SOA-C02 Monitoring, Logging, and Remediation Practice Test 13 — 15 Questions

Question 1

A SysOps administrator is responsible for a multi-tier web application running on AWS. The application consists of an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS for MySQL database. Recently, the operations team has been receiving alerts from CloudWatch that the ALB's 'HTTPCode_Target_5XX_Count' metric is spiking periodically. The team has also noticed that the database CPU utilization is high during these spikes. The application logs show that some requests are timing out. The administrator needs to identify the root cause and implement a remediation. After reviewing the architecture, the administrator rules out the database as the bottleneck because the database connections are pooled and the query response times are normal. The administrator suspects that the issue is related to the application server's health. Which course of action should the administrator take to diagnose and resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the health check timeout and threshold to allow for transient high CPU usage.. The periodic spikes in ALB 5xx errors, high database CPU, and application timeouts, combined with normal query response times and pooled connections, strongly suggest that the application servers are becoming overwhelmed and failing health checks. By increasing the health check timeout and threshold, the ALB will allow the EC2 instances more time to recover from transient CPU or memory pressure before being marked unhealthy and removed from service, which prevents unnecessary instance replacement and reduces the cascading load on remaining instances and the database.

Answer

Add an Amazon ElastiCache cluster to cache database queries.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Answer

Increase the idle timeout on the ALB to keep connections open longer.

Question 2

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

Accepted Answer

The log group contains too many log events, causing the query to time out.. In CloudWatch Logs Insights, `stats count() by bin(5m)` is valid syntax; `bin()` does not require a preceding field. Therefore option A is not the cause. The most likely cause among the options is that the log group contains too many log events, causing the query to time out before results are returned. Retention policy does not affect events from the last hour, and `@message` is a valid field.

Answer

The 'stats' command requires a 'by' clause with a field name, but 'bin(5m)' is invalid.

Answer

The @message field is not a valid field in CloudWatch Logs Insights.

Answer

The log group's retention policy is set to 1 day and the data is older than the retention period.

Question 3

A company uses Amazon RDS for MySQL and wants to monitor the number of database connections in real time. Which CloudWatch metric should the SysOps administrator use?

Accepted Answer

DatabaseConnections. Amazon RDS for MySQL exposes a CloudWatch metric named `DatabaseConnections` that reports the number of client connections to the DB instance. This metric is derived from the MySQL `Threads_connected` status variable and is updated every minute, providing real-time visibility into connection counts for monitoring and alarming.

Answer

CPUUtilization

Answer

ActiveConnections

Answer

ConnectionCount

Question 4

An organization uses AWS CloudTrail to log API calls across multiple accounts in AWS Organizations. The logs are delivered to a central S3 bucket. The security team wants to receive near-real-time notifications whenever an IAM user creates a new access key. Which solution is the MOST operationally efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event from CloudTrail and publishes to an Amazon SNS topic.. Amazon EventBridge can directly consume CloudTrail events (including `CreateAccessKey`) in near-real-time without polling or custom code. By creating a rule that matches this specific event and targets an SNS topic, the security team gets immediate notifications with minimal operational overhead. This approach is serverless, event-driven, and requires no intermediate services or custom functions.

Answer

Enable S3 Event Notifications on the CloudTrail bucket to trigger a Lambda function that scans new objects for access key creation.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and set up a metric filter that triggers an alarm.

Answer

Use Amazon CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 5

A SysOps administrator notices that an Amazon EC2 instance's CPU utilization is consistently above 90% during business hours. The instance is part of an Auto Scaling group with a simple scaling policy based on average CPU utilization. However, the Auto Scaling group is not launching new instances. What is the most likely cause?

Accepted Answer

The scaling policy is in a cooldown period after a previous scaling activity.. The simple scaling policy in Auto Scaling has a cooldown period (default 300 seconds) that prevents the group from launching or terminating instances immediately after a previous scaling activity. If the policy triggered a scale-out event recently, the cooldown period is still active, so even though CPU utilization remains above 90%, no new instances are launched until the cooldown expires. This is the most likely cause because the cooldown is designed to stabilize metrics and avoid thrashing.

Answer

The Auto Scaling group has a minimum size equal to the current number of instances.

Answer

The Auto Scaling group has a scheduled scaling action that is overriding the dynamic policy.

Answer

The instance is not healthy and is being terminated by the Auto Scaling group.

Question 6

Refer to the exhibit. A SysOps administrator created this IAM policy for an application that sends custom metrics to CloudWatch and writes logs to CloudWatch Logs. The application reports that it cannot publish logs. What is the most likely reason?

Accepted Answer

The resource ARN for the logs actions is incorrect; it should include 'log-group:' before the wildcard.. The IAM policy uses `arn:aws:logs:us-east-1:123456789012:*` for the `Resource` element of the `logs:PutLogEvents` and `logs:CreateLogGroup` actions. For CloudWatch Logs, the resource ARN must include the `log-group:` prefix before the log group name or wildcard, such as `arn:aws:logs:us-east-1:123456789012:log-group:*`. Without this prefix, the ARN does not match any valid CloudWatch Logs resource, causing the application to fail when attempting to publish logs.

Answer

The policy requires a condition key to restrict access to specific log groups.

Answer

The policy does not allow the cloudwatch:PutMetricData action for the specific metric.

Answer

The application must assume an IAM role to write logs.

Question 7

A company wants to monitor the health of its web application running on EC2 instances behind an Application Load Balancer (ALB). Which CloudWatch metric from the ALB can indicate that requests are failing due to server errors?

Accepted Answer

HTTPCode_Target_5XX_Count. The HTTPCode_Target_5XX_Count metric from the Application Load Balancer (ALB) specifically counts the number of HTTP response codes in the 5xx range returned by the target (EC2 instances). A 5xx status code indicates a server-side error, such as an internal server error (500), gateway timeout (504), or service unavailable (503), which directly reflects that requests are failing due to issues on the EC2 instances themselves.

Answer

HTTPCode_Target_4XX_Count

Answer

HTTPCode_Target_2XX_Count

Answer

HTTPCode_Target_3XX_Count

Question 8

A SysOps administrator is troubleshooting an issue where an Amazon RDS DB instance's storage space is running out. The administrator has enabled CloudWatch alarms for FreeStorageSpace, but the alarm did not trigger before the storage was exhausted. What is the most likely reason?

Accepted Answer

The alarm's evaluation period was too long and the storage filled up faster than the alarm could trigger.. CloudWatch alarms evaluate metrics based on a specified evaluation period (e.g., 5 minutes). If the storage fills up faster than the alarm's evaluation period, the alarm may not have enough data points to trigger before the storage is exhausted. This is a common issue when the rate of storage consumption exceeds the alarm's evaluation frequency.

Answer

The FreeStorageSpace metric is not available for the selected DB instance class.

Answer

The alarm was configured to use a static threshold but the metric is not emitted during storage operations.

Answer

The alarm was monitoring the wrong metric, such as 'Storage' instead of 'FreeStorageSpace'.

Question 9

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified if a stack creation fails. Which method is the most efficient way to achieve this?

Accepted Answer

Specify an SNS topic ARN in the 'NotificationARNs' parameter of the stack.. CloudFormation natively supports specifying an Amazon SNS topic ARN in the 'NotificationARNs' parameter of the stack. When a stack creation fails, CloudFormation automatically publishes a notification to the SNS topic, which can then deliver the message via email, SMS, or other protocols without any custom polling or additional services.

Answer

Use Amazon Simple Email Service (SES) to send emails on stack failure.

Answer

Create a Lambda function that polls the CloudFormation API for stack status changes.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' events.

Question 10

A SysOps administrator is setting up centralized logging for multiple AWS accounts using CloudWatch Logs. Which TWO actions should the administrator take to ensure that logs from all accounts are aggregated in a single account?

Accepted Answer

In the central account, create a CloudWatch Logs destination and attach a resource policy that grants the source accounts permission to write logs.. A CloudWatch Logs destination in the central account, combined with a resource policy that grants the source accounts permission to write logs, is the standard mechanism for cross-account log aggregation. The destination acts as a target for subscription filters, and the resource policy explicitly allows the source accounts to call the PutLogEvents API against that destination. This setup ensures that log events from source accounts are delivered to the central account without requiring IAM roles or additional infrastructure.

Answer

In the central account, create an IAM role that trusts the source accounts and allows PutLogEvents.

Answer

In the central account, create a log group with the same name as the source accounts' log groups.

Answer

In each source account, create a Kinesis Data Firehose delivery stream that sends logs to the central account's S3 bucket.

Question 11

An organization uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. A SysOps administrator needs to be alerted when a canary run fails. Which THREE steps are required to set up this alerting?

Accepted Answer

Configure a CloudWatch alarm on the canary's `SuccessPercent` metric.. CloudWatch Synthetics canaries automatically publish a `SuccessPercent` metric to CloudWatch. By configuring a CloudWatch alarm on this metric (e.g., when `SuccessPercent` drops below 100), the administrator can trigger an alert whenever a canary run fails. This is the standard method for monitoring canary health without needing custom metrics.

Answer

Create a custom CloudWatch metric for canary failures.

Answer

Enable detailed monitoring on the canary.

Question 12

A SysOps administrator is investigating a security incident where an unauthorized user accessed an S3 bucket. Which TWO AWS services can the administrator use to collect and analyze the relevant logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API calls made to S3, including who made the request, the source IP address, and the time of the action. This allows the administrator to trace the unauthorized access to a specific IAM user or role and identify the exact API operations performed, such as GetObject or PutObject.

Answer

AWS WAF logs

Answer

Amazon VPC Flow Logs

Answer

Amazon Route 53 resolver logs

Question 13

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application experiences intermittent latency spikes. The SysOps administrator has enabled detailed CloudWatch metrics on the ALB and the EC2 instances. The administrator notices that during the latency spikes, the ALB's TargetResponseTime metric increases, but the EC2 instance's CPU utilization and memory usage remain normal. The administrator also observes that the number of concurrent connections to the ALB spikes during these periods. Which action should the administrator take to identify the root cause?

Accepted Answer

Analyze the ALB's ActiveConnectionCount and RequestCountPerTarget metrics to see if the load balancer is reaching its connection limit.. The ALB's ActiveConnectionCount and RequestCountPerTarget metrics directly indicate whether the load balancer is approaching its connection limit (default 50,000 for ALBs). During latency spikes, if concurrent connections spike but instance CPU/memory are normal, the bottleneck is likely at the load balancer level, not the instances. Analyzing these metrics helps determine if the ALB is queuing or dropping requests due to connection limits, causing increased TargetResponseTime.

Answer

Check the RDS database's DatabaseConnections metric to see if the database is overwhelmed.

Answer

Enable VPC Flow Logs and analyze the traffic patterns for dropped packets.

Answer

Enable detailed monitoring on the EC2 instances to capture CPU credits for burstable instances.

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer, Auto Scaling group, and RDS database. The SysOps administrator receives a notification that a stack update has failed. The administrator wants to investigate the failure and understand which resource caused the issue. The stack is in the UPDATE_ROLLBACK_IN_PROGRESS state. What should the administrator do to identify the failed resource?

Accepted Answer

View the stack events in the CloudFormation console to see which resource failed and the error message.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_IN_PROGRESS, the most direct way to identify the failed resource is to view the stack events in the CloudFormation console. Each event includes a status reason field that contains the specific error message and the logical resource ID of the resource that caused the failure, allowing the administrator to pinpoint the issue without additional investigation.

Answer

Review the stack's template in the CloudFormation console to check for syntax errors.

Answer

Check the CloudWatch Logs for the EC2 instances in the Auto Scaling group.

Answer

Manually re-run the update with the same parameters to see if the error recurs.

Question 15

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is unreachable. The instance passes status checks and is in a healthy state. Security groups and network ACLs are configured correctly. CloudWatch metrics show CPU utilization is 5%. The administrator can SSH into the instance but cannot connect to the web server on port 443. What is the most likely cause?

Accepted Answer

The web server service is not running or crashed.. The instance passes both status checks and is healthy, and the administrator can SSH into it, confirming that the operating system and network stack are functional. Since the web server is unreachable on port 443 despite correct security group and network ACL configurations, and CPU utilization is low (5%), the most likely cause is that the web server service (e.g., Apache, Nginx) has stopped or crashed. This would prevent the instance from listening on port 443, even though the underlying infrastructure is sound.

Answer

The security group inbound rule for HTTPS is misconfigured.

Answer

The instance has an incorrect route table entry.

Answer

The instance has insufficient CPU credits.