SOA-C02 Monitoring, Logging, and Remediation Practice Test 13 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator notices that the application's response time is increasing during peak hours. The administrator wants to set up a CloudWatch dashboard that displays the average latency of requests across all instances and the number of healthy hosts. Which metrics should be used?

Accepted Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'HealthyHostCount' metric.. Option B is correct because the ALB's 'TargetResponseTime' metric measures the average time (in seconds) that requests are routed to targets, which directly reflects application latency. The ALB's 'HealthyHostCount' metric shows the number of healthy registered targets, which is the exact metric needed to monitor host health. Together, these two metrics provide the required visibility into average latency and healthy host count across all instances.

Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'UnhealthyHostCount' metric.

Answer

Use the ALB's 'RequestCount' metric and the EC2 Auto Scaling group's 'GroupInServiceInstances' metric.

Answer

Use the ALB's 'Latency' metric and the EC2 instance's 'CPUUtilization' metric.

Question 2

A SysOps administrator is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The administrator wants to identify the specific queries consuming the most CPU. What is the MOST efficient way to achieve this?

Accepted Answer

Enable Performance Insights for the RDS instance and view the top SQL queries.. Performance Insights provides a built-in database load visualization and a dashboard that directly shows the top SQL queries consuming the most resources, including CPU. This is the most efficient method because it requires no additional configuration beyond enabling the feature and immediately surfaces the specific queries causing high CPU utilization.

Answer

Use CloudWatch metrics for RDS and create a dashboard for CPU utilization.

Answer

Enable Enhanced Monitoring for the RDS instance and view the CPU metrics.

Answer

Enable CloudWatch Logs for the RDS instance and filter for slow query logs.

Question 3

A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The marketing team wants to know how many users visit the website each day, including the geographic distribution. Which solution requires the LEAST operational overhead?

Accepted Answer

Enable CloudFront access logs and use Amazon Athena to query the logs in S3.. Option B is correct because enabling CloudFront access logs and querying them with Amazon Athena provides detailed user visit counts and geographic distribution with minimal operational overhead. Access logs contain client IP addresses and request details, which Athena can analyze using SQL without managing servers or complex pipelines. This approach is serverless and cost-effective for periodic analysis.

Answer

Use CloudWatch metrics for CloudFront to view request counts and enable detailed metrics.

Answer

Enable AWS CloudTrail for CloudFront and query the event history.

Answer

Enable CloudFront real-time logs and send them to Amazon Kinesis Data Analytics for analysis.

Question 4

A SysOps administrator is monitoring an Amazon ECS cluster running Fargate tasks. The administrator wants to receive a notification when any task fails to start due to insufficient memory. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send notifications to an SNS topic.. Option B is correct because Amazon CloudWatch Events (now Events) can trigger an SNS notification when a specific ECS task state change occurs. Option C is correct because you can create a CloudWatch Events rule that matches ECS task state changes with a reason of 'RESOURCE:MEMORY', which indicates the task failed to start due to insufficient memory. Together, these actions ensure you receive a notification when a Fargate task fails to start due to memory constraints.

Answer

Enable AWS CloudTrail and create a metric filter for RunTask API calls.

Answer

Create a CloudWatch alarm on the ECS cluster's CPUUtilization metric.

Answer

Enable CloudWatch Logs for the ECS cluster and filter for error messages.

Question 5

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified when a stack creation fails. Which solution meets this requirement with the LEAST effort?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's 'NotificationARNs' parameter.. Option C is correct because CloudFormation natively supports specifying an SNS topic in the 'NotificationARNs' parameter, which automatically sends notifications on stack events such as creation failure. This requires no additional infrastructure, scripting, or monitoring setup, making it the least-effort solution.

Answer

Create a CloudWatch alarm that triggers when the CloudFormation stack status is 'CREATE_FAILED'.

Answer

Use AWS CloudTrail to monitor CreateStack API calls and trigger an SNS notification.

Answer

Write a custom script that polls the CloudFormation API every minute and sends an SNS notification on failure.

Question 6

A SysOps administrator needs to centrally collect operating system-level metrics from a fleet of Amazon EC2 instances running Amazon Linux 2. The metrics should include memory usage and disk I/O. Which solution should the administrator implement?

Accepted Answer

Install and configure the CloudWatch agent on the EC2 instances.. The CloudWatch agent is the correct solution because it can collect custom OS-level metrics such as memory usage and disk I/O from EC2 instances running Amazon Linux 2. Unlike the default CloudWatch metrics, which only capture hypervisor-level metrics (e.g., CPU, network), the CloudWatch agent uses the procstat and disk plugins to gather detailed system metrics and publish them to CloudWatch as custom namespaces.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log OS-level metrics.

Answer

Use AWS Systems Manager Inventory to collect metrics.

Question 7

A company has an S3 bucket that stores sensitive data. The security team requires an alert whenever an object in the bucket is deleted. What is the MOST efficient way to achieve this?

Accepted Answer

Enable S3 event notifications and send them to Amazon EventBridge, then create a rule to publish to SNS.. Option D is correct because S3 event notifications can be sent directly to Amazon EventBridge, which allows you to create a rule that triggers an SNS topic for real-time alerts on object deletions. This approach is the most efficient as it avoids the overhead of log analysis or polling, providing immediate notification with minimal latency.

Answer

Configure S3 access logs and stream them to CloudWatch Logs, then create a metric filter.

Answer

Use S3 Inventory to generate a daily report and check for deletes.

Answer

Enable AWS CloudTrail data events for the S3 bucket and create a CloudWatch metric filter.

Question 8

A SysOps administrator is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. The administrator suspects that a specific query is causing high I/O. Which tools should be used together to identify the query and its I/O impact? (Choose THREE.)

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights (A) provides a database performance dashboard that visualizes database load and identifies the specific queries causing high load, including I/O wait events. By correlating this with Amazon RDS Enhanced Monitoring (D), which offers OS-level metrics like read/write IOPS and queue depth, you can pinpoint the exact query and its I/O impact. The combination of RDS Performance Insights with database load and wait events (E) directly surfaces the query text and the wait types (e.g., IO:DataFileRead) to confirm high I/O.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 9

A company wants to automatically remediate an Amazon EC2 instance that becomes unresponsive by rebooting it. The solution should use AWS managed services to minimize custom code. Which combination should a SysOps administrator use? (Choose TWO.)

Accepted Answer

Amazon CloudWatch alarm on EC2 status check failures. Option B is correct because Amazon CloudWatch can monitor EC2 status check failures (both system and instance checks) and trigger an alarm. When the alarm enters the ALARM state, it can directly invoke an AWS Systems Manager Automation document to reboot the instance, which is a managed, code-free remediation approach. This combination minimizes custom code by using built-in AWS services.

Answer

Amazon EC2 Auto Scaling and lifecycle hooks

Answer

Amazon CloudWatch alarm and AWS Lambda function

Answer

Amazon EventBridge rule to trigger an SNS notification

Question 10

A SysOps administrator needs to track changes to IAM policies in the AWS account for auditing purposes. Which service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to IAM, including changes to IAM policies (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These logs are stored in a CloudTrail trail and can be delivered to Amazon S3 for long-term auditing. CloudTrail is specifically designed for auditing API activity, making it the appropriate choice for tracking policy modifications.

Answer

IAM Access Analyzer

Answer

AWS Config

Answer

Amazon CloudWatch

Question 11

A SysOps administrator is troubleshooting an application that intermittently fails to connect to an RDS database. The error logs show 'Too many connections'. What CloudWatch metric should the administrator monitor to proactively detect this issue?

Accepted Answer

DatabaseConnections. The 'Too many connections' error indicates that the RDS database has reached its maximum allowed number of simultaneous client connections. The DatabaseConnections CloudWatch metric tracks the current number of connections to the DB instance, so monitoring this metric allows the administrator to set an alarm when connections approach the instance's max_connections limit, enabling proactive scaling or connection management before errors occur.

Answer

CPUUtilization

Answer

NetworkThroughput

Answer

FreeableMemory

Question 12

A company uses CloudWatch Logs to store application logs from EC2 instances. The SysOps team needs to search for specific error patterns across all log groups. What is the most efficient way to perform this search?

Accepted Answer

Use CloudWatch Logs Insights to run a query across the log groups.. CloudWatch Logs Insights is purpose-built for ad-hoc querying and analysis of log data across multiple log groups. It allows you to run SQL-like queries (using a query language) to search for specific patterns, filter results, and aggregate data without needing to set up additional infrastructure. This is the most efficient method for the SysOps team's requirement because it provides immediate, interactive search capabilities directly within the AWS Management Console or via the AWS CLI.

Answer

Define a CloudWatch metric filter to count errors and view the metric.

Answer

Create a subscription filter to stream logs to Amazon ES and use Kibana.

Answer

Export the logs to Amazon S3 and use S3 Select to search.

Question 13

An application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing increased latency. The SysOps administrator checks CloudWatch and sees that the ALB's TargetResponseTime is high, but the backend EC2 instance's CPUUtilization and MemoryUtilization are low. What is the most likely cause?

Accepted Answer

The ALB is experiencing connection queuing due to a high number of concurrent requests.. When TargetResponseTime is high but backend CPU and memory are low, the bottleneck is not the compute capacity of the instances but rather the ALB's ability to forward requests. The ALB has a default connection queue limit (typically 1024 pending connections per target group), and when concurrent requests exceed that, new requests are queued, increasing response time without stressing the backend. This is a classic sign of connection queuing at the load balancer level.

Answer

The application is CPU-bound on the EC2 instances.

Answer

The EC2 instances are throttled due to a burst balance limit.

Answer

The application is waiting on a database query that is slow.

Question 14

A company wants to receive an email notification when an EC2 instance's status check fails. What AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarm. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending an email via Amazon SNS, when a status check fails. This is the correct service because it directly integrates with EC2 metrics and supports alarm-based notifications for status check failures.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 15

A SysOps administrator needs to ensure that all S3 buckets in the account have server access logging enabled. The administrator wants to be notified if a bucket is created without logging. What is the most efficient solution?

Accepted Answer

Use AWS Config with a managed rule to evaluate S3 buckets for server access logging.. AWS Config with the managed rule 's3-bucket-server-access-logging-enabled' continuously evaluates all S3 buckets against the desired configuration. When a bucket is created without server access logging, AWS Config automatically flags it as noncompliant and can trigger an SNS notification. This is the most efficient solution because it provides ongoing, automated compliance monitoring without requiring custom scripts or event-driven remediation.

Answer

Periodically run a script to list all buckets and check logging configuration.

Answer

Enable S3 event notifications on the bucket creation event and trigger a Lambda function.

Answer

Use CloudWatch Events to detect CreateBucket API calls and trigger a Lambda function.