SOA-C02 Monitoring, Logging, and Remediation Practice Test 11 — 15 Questions

Question 1

A company uses Amazon CloudWatch Logs to store application logs. The security team needs to be alerted when any log group contains a specific error pattern. The solution must minimize latency and operational overhead. What should a SysOps administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Lambda function subscribed to the CloudWatch Logs log group, which checks for the error pattern and publishes to an SNS topic.. Subscribing a Lambda function directly to a CloudWatch Logs log group allows real-time, low-latency processing of log events as they arrive. The Lambda function can parse each log event for the specific error pattern and publish to an SNS topic to alert the security team, minimizing operational overhead by avoiding additional streaming or polling services.

Answer

Stream the logs to Amazon Kinesis Data Firehose, which then triggers a Lambda function to check for errors.

Answer

Create a CloudWatch metric filter on the log group and set an alarm that triggers an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 2

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an alert if it exceeds 80% for 10 consecutive minutes. The instance is in a VPC with no Internet access. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and an evaluation period of 2.. A CloudWatch alarm with a period of 5 minutes and an evaluation period of 2 means the alarm evaluates two consecutive 5-minute data points, totaling 10 minutes. Since the EC2 instance is in a VPC with no Internet access, CloudWatch metrics are still reported via the CloudWatch service endpoint within the VPC (or via VPC endpoints), so no additional agent or script is needed. This is the most efficient approach as it uses native CloudWatch functionality without requiring any custom scripts or additional software.

Answer

Use AWS Systems Manager to run a script on the instance that checks CPU and sends an SNS notification.

Answer

Enable detailed monitoring on the EC2 instance and create a CloudWatch alarm on the CPUUtilization metric.

Answer

Install the CloudWatch agent on the EC2 instance to collect CPU metrics and create a CloudWatch alarm.

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator notices that the application's response time is increasing during peak hours. The administrator wants to set up a CloudWatch dashboard that displays the average latency of requests across all instances and the number of healthy hosts. Which metrics should be used?

Accepted Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'HealthyHostCount' metric.. The ALB's 'TargetResponseTime' metric measures the average time (in seconds) that requests are routed to targets, which directly reflects application latency. The ALB's 'HealthyHostCount' metric shows the number of healthy registered targets, which is the exact metric needed to monitor host health. Together, these two metrics provide the required visibility into average latency and healthy host count across all instances.

Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'UnhealthyHostCount' metric.

Answer

Use the ALB's 'RequestCount' metric and the EC2 Auto Scaling group's 'GroupInServiceInstances' metric.

Answer

Use the ALB's 'Latency' metric and the EC2 instance's 'CPUUtilization' metric.

Question 4

A SysOps administrator is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The administrator wants to identify the specific queries consuming the most CPU. What is the MOST efficient way to achieve this?

Accepted Answer

Enable Performance Insights for the RDS instance and view the top SQL queries.. Performance Insights provides a built-in database load visualization and a dashboard that directly shows the top SQL queries consuming the most resources, including CPU. This is the most efficient method because it requires no additional configuration beyond enabling the feature and immediately surfaces the specific queries causing high CPU utilization.

Answer

Use CloudWatch metrics for RDS and create a dashboard for CPU utilization.

Answer

Enable Enhanced Monitoring for the RDS instance and view the CPU metrics.

Answer

Enable CloudWatch Logs for the RDS instance and filter for slow query logs.

Question 5

A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The marketing team wants to know how many users visit the website each day, including the geographic distribution. Which solution requires the LEAST operational overhead?

Accepted Answer

Enable CloudFront access logs and use Amazon Athena to query the logs in S3.. Enabling CloudFront access logs and querying them with Amazon Athena provides detailed user visit counts and geographic distribution with minimal operational overhead. Access logs contain client IP addresses and request details, which Athena can analyze using SQL without managing servers or complex pipelines. This approach is serverless and cost-effective for periodic analysis.

Answer

Use CloudWatch metrics for CloudFront to view request counts and enable detailed metrics.

Answer

Enable AWS CloudTrail for CloudFront and query the event history.

Answer

Enable CloudFront real-time logs and send them to Amazon Kinesis Data Analytics for analysis.

Question 6

A SysOps administrator is monitoring an Amazon ECS cluster running Fargate tasks. The administrator wants to receive a notification when any task fails to start due to insufficient memory. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send notifications to an SNS topic.. Amazon CloudWatch Events (now Events) can trigger an SNS notification when a specific ECS task state change occurs. Option C is correct because you can create a CloudWatch Events rule that matches ECS task state changes with a reason of 'RESOURCE:MEMORY', which indicates the task failed to start due to insufficient memory. Together, these actions ensure you receive a notification when a Fargate task fails to start due to memory constraints.

Answer

Enable AWS CloudTrail and create a metric filter for RunTask API calls.

Answer

Create a CloudWatch alarm on the ECS cluster's CPUUtilization metric.

Answer

Enable CloudWatch Logs for the ECS cluster and filter for error messages.

Question 7

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified when a stack creation fails. Which solution meets this requirement with the LEAST effort?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's 'NotificationARNs' parameter.. CloudFormation natively supports specifying an SNS topic in the 'NotificationARNs' parameter, which automatically sends notifications on stack events such as creation failure. This requires no additional infrastructure, scripting, or monitoring setup, making it the least-effort solution.

Answer

Create a CloudWatch alarm that triggers when the CloudFormation stack status is 'CREATE_FAILED'.

Answer

Use AWS CloudTrail to monitor CreateStack API calls and trigger an SNS notification.

Answer

Write a custom script that polls the CloudFormation API every minute and sends an SNS notification on failure.

Question 8

A SysOps administrator needs to centrally collect operating system-level metrics from a fleet of Amazon EC2 instances running Amazon Linux 2. The metrics should include memory usage and disk I/O. Which solution should the administrator implement?

Accepted Answer

Install and configure the CloudWatch agent on the EC2 instances.. The CloudWatch agent is the correct solution because it can collect custom OS-level metrics such as memory usage and disk I/O from EC2 instances running Amazon Linux 2. Unlike the default CloudWatch metrics, which only capture hypervisor-level metrics (e.g., CPU, network), the CloudWatch agent uses the procstat and disk plugins to gather detailed system metrics and publish them to CloudWatch as custom namespaces.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log OS-level metrics.

Answer

Use AWS Systems Manager Inventory to collect metrics.

Question 9

A SysOps administrator is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. The administrator suspects that a specific query is causing high I/O. Which tools should be used together to identify the query and its I/O impact? (Choose THREE.)

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights (A) provides a database performance dashboard that visualizes database load and identifies the specific queries causing high load, including I/O wait events. By correlating this with Amazon RDS Enhanced Monitoring (D), which offers OS-level metrics like read/write IOPS and queue depth, you can pinpoint the exact query and its I/O impact. The combination of RDS Performance Insights with database load and wait events (E) directly surfaces the query text and the wait types (e.g., IO:DataFileRead) to confirm high I/O.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 10

A company wants to automatically remediate an Amazon EC2 instance that becomes unresponsive by rebooting it. The solution should use AWS managed services to minimize custom code. Which combination should a SysOps administrator use? (Choose TWO.)

Accepted Answer

Amazon CloudWatch alarm on EC2 status check failures. Amazon CloudWatch can monitor EC2 status check failures (both system and instance checks) and trigger an alarm. When the alarm enters the ALARM state, it can directly invoke an AWS Systems Manager Automation document to reboot the instance, which is a managed, code-free remediation approach. This combination minimizes custom code by using built-in AWS services.

Answer

Amazon EC2 Auto Scaling and lifecycle hooks

Answer

Amazon CloudWatch alarm and AWS Lambda function

Answer

Amazon EventBridge rule to trigger an SNS notification

Question 11

A SysOps administrator needs to track changes to IAM policies in the AWS account for auditing purposes. Which service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to IAM, including changes to IAM policies (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These logs are stored in a CloudTrail trail and can be delivered to Amazon S3 for long-term auditing. CloudTrail is specifically designed for auditing API activity, making it the appropriate choice for tracking policy modifications.

Answer

IAM Access Analyzer

Answer

AWS Config

Answer

Amazon CloudWatch

Question 12

A SysOps administrator is troubleshooting an application that intermittently fails to connect to an RDS database. The error logs show 'Too many connections'. What CloudWatch metric should the administrator monitor to proactively detect this issue?

Accepted Answer

DatabaseConnections. The 'Too many connections' error indicates that the RDS database has reached its maximum allowed number of simultaneous client connections. The DatabaseConnections CloudWatch metric tracks the current number of connections to the DB instance, so monitoring this metric allows the administrator to set an alarm when connections approach the instance's max_connections limit, enabling proactive scaling or connection management before errors occur.

Answer

CPUUtilization

Answer

NetworkThroughput

Answer

FreeableMemory

Question 13

A company uses CloudWatch Logs to store application logs from EC2 instances. The SysOps team needs to search for specific error patterns across all log groups. What is the most efficient way to perform this search?

Accepted Answer

Use CloudWatch Logs Insights to run a query across the log groups.. CloudWatch Logs Insights is purpose-built for ad-hoc querying and analysis of log data across multiple log groups. It allows you to run SQL-like queries (using a query language) to search for specific patterns, filter results, and aggregate data without needing to set up additional infrastructure. This is the most efficient method for the SysOps team's requirement because it provides immediate, interactive search capabilities directly within the AWS Management Console or via the AWS CLI.

Answer

Define a CloudWatch metric filter to count errors and view the metric.

Answer

Create a subscription filter to stream logs to Amazon ES and use Kibana.

Answer

Export the logs to Amazon S3 and use S3 Select to search.

Question 14

An application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing increased latency. The SysOps administrator checks CloudWatch and sees that the ALB's TargetResponseTime is high, but the backend EC2 instance's CPUUtilization and MemoryUtilization are low. What is the most likely cause?

Accepted Answer

The ALB is experiencing connection queuing due to a high number of concurrent requests.. When TargetResponseTime is high but backend CPU and memory are low, the bottleneck is not the compute capacity of the instances but rather the ALB's ability to forward requests. The ALB has a default connection queue limit (typically 1024 pending connections per target group), and when concurrent requests exceed that, new requests are queued, increasing response time without stressing the backend. This is a classic sign of connection queuing at the load balancer level.

Answer

The application is CPU-bound on the EC2 instances.

Answer

The EC2 instances are throttled due to a burst balance limit.

Answer

The application is waiting on a database query that is slow.

Question 15

A company wants to receive an email notification when an EC2 instance's status check fails. What AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarm. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending an email via Amazon SNS, when a status check fails. This is the correct service because it directly integrates with EC2 metrics and supports alarm-based notifications for status check failures.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor