SOA-C02 Monitoring, Logging, and Remediation Practice Test 13 — 15 Questions

Question 1

An organization is using AWS CloudFormation to deploy infrastructure. The SysOps administrator needs to receive notifications when stack creation fails. What is the simplest way to achieve this?

Accepted Answer

Provide an SNS topic ARN in the --notification-arns parameter when creating the stack.. The `--notification-arns` parameter in the AWS CLI `create-stack` command directly associates an SNS topic with the stack, causing CloudFormation to publish notifications for all stack events, including failures. This is the simplest method as it requires no additional services or configuration beyond specifying the SNS topic ARN at stack creation.

Answer

Create a CloudWatch alarm on the 'StackCreationFailure' metric.

Answer

Create an EventBridge rule that triggers on CloudFormation events.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' failures.

Question 2

A company has an Auto Scaling group of EC2 instances behind an Application Load Balancer. The SysOps administrator notices that the healthy host count is lower than expected. The instances are in service, and security groups allow traffic. What is a likely cause?

Accepted Answer

The health check path is returning HTTP 503.. A health check path returning HTTP 503 (Service Unavailable) indicates that the target instances are reachable but the application is failing to respond correctly. The Application Load Balancer (ALB) marks instances as unhealthy when the health check receives any non-2xx or non-3xx response, which reduces the healthy host count even though the instances are in service and security groups are properly configured.

Answer

The instances are not registered with the target group.

Answer

The security group for the load balancer does not allow inbound traffic.

Answer

The target group is not associated with the load balancer.

Question 3

A SysOps administrator wants to be alerted when an EC2 instance's status check fails. The instance is part of an Auto Scaling group. What is the BEST approach?

Accepted Answer

Create a CloudWatch alarm on the 'StatusCheckFailed' metric.. The 'StatusCheckFailed' metric is automatically published by EC2 to CloudWatch, and a CloudWatch alarm on this metric can directly trigger an SNS notification or other action when the status check fails. This is the simplest and most reliable method for alerting on instance health, regardless of whether the instance is in an Auto Scaling group.

Answer

Use Amazon EventBridge to detect status check failures.

Answer

Enable CloudTrail to monitor EC2 instance status changes.

Answer

Configure an Auto Scaling lifecycle hook to send a notification.

Question 4

An application running on EC2 instances sends custom metrics to CloudWatch using the PutMetricData API. The metrics are not appearing in the CloudWatch console. The IAM role attached to the instances has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*" } ] }. What is the most likely cause?

Accepted Answer

The metric data is being sent to a different AWS region.. The most likely cause is that the metric data is being sent to a different AWS region than the one displayed in the CloudWatch console. The PutMetricData API call includes a regional endpoint, and if the EC2 instance is configured to send metrics to a region other than the one you are viewing, the metrics will not appear. The IAM policy correctly allows the action, so authentication is not the issue.

Answer

The metric timestamp is older than 14 days.

Answer

The metric namespace must start with 'AWS/'.

Answer

The IAM policy does not allow the 'cloudwatch:PutMetricData' action.

Question 5

A SysOps administrator is setting up monitoring for an RDS MySQL database. The administrator needs to be notified when the database connection count exceeds 100. Which steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.. Amazon CloudWatch alarms can send notifications to an Amazon SNS topic when the alarm state changes. This allows the SysOps administrator to receive alerts (e.g., via email, SMS, or HTTP) when the database connection count exceeds the threshold. Option B is correct because the 'DatabaseConnections' metric is a standard CloudWatch metric for RDS MySQL that tracks the number of current connections to the database instance. Creating an alarm on this metric with a threshold of 100 will trigger when the connection count exceeds that value.

Answer

Enable Enhanced Monitoring for RDS.

Answer

Enable CloudTrail to log RDS API calls.

Answer

Create an Amazon EventBridge rule that triggers on RDS events.

Question 6

A company has a centralized logging solution where CloudTrail logs from multiple accounts are delivered to a single S3 bucket. The security team needs to be alerted when an IAM user is created in any of the accounts. Which steps should be taken? (Choose THREE.)

Accepted Answer

Create a CloudWatch Logs metric filter for 'CreateUser' event.. A CloudWatch Logs metric filter can parse CloudTrail logs delivered to CloudWatch Logs and match the 'CreateUser' event pattern. This filter creates a metric that can be used to trigger an alarm. Option B is correct because CloudTrail must be configured to deliver logs to CloudWatch Logs in each account so that the metric filter can be applied to the log group. Option E is correct because a CloudWatch alarm on the metric filter can publish to an SNS topic, which sends notifications (e.g., email, SMS) to the security team when an IAM user is created.

Answer

Create an AWS Config rule to detect IAM user creation.

Answer

Configure S3 event notification on the central bucket to trigger a Lambda function.

Question 7

A SysOps administrator needs to track changes to security group rules in a VPC. Which AWS services can be used to monitor and log these changes? (Choose TWO.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to the Amazon EC2 service, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and CreateSecurityGroup. These events capture the identity, source IP, and timestamp of every change to security group rules, providing an audit trail for compliance and troubleshooting.

Answer

VPC Flow Logs.

Answer

AWS Trusted Advisor.

Answer

Amazon CloudWatch Logs.

Question 8

Refer to the exhibit. A Lambda function is unable to write logs to CloudWatch Logs. The IAM role attached to the Lambda function includes the policy shown. What is the issue?

Accepted Answer

The resource ARN does not include a log-stream component.. The Lambda function's IAM policy grants permissions for `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` on the resource ARN `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:*`. However, this ARN only specifies the log group and a wildcard for log streams, which is insufficient for the `logs:PutLogEvents` action. The `logs:PutLogEvents` action requires a resource ARN that includes a specific log-stream component (e.g., `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:log-stream:*`), because the API call targets a particular log stream within the log group. Without this, the Lambda function cannot write logs, resulting in a permissions error.

Answer

The log group name is incorrect.

Answer

The policy effect is Deny.

Answer

The 'logs:PutLogEvents' action is not allowed.

Question 9

Refer to the exhibit. A SysOps administrator runs the command and sees the output. The administrator then creates a CloudWatch alarm on the CPUUtilization metric for this instance, but the alarm state remains 'INSUFFICIENT_DATA'. What is a likely cause?

Accepted Answer

The EC2 instance is stopped or terminated.. The command output shows the instance state is 'stopped'. CloudWatch cannot retrieve metrics from a stopped or terminated EC2 instance because the hypervisor is no longer running the instance's operating system or collecting CPU utilization data. When no metric data points are received for the configured alarm period, the alarm transitions to 'INSUFFICIENT_DATA' state.

Answer

Detailed monitoring is not enabled.

Answer

The instance is in a different AWS region.

Answer

The metric name is misspelled.

Question 10

Refer to the exhibit. A SysOps administrator runs the command to find 'CreateKeyPair' events in January 2023 but gets an empty list. The administrator knows that key pairs were created during that time. What is the most likely reason?

Accepted Answer

The events occurred in a different AWS region.. The `aws cloudtrail lookup-events` command returns events only from the region specified in the AWS CLI configuration (or the `--region` parameter). If the administrator did not specify a region, the command defaults to the region set in the CLI profile. Since `CreateKeyPair` events are regional (each key pair is created in a specific region), the empty result indicates the events occurred in a different AWS region than the one queried.

Answer

The start and end times are outside the 90-day retention period.

Answer

CloudTrail is not enabled in the account.

Answer

The IAM user does not have 'cloudtrail:LookupEvents' permission.

Question 11

A company is experiencing intermittent performance issues with an application running on an EC2 instance. The CloudWatch metrics show high CPU utilization but no correlation with the timing of the issue. The SysOps administrator needs to collect detailed performance data to identify the root cause. Which AWS service should the administrator use to capture network-level metrics and logs?

Accepted Answer

Enable VPC Flow Logs for the EC2 instance's subnet.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) at the network interface level, which is essential for diagnosing network-related performance issues. Since the problem is intermittent and uncorrelated with CPU, network-level metrics can reveal issues like packet loss, throttling, or latency that application logs or CPU metrics alone cannot. This directly addresses the need for detailed network-level data.

Answer

Configure a CloudWatch Logs agent on the instance to send application logs.

Answer

Use AWS CloudTrail to log all API calls made to the instance.

Answer

Enable AWS Config to track configuration changes to the instance.

Question 12

A SysOps administrator receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group behind an Application Load Balancer. The administrator needs to ensure that the instance is automatically replaced and that the root cause is investigated. What is the MOST efficient combination of actions to achieve this?

Accepted Answer

Configure an Auto Scaling lifecycle hook to terminate the unhealthy instance and send the instance system log to an S3 bucket for analysis.. It combines automatic instance replacement via the Auto Scaling group's health check (which marks the instance unhealthy and terminates it) with a lifecycle hook that captures the instance's system log before termination and sends it to S3 for root cause analysis. This is the most efficient approach as it requires no manual intervention and preserves diagnostic data.

Answer

Create a CloudWatch alarm that triggers an SNS notification to the administrator to manually replace the instance.

Answer

Reboot the instance from the AWS Management Console and then review CloudTrail logs.

Answer

Manually stop and start the instance to recover it, then check the system logs.

Question 13

A company needs to monitor for unauthorized changes to critical IAM policies. The SysOps administrator must receive notifications within minutes of any change. Which combination of AWS services should the administrator use?

Accepted Answer

Use AWS CloudTrail to log IAM changes, and create a CloudWatch Events rule that triggers an SNS notification when specific API calls are made.. AWS CloudTrail logs all IAM API calls (e.g., PutRolePolicy, AttachRolePolicy) as events. A CloudWatch Events rule (now called Amazon EventBridge rule) can be configured to match these specific API calls and trigger an SNS topic, delivering near-instant notifications within minutes. This combination provides real-time, event-driven monitoring without polling or delays.

Answer

Use AWS Config rules to detect changes and send notifications via SNS.

Answer

Use CloudWatch Logs to monitor IAM activity and create a metric filter to trigger an alarm.

Answer

Use a Lambda function that periodically checks IAM policies and sends an SNS message if changes are detected.

Question 14

A SysOps administrator notices that an RDS instance's CPU utilization is consistently above 80% during peak hours. The administrator wants to set up automated actions to scale the database and also notify the team. What should the administrator do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization that triggers a Lambda function to modify the RDS instance class to a larger size.. It uses a CloudWatch alarm on CPU utilization to trigger a Lambda function, which can programmatically call the ModifyDBInstance API to scale the RDS instance class up during peak hours. This provides automated, event-driven scaling based on actual utilization, and the same alarm can be configured to send an SNS notification to the team. This approach is flexible and allows custom logic in Lambda, such as checking current metrics before scaling.

Answer

Configure a scheduled scaling action to change the instance class during peak hours.

Answer

Add the RDS instance to an Auto Scaling group.

Answer

Enable RDS Auto Scaling for the instance.

Question 15

A SysOps administrator needs to ensure that all S3 buckets in the account are configured with server access logging. Which AWS service can evaluate the buckets and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously evaluate your S3 buckets against a managed rule (s3-bucket-server-access-logging-enabled) and automatically remediate non-compliant buckets using AWS Systems Manager Automation documents. This allows the SysOps administrator to enforce server access logging as a compliance requirement without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor