SOA-C02 Monitoring, Logging, and Remediation Practice Test 15 — 15 Questions

Question 1

A SysOps administrator is monitoring an Amazon ECS cluster running Fargate tasks. The administrator wants to receive a notification when any task fails to start due to insufficient memory. Which combination of actions should be taken? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the CloudWatch Events rule to send notifications to an SNS topic.. Amazon CloudWatch Events (now Events) can trigger an SNS notification when a specific ECS task state change occurs. Option C is correct because you can create a CloudWatch Events rule that matches ECS task state changes with a reason of 'RESOURCE:MEMORY', which indicates the task failed to start due to insufficient memory. Together, these actions ensure you receive a notification when a Fargate task fails to start due to memory constraints.

Answer

Enable AWS CloudTrail and create a metric filter for RunTask API calls.

Answer

Create a CloudWatch alarm on the ECS cluster's CPUUtilization metric.

Answer

Enable CloudWatch Logs for the ECS cluster and filter for error messages.

Question 2

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified when a stack creation fails. Which solution meets this requirement with the LEAST effort?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's 'NotificationARNs' parameter.. CloudFormation natively supports specifying an SNS topic in the 'NotificationARNs' parameter, which automatically sends notifications on stack events such as creation failure. This requires no additional infrastructure, scripting, or monitoring setup, making it the least-effort solution.

Answer

Create a CloudWatch alarm that triggers when the CloudFormation stack status is 'CREATE_FAILED'.

Answer

Use AWS CloudTrail to monitor CreateStack API calls and trigger an SNS notification.

Answer

Write a custom script that polls the CloudFormation API every minute and sends an SNS notification on failure.

Question 3

A SysOps administrator needs to centrally collect operating system-level metrics from a fleet of Amazon EC2 instances running Amazon Linux 2. The metrics should include memory usage and disk I/O. Which solution should the administrator implement?

Accepted Answer

Install and configure the CloudWatch agent on the EC2 instances.. The CloudWatch agent is the correct solution because it can collect custom OS-level metrics such as memory usage and disk I/O from EC2 instances running Amazon Linux 2. Unlike the default CloudWatch metrics, which only capture hypervisor-level metrics (e.g., CPU, network), the CloudWatch agent uses the procstat and disk plugins to gather detailed system metrics and publish them to CloudWatch as custom namespaces.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log OS-level metrics.

Answer

Use AWS Systems Manager Inventory to collect metrics.

Question 4

A company wants to automatically remediate an Amazon EC2 instance that becomes unresponsive by rebooting it. The solution should use AWS managed services to minimize custom code. Which combination should a SysOps administrator use? (Choose TWO.)

Accepted Answer

Amazon CloudWatch alarm on EC2 status check failures. Amazon CloudWatch can monitor EC2 status check failures (both system and instance checks) and trigger an alarm. When the alarm enters the ALARM state, it can directly invoke an AWS Systems Manager Automation document to reboot the instance, which is a managed, code-free remediation approach. This combination minimizes custom code by using built-in AWS services.

Answer

Amazon EC2 Auto Scaling and lifecycle hooks

Answer

Amazon CloudWatch alarm and AWS Lambda function

Answer

Amazon EventBridge rule to trigger an SNS notification

Question 5

A SysOps administrator is troubleshooting an application that intermittently fails to connect to an RDS database. The error logs show 'Too many connections'. What CloudWatch metric should the administrator monitor to proactively detect this issue?

Accepted Answer

DatabaseConnections. The 'Too many connections' error indicates that the RDS database has reached its maximum allowed number of simultaneous client connections. The DatabaseConnections CloudWatch metric tracks the current number of connections to the DB instance, so monitoring this metric allows the administrator to set an alarm when connections approach the instance's max_connections limit, enabling proactive scaling or connection management before errors occur.

Answer

CPUUtilization

Answer

NetworkThroughput

Answer

FreeableMemory

Question 6

A company uses CloudWatch Logs to store application logs from EC2 instances. The SysOps team needs to search for specific error patterns across all log groups. What is the most efficient way to perform this search?

Accepted Answer

Use CloudWatch Logs Insights to run a query across the log groups.. CloudWatch Logs Insights is purpose-built for ad-hoc querying and analysis of log data across multiple log groups. It allows you to run SQL-like queries (using a query language) to search for specific patterns, filter results, and aggregate data without needing to set up additional infrastructure. This is the most efficient method for the SysOps team's requirement because it provides immediate, interactive search capabilities directly within the AWS Management Console or via the AWS CLI.

Answer

Define a CloudWatch metric filter to count errors and view the metric.

Answer

Create a subscription filter to stream logs to Amazon ES and use Kibana.

Answer

Export the logs to Amazon S3 and use S3 Select to search.

Question 7

A company wants to receive an email notification when an EC2 instance's status check fails. What AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarm. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending an email via Amazon SNS, when a status check fails. This is the correct service because it directly integrates with EC2 metrics and supports alarm-based notifications for status check failures.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 8

A SysOps administrator needs to ensure that all S3 buckets in the account have server access logging enabled. The administrator wants to be notified if a bucket is created without logging. What is the most efficient solution?

Accepted Answer

Use AWS Config with a managed rule to evaluate S3 buckets for server access logging.. AWS Config with the managed rule 's3-bucket-server-access-logging-enabled' continuously evaluates all S3 buckets against the desired configuration. When a bucket is created without server access logging, AWS Config automatically flags it as noncompliant and can trigger an SNS notification. This is the most efficient solution because it provides ongoing, automated compliance monitoring without requiring custom scripts or event-driven remediation.

Answer

Periodically run a script to list all buckets and check logging configuration.

Answer

Enable S3 event notifications on the bucket creation event and trigger a Lambda function.

Answer

Use CloudWatch Events to detect CreateBucket API calls and trigger a Lambda function.

Question 9

An application running on Amazon ECS (Fargate) is experiencing intermittent failures. The logs show 'CannotPullContainerError: error pulling image configuration: download failed after attempts=6'. The SysOps team has verified that the image exists in Amazon ECR and the task role has permissions to pull from ECR. What is the most likely cause?

Accepted Answer

The ECS tasks are in a private subnet without a NAT gateway or VPC endpoints for ECR and S3.. The error 'CannotPullContainerError: error pulling image configuration: download failed after attempts=6' indicates that the ECS task is unable to download the image layers from Amazon ECR. Since the image exists and the task role has permissions, the most likely cause is a network connectivity issue. When ECS tasks run in a private subnet without a NAT gateway or VPC endpoints for ECR and S3, they cannot reach the public ECR API endpoints or the S3 buckets that store image layers, causing the pull to fail after multiple retries.

Answer

The container image is corrupted.

Answer

The ECR repository policy is not allowing the task role.

Answer

The ECS task definition has an incorrect memory allocation.

Question 10

A SysOps administrator wants to receive alerts when the root user performs an action in the AWS account. Which service should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail captures all API calls made by the root user as events. By sending these events to Amazon CloudWatch Logs, you can create a metric filter that matches root user activity and trigger an alarm via CloudWatch Alarms. This combination enables real-time notification when the root user performs any action.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon CloudWatch Metrics

Answer

AWS Config

Question 11

An organization wants to ensure that all changes to an S3 bucket policy are logged and immediately trigger a notification to the security team. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutBucketPolicy API call and triggers an SNS topic.. CloudWatch Events (now Amazon EventBridge) can capture the PutBucketPolicy API call via a service-specific event pattern and route it to an SNS topic for immediate notification. This approach is the most efficient as it directly monitors the API call in real-time without polling or additional configuration, ensuring the security team is alerted the moment the policy changes.

Answer

Create a CloudWatch Alarm that monitors the S3 bucket's policy.

Answer

Use AWS Config with a managed rule to detect policy changes.

Answer

Enable S3 event notifications on the bucket for 'PutBucketPolicy' events.

Question 12

A SysOps administrator is troubleshooting a slow-running RDS MySQL instance. The administrator notices that the ReadIOPS metric is consistently high, but the WriteIOPS is low. The instance type is db.m5.large with 300 GB of General Purpose SSD (gp2). What is the most likely cause?

Accepted Answer

The gp2 volume is experiencing I/O credit exhaustion.. A db.m5.large instance with 300 GB of gp2 storage has a baseline IOPS of 900 (3 IOPS per GB) and a burst balance of 5.4 million I/O credits. With consistently high ReadIOPS and low WriteIOPS, the volume is likely exhausting its I/O credit balance, causing performance throttling. This is a classic symptom of gp2 I/O credit exhaustion, where read-heavy workloads deplete the burst bucket, leading to degraded performance.

Answer

The instance type is too small for the workload.

Answer

The database is experiencing write contention.

Answer

The network bandwidth is insufficient.

Question 13

A company is using Amazon CloudWatch Logs to collect logs from multiple AWS services. The SysOps administrator needs to query logs across multiple log groups in real-time. Which THREE of the following are capabilities of CloudWatch Logs Insights?

Accepted Answer

Run queries in real-time against incoming log data.. CloudWatch Logs Insights supports real-time queries against incoming log data, allowing you to analyze logs as they are ingested. This is enabled by its ability to query live streams without requiring data to be indexed first, making it suitable for real-time troubleshooting and monitoring.

Answer

Export query results directly to an S3 bucket.

Answer

Schedule queries to run at a specific time.

Question 14

Refer to the exhibit. A SysOps administrator runs the CloudWatch Logs Insights query shown. What does this query do?

Accepted Answer

Counts the number of ERROR and FATAL log entries per 5-minute interval and displays them in descending order by time.. The CloudWatch Logs Insights query uses `stats count(*) by bin(5m)` to aggregate log events into 5-minute time buckets, then filters with `filter @message like /ERROR|FATAL/` to include only those severity levels. The `sort @timestamp desc` orders the resulting time buckets in descending chronological order, producing a count of ERROR and FATAL entries per 5-minute interval. This matches option B exactly.

Answer

Groups ERROR and FATAL entries by log stream name.

Answer

Displays the full log messages of all ERROR and FATAL entries.

Answer

Deletes all log entries containing ERROR or FATAL older than 5 minutes.

Question 15

Refer to the exhibit. A SysOps administrator creates the CloudWatch Alarm shown. However, the alarm never enters ALARM state even though the CPU utilization of the EC2 instance is consistently above 90%. What is the most likely reason?

Accepted Answer

The alarm is missing the InstanceId dimension.. The alarm never enters ALARM state because it is missing the required `InstanceId` dimension. CloudWatch metrics for EC2, such as `CPUUtilization`, are published with the `InstanceId` dimension to uniquely identify the data stream. Without specifying this dimension in the alarm configuration, CloudWatch cannot match the alarm to the metric data emitted by the EC2 instance, so the alarm remains in INSUFFICIENT_DATA or OK state regardless of actual CPU usage.

Answer

The threshold is set too high; it should be 80%.

Answer

The evaluation periods are too few.

Answer

The statistic should be Maximum instead of Average.