SOA-C02 Monitoring, Logging, and Remediation Practice Test 14 — 15 Questions

Question 1

An IAM policy is attached to an EC2 instance role to allow sending logs to CloudWatch Logs. The application running on the instance fails to send logs to the log group 'MyAppLogGroup'. Which change is required to fix the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a new statement allowing logs:PutLogEvents on 'arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogGroup:log-stream:*'.. The IAM policy attached to the EC2 instance role is missing the `logs:PutLogEvents` permission for the specific log stream within the log group. Even if the policy allows `logs:CreateLogStream` and `logs:DescribeLogGroups`, the application cannot send log events without `logs:PutLogEvents` on the log stream resource. Option C adds the required statement with the correct ARN pattern to resolve the failure.

Answer

Install the CloudWatch agent on the instance.

Answer

Attach the policy to the EC2 instance instead of the instance role.

Answer

Change the log group ARN in the policy to include the log stream name.

Question 2

A company wants to receive a notification when the root account is used to perform any action in the AWS account. Which service should be used to monitor this?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. AWS CloudTrail logs all API activity in the account, including root user actions. By creating a CloudTrail trail and sending those logs to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that matches the `RootAccess` event or any API call where `userIdentity.type` is `Root` and trigger a notification via SNS or Lambda. This combination provides real-time monitoring and alerting for root account usage.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 3

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack enters a ROLLBACK_IN_PROGRESS state. Which TWO methods can achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the CloudFormation stack status change.. Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack status changes, including ROLLBACK_IN_PROGRESS, by matching the 'CloudFormation Stack Status Change' event pattern. This allows you to trigger a notification action (e.g., via SNS or Lambda) in real time when the stack enters that state.

Answer

Use AWS Config rules to evaluate the stack state.

Answer

Configure a CloudWatch Logs subscription filter to detect the stack state.

Answer

Create a CloudTrail trail and monitor the UpdateStack API call.

Question 4

A SysOps administrator is troubleshooting a Lambda function that is not processing messages from an SQS queue. The function is subscribed to the queue via an event source mapping. The function has a reserved concurrency of 0. Which TWO actions will resolve the issue?

Accepted Answer

Set the reserved concurrency to a value greater than 0.. Reserved concurrency of 0 means the Lambda function has no available execution capacity, so it cannot process any invocations, including those from SQS. Setting reserved concurrency to a value greater than 0 (e.g., 1 or more) allocates the necessary execution slots for the function to run. This directly resolves the issue because the event source mapping will successfully invoke the function only when concurrency is available.

Answer

Add SQS permissions to the Lambda execution role.

Answer

Configure a dead-letter queue for the Lambda function.

Answer

Increase the batch size in the event source mapping.

Question 5

A company hosts a web application on multiple EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator receives a report that the application is experiencing intermittent 503 errors. The ALB target group health checks are configured to check the /health endpoint every 30 seconds with a healthy threshold of 2 and an unhealthy threshold of 2. The administrator checks the ALB metrics and notices that the number of healthy hosts occasionally drops to zero. The EC2 instances are normal and the application logs show no errors. What is the most likely cause and solution?

Accepted Answer

Increase the health check timeout to 10 seconds.. The intermittent 503 errors and healthy hosts dropping to zero indicate that health checks are timing out before the application can respond. With a default health check timeout of 5 seconds and a 30-second interval, if the /health endpoint occasionally takes longer than 5 seconds (e.g., due to transient load), the ALB marks instances unhealthy after two consecutive failures (unhealthy threshold of 2). Increasing the timeout to 10 seconds gives the endpoint more time to respond, preventing false negatives without changing the check frequency.

Answer

Increase the health check interval to 60 seconds.

Answer

Add more EC2 instances to the target group.

Answer

Decrease the healthy threshold to 1.

Question 6

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The SysOps administrator notices that the DB instance's CPU utilization spikes to 100% every few minutes. CloudWatch alarms have been set to trigger when CPU exceeds 90% for 5 minutes, but no alarm state changes are observed. The administrator checks the CloudWatch metrics and sees that the CPU utilization metric shows periodic spikes but they last only 2-3 minutes each. What is the most likely cause and what should the administrator do to receive notifications?

Accepted Answer

Set the alarm to evaluate over 1 minute instead of 5 minutes.. The CPU utilization spikes last only 2-3 minutes, which is shorter than the alarm's evaluation period of 5 consecutive minutes. Since the alarm requires the metric to exceed the 90% threshold for 5 minutes before triggering, these brief spikes never satisfy the alarm's duration condition. Setting the alarm to evaluate over 1 minute will match the spike duration and allow the alarm to trigger on these short-lived bursts.

Answer

The Multi-AZ failover is causing the spikes; disable Multi-AZ.

Answer

The DB instance is not publishing CPU metrics at a high enough resolution.

Answer

The CPU metric is not accurate; use the CPU credit metric instead.

Question 7

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

Accepted Answer

Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.. CloudWatch Events (now part of Amazon EventBridge) can capture log events in real-time and trigger a Lambda function. The Lambda function can then compute job duration by correlating JOB_START and JOB_END events (e.g., using a DynamoDB table to store start times) and publish a custom metric or trigger an alarm if duration exceeds 1 hour. This approach handles the per-job correlation that metric filters cannot achieve.

Answer

Use CloudWatch Logs Insights to run a query every hour and check the duration.

Answer

Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.

Answer

Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.

Question 8

A company uses Amazon S3 to store sensitive data. The SysOps administrator needs to ensure that any attempt to upload an object with server-side encryption disabled is immediately detected and the administrator is notified. The administrator has enabled AWS CloudTrail and is logging S3 data events. Which approach should the administrator use to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutObject API calls without the encryption header and triggers an SNS notification.. CloudWatch Events (now Amazon EventBridge) can filter API calls captured by CloudTrail for PutObject operations that lack the x-amz-server-side-encryption header, and then trigger an SNS notification in near real-time. This ensures immediate detection and notification of any upload with server-side encryption disabled, meeting the requirement for instant alerting.

Answer

Enable S3 event notifications to send events to SNS for all PutObject operations.

Answer

Create an AWS Config rule to detect objects without encryption.

Answer

Use S3 Inventory to generate a daily report of unencrypted objects.

Question 9

A SysOps administrator is troubleshooting a slow web application running on EC2 instances behind an ALB. The application uses an RDS MySQL database. The administrator checks CloudWatch metrics and sees that the ALB's latency is high, the RDS CPU is high, and the EC2 CPU is moderate. The application team reports that the database queries are slow. The administrator suspects that the database is the bottleneck. However, the RDS instance is already a db.r5.large and the administrator wants to avoid increasing instance size due to cost. What should the administrator do to improve performance without increasing instance size?

Accepted Answer

Enable Performance Insights on the RDS instance to identify slow queries.. Enabling Performance Insights on the RDS instance allows the administrator to identify the specific slow queries causing the bottleneck. This diagnostic tool provides a database load analysis, showing which queries consume the most resources, enabling targeted optimization (e.g., adding indexes or rewriting queries) without increasing instance size. Since the EC2 CPU is moderate and the ALB latency is high due to slow database queries, resolving the query performance directly addresses the root cause.

Answer

Increase the number of EC2 instances to reduce the load on the database.

Answer

Add an ElastiCache Redis cluster to cache database queries.

Answer

Create a Read Replica and offload read traffic to it.

Question 10

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The stack creation fails with the error 'The maximum number of VPCs has been reached.' The SysOps administrator needs to deploy the stack as soon as possible. What should the administrator do?

Accepted Answer

Request a VPC limit increase from AWS Support.. The error 'The maximum number of VPCs has been reached' indicates the AWS account has hit the default VPC limit (5 per region). Requesting a service limit increase from AWS Support is the fastest way to raise this soft limit without modifying existing infrastructure or templates, allowing the stack to deploy in the same region.

Answer

Delete unused VPCs to free up capacity.

Answer

Modify the CloudFormation template to use an existing VPC.

Answer

Deploy the stack in a different AWS region.

Question 11

A company uses Amazon CloudWatch Logs to store application logs. The security team needs to be alerted when any log group contains a specific error pattern. The solution must minimize latency and operational overhead. What should a SysOps administrator do?

Accepted Answer

Create a Lambda function subscribed to the CloudWatch Logs log group, which checks for the error pattern and publishes to an SNS topic.. Subscribing a Lambda function directly to a CloudWatch Logs log group allows real-time, low-latency processing of log events as they arrive. The Lambda function can parse each log event for the specific error pattern and publish to an SNS topic to alert the security team, minimizing operational overhead by avoiding additional streaming or polling services.

Answer

Stream the logs to Amazon Kinesis Data Firehose, which then triggers a Lambda function to check for errors.

Answer

Create a CloudWatch metric filter on the log group and set an alarm that triggers an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 12

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an alert if it exceeds 80% for 10 consecutive minutes. The instance is in a VPC with no Internet access. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and an evaluation period of 2.. A CloudWatch alarm with a period of 5 minutes and an evaluation period of 2 means the alarm evaluates two consecutive 5-minute data points, totaling 10 minutes. Since the EC2 instance is in a VPC with no Internet access, CloudWatch metrics are still reported via the CloudWatch service endpoint within the VPC (or via VPC endpoints), so no additional agent or script is needed. This is the most efficient approach as it uses native CloudWatch functionality without requiring any custom scripts or additional software.

Answer

Use AWS Systems Manager to run a script on the instance that checks CPU and sends an SNS notification.

Answer

Enable detailed monitoring on the EC2 instance and create a CloudWatch alarm on the CPUUtilization metric.

Answer

Install the CloudWatch agent on the EC2 instance to collect CPU metrics and create a CloudWatch alarm.

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator notices that the application's response time is increasing during peak hours. The administrator wants to set up a CloudWatch dashboard that displays the average latency of requests across all instances and the number of healthy hosts. Which metrics should be used?

Accepted Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'HealthyHostCount' metric.. The ALB's 'TargetResponseTime' metric measures the average time (in seconds) that requests are routed to targets, which directly reflects application latency. The ALB's 'HealthyHostCount' metric shows the number of healthy registered targets, which is the exact metric needed to monitor host health. Together, these two metrics provide the required visibility into average latency and healthy host count across all instances.

Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'UnhealthyHostCount' metric.

Answer

Use the ALB's 'RequestCount' metric and the EC2 Auto Scaling group's 'GroupInServiceInstances' metric.

Answer

Use the ALB's 'Latency' metric and the EC2 instance's 'CPUUtilization' metric.

Question 14

A SysOps administrator is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The administrator wants to identify the specific queries consuming the most CPU. What is the MOST efficient way to achieve this?

Accepted Answer

Enable Performance Insights for the RDS instance and view the top SQL queries.. Performance Insights provides a built-in database load visualization and a dashboard that directly shows the top SQL queries consuming the most resources, including CPU. This is the most efficient method because it requires no additional configuration beyond enabling the feature and immediately surfaces the specific queries causing high CPU utilization.

Answer

Use CloudWatch metrics for RDS and create a dashboard for CPU utilization.

Answer

Enable Enhanced Monitoring for the RDS instance and view the CPU metrics.

Answer

Enable CloudWatch Logs for the RDS instance and filter for slow query logs.

Question 15

A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The marketing team wants to know how many users visit the website each day, including the geographic distribution. Which solution requires the LEAST operational overhead?

Accepted Answer

Enable CloudFront access logs and use Amazon Athena to query the logs in S3.. Enabling CloudFront access logs and querying them with Amazon Athena provides detailed user visit counts and geographic distribution with minimal operational overhead. Access logs contain client IP addresses and request details, which Athena can analyze using SQL without managing servers or complex pipelines. This approach is serverless and cost-effective for periodic analysis.

Answer

Use CloudWatch metrics for CloudFront to view request counts and enable detailed metrics.

Answer

Enable AWS CloudTrail for CloudFront and query the event history.

Answer

Enable CloudFront real-time logs and send them to Amazon Kinesis Data Analytics for analysis.