SOA-C02 Monitoring, Logging, and Remediation Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. A SysOps administrator runs the command shown to investigate a CloudWatch alarm named 'HighCPU'. What does the output indicate?

Accepted Answer

The alarm entered the ALARM state and then returned to OK.. The output shows two state transition datapoints: one at timestamp 2021-03-15T10:30:00Z with 'oldState' OK and 'newState' ALARM, and another at 2021-03-15T10:35:00Z with 'oldState' ALARM and 'newState' OK. This sequence confirms the alarm entered the ALARM state and then returned to OK, which is exactly what the describe-alarm-history command reveals when an alarm has experienced a full ALARM-to-OK cycle.

Answer

The alarm was deleted and recreated.

Answer

The alarm is currently in INSUFFICIENT_DATA state.

Answer

The alarm never entered the ALARM state.

Question 2

A SysOps administrator is troubleshooting an issue where an EC2 instance's CPU utilization is consistently above 90%, but no CloudWatch alarm is triggered. The alarm is configured to monitor the 'CPUUtilization' metric with a threshold of 80% for 2 consecutive periods of 5 minutes. What is the most likely cause?

Accepted Answer

The CPU utilization spikes above 80% for less than 10 minutes at a time.. The CloudWatch alarm requires 2 consecutive periods of 5 minutes (i.e., 10 minutes total) where the CPU utilization exceeds 80%. If the CPU utilization spikes above 80% for less than 10 minutes at a time, the alarm will not trigger because it never meets the consecutive evaluation period requirement. The alarm evaluates each 5-minute period independently, and only when both consecutive periods breach the threshold does the alarm state change to ALARM.

Answer

The alarm is in the 'OK' state and not 'INSUFFICIENT_DATA'.

Answer

The CPUUtilization metric is not enabled by default for EC2 instances.

Answer

The alarm period is set to 5 minutes, but the metric is reported every 1 minute.

Question 3

An application running on EC2 instances in an Auto Scaling group is experiencing intermittent errors. The errors correlate with periods of high memory usage. The SysOps administrator wants to set up a CloudWatch alarm to scale out when memory usage exceeds 80%. What should the administrator do to enable monitoring of memory usage?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to publish memory metrics.. The CloudWatch agent is required to publish custom memory metrics from EC2 instances because memory utilization is not a standard metric provided by default. By installing and configuring the agent, the administrator can collect memory usage data and create a CloudWatch alarm to trigger Auto Scaling actions when usage exceeds 80%.

Answer

Enable detailed monitoring on the Auto Scaling group.

Answer

Use the default EC2 memory metric provided by CloudWatch.

Answer

Create a Lambda function to pull memory data from the EC2 instances.

Question 4

A company uses AWS CloudTrail to log API activity. The security team needs to be notified immediately when an IAM user creates a new access key. Which combination of steps should a SysOps administrator take? (Choose TWO.)

Accepted Answer

Create a CloudWatch Logs metric filter for the 'CreateAccessKey' event.. CloudWatch Logs metric filters allow you to extract specific patterns from CloudTrail log data, such as the 'CreateAccessKey' event, and convert them into a metric. This enables you to monitor for this specific API call and trigger an alarm when it occurs, meeting the requirement for immediate notification.

Answer

Enable AWS Config rules to detect changes to IAM users.

Answer

Configure CloudTrail to send notifications directly to Amazon SNS.

Answer

Create an Amazon EventBridge rule to match the 'CreateAccessKey' API call.

Question 5

A SysOps administrator needs to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. Which solution is the MOST operationally efficient?

Accepted Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket in the central account.. AWS CloudTrail can be configured in each account to deliver logs directly to the same S3 bucket in a central account by specifying the central bucket's ARN and setting appropriate bucket policies. This approach is operationally efficient as it eliminates the need for intermediate services or replication, reducing complexity and cost while ensuring logs are centralized without manual intervention.

Answer

Use S3 replication to copy logs from each account's bucket to a central bucket.

Answer

Use CloudWatch Logs subscription filter to stream logs to a central account.

Answer

Use Amazon Kinesis Data Firehose to deliver logs from each account to a central S3 bucket.

Question 6

An organization is using AWS CloudFormation to deploy infrastructure. The SysOps administrator needs to receive notifications when stack creation fails. What is the simplest way to achieve this?

Accepted Answer

Provide an SNS topic ARN in the --notification-arns parameter when creating the stack.. The `--notification-arns` parameter in the AWS CLI `create-stack` command directly associates an SNS topic with the stack, causing CloudFormation to publish notifications for all stack events, including failures. This is the simplest method as it requires no additional services or configuration beyond specifying the SNS topic ARN at stack creation.

Answer

Create a CloudWatch alarm on the 'StackCreationFailure' metric.

Answer

Create an EventBridge rule that triggers on CloudFormation events.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' failures.

Question 7

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail event history.. AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Answer

AWS IAM credential report.

Question 8

A company has an Auto Scaling group of EC2 instances behind an Application Load Balancer. The SysOps administrator notices that the healthy host count is lower than expected. The instances are in service, and security groups allow traffic. What is a likely cause?

Accepted Answer

The health check path is returning HTTP 503.. A health check path returning HTTP 503 (Service Unavailable) indicates that the target instances are reachable but the application is failing to respond correctly. The Application Load Balancer (ALB) marks instances as unhealthy when the health check receives any non-2xx or non-3xx response, which reduces the healthy host count even though the instances are in service and security groups are properly configured.

Answer

The instances are not registered with the target group.

Answer

The security group for the load balancer does not allow inbound traffic.

Answer

The target group is not associated with the load balancer.

Question 9

A SysOps administrator wants to be alerted when an EC2 instance's status check fails. The instance is part of an Auto Scaling group. What is the BEST approach?

Accepted Answer

Create a CloudWatch alarm on the 'StatusCheckFailed' metric.. The 'StatusCheckFailed' metric is automatically published by EC2 to CloudWatch, and a CloudWatch alarm on this metric can directly trigger an SNS notification or other action when the status check fails. This is the simplest and most reliable method for alerting on instance health, regardless of whether the instance is in an Auto Scaling group.

Answer

Use Amazon EventBridge to detect status check failures.

Answer

Enable CloudTrail to monitor EC2 instance status changes.

Answer

Configure an Auto Scaling lifecycle hook to send a notification.

Question 10

An application running on EC2 instances sends custom metrics to CloudWatch using the PutMetricData API. The metrics are not appearing in the CloudWatch console. The IAM role attached to the instances has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*" } ] }. What is the most likely cause?

Accepted Answer

The metric data is being sent to a different AWS region.. The most likely cause is that the metric data is being sent to a different AWS region than the one displayed in the CloudWatch console. The PutMetricData API call includes a regional endpoint, and if the EC2 instance is configured to send metrics to a region other than the one you are viewing, the metrics will not appear. The IAM policy correctly allows the action, so authentication is not the issue.

Answer

The metric timestamp is older than 14 days.

Answer

The metric namespace must start with 'AWS/'.

Answer

The IAM policy does not allow the 'cloudwatch:PutMetricData' action.

Question 11

A SysOps administrator is setting up monitoring for an RDS MySQL database. The administrator needs to be notified when the database connection count exceeds 100. Which steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.. Amazon CloudWatch alarms can send notifications to an Amazon SNS topic when the alarm state changes. This allows the SysOps administrator to receive alerts (e.g., via email, SMS, or HTTP) when the database connection count exceeds the threshold. Option B is correct because the 'DatabaseConnections' metric is a standard CloudWatch metric for RDS MySQL that tracks the number of current connections to the database instance. Creating an alarm on this metric with a threshold of 100 will trigger when the connection count exceeds that value.

Answer

Enable Enhanced Monitoring for RDS.

Answer

Enable CloudTrail to log RDS API calls.

Answer

Create an Amazon EventBridge rule that triggers on RDS events.

Question 12

A company has a centralized logging solution where CloudTrail logs from multiple accounts are delivered to a single S3 bucket. The security team needs to be alerted when an IAM user is created in any of the accounts. Which steps should be taken? (Choose THREE.)

Accepted Answer

Create a CloudWatch Logs metric filter for 'CreateUser' event.. A CloudWatch Logs metric filter can parse CloudTrail logs delivered to CloudWatch Logs and match the 'CreateUser' event pattern. This filter creates a metric that can be used to trigger an alarm. Option B is correct because CloudTrail must be configured to deliver logs to CloudWatch Logs in each account so that the metric filter can be applied to the log group. Option E is correct because a CloudWatch alarm on the metric filter can publish to an SNS topic, which sends notifications (e.g., email, SMS) to the security team when an IAM user is created.

Answer

Create an AWS Config rule to detect IAM user creation.

Answer

Configure S3 event notification on the central bucket to trigger a Lambda function.

Question 13

A SysOps administrator needs to track changes to security group rules in a VPC. Which AWS services can be used to monitor and log these changes? (Choose TWO.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to the Amazon EC2 service, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and CreateSecurityGroup. These events capture the identity, source IP, and timestamp of every change to security group rules, providing an audit trail for compliance and troubleshooting.

Answer

VPC Flow Logs.

Answer

AWS Trusted Advisor.

Answer

Amazon CloudWatch Logs.

Question 14

Refer to the exhibit. A Lambda function is unable to write logs to CloudWatch Logs. The IAM role attached to the Lambda function includes the policy shown. What is the issue?

Accepted Answer

The resource ARN does not include a log-stream component.. The Lambda function's IAM policy grants permissions for `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` on the resource ARN `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:*`. However, this ARN only specifies the log group and a wildcard for log streams, which is insufficient for the `logs:PutLogEvents` action. The `logs:PutLogEvents` action requires a resource ARN that includes a specific log-stream component (e.g., `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:log-stream:*`), because the API call targets a particular log stream within the log group. Without this, the Lambda function cannot write logs, resulting in a permissions error.

Answer

The log group name is incorrect.

Answer

The policy effect is Deny.

Answer

The 'logs:PutLogEvents' action is not allowed.

Question 15

Refer to the exhibit. A SysOps administrator runs the command shown to investigate a CloudWatch alarm named 'HighCPU'. What does the output indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EC2 instance is stopped or terminated.. The command output shows the instance state is 'stopped'. CloudWatch cannot retrieve metrics from a stopped or terminated EC2 instance because the hypervisor is no longer running the instance's operating system or collecting CPU utilization data. When no metric data points are received for the configured alarm period, the alarm transitions to 'INSUFFICIENT_DATA' state.

Answer

Detailed monitoring is not enabled.

Answer

The instance is in a different AWS region.

Answer

The metric name is misspelled.