SOA-C02 Monitoring, Logging, and Remediation Practice Test 12 — 15 Questions

Question 1

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is unreachable. The instance passes status checks and is in a healthy state. Security groups and network ACLs are configured correctly. CloudWatch metrics show CPU utilization is 5%. The administrator can SSH into the instance but cannot connect to the web server on port 443. What is the most likely cause?

Accepted Answer

The web server service is not running or crashed.. The instance passes both status checks and is healthy, and the administrator can SSH into it, confirming that the operating system and network stack are functional. Since the web server is unreachable on port 443 despite correct security group and network ACL configurations, and CPU utilization is low (5%), the most likely cause is that the web server service (e.g., Apache, Nginx) has stopped or crashed. This would prevent the instance from listening on port 443, even though the underlying infrastructure is sound.

Answer

The security group inbound rule for HTTPS is misconfigured.

Answer

The instance has an incorrect route table entry.

Answer

The instance has insufficient CPU credits.

Question 2

A company uses CloudWatch Logs to collect application logs from EC2 instances. The logs are critical for troubleshooting. The operations team notices that some log entries are missing during peak hours. The CloudWatch Logs agent is configured with a batch size of 1 MB and a batch timeout of 10 seconds. Which TWO actions should the administrator take to reduce the chance of missing log events?

Accepted Answer

Increase the batch size to 5 MB.. Option C is correct because increasing the batch size from 1 MB to 5 MB allows the CloudWatch Logs agent to buffer more log data before sending a request. During peak hours, log volume spikes can cause the agent to drop events if the batch fills up faster than it can be transmitted. A larger batch size reduces the frequency of API calls and helps ensure that all log entries are successfully delivered.

Answer

Use PutLogEvents directly from the application.

Answer

Reduce the retry count for failed requests.

Answer

Increase the batch timeout to 30 seconds.

Question 3

A SysOps administrator sets up an alarm to monitor the CPU utilization of an Auto Scaling group. The alarm should trigger a scaling policy when CPU exceeds 80% for 5 consecutive minutes. The alarm state remains 'INSUFFICIENT_DATA' even though instances are running. Which THREE are possible causes?

Accepted Answer

The EC2 instances are not sending CPU utilization metrics to CloudWatch.. Option A is correct because if EC2 instances are not sending CPU utilization metrics to CloudWatch, the alarm will remain in INSUFFICIENT_DATA state. This can happen if the CloudWatch agent is not installed or configured on the instances, or if the instances lack the necessary IAM permissions to publish metrics. Without metric data, CloudWatch cannot evaluate the alarm condition.

Answer

The Auto Scaling group does not have a health check grace period configured.

Answer

The Auto Scaling group uses ELB health checks.

Question 4

An IAM policy is attached to an EC2 instance role to allow sending logs to CloudWatch Logs. The application running on the instance fails to send logs to the log group 'MyAppLogGroup'. Which change is required to fix the issue?

Accepted Answer

Add a new statement allowing logs:PutLogEvents on 'arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogGroup:log-stream:*'.. The IAM policy attached to the EC2 instance role is missing the `logs:PutLogEvents` permission for the specific log stream within the log group. Even if the policy allows `logs:CreateLogStream` and `logs:DescribeLogGroups`, the application cannot send log events without `logs:PutLogEvents` on the log stream resource. Option C adds the required statement with the correct ARN pattern to resolve the failure.

Answer

Install the CloudWatch agent on the instance.

Answer

Attach the policy to the EC2 instance instead of the instance role.

Answer

Change the log group ARN in the policy to include the log stream name.

Question 5

A company wants to receive a notification when the root account is used to perform any action in the AWS account. Which service should be used to monitor this?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. AWS CloudTrail logs all API activity in the account, including root user actions. By creating a CloudTrail trail and sending those logs to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that matches the `RootAccess` event or any API call where `userIdentity.type` is `Root` and trigger a notification via SNS or Lambda. This combination provides real-time monitoring and alerting for root account usage.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 6

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack enters a ROLLBACK_IN_PROGRESS state. Which TWO methods can achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the CloudFormation stack status change.. Option B is correct because Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack status changes, including ROLLBACK_IN_PROGRESS, by matching the 'CloudFormation Stack Status Change' event pattern. This allows you to trigger a notification action (e.g., via SNS or Lambda) in real time when the stack enters that state.

Answer

Use AWS Config rules to evaluate the stack state.

Answer

Configure a CloudWatch Logs subscription filter to detect the stack state.

Answer

Create a CloudTrail trail and monitor the UpdateStack API call.

Question 7

A SysOps administrator is troubleshooting a Lambda function that is not processing messages from an SQS queue. The function is subscribed to the queue via an event source mapping. The function has a reserved concurrency of 0. Which TWO actions will resolve the issue?

Accepted Answer

Set the reserved concurrency to a value greater than 0.. Reserved concurrency of 0 means the Lambda function has no available execution capacity, so it cannot process any invocations, including those from SQS. Setting reserved concurrency to a value greater than 0 (e.g., 1 or more) allocates the necessary execution slots for the function to run. This directly resolves the issue because the event source mapping will successfully invoke the function only when concurrency is available.

Answer

Add SQS permissions to the Lambda execution role.

Answer

Configure a dead-letter queue for the Lambda function.

Answer

Increase the batch size in the event source mapping.

Question 8

A company hosts a web application on multiple EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator receives a report that the application is experiencing intermittent 503 errors. The ALB target group health checks are configured to check the /health endpoint every 30 seconds with a healthy threshold of 2 and an unhealthy threshold of 2. The administrator checks the ALB metrics and notices that the number of healthy hosts occasionally drops to zero. The EC2 instances are normal and the application logs show no errors. What is the most likely cause and solution?

Accepted Answer

Increase the health check timeout to 10 seconds.. The intermittent 503 errors and healthy hosts dropping to zero indicate that health checks are timing out before the application can respond. With a default health check timeout of 5 seconds and a 30-second interval, if the /health endpoint occasionally takes longer than 5 seconds (e.g., due to transient load), the ALB marks instances unhealthy after two consecutive failures (unhealthy threshold of 2). Increasing the timeout to 10 seconds gives the endpoint more time to respond, preventing false negatives without changing the check frequency.

Answer

Increase the health check interval to 60 seconds.

Answer

Add more EC2 instances to the target group.

Answer

Decrease the healthy threshold to 1.

Question 9

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The SysOps administrator notices that the DB instance's CPU utilization spikes to 100% every few minutes. CloudWatch alarms have been set to trigger when CPU exceeds 90% for 5 minutes, but no alarm state changes are observed. The administrator checks the CloudWatch metrics and sees that the CPU utilization metric shows periodic spikes but they last only 2-3 minutes each. What is the most likely cause and what should the administrator do to receive notifications?

Accepted Answer

Set the alarm to evaluate over 1 minute instead of 5 minutes.. The CPU utilization spikes last only 2-3 minutes, which is shorter than the alarm's evaluation period of 5 consecutive minutes. Since the alarm requires the metric to exceed the 90% threshold for 5 minutes before triggering, these brief spikes never satisfy the alarm's duration condition. Setting the alarm to evaluate over 1 minute will match the spike duration and allow the alarm to trigger on these short-lived bursts.

Answer

The Multi-AZ failover is causing the spikes; disable Multi-AZ.

Answer

The DB instance is not publishing CPU metrics at a high enough resolution.

Answer

The CPU metric is not accurate; use the CPU credit metric instead.

Question 10

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

Accepted Answer

Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.. Option C is correct because CloudWatch Logs metric filters can extract numeric values from log events and compute custom metrics. By creating a metric filter that extracts the timestamp of JOB_START and JOB_END, you can use the filter pattern to capture both events and then use a custom metric to compute the duration (e.g., by emitting a metric value representing the time difference). This allows you to set an alarm on the metric when the duration exceeds 1 hour, directly meeting the requirement without additional compute resources.

Answer

Use CloudWatch Logs Insights to run a query every hour and check the duration.

Answer

Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.

Answer

Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.

Question 11

A company uses Amazon S3 to store sensitive data. The SysOps administrator needs to ensure that any attempt to upload an object with server-side encryption disabled is immediately detected and the administrator is notified. The administrator has enabled AWS CloudTrail and is logging S3 data events. Which approach should the administrator use to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutObject API calls without the encryption header and triggers an SNS notification.. Option B is correct because CloudWatch Events (now Amazon EventBridge) can filter API calls captured by CloudTrail for PutObject operations that lack the x-amz-server-side-encryption header, and then trigger an SNS notification in near real-time. This ensures immediate detection and notification of any upload with server-side encryption disabled, meeting the requirement for instant alerting.

Answer

Enable S3 event notifications to send events to SNS for all PutObject operations.

Answer

Create an AWS Config rule to detect objects without encryption.

Answer

Use S3 Inventory to generate a daily report of unencrypted objects.

Question 12

A SysOps administrator is troubleshooting a slow web application running on EC2 instances behind an ALB. The application uses an RDS MySQL database. The administrator checks CloudWatch metrics and sees that the ALB's latency is high, the RDS CPU is high, and the EC2 CPU is moderate. The application team reports that the database queries are slow. The administrator suspects that the database is the bottleneck. However, the RDS instance is already a db.r5.large and the administrator wants to avoid increasing instance size due to cost. What should the administrator do to improve performance without increasing instance size?

Accepted Answer

Enable Performance Insights on the RDS instance to identify slow queries.. Option D is correct because enabling Performance Insights on the RDS instance allows the administrator to identify the specific slow queries causing the bottleneck. This diagnostic tool provides a database load analysis, showing which queries consume the most resources, enabling targeted optimization (e.g., adding indexes or rewriting queries) without increasing instance size. Since the EC2 CPU is moderate and the ALB latency is high due to slow database queries, resolving the query performance directly addresses the root cause.

Answer

Increase the number of EC2 instances to reduce the load on the database.

Answer

Add an ElastiCache Redis cluster to cache database queries.

Answer

Create a Read Replica and offload read traffic to it.

Question 13

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The stack creation fails with the error 'The maximum number of VPCs has been reached.' The SysOps administrator needs to deploy the stack as soon as possible. What should the administrator do?

Accepted Answer

Request a VPC limit increase from AWS Support.. Option C is correct because the error 'The maximum number of VPCs has been reached' indicates the AWS account has hit the default VPC limit (5 per region). Requesting a service limit increase from AWS Support is the fastest way to raise this soft limit without modifying existing infrastructure or templates, allowing the stack to deploy in the same region.

Answer

Delete unused VPCs to free up capacity.

Answer

Modify the CloudFormation template to use an existing VPC.

Answer

Deploy the stack in a different AWS region.

Question 14

A company uses Amazon CloudWatch Logs to store application logs. The security team needs to be alerted when any log group contains a specific error pattern. The solution must minimize latency and operational overhead. What should a SysOps administrator do?

Accepted Answer

Create a Lambda function subscribed to the CloudWatch Logs log group, which checks for the error pattern and publishes to an SNS topic.. Option C is correct because subscribing a Lambda function directly to a CloudWatch Logs log group allows real-time, low-latency processing of log events as they arrive. The Lambda function can parse each log event for the specific error pattern and publish to an SNS topic to alert the security team, minimizing operational overhead by avoiding additional streaming or polling services.

Answer

Stream the logs to Amazon Kinesis Data Firehose, which then triggers a Lambda function to check for errors.

Answer

Create a CloudWatch metric filter on the log group and set an alarm that triggers an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 15

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an alert if it exceeds 80% for 10 consecutive minutes. The instance is in a VPC with no Internet access. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and an evaluation period of 2.. Option B is correct because a CloudWatch alarm with a period of 5 minutes and an evaluation period of 2 means the alarm evaluates two consecutive 5-minute data points, totaling 10 minutes. Since the EC2 instance is in a VPC with no Internet access, CloudWatch metrics are still reported via the CloudWatch service endpoint within the VPC (or via VPC endpoints), so no additional agent or script is needed. This is the most efficient approach as it uses native CloudWatch functionality without requiring any custom scripts or additional software.

Answer

Use AWS Systems Manager to run a script on the instance that checks CPU and sends an SNS notification.

Answer

Enable detailed monitoring on the EC2 instance and create a CloudWatch alarm on the CPUUtilization metric.

Answer

Install the CloudWatch agent on the EC2 instance to collect CPU metrics and create a CloudWatch alarm.