SOA-C02 Monitoring, Logging, and Remediation Practice Test 12 — 15 Questions

Question 1

A SysOps administrator needs to ensure that all S3 buckets in the account have server access logging enabled. The administrator wants to be notified if a bucket is created without logging. What is the most efficient solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config with a managed rule to evaluate S3 buckets for server access logging.. AWS Config with the managed rule 's3-bucket-server-access-logging-enabled' continuously evaluates all S3 buckets against the desired configuration. When a bucket is created without server access logging, AWS Config automatically flags it as noncompliant and can trigger an SNS notification. This is the most efficient solution because it provides ongoing, automated compliance monitoring without requiring custom scripts or event-driven remediation.

Answer

Periodically run a script to list all buckets and check logging configuration.

Answer

Enable S3 event notifications on the bucket creation event and trigger a Lambda function.

Answer

Use CloudWatch Events to detect CreateBucket API calls and trigger a Lambda function.

Question 2

An application running on Amazon ECS (Fargate) is experiencing intermittent failures. The logs show 'CannotPullContainerError: error pulling image configuration: download failed after attempts=6'. The SysOps team has verified that the image exists in Amazon ECR and the task role has permissions to pull from ECR. What is the most likely cause?

Accepted Answer

The ECS tasks are in a private subnet without a NAT gateway or VPC endpoints for ECR and S3.. The error 'CannotPullContainerError: error pulling image configuration: download failed after attempts=6' indicates that the ECS task is unable to download the image layers from Amazon ECR. Since the image exists and the task role has permissions, the most likely cause is a network connectivity issue. When ECS tasks run in a private subnet without a NAT gateway or VPC endpoints for ECR and S3, they cannot reach the public ECR API endpoints or the S3 buckets that store image layers, causing the pull to fail after multiple retries.

Answer

The container image is corrupted.

Answer

The ECR repository policy is not allowing the task role.

Answer

The ECS task definition has an incorrect memory allocation.

Question 3

A SysOps administrator wants to receive alerts when the root user performs an action in the AWS account. Which service should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail captures all API calls made by the root user as events. By sending these events to Amazon CloudWatch Logs, you can create a metric filter that matches root user activity and trigger an alarm via CloudWatch Alarms. This combination enables real-time notification when the root user performs any action.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon CloudWatch Metrics

Answer

AWS Config

Question 4

An organization wants to ensure that all changes to an S3 bucket policy are logged and immediately trigger a notification to the security team. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutBucketPolicy API call and triggers an SNS topic.. CloudWatch Events (now Amazon EventBridge) can capture the PutBucketPolicy API call via a service-specific event pattern and route it to an SNS topic for immediate notification. This approach is the most efficient as it directly monitors the API call in real-time without polling or additional configuration, ensuring the security team is alerted the moment the policy changes.

Answer

Create a CloudWatch Alarm that monitors the S3 bucket's policy.

Answer

Use AWS Config with a managed rule to detect policy changes.

Answer

Enable S3 event notifications on the bucket for 'PutBucketPolicy' events.

Question 5

A SysOps administrator is troubleshooting a slow-running RDS MySQL instance. The administrator notices that the ReadIOPS metric is consistently high, but the WriteIOPS is low. The instance type is db.m5.large with 300 GB of General Purpose SSD (gp2). What is the most likely cause?

Accepted Answer

The gp2 volume is experiencing I/O credit exhaustion.. A db.m5.large instance with 300 GB of gp2 storage has a baseline IOPS of 900 (3 IOPS per GB) and a burst balance of 5.4 million I/O credits. With consistently high ReadIOPS and low WriteIOPS, the volume is likely exhausting its I/O credit balance, causing performance throttling. This is a classic symptom of gp2 I/O credit exhaustion, where read-heavy workloads deplete the burst bucket, leading to degraded performance.

Answer

The instance type is too small for the workload.

Answer

The database is experiencing write contention.

Answer

The network bandwidth is insufficient.

Question 6

A SysOps administrator is configuring a CloudWatch dashboard to monitor an application. Which TWO of the following are valid widget types that can be added to a CloudWatch dashboard?

Accepted Answer

Alarm. CloudWatch dashboards support multiple widget types at the top level, including 'alarm', 'metric', 'text', 'custom', and 'log'. Among the options, 'Alarm' (B) is a top-level widget type that displays the status of an alarm. 'Number' (D) is a valid metric widget visualization, often treated as a widget type in the CloudWatch console. 'Time Series' (E) is a visualization sub-type of the metric widget, not a standalone widget type, making it incorrect in the context of top-level widget types. Options A (Line) and C (Bar chart) are also visualization sub-types, not top-level widget types.

Answer

Line

Answer

Bar chart

Answer

Time Series

Question 7

A company is using Amazon CloudWatch Logs to collect logs from multiple AWS services. The SysOps administrator needs to query logs across multiple log groups in real-time. Which THREE of the following are capabilities of CloudWatch Logs Insights?

Accepted Answer

Run queries in real-time against incoming log data.. CloudWatch Logs Insights supports real-time queries against incoming log data, allowing you to analyze logs as they are ingested. This is enabled by its ability to query live streams without requiring data to be indexed first, making it suitable for real-time troubleshooting and monitoring.

Answer

Export query results directly to an S3 bucket.

Answer

Schedule queries to run at a specific time.

Question 8

A SysOps administrator is setting up monitoring for an Amazon RDS instance. Which TWO metrics are available by default in Amazon CloudWatch for RDS?

Accepted Answer

DatabaseConnections. Amazon RDS automatically publishes a set of metrics to CloudWatch at no additional cost. DatabaseConnections tracks the number of database client connections, and CPUUtilization measures the percentage of CPU usage. Both are default metrics available without any extra configuration.

Answer

FreeableMemory

Answer

FailedLoginAttempts

Answer

WriteLatency

Question 9

Refer to the exhibit. A SysOps administrator runs the CloudWatch Logs Insights query shown. What does this query do?

Accepted Answer

Counts the number of ERROR and FATAL log entries per 5-minute interval and displays them in descending order by time.. The CloudWatch Logs Insights query uses `stats count(*) by bin(5m)` to aggregate log events into 5-minute time buckets, then filters with `filter @message like /ERROR|FATAL/` to include only those severity levels. The `sort @timestamp desc` orders the resulting time buckets in descending chronological order, producing a count of ERROR and FATAL entries per 5-minute interval. This matches option B exactly.

Answer

Groups ERROR and FATAL entries by log stream name.

Answer

Displays the full log messages of all ERROR and FATAL entries.

Answer

Deletes all log entries containing ERROR or FATAL older than 5 minutes.

Question 10

Refer to the exhibit. A SysOps administrator creates the CloudWatch Alarm shown. However, the alarm never enters ALARM state even though the CPU utilization of the EC2 instance is consistently above 90%. What is the most likely reason?

Accepted Answer

The alarm is missing the InstanceId dimension.. The alarm never enters ALARM state because it is missing the required `InstanceId` dimension. CloudWatch metrics for EC2, such as `CPUUtilization`, are published with the `InstanceId` dimension to uniquely identify the data stream. Without specifying this dimension in the alarm configuration, CloudWatch cannot match the alarm to the metric data emitted by the EC2 instance, so the alarm remains in INSUFFICIENT_DATA or OK state regardless of actual CPU usage.

Answer

The threshold is set too high; it should be 80%.

Answer

The evaluation periods are too few.

Answer

The statistic should be Maximum instead of Average.

Question 11

Refer to the exhibit. A SysOps administrator runs the command shown to investigate a CloudWatch alarm named 'HighCPU'. What does the output indicate?

Accepted Answer

The alarm entered the ALARM state and then returned to OK.. The output shows two state transition datapoints: one at timestamp 2021-03-15T10:30:00Z with 'oldState' OK and 'newState' ALARM, and another at 2021-03-15T10:35:00Z with 'oldState' ALARM and 'newState' OK. This sequence confirms the alarm entered the ALARM state and then returned to OK, which is exactly what the describe-alarm-history command reveals when an alarm has experienced a full ALARM-to-OK cycle.

Answer

The alarm was deleted and recreated.

Answer

The alarm is currently in INSUFFICIENT_DATA state.

Answer

The alarm never entered the ALARM state.

Question 12

A SysOps administrator is troubleshooting an issue where an EC2 instance's CPU utilization is consistently above 90%, but no CloudWatch alarm is triggered. The alarm is configured to monitor the 'CPUUtilization' metric with a threshold of 80% for 2 consecutive periods of 5 minutes. What is the most likely cause?

Accepted Answer

The CPU utilization spikes above 80% for less than 10 minutes at a time.. The CloudWatch alarm requires 2 consecutive periods of 5 minutes (i.e., 10 minutes total) where the CPU utilization exceeds 80%. If the CPU utilization spikes above 80% for less than 10 minutes at a time, the alarm will not trigger because it never meets the consecutive evaluation period requirement. The alarm evaluates each 5-minute period independently, and only when both consecutive periods breach the threshold does the alarm state change to ALARM.

Answer

The alarm is in the 'OK' state and not 'INSUFFICIENT_DATA'.

Answer

The CPUUtilization metric is not enabled by default for EC2 instances.

Answer

The alarm period is set to 5 minutes, but the metric is reported every 1 minute.

Question 13

An application running on EC2 instances in an Auto Scaling group is experiencing intermittent errors. The errors correlate with periods of high memory usage. The SysOps administrator wants to set up a CloudWatch alarm to scale out when memory usage exceeds 80%. What should the administrator do to enable monitoring of memory usage?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to publish memory metrics.. The CloudWatch agent is required to publish custom memory metrics from EC2 instances because memory utilization is not a standard metric provided by default. By installing and configuring the agent, the administrator can collect memory usage data and create a CloudWatch alarm to trigger Auto Scaling actions when usage exceeds 80%.

Answer

Enable detailed monitoring on the Auto Scaling group.

Answer

Use the default EC2 memory metric provided by CloudWatch.

Answer

Create a Lambda function to pull memory data from the EC2 instances.

Question 14

A company uses AWS CloudTrail to log API activity. The security team needs to be notified immediately when an IAM user creates a new access key. Which combination of steps should a SysOps administrator take? (Choose TWO.)

Accepted Answer

Create a CloudWatch Logs metric filter for the 'CreateAccessKey' event.. CloudWatch Logs metric filters allow you to extract specific patterns from CloudTrail log data, such as the 'CreateAccessKey' event, and convert them into a metric. This enables you to monitor for this specific API call and trigger an alarm when it occurs, meeting the requirement for immediate notification.

Answer

Enable AWS Config rules to detect changes to IAM users.

Answer

Configure CloudTrail to send notifications directly to Amazon SNS.

Answer

Create an Amazon EventBridge rule to match the 'CreateAccessKey' API call.

Question 15

A SysOps administrator needs to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. Which solution is the MOST operationally efficient?

Accepted Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket in the central account.. AWS CloudTrail can be configured in each account to deliver logs directly to the same S3 bucket in a central account by specifying the central bucket's ARN and setting appropriate bucket policies. This approach is operationally efficient as it eliminates the need for intermediate services or replication, reducing complexity and cost while ensuring logs are centralized without manual intervention.

Answer

Use S3 replication to copy logs from each account's bucket to a central bucket.

Answer

Use CloudWatch Logs subscription filter to stream logs to a central account.

Answer

Use Amazon Kinesis Data Firehose to deliver logs from each account to a central S3 bucket.