SOA-C02 Monitoring, Logging, and Remediation Practice Test 15 — 15 Questions

Question 1

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail event history.. AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Answer

AWS IAM credential report.

Question 2

A company has an Auto Scaling group of EC2 instances behind an Application Load Balancer. The SysOps administrator notices that the healthy host count is lower than expected. The instances are in service, and security groups allow traffic. What is a likely cause?

Accepted Answer

The health check path is returning HTTP 503.. The correct answer is C because a health check path returning HTTP 503 (Service Unavailable) indicates that the target instances are reachable but the application is failing to respond correctly. The Application Load Balancer (ALB) marks instances as unhealthy when the health check receives any non-2xx or non-3xx response, which reduces the healthy host count even though the instances are in service and security groups are properly configured.

Answer

The instances are not registered with the target group.

Answer

The security group for the load balancer does not allow inbound traffic.

Answer

The target group is not associated with the load balancer.

Question 3

A SysOps administrator wants to be alerted when an EC2 instance's status check fails. The instance is part of an Auto Scaling group. What is the BEST approach?

Accepted Answer

Create a CloudWatch alarm on the 'StatusCheckFailed' metric.. Option B is correct because the 'StatusCheckFailed' metric is automatically published by EC2 to CloudWatch, and a CloudWatch alarm on this metric can directly trigger an SNS notification or other action when the status check fails. This is the simplest and most reliable method for alerting on instance health, regardless of whether the instance is in an Auto Scaling group.

Answer

Use Amazon EventBridge to detect status check failures.

Answer

Enable CloudTrail to monitor EC2 instance status changes.

Answer

Configure an Auto Scaling lifecycle hook to send a notification.

Question 4

An application running on EC2 instances sends custom metrics to CloudWatch using the PutMetricData API. The metrics are not appearing in the CloudWatch console. The IAM role attached to the instances has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*" } ] }. What is the most likely cause?

Accepted Answer

The metric data is being sent to a different AWS region.. The most likely cause is that the metric data is being sent to a different AWS region than the one displayed in the CloudWatch console. The PutMetricData API call includes a regional endpoint, and if the EC2 instance is configured to send metrics to a region other than the one you are viewing, the metrics will not appear. The IAM policy correctly allows the action, so authentication is not the issue.

Answer

The metric timestamp is older than 14 days.

Answer

The metric namespace must start with 'AWS/'.

Answer

The IAM policy does not allow the 'cloudwatch:PutMetricData' action.

Question 5

A SysOps administrator is setting up monitoring for an RDS MySQL database. The administrator needs to be notified when the database connection count exceeds 100. Which steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.. Option A is correct because Amazon CloudWatch alarms can send notifications to an Amazon SNS topic when the alarm state changes. This allows the SysOps administrator to receive alerts (e.g., via email, SMS, or HTTP) when the database connection count exceeds the threshold. Option B is correct because the 'DatabaseConnections' metric is a standard CloudWatch metric for RDS MySQL that tracks the number of current connections to the database instance. Creating an alarm on this metric with a threshold of 100 will trigger when the connection count exceeds that value.

Answer

Enable Enhanced Monitoring for RDS.

Answer

Enable CloudTrail to log RDS API calls.

Answer

Create an Amazon EventBridge rule that triggers on RDS events.

Question 6

A company has a centralized logging solution where CloudTrail logs from multiple accounts are delivered to a single S3 bucket. The security team needs to be alerted when an IAM user is created in any of the accounts. Which steps should be taken? (Choose THREE.)

Accepted Answer

Create a CloudWatch Logs metric filter for 'CreateUser' event.. Option A is correct because a CloudWatch Logs metric filter can parse CloudTrail logs delivered to CloudWatch Logs and match the 'CreateUser' event pattern. This filter creates a metric that can be used to trigger an alarm. Option B is correct because CloudTrail must be configured to deliver logs to CloudWatch Logs in each account so that the metric filter can be applied to the log group. Option E is correct because a CloudWatch alarm on the metric filter can publish to an SNS topic, which sends notifications (e.g., email, SMS) to the security team when an IAM user is created.

Answer

Create an AWS Config rule to detect IAM user creation.

Answer

Configure S3 event notification on the central bucket to trigger a Lambda function.

Question 7

A SysOps administrator needs to track changes to security group rules in a VPC. Which AWS services can be used to monitor and log these changes? (Choose TWO.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to the Amazon EC2 service, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and CreateSecurityGroup. These events capture the identity, source IP, and timestamp of every change to security group rules, providing an audit trail for compliance and troubleshooting.

Answer

VPC Flow Logs.

Answer

AWS Trusted Advisor.

Answer

Amazon CloudWatch Logs.

Question 8

Refer to the exhibit. A Lambda function is unable to write logs to CloudWatch Logs. The IAM role attached to the Lambda function includes the policy shown. What is the issue?

Accepted Answer

The resource ARN does not include a log-stream component.. The Lambda function's IAM policy grants permissions for `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` on the resource ARN `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:*`. However, this ARN only specifies the log group and a wildcard for log streams, which is insufficient for the `logs:PutLogEvents` action. The `logs:PutLogEvents` action requires a resource ARN that includes a specific log-stream component (e.g., `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:log-stream:*`), because the API call targets a particular log stream within the log group. Without this, the Lambda function cannot write logs, resulting in a permissions error.

Answer

The log group name is incorrect.

Answer

The policy effect is Deny.

Answer

The 'logs:PutLogEvents' action is not allowed.

Question 9

Refer to the exhibit. A SysOps administrator runs the command and sees the output. The administrator then creates a CloudWatch alarm on the CPUUtilization metric for this instance, but the alarm state remains 'INSUFFICIENT_DATA'. What is a likely cause?

Accepted Answer

The EC2 instance is stopped or terminated.. The command output shows the instance state is 'stopped'. CloudWatch cannot retrieve metrics from a stopped or terminated EC2 instance because the hypervisor is no longer running the instance's operating system or collecting CPU utilization data. When no metric data points are received for the configured alarm period, the alarm transitions to 'INSUFFICIENT_DATA' state.

Answer

Detailed monitoring is not enabled.

Answer

The instance is in a different AWS region.

Answer

The metric name is misspelled.

Question 10

Refer to the exhibit. A SysOps administrator runs the command to find 'CreateKeyPair' events in January 2023 but gets an empty list. The administrator knows that key pairs were created during that time. What is the most likely reason?

Accepted Answer

The events occurred in a different AWS region.. The `aws cloudtrail lookup-events` command returns events only from the region specified in the AWS CLI configuration (or the `--region` parameter). If the administrator did not specify a region, the command defaults to the region set in the CLI profile. Since `CreateKeyPair` events are regional (each key pair is created in a specific region), the empty result indicates the events occurred in a different AWS region than the one queried.

Answer

The start and end times are outside the 90-day retention period.

Answer

CloudTrail is not enabled in the account.

Answer

The IAM user does not have 'cloudtrail:LookupEvents' permission.

Question 11

A company is experiencing intermittent performance issues with an application running on an EC2 instance. The CloudWatch metrics show high CPU utilization but no correlation with the timing of the issue. The SysOps administrator needs to collect detailed performance data to identify the root cause. Which AWS service should the administrator use to capture network-level metrics and logs?

Accepted Answer

Enable VPC Flow Logs for the EC2 instance's subnet.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) at the network interface level, which is essential for diagnosing network-related performance issues. Since the problem is intermittent and uncorrelated with CPU, network-level metrics can reveal issues like packet loss, throttling, or latency that application logs or CPU metrics alone cannot. This directly addresses the need for detailed network-level data.

Answer

Configure a CloudWatch Logs agent on the instance to send application logs.

Answer

Use AWS CloudTrail to log all API calls made to the instance.

Answer

Enable AWS Config to track configuration changes to the instance.

Question 12

A SysOps administrator receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group behind an Application Load Balancer. The administrator needs to ensure that the instance is automatically replaced and that the root cause is investigated. What is the MOST efficient combination of actions to achieve this?

Accepted Answer

Configure an Auto Scaling lifecycle hook to terminate the unhealthy instance and send the instance system log to an S3 bucket for analysis.. Option A is correct because it combines automatic instance replacement via the Auto Scaling group's health check (which marks the instance unhealthy and terminates it) with a lifecycle hook that captures the instance's system log before termination and sends it to S3 for root cause analysis. This is the most efficient approach as it requires no manual intervention and preserves diagnostic data.

Answer

Create a CloudWatch alarm that triggers an SNS notification to the administrator to manually replace the instance.

Answer

Reboot the instance from the AWS Management Console and then review CloudTrail logs.

Answer

Manually stop and start the instance to recover it, then check the system logs.

Question 13

A company needs to monitor for unauthorized changes to critical IAM policies. The SysOps administrator must receive notifications within minutes of any change. Which combination of AWS services should the administrator use?

Accepted Answer

Use AWS CloudTrail to log IAM changes, and create a CloudWatch Events rule that triggers an SNS notification when specific API calls are made.. Option B is correct because CloudTrail logs API calls to IAM, and a CloudWatch Events rule (now EventBridge) can trigger an SNS notification for specific API calls. Option A is incorrect because AWS Config evaluates resource configurations but is not the best for real-time notifications. Option C is incorrect because CloudWatch Logs does not directly monitor API calls. Option D is incorrect because Lambda alone cannot monitor without a trigger.

Answer

Use AWS Config rules to detect changes and send notifications via SNS.

Answer

Use CloudWatch Logs to monitor IAM activity and create a metric filter to trigger an alarm.

Answer

Use a Lambda function that periodically checks IAM policies and sends an SNS message if changes are detected.

Question 14

A SysOps administrator notices that an RDS instance's CPU utilization is consistently above 80% during peak hours. The administrator wants to set up automated actions to scale the database and also notify the team. What should the administrator do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization that triggers a Lambda function to modify the RDS instance class to a larger size.. Option C is correct because it uses a CloudWatch alarm on CPU utilization to trigger a Lambda function, which can programmatically call the ModifyDBInstance API to scale the RDS instance class up during peak hours. This provides automated, event-driven scaling based on actual utilization, and the same alarm can be configured to send an SNS notification to the team. This approach is flexible and allows custom logic in Lambda, such as checking current metrics before scaling.

Answer

Configure a scheduled scaling action to change the instance class during peak hours.

Answer

Add the RDS instance to an Auto Scaling group.

Answer

Enable RDS Auto Scaling for the instance.

Question 15

An application running on EC2 instances occasionally throws 'Connection refused' errors when connecting to an RDS database. The SysOps administrator needs to determine if the issue is due to database connection limits or network security groups. Which metrics and logs should the administrator examine?

Accepted Answer

Examine the RDS CloudWatch metric DatabaseConnections and analyze VPC Flow Logs for the EC2 instance's network interface.. Option D is correct because 'Connection refused' errors typically stem from either the database exhausting its maximum connections or network-level security groups blocking traffic. The RDS CloudWatch metric `DatabaseConnections` directly shows the current number of active connections against the instance's `max_connections` limit, while VPC Flow Logs capture whether packets are being accepted or rejected by security groups or network ACLs, pinpointing network blockages.

Answer

Check CloudWatch RDS CPUUtilization and CloudTrail logs for RDS API calls.

Answer

Review RDS error logs in CloudWatch Logs and check the EC2 instance's system log.

Answer

Look at the EC2 instance's CloudWatch NetworkIn and NetworkOut metrics and RDS FreeableMemory metric.