshift.

Answer

Store logs locally on each instance and periodically copy them to Amazon S3.

Question 4

A SysOps administrator needs to track changes made to an Amazon S3 bucket policy and receive notifications when changes occur. Which AWS service should be used?

Accepted Answer

AWS Config. AWS Config is designed to record configuration changes to AWS resources, including S3 bucket policies, and can evaluate them against desired configurations. It can send notifications via Amazon SNS when changes occur, and it provides a history of configuration changes. This directly meets the requirement to track changes and receive notifications.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Events

Answer

AWS CloudTrail

Question 5

A SysOps administrator is troubleshooting an application that runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The administrator checks the ALB access logs and finds entries with 'elb_status_code' 503 and 'target_status_code' '-'. What is the most likely cause?

Accepted Answer

The target instances are unhealthy, causing the ALB to return 503.. The ALB access log entry with `elb_status_code` 503 and `target_status_code` '-' indicates that the load balancer itself generated the 503 error because it could not establish a connection to any healthy target. The dash for the target status code means the request never reached a target instance, which occurs when all targets in the target group are marked unhealthy by the health checks. This is the most common cause of intermittent 503 errors with an ALB.

Answer

The SSL certificate on the ALB has expired.

Answer

The target instances have high CPU utilization.

Answer

The security group on the ALB is blocking traffic.

Question 6

A company wants to monitor the number of messages in an Amazon SQS queue and scale the number of EC2 instance consumers based on queue depth. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Amazon CloudWatch monitors the SQS queue depth (ApproximateNumberOfMessagesVisible metric) and triggers an Amazon EC2 Auto Scaling scaling policy based on a CloudWatch alarm. This allows the number of EC2 consumer instances to dynamically scale in or out in response to the queue depth, ensuring efficient processing without over-provisioning.

Answer

Amazon Elastic Load Balancing and Amazon EC2 Auto Scaling

Answer

Amazon CloudWatch and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Question 7

An application writes logs to a file on an EC2 instance. The SysOps team needs to send these logs to Amazon CloudWatch Logs in real time. The logs must be encrypted at rest in CloudWatch Logs using a customer-managed KMS key. Which steps are required?

Accepted Answer

Install the CloudWatch Logs agent and associate a KMS key with the log group using the 'associate-kms-key' API.. The CloudWatch Logs agent can send log data from an EC2 instance to CloudWatch Logs in real time, and the 'associate-kms-key' API (or the equivalent AWS CLI command 'put-log-group-encryption') allows you to associate a customer-managed KMS key with a log group, encrypting the logs at rest. This meets both the real-time delivery and customer-managed KMS encryption requirements without additional services or workarounds.

Answer

Use AWS CloudTrail to deliver logs to CloudWatch Logs with KMS encryption.

Answer

Store logs in S3 with KMS encryption and use S3 event notifications to trigger Lambda to put logs in CloudWatch Logs.

Answer

Install the CloudWatch Logs agent and enable encryption on the EC2 instance volume using KMS.

Question 8

Which TWO AWS services can be used to monitor the performance of an Amazon RDS database and set alarms based on metrics?

Accepted Answer

Amazon RDS Performance Insights. Amazon CloudWatch (Option D) is the primary monitoring service for AWS resources, including Amazon RDS. It collects metrics like CPU utilization, database connections, and read/write latency, and allows you to set CloudWatch Alarms that trigger actions (e.g., SNS notifications) when thresholds are breached. Amazon RDS Performance Insights (Option B) provides deeper database performance analysis by visualizing database load and identifying bottlenecks, and it can also publish metrics to CloudWatch for alarm purposes.

Answer

AWS Lambda

Answer

Amazon S3

Answer

AWS CloudTrail

Question 9

Which TWO options are valid ways to send custom metrics to Amazon CloudWatch?

Accepted Answer

Use the CloudWatch agent to collect and publish custom metrics.. The CloudWatch agent can be installed on EC2 instances or on-premises servers to collect system-level metrics (like memory and disk usage) and custom application metrics, then publish them to CloudWatch. Option B is correct because the PutMetricData API call allows direct programmatic ingestion of custom metrics into CloudWatch, supporting up to 1,000 metrics per call with a maximum payload of 1 MB.

Answer

Use Amazon SQS to send metric data to CloudWatch.

Answer

Use AWS CloudTrail to log custom metrics.

Answer

Use Amazon Kinesis Data Firehose to deliver metrics to CloudWatch.

Question 10

Refer to the exhibit. A SysOps administrator runs the 'list-metrics' command for CPUUtilization. Based on the output, what can the administrator conclude?

Accepted Answer

There are two EC2 instances that have reported CPUUtilization metrics at some point.. The 'list-metrics' output shows two distinct dimensions (i-12345678 and i-87654321) for the CPUUtilization metric, indicating that two EC2 instances have reported this metric at some point. Option B is correct because the presence of two unique instance IDs in the metric data confirms that CPUUtilization has been recorded for both instances, regardless of whether they are currently active or have alarms configured.

Answer

The CPUUtilization metric is only available for EC2 instances.

Answer

Both instances are actively publishing CPUUtilization metrics.

Answer

An alarm has been set on both instances for CPUUtilization.

Question 11

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance attempts to write logs to a log group named 'MyAppLogs' in CloudWatch Logs but fails. What is the likely cause?

Accepted Answer

The policy does not grant permission to create the log group because the resource for CreateLogGroup is specified as the log stream ARN.. The policy grants `logs:CreateLogGroup` but specifies the resource as the log stream ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:log-stream:*`). CloudWatch Logs requires the resource for `CreateLogGroup` to be the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:*` or a specific log group name), not a log stream. Since the application is attempting to write logs to a log group that does not yet exist, the `CreateLogGroup` call fails due to the incorrect resource ARN, causing the overall write operation to fail.

Answer

The EC2 instance does not have an internet gateway to reach CloudWatch Logs.

Answer

The log group name in the policy does not match the application's log group.

Answer

The policy lacks permission for 'logs:DescribeLogGroups'.

Question 12

Refer to the exhibit. A SysOps administrator reviews the CloudWatch alarm configuration. The alarm is in ALARM state. Which statement accurately describes the alarm's behavior?

Accepted Answer

The alarm triggered because the average CPU utilization over 5 minutes exceeded 80% for one consecutive period.. The alarm configuration shows 'Period: 5 minutes' and 'Statistic: Average' with 'Threshold: 80%' and 'Datapoints to alarm: 1 out of 1'. This means the alarm evaluates the average CPU utilization over a single 5-minute period, and if that average exceeds 80%, the alarm transitions to ALARM state immediately after one period's data point is available.

Answer

The alarm evaluates CPU utilization every 5 minutes and requires 3 consecutive breaches to trigger.

Answer

The alarm will automatically resolve when CPU utilization drops below 80% for one period.

Answer

The alarm sends a notification to the SNS topic every 5 minutes while in ALARM state.

Question 13

A company is using AWS CloudTrail to log API activity. They need to ensure that log files are protected from unauthorized modification and can be used to verify the integrity of log files. Which AWS feature should be enabled?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to create a digest file that can be used to verify that log files have not been modified, deleted, or tampered with after delivery. This feature is specifically designed to provide cryptographic assurance of log file integrity, meeting the requirement to protect against unauthorized modification and enable verification.

Answer

Enable S3 server-side encryption on the CloudTrail S3 bucket.

Answer

Stream CloudTrail logs to Amazon CloudWatch Logs.

Answer

Enable S3 Multi-Factor Authentication (MFA) Delete on the CloudTrail S3 bucket.

Question 14

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 15

A company uses Amazon CloudWatch Logs to collect logs from multiple EC2 instances. The SysOps administrator needs to create a metric filter that counts the number of ERROR-level log entries per hour and triggers an alarm when the count exceeds 100 in any 5-minute period. Which metric filter pattern should be used?

Accepted Answer

Use the pattern "ERROR" and set the metric value to 1.. A CloudWatch Logs metric filter counts each log event that matches the pattern. Setting the metric value to 1 ensures that each matching log entry increments the metric by 1, allowing the alarm to evaluate the sum over a 5-minute period against the threshold of 100. The pattern "ERROR" matches any log entry containing the string "ERROR" anywhere in the message.

Answer

Use the pattern "ERROR" and set the metric value to 100.

Answer

Use the pattern "ERROR *" to match any log entry starting with ERROR.

Answer

Use the pattern "[ERROR, 5]" to match 5 consecutive ERROR entries.