SOA-C02 Monitoring, Logging, and Remediation Practice Test 15 — 15 Questions

Question 1

A company has deployed a web application on EC2 instances with an Auto Scaling group. The SysOps administrator needs to automatically replace any instance that is in a 'failed' status as reported by the EC2 status checks. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Auto Scaling group to use EC2 status checks for health checks.. An Auto Scaling group can be configured to use EC2 status checks (both system and instance) as the health check type. When the status check reports a failed status, the Auto Scaling group automatically terminates the unhealthy instance and launches a new one to replace it, ensuring self-healing without manual intervention.

Answer

Create an AWS Config rule to detect failed status checks and trigger a remediation action.

Answer

Create an AWS Lambda function that stops and starts the failed instance.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and trigger an SNS notification.

Question 2

A SysOps administrator receives a notification that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. What is the immediate impact on the application?

Accepted Answer

The Auto Scaling group will launch a new instance to replace the failed one, potentially causing temporary downtime.. When an EC2 instance fails a status check, the Auto Scaling group detects the failure and initiates a replacement by launching a new instance. However, the failed instance is not immediately terminated; it may remain in a stopped or impaired state until the replacement is fully in service, which can cause temporary downtime for the application if the instance was actively handling traffic.

Answer

The instance is still accessible and serving traffic.

Answer

The instance is immediately terminated.

Answer

The instance is automatically stopped and started.

Question 3

A SysOps administrator needs to receive alerts when an S3 bucket is publicly accessible. Which TWO AWS services can be used to monitor and detect this configuration?

Accepted Answer

AWS Security Hub. AWS Security Hub (B) is correct because it aggregates security findings from multiple AWS services, including Amazon GuardDuty and AWS Config, and can detect publicly accessible S3 buckets via its built-in security standards (e.g., CIS AWS Foundations Benchmark). AWS Config (D) is correct because it can evaluate S3 bucket configurations against rules, such as the managed rule 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited', and trigger alerts when a bucket becomes publicly accessible.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Question 4

A company uses CloudWatch Logs to monitor application logs. The SysOps administrator wants to search for specific error patterns across multiple log groups. Which THREE AWS services can be used to achieve this?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is correct because it is a native AWS service designed specifically for querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) across multiple log groups to search for specific error patterns, making it a direct and efficient solution for this use case without requiring data export or additional infrastructure.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Question 5

A SysOps administrator notices that an EC2 instance's CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a CPU utilization-based scaling policy. However, no new instances have been launched. What is the most likely cause?

Accepted Answer

The Auto Scaling cooldown period is preventing additional scaling activities.. The most likely cause is that the Auto Scaling cooldown period is preventing additional scaling activities. When a scaling activity completes, a cooldown period (default 300 seconds) starts during which the Auto Scaling group ignores additional CloudWatch alarms to allow metrics to stabilize. If the instance has been above 90% CPU for an hour but no new instances launched, the cooldown period may have been triggered by a previous scaling event and is still active, blocking further scale-out actions despite sustained high utilization.

Answer

The EC2 instance is in a private subnet and cannot communicate with the Auto Scaling service.

Answer

The CloudWatch alarm is publishing to an S3 bucket that is full.

Answer

The scaling policy is based on memory utilization, not CPU.

Question 6

A company has an application running on EC2 instances behind an Application Load Balancer. They want to receive an email notification when the average latency exceeds 2 seconds. Which combination of steps should the SysOps administrator take? (Select TWO.)

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when a metric threshold is breached. By creating an SNS topic and subscribing an email endpoint to it, the SysOps administrator can receive email alerts when the alarm state changes, such as when the average latency exceeds 2 seconds.

Answer

Enable AWS CloudTrail to capture API calls and monitor latency.

Answer

Use CloudWatch Logs to stream logs to Amazon ES for latency analysis.

Answer

Create a CloudWatch alarm on the EC2 instance's CPUUtilization metric.

Question 7

A SysOps administrator creates this IAM policy for a monitoring application. The application needs to publish custom metrics to CloudWatch and retrieve information about EC2 instances and Auto Scaling groups. The application reports that it cannot list EC2 instances. What is the most likely reason?

Accepted Answer

The policy uses a wildcard for the ec2:Describe action; it should specify ec2:DescribeInstances.. The policy specifies 'ec2:Describe' as an action, but 'ec2:Describe' is not a valid IAM action. IAM does support wildcards in action names (e.g., 'ec2:Describe*'), but without a wildcard or a specific action like 'ec2:DescribeInstances', the policy grants no EC2 Describe permissions. Therefore, the application cannot list EC2 instances.

Answer

The policy does not grant access to the us-east-1 region.

Answer

The policy is missing the cloudwatch:PutMetricData action for the monitoring application.

Answer

The policy should include ec2:DescribeTags to list instances.

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer. The SysOps administrator creates a CloudWatch alarm on the ALB's HTTPCode_ELB_5XX_Count metric to trigger an SNS notification when there are many 5xx errors. However, the alarm remains in INSUFFICIENT_DATA state. What is a likely cause?

Accepted Answer

The ALB and the CloudWatch alarm are in different AWS Regions.. CloudWatch alarms can only evaluate metrics from the same AWS Region in which the alarm is created. If the ALB and the CloudWatch alarm are in different Regions, the alarm will never receive metric data points, causing it to remain in INSUFFICIENT_DATA state. This is a common cross-Region limitation for CloudWatch metrics.

Answer

The HTTPCode_ELB_5XX_Count metric is not available for ALBs.

Answer

The IAM role for CloudWatch does not have permission to read the ALB metrics.

Answer

The alarm's period is set to 1 minute, but the metric is published every 5 minutes.

Question 9

A SysOps administrator needs to ensure that all S3 buckets in the account are logged to CloudTrail for data events. The administrator enables CloudTrail with data events for S3 and selects 'All buckets' in the current account. However, after a week, they notice that some buckets are not being logged. What is the most likely reason?

Accepted Answer

The S3 buckets are in a different AWS Region from the CloudTrail trail.. The most likely reason some buckets are not being logged is that those buckets reside in a different AWS Region than the one where the CloudTrail trail is configured. If the administrator creates a single-region trail and selects ‘All buckets’ for data events, the trail will only capture data events for S3 buckets in that specific region. Buckets in other regions will not be logged, resulting in partial logging coverage. Option C correctly identifies this regional mismatch.

Answer

The IAM user who created the trail does not have s3:PutObject permissions on the buckets.

Answer

The S3 buckets do not have a bucket policy that allows CloudTrail to write the log files.

Answer

The S3 buckets have server access logging enabled, which conflicts with CloudTrail logging.

Question 10

A company has an application that writes logs to CloudWatch Logs. The SysOps administrator needs to search for a specific error pattern across multiple log groups. Which solution is the most efficient?

Accepted Answer

Use CloudWatch Logs Insights to query the log groups.. CloudWatch Logs Insights is purpose-built for interactive ad-hoc querying of log data across multiple log groups, enabling efficient pattern matching and filtering without requiring pre-configured infrastructure. It uses a dedicated query language optimized for searching, aggregating, and analyzing log events, making it the most efficient solution for searching a specific error pattern across multiple log groups.

Answer

Create a CloudWatch dashboard to visualize log data.

Answer

Create a metric filter to count the error pattern.

Answer

Create a subscription filter to stream logs to Amazon ES.

Question 11

A SysOps administrator is troubleshooting an issue where an EC2 instance's CloudWatch agent is not sending memory metrics. The agent is installed and configured to collect memory metrics. The IAM role attached to the instance has the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "cloudwatch:PutMetricData",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cloudwatch:ListMetrics",
      "Resource": "*"
    }
  ]
}

What is the most likely reason the memory metrics are not appearing?

Accepted Answer

The IAM role is missing the ssm:GetParameter permission.. The IAM policy includes cloudwatch:PutMetricData and cloudwatch:ListMetrics, but if the CloudWatch agent retrieves its memory metrics configuration from Systems Manager Parameter Store (a common setup), the instance requires the ssm:GetParameter permission. Without this permission, the agent cannot fetch the configuration, and memory metrics will not be sent. Therefore, option C correctly identifies the missing IAM permission.

Answer

The CloudWatch agent requires the SSM Agent to be installed.

Answer

The CloudWatch agent must be configured to send metrics to CloudWatch Logs first.

Answer

Detailed monitoring must be enabled on the EC2 instance.

Question 12

A SysOps administrator wants to be notified when an Auto Scaling group launches a new instance. Which AWS service can be used to capture the Auto Scaling lifecycle events and send a notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS is the correct choice because it can receive lifecycle notifications from Auto Scaling groups via Amazon EventBridge (formerly CloudWatch Events) and then deliver those notifications to subscribers (e.g., email, SMS, HTTP endpoints). Auto Scaling groups emit lifecycle events (e.g., `EC2 Instance-launch Lifecycle Action`) that can be captured by EventBridge rules, which then invoke an SNS topic to send the notification.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 13

A company uses AWS CloudFormation to deploy a stack that includes an EC2 instance and an S3 bucket. The SysOps administrator needs to monitor the stack for any changes to the S3 bucket's bucket policy. Which AWS service should be used?

Accepted Answer

AWS Config. AWS Config is the correct service because it can track changes to S3 bucket policies, evaluate them against desired configurations, and trigger notifications or remediation. AWS CloudTrail logs API calls that modify bucket policies but does not monitor the policy state itself. Amazon CloudWatch is used for monitoring metrics and logs, not for tracking configuration changes. AWS Trusted Advisor provides best practice recommendations and does not monitor bucket policies.

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 14

A SysOps administrator examines the output of the describe-alarms command for the 'HighCPU' alarm. The alarm is in ALARM state. What action will be taken automatically?

Accepted Answer

Send a notification to an SNS topic.. The 'HighCPU' alarm is a CPU utilization metric alarm. EC2 instance recovery actions are only valid for alarms based on StatusCheckFailed metrics, not for CPU alarms. Without specific configuration indicating an Auto Scaling policy, the most common automatic action for a CPU alarm is to send a notification to an SNS topic if one is configured. Therefore, the correct answer is D.

Answer

Recover the EC2 instance using EC2 instance recovery.

Answer

Launch a new EC2 instance in an Auto Scaling group.

Answer

Reboot the EC2 instance.

Question 15

A SysOps administrator needs to create a custom metric to track the number of active connections to an EC2 instance. Which steps should be taken? (Select TWO.)

Accepted Answer

Use the AWS CLI to call put-metric-data and publish the custom metric.. The AWS CLI `put-metric-data` command allows you to publish custom metrics directly to CloudWatch, which is the standard method for sending application-level or OS-level metrics that are not automatically provided by AWS. Option E is correct because the Amazon CloudWatch agent can collect custom metrics from the EC2 instance (e.g., active connection counts from netstat or a script) and publish them to CloudWatch, making it the recommended approach for in-guest metric collection.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Store the metric data in an S3 bucket and configure CloudWatch to read from it.

Answer

Use the EC2 console to enable custom metric collection.