SOA-C02 Monitoring, Logging, and Remediation Practice Test 14 — 15 Questions

Question 1

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The administrator notices that the ALB returns 503 errors during peak traffic. The instances are healthy according to the ALB health checks. What is the MOST likely cause and what metric should the administrator check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ALB's surge queue is full; check the SurgeQueueLength metric.. The ALB returns 503 errors despite healthy targets, which indicates that the ALB itself is overwhelmed and cannot process incoming requests. The ALB uses a surge queue to buffer requests when traffic exceeds its capacity; when the queue is full, new requests are rejected with a 503. The SurgeQueueLength metric directly measures this queue depth, making it the correct metric to check.

Answer

The SSL certificate has expired; check the TLS handshake errors.

Answer

The ALB is overloaded; check the ALB's CPUUtilization metric.

Answer

The targets are failing health checks; check the HealthyHostCount metric.

Question 2

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is not reachable from the internet. The instance has a public IP and is in a public subnet. The security group allows HTTP and HTTPS from 0.0.0.0/0. The network ACL allows all inbound and outbound traffic. What should the administrator check NEXT?

Accepted Answer

Verify that the subnet's route table has a route to an internet gateway.. The instance is in a public subnet with a public IP and security group allowing HTTP/HTTPS, and the network ACL allows all traffic. The most likely remaining issue is that the subnet's route table lacks a route to an internet gateway (IGW), which is required for traffic to and from the internet. Without this route, the instance cannot send responses back to internet clients, making it unreachable despite having a public IP.

Answer

Check that the instance is associated with an Elastic IP address.

Answer

Confirm that the instance's operating system firewall is disabled.

Answer

Review the VPC Flow Logs for the instance's network interface.

Question 3

A company stores critical data in an S3 bucket and wants to be notified immediately when any object is deleted from the bucket. Which combination of services should the SysOps administrator use?

Accepted Answer

Configure an S3 event notification for 's3:ObjectRemoved:*' events to send to an SNS topic.. S3 event notifications can be configured to trigger on 's3:ObjectRemoved:*' events, which cover both permanent and versioned object deletions. These notifications can be sent directly to an SNS topic, enabling immediate notification without additional compute or logging overhead. This is the simplest and most direct approach for real-time alerts on object deletions.

Answer

Enable S3 server access logging and send logs to CloudWatch Logs, then create a metric filter and alarm.

Answer

Use S3 event notifications to invoke a Lambda function that checks the object and sends an email.

Answer

Use AWS CloudTrail to log DeleteObject calls and create a CloudWatch Events rule to send an SNS notification.

Question 4

A company is using an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. The SysOps administrator notices that the scaling is not triggering as expected. Which THREE steps should the administrator take to troubleshoot the issue?

Accepted Answer

Check the scaling activity history in the Auto Scaling group for any errors or cooldown periods.. The scaling activity history provides a log of all scaling actions, including errors, cooldown periods, and why a scaling event was or was not triggered. By reviewing this history, the administrator can identify if the scaling policy was blocked by a cooldown period, if the alarm state was not reached, or if there were any configuration errors that prevented the scaling action from executing.

Answer

Ensure that the EC2 instances are passing the ELB health checks.

Answer

Manually increase the desired capacity to see if the scaling policy takes effect.

Question 5

A SysOps administrator wants to be alerted when the root user of the AWS account signs in. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including root user sign-ins, as `RootLogin` events in the management events trail. Option D is correct because Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches these CloudTrail log events and triggers a notification action, such as sending an SNS alert, when the root user signs in.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 6

Refer to the exhibit. A SysOps administrator runs the AWS CLI command shown. The output shows that the CPUUtilization average over the period is 75%. However, the administrator knows that the instance was idle for the first 15 minutes of the hour. Which explanation best describes why the average might be misleading?

Accepted Answer

The average statistic over a period of 300 seconds can smooth out spikes, and the overall average of 75% may be due to a high spike after the idle period.. The average statistic over a 300-second period can smooth out brief but intense spikes in CPU utilization. In this scenario, the instance was idle for the first 15 minutes, so the average of 75% over the entire hour must be driven by a very high CPU spike later in the period. The period of 300 seconds aggregates data into 5-minute intervals, which can mask the idle period and make the overall average misleading.

Answer

The period is too long; a shorter period like 60 seconds would show more granular data.

Answer

The command should include --unit Percent to get accurate data.

Answer

The --statistics parameter should be set to 'Sum' to capture total usage.

Question 7

Refer to the exhibit. An EC2 instance is running the CloudWatch Logs agent and uses the IAM policy shown. The agent is configured to send logs to the log group 'MyAppLogGroup'. However, logs are not appearing. What is the MOST likely cause?

Accepted Answer

The policy is missing permission to create the log group if it does not exist.. The CloudWatch Logs agent cannot automatically create a log group; it requires explicit permission via the `logs:CreateLogGroup` action in the IAM policy. Without this permission, if the log group 'MyAppLogGroup' does not already exist, the agent will fail to send logs, even though the `logs:PutLogEvents` action is allowed. The policy shown only grants `logs:PutLogEvents` and `logs:DescribeLogStreams`, missing the necessary `logs:CreateLogGroup` and `logs:CreateLogStream` actions for initial setup.

Answer

The log group name in the policy does not match the agent configuration.

Answer

The policy does not allow the 'logs:PutLogEvents' action.

Answer

The Resource ARN incorrectly specifies a wildcard after the log group name.

Question 8

Refer to the exhibit. A SysOps administrator deploys this CloudFormation stack. The EC2 instance launches and the web server starts. However, the CloudWatch alarm does not trigger even when CPU utilization exceeds 80%. What is the MOST likely reason?

Accepted Answer

The alarm statistic should be 'Maximum' instead of 'Average' to catch CPU spikes that may not sustain the average above 80% for 5 minutes.. The alarm is configured with the 'Average' statistic, which smooths out CPU utilization over the 5-minute period. If CPU utilization spikes above 80% but does not sustain an average above that threshold for the entire duration, the alarm will not trigger. Using the 'Maximum' statistic would catch any single data point exceeding 80% within the period, making it appropriate for detecting short-lived spikes.

Answer

The alarm action is missing a valid SNS topic ARN.

Answer

The alarm dimension is incorrect; it should use the instance's private IP.

Answer

The user data script fails to start the web server, causing the instance to be unhealthy.

Question 9

A company uses AWS CloudTrail to log API calls in a multi-account environment. The security team wants to be alerted when an IAM user in the production account modifies a security group to allow inbound SSH from 0.0.0.0/0. Which combination of actions should be taken to meet this requirement?

Accepted Answer

Stream CloudTrail logs to CloudWatch Logs, create a metric filter for the specific API call, and set a CloudWatch Alarm that sends a notification to an SNS topic.. CloudTrail logs can be streamed to CloudWatch Logs, where a metric filter can be created to match the specific API call (e.g., AuthorizeSecurityGroupIngress with a CIDR of 0.0.0.0/0 and port 22). A CloudWatch Alarm based on that metric can then trigger an SNS notification, providing a real-time alert for the exact security group modification.

Answer

Use AWS Config managed rule 'restricted-ssh' to detect the security group change and trigger an SNS notification.

Answer

Enable AWS Security Hub and configure a custom insight to detect the security group modification.

Answer

Create an AWS Lambda function that is triggered by CloudTrail events and publishes to SNS.

Question 10

A SysOps administrator notices that an EC2 instance's CPU utilization has been at 100% for the past hour. The administrator checks CloudWatch metrics and sees no anomalies in network or disk I/O. Which step should the administrator take to investigate further?

Accepted Answer

Enable detailed monitoring on the EC2 instance to get 1-minute CloudWatch metrics.. Detailed monitoring (1-minute metrics) provides higher-resolution data than the default 5-minute metrics, allowing the administrator to identify short-lived CPU spikes or patterns that might be averaged out in the standard 5-minute interval. Since network and disk I/O appear normal, the issue is likely a process or application consuming CPU, and finer-grained metrics help pinpoint the timing and correlate with specific events or logs.

Answer

Install the CloudWatch Logs agent on the instance to capture system logs.

Answer

Check the EC2 instance's CPU credit balance in CloudWatch.

Answer

Stop the EC2 instance and start it again to reset the CPU.

Question 11

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The function fails intermittently with a timeout error. What should the SysOps administrator do to monitor and resolve this issue?

Accepted Answer

Increase the Lambda function timeout and review the function logs in CloudWatch Logs.. Increasing the Lambda function timeout directly addresses the intermittent timeout error by allowing the function more time to complete execution before Lambda terminates it. Reviewing CloudWatch Logs is essential to identify the root cause, such as slow downstream dependencies or inefficient code, enabling targeted optimization. This approach aligns with standard troubleshooting for Lambda timeout issues.

Answer

Place the S3 bucket in a different AWS region to reduce latency.

Answer

Enable provisioned concurrency for the Lambda function.

Answer

Configure EC2 Auto Scaling to launch more instances for the Lambda function.

Question 12

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator needs to be notified if the ALB's error rate exceeds 5% for 5 consecutive minutes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use a CloudWatch alarm on the ALB's 'HTTPCode_ELB_5XX_Count' metric with a math expression to calculate error rate.. CloudWatch can directly monitor the ALB's 'HTTPCode_ELB_5XX_Count' metric and combine it with the 'RequestCount' metric using a math expression to calculate the error rate as a percentage. This approach requires no additional logging or external services, and a CloudWatch alarm can be configured to trigger an SNS notification when the error rate exceeds 5% for 5 consecutive minutes, minimizing operational overhead.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena to detect error rates.

Answer

Enable CloudTrail for the ALB and create a metric filter for 5xx errors.

Answer

Use AWS Config rules to monitor the ALB configuration and trigger a notification on changes.

Question 13

A SysOps administrator is troubleshooting an EC2 instance that is unresponsive. The administrator can SSH into the instance but finds that the CloudWatch agent is not sending custom metrics. The CloudWatch agent configuration file is at '/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'. What should the administrator check first?

Accepted Answer

Verify that the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy.. The correct first check is to verify the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy. The CloudWatch agent uses the instance's IAM role to obtain credentials for publishing metrics to CloudWatch. Without this policy, the agent will fail to send custom metrics even if it is running correctly and the instance has network connectivity.

Answer

Ensure that the IAM user has permissions to access CloudWatch.

Answer

Check if the security group allows outbound traffic on port 443.

Answer

Run 'sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status' to check the agent status.

Question 14

A company wants to centrally collect and analyze logs from all AWS accounts in an organization. The logs include CloudTrail, VPC Flow Logs, and AWS Config logs. Which solution is the most scalable and cost-effective?

Accepted Answer

Configure each account to deliver logs to a centralized S3 bucket and use Amazon Athena to query them.. It uses a centralized S3 bucket to aggregate logs from all accounts, which is highly scalable and cost-effective due to S3's low storage costs and lifecycle policies. Amazon Athena then allows serverless, pay-per-query analysis of the logs without needing to provision or manage any infrastructure, making it ideal for ad-hoc and cross-account log analysis.

Answer

Stream all logs to a central CloudWatch Logs account using cross-account subscriptions.

Answer

Use CloudWatch Logs Insights to query logs from each account individually.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to an Amazon Elasticsearch Service cluster.

Question 15

A company uses Amazon RDS for MySQL and needs to be alerted when the database's CPU utilization exceeds 80% for 10 minutes. The administrator creates a CloudWatch alarm based on the 'CPUUtilization' metric. However, the alarm does not trigger even though the metric shows values above 80%. What is the most likely cause?

Accepted Answer

The alarm is configured to use the 'Maximum' statistic, but the metric chart shows 'Average'.. The CloudWatch alarm is configured to use the 'Maximum' statistic, while the metric chart displays the 'Average' statistic. If the CPU utilization spikes above 80% but the average over the evaluation period remains below 80%, the alarm using 'Maximum' will not trigger. The alarm evaluates the metric based on its configured statistic, not the chart's default view.

Answer

The alarm's period is set to 5 minutes, so it checks only every 5 minutes.

Answer

The RDS instance is in a VPC that does not have internet access.

Answer

The administrator has not enabled Enhanced Monitoring on the RDS instance.