SOA-C02 Monitoring, Logging, and Remediation Practice Test 12 — 15 Questions

Question 1

A company uses AWS CloudTrail to log all management events. The SysOps administrator needs to be notified when an IAM user creates a new access key. Which configuration is the MOST efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers an SNS notification.. CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail in real time and trigger an SNS notification. This is the most efficient solution as it requires no additional log analysis or polling, and it reacts immediately when the API call occurs.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

Answer

Use AWS Trusted Advisor to check for excessive access keys.

Answer

Use AWS Config to monitor the 'iam-user' resource type for changes to access keys.

Question 2

A SysOps administrator notices that an Amazon RDS for MySQL instance's CPU utilization is consistently above 80% during business hours. The administrator wants to identify the queries causing the high load without impacting performance. Which action should be taken?

Accepted Answer

Enable Performance Insights on the RDS instance.. Performance Insights provides a database-specific performance schema that visualizes database load and identifies the SQL queries responsible for high CPU utilization. It operates with minimal overhead by sampling the database engine's internal performance data, making it ideal for diagnosing query performance issues without impacting the production workload.

Answer

Enable the MySQL slow query log and store it in CloudWatch Logs.

Answer

Enable Enhanced Monitoring to get OS-level metrics.

Answer

Increase the retention period for CloudWatch metrics to 15 months.

Question 3

A company wants to visualize the geographic distribution of failed login attempts to their web application. The application runs on EC2 instances behind an ALB. They have access logs enabled for the ALB. Which service should be used to create the visualization?

Accepted Answer

Amazon QuickSight with S3 as a data source.. Amazon QuickSight is a fully managed business intelligence service that can directly query ALB access logs stored in Amazon S3, enabling the creation of geospatial visualizations (e.g., heat maps) of failed login attempts. ALB access logs are delivered to S3 in a structured format, and QuickSight can parse and visualize this data without additional processing. This makes QuickSight with S3 as a data source the correct choice for building the required geographic visualization.

Answer

Amazon CloudWatch Dashboard with a custom widget.

Answer

Amazon Kinesis Data Analytics with a Lambda function.

Answer

Amazon S3 Select with Athena.

Question 4

A company is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances. The SysOps administrator needs to ensure that log data is encrypted at rest and in transit. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Encrypt the CloudWatch Logs log group using an AWS KMS customer managed key.. CloudWatch Logs supports encryption at rest using AWS KMS customer managed keys (CMKs). By associating a KMS key with a log group, all log data stored in that log group is encrypted at rest, meeting the encryption-at-rest requirement. Option D is correct because the CloudWatch Logs agent can be configured to use TLS/SSL (port 443) for log delivery, ensuring encryption in transit between the EC2 instances and CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the CloudWatch Logs log group.

Answer

Apply an S3 bucket policy that requires encryption for objects uploaded to the bucket.

Answer

Install an AWS Certificate Manager (ACM) certificate on the EC2 instances.

Question 5

A SysOps administrator is creating a monitoring solution for a web application that uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The administrator wants to monitor the average request count per minute and the number of healthy hosts. Which TWO CloudWatch metrics should the administrator use? (Choose TWO.)

Accepted Answer

AWS/ApplicationELB HealthyHostCount. AWS/ApplicationELB HealthyHostCount, is correct because it directly reports the number of registered instances that are passing health checks, which is exactly what the administrator needs to monitor the number of healthy hosts behind the ALB. Option E, AWS/ApplicationELB RequestCount, is correct because it tracks the total number of requests handled by the ALB, and by dividing by the time period, the administrator can calculate the average request count per minute.

Answer

AWS/ApplicationELB Latency

Answer

AWS/EC2 CPUUtilization

Answer

AWS/AutoScaling GroupInServiceInstances

Question 6

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for MySQL DB instance. The administrator wants to receive a notification when the average CPU utilization exceeds 80% for 10 consecutive minutes. Which steps should the administrator take to set up this monitoring?

Accepted Answer

Create a CloudWatch alarm on the 'CPUUtilization' metric with a threshold of 80% and an SNS topic for notifications.. Amazon RDS automatically publishes the 'CPUUtilization' metric to CloudWatch, and a CloudWatch alarm can be configured with a threshold of 80% for the 'Average' statistic over a period of 10 consecutive minutes (e.g., 10 evaluation periods of 1 minute each). The alarm can then trigger an SNS topic to send notifications when the threshold is breached. This directly meets the requirement without additional services.

Answer

Use CloudWatch Logs to monitor the database logs and create an alarm based on log patterns.

Answer

Enable Enhanced Monitoring and create an alarm on the 'CPUUtilization' metric in RDS console.

Answer

Enable CloudTrail and create a metric filter for CPU utilization.

Question 7

A company is running a critical application on Amazon EC2 instances. The application performance has degraded over the past week. The SysOps administrator suspects a memory leak. The administrator needs to collect detailed memory usage metrics every minute and store them for 30 days. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. The CloudWatch agent is specifically designed to collect custom metrics like memory utilization from EC2 instances, which are not available through default or detailed EC2 monitoring. By installing the agent and configuring it to publish memory metrics to CloudWatch every minute, the administrator can meet the requirement for 1-minute granularity and 30-day retention cost-effectively, as CloudWatch retains metric data at 1-minute resolution for 15 days by default, but can be extended to 30 days via a custom metric retention setting.

Answer

Use AWS CloudTrail to log memory usage and store the logs in Amazon S3.

Answer

Enable default EC2 monitoring to collect memory metrics every 5 minutes.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics every 1 minute.

Question 8

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance running Amazon Linux 2 is not sending logs to CloudWatch Logs. The CloudWatch agent is installed and configured. Which step should the administrator take FIRST to diagnose the issue?

Accepted Answer

Check the CloudWatch agent status and review its log files on the instance.. The CloudWatch agent is already installed and configured, so the first step is to check its operational status and review its own log files (typically in /var/log/aws/amazon-cloudwatch-agent/). This directly reveals whether the agent is running, encountering configuration errors, or failing to connect to the CloudWatch Logs service endpoint, without making unnecessary changes.

Answer

Reinstall the CloudWatch agent from the AWS Systems Manager.

Answer

Update the IAM role attached to the instance to include CloudWatch Logs permissions.

Answer

Verify the EC2 instance status in the AWS Management Console.

Question 9

A company uses Amazon CloudWatch to monitor its AWS resources. The operations team needs to receive email notifications when the root user performs any action in the AWS account. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs metric filter, and Amazon SNS.. AWS CloudTrail logs all API activity, including root user actions. By sending these logs to CloudWatch Logs, you can create a metric filter that matches root user events (e.g., `userIdentity.type = "Root"`). When the metric filter triggers a CloudWatch alarm, it publishes a notification to an SNS topic, which sends an email to subscribers. This combination ensures real-time notification of root user actions.

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS).

Answer

AWS Trusted Advisor and Amazon Simple Email Service (SES).

Answer

AWS Config, Amazon CloudWatch Events, and Amazon SNS.

Question 10

An organization has a production AWS environment with multiple VPCs and hundreds of EC2 instances. The security team wants to be alerted when any security group is modified. Which approach should a SysOps administrator use to meet this requirement with minimal overhead?

Accepted Answer

Use AWS Config rules to detect security group changes and trigger an SNS notification.. AWS Config rules can continuously evaluate security group configurations against desired settings and trigger an SNS notification when a change is detected. This approach provides automated, event-driven monitoring with minimal operational overhead, as it does not require custom scripts or manual log analysis.

Answer

Enable CloudTrail and create a CloudWatch alarm for each security group modification event.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena for security group changes.

Answer

Deploy Amazon GuardDuty to monitor for security group modifications.

Question 11

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The administrator needs to investigate which queries are consuming the most CPU. Which action should the administrator take?

Accepted Answer

Enable Performance Insights for the RDS instance and review the top SQL queries.. Performance Insights is the correct tool because it provides a database-specific performance schema that visualizes database load and identifies the top SQL queries consuming resources. By enabling Performance Insights on the RDS instance, the administrator can directly view which queries are responsible for the high CPU utilization during peak hours, allowing targeted optimization.

Answer

Use CloudWatch Logs Insights to query the database error log for slow queries.

Answer

Enable detailed CloudWatch metrics for the RDS instance and analyze the CPUUtilization metric.

Answer

Enable RDS Enhanced Monitoring and review the 'cpuCreditUsage' metric.

Question 12

A company has an Amazon S3 bucket that stores critical data. The security team wants to be notified whenever an object in the bucket is deleted. Which solution should the SysOps administrator implement?

Accepted Answer

Enable CloudTrail data events for the S3 bucket, create a CloudWatch Events rule for 'DeleteObject' API calls, and send notifications via SNS.. It uses CloudTrail data events to capture 'DeleteObject' API calls specifically for the S3 bucket, then routes those events via CloudWatch Events to an SNS topic for notification. This provides a reliable, real-time notification mechanism for object deletions without requiring custom code or post-hoc analysis.

Answer

Configure an S3 event notification for 's3:ObjectRemoved:*' events to trigger an AWS Lambda function that sends an email.

Answer

Use AWS Config to monitor S3 bucket resources and trigger an SNS notification on configuration changes.

Answer

Enable S3 server access logs and use Amazon Athena to query for delete events, then send notifications.

Question 13

A SysOps administrator is managing a fleet of EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The administrator notices that the 'SurgeQueueLength' metric for the ALB is frequently high. What does this indicate, and what is the BEST remediation action?

Accepted Answer

The targets are not able to handle the request rate; increase the desired capacity or add scaling policies.. The SurgeQueueLength metric measures the number of requests that are queued by the Application Load Balancer (ALB) because no healthy target is available to process them. A frequently high value indicates that the targets (EC2 instances) are overwhelmed and cannot keep up with the incoming request rate. The best remediation is to increase the desired capacity of the Auto Scaling group or add scaling policies (e.g., based on SurgeQueueLength or RequestCountPerTarget) to automatically add more instances to handle the load.

Answer

The targets are unhealthy; decrease the desired capacity to reduce load.

Answer

The load balancer is accepting too many connections; increase the idle timeout.

Answer

The load balancer is overloaded; replace it with a Network Load Balancer.

Question 14

A SysOps administrator needs to monitor the disk space utilization on a fleet of EC2 instances running Windows Server. Which TWO steps should the administrator take to collect and visualize this data? (Choose TWO.)

Accepted Answer

Install the CloudWatch agent on each EC2 instance to collect disk space metrics.. The CloudWatch agent is required to collect custom metrics like disk space utilization from EC2 instances running Windows Server. Default EC2 monitoring only collects hypervisor-level metrics (CPU, network, disk I/O), not guest OS metrics such as disk space. Installing the CloudWatch agent and configuring it to collect disk space metrics is the correct step. Creating a CloudWatch dashboard then allows visualization of those collected metrics.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log disk space changes.

Answer

Enable default EC2 monitoring to collect disk space metrics automatically.

Question 15

A SysOps administrator is investigating a performance issue with an Amazon RDS for PostgreSQL instance. The administrator has enabled Performance Insights. Which TWO metrics from Performance Insights can help identify the root cause of a sudden increase in database load? (Choose TWO.)

Accepted Answer

DB Load by Wait Events.. The correct answers are C and E. DB Load by Wait Events (C) breaks down the total load into wait event categories (e.g., CPU, I/O, locks), directly identifying the resource causing the bottleneck. Top SQL queries by DB Load (E) shows which specific SQL statements contribute the most to the load, enabling targeted optimization. Together, they provide a complete root cause analysis. Options A and D (Read/Write IOPS, CPUUtilization) are infrastructure-level metrics that may indicate resource pressure but do not reveal database-level contention or query-level impact. Option B (Average Active Sessions) is the overall load metric itself, not a breakdown, so it does not pinpoint the cause.

Answer

Read IOPS and Write IOPS.

Answer

Average Active Sessions.

Answer

CPUUtilization percentage.