SOA-C02 Monitoring, Logging, and Remediation Practice Test 16 — 15 Questions

Question 1

A company wants to ensure that all IAM user changes are logged and that an alert is sent when a new IAM user is created. Which services should be used together to achieve this? (Select THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can receive and store log events from AWS CloudTrail, which records all IAM user changes including user creation. By sending CloudTrail logs to CloudWatch Logs, you can then create metric filters to detect specific API calls like 'CreateUser' and trigger CloudWatch Alarms to send notifications via SNS.

Answer

AWS Config

Answer

Amazon S3

Question 2

A SysOps administrator notices that an Amazon RDS for MySQL instance's CPU utilization has been consistently above 80% for the past hour. Which CloudWatch metric should the administrator examine to determine whether the high CPU is due to a specific SQL query?

Accepted Answer

DatabaseConnections. DatabaseConnections, because a high number of database connections can indicate that many concurrent queries are running, which could be caused by a specific SQL query that is inefficient or blocking others. However, to directly identify a specific SQL query causing high CPU, you would need to use Performance Insights or the slow query log, not a CloudWatch metric alone. DatabaseConnections is the closest metric among the options that correlates with query activity, as a sudden spike in connections often points to problematic queries.

Answer

WriteIOPS

Answer

FreeableMemory

Answer

ReadLatency

Question 3

A company has an application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 503 errors. The ALB access logs show that the errors occur when the target response time exceeds 30 seconds. Which configuration change should the SysOps administrator make to reduce the number of 503 errors without affecting the application's behavior?

Accepted Answer

Increase the idle timeout setting on the ALB. The 503 errors occur when the target response time exceeds 30 seconds, which matches the default idle timeout of the Application Load Balancer. By increasing the idle timeout setting on the ALB to a value higher than the application's maximum expected response time (e.g., 60 or 120 seconds), the ALB will wait longer before closing the connection, preventing premature 503 errors while the backend is still processing the request.

Answer

Increase the deregistration delay on the target group

Answer

Enable cross-zone load balancing on the ALB

Answer

Decrease the health check interval on the target group

Question 4

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running a custom application. The instance is not using the default CloudWatch metrics for memory. What should the administrator do to collect memory metrics?

Accepted Answer

Install and configure the CloudWatch agent on the instance. The default CloudWatch metrics for EC2 include CPU, disk, and network utilization, but not memory utilization. To collect custom metrics like memory usage, you must install and configure the CloudWatch agent on the instance. The agent collects memory and disk metrics from the OS and sends them to CloudWatch as custom metrics.

Answer

Enable detailed monitoring on the EC2 instance

Answer

Use AWS Trusted Advisor to check memory utilization

Answer

Use Amazon Inspector to monitor memory

Question 5

A company uses AWS CloudTrail to log API activity. A SysOps administrator discovers that some management events are not being logged. The administrator checks the CloudTrail configuration and confirms that management events are enabled and logging is working for most events. What is the most likely cause of the missing events?

Accepted Answer

The trail is configured to log events only for a single region, and the missing events occurred in a different region. CloudTrail trails can be configured to log events for a single region or all regions. If the trail is set to log only one region, management events occurring in any other region will not be captured. Since the administrator confirmed management events are enabled and logging works for most events, the most likely cause is that the missing events originated from a region not covered by the trail.

Answer

The trail excludes specific management events based on read/write filtering

Answer

The trail is logging only data events for S3

Answer

The missing events are from unsupported services

Question 6

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should the administrator use to set up an alarm based on the status check metric?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because EC2 instance status checks are published as CloudWatch metrics (e.g., StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System). A CloudWatch Alarm can be configured to monitor these metrics and trigger an action, such as sending a notification via Amazon SNS, when the alarm state changes to ALARM. This directly meets the requirement to receive a notification when a status check fails.

Answer

Amazon EventBridge

Answer

AWS Config

Answer

AWS Systems Manager

Question 7

A SysOps administrator is troubleshooting an issue where an Amazon RDS instance's storage space is being consumed rapidly. The administrator wants to identify the specific database or table causing the storage increase. Which AWS service or feature should the administrator use to gather this information?

Accepted Answer

Amazon RDS Enhanced Monitoring. Amazon RDS Enhanced Monitoring provides real-time OS-level metrics for the DB instance, including per-process CPU, memory, and disk I/O utilization. While it does not directly break down storage by table or database, it helps identify which database process (e.g., a specific query or session) is consuming significant disk I/O. Once the offending process is identified, the administrator can use database-level queries (e.g., querying information_schema.tables) to pinpoint the specific table causing the storage increase.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A company uses AWS Lambda functions that process data from an Amazon SQS queue. The Lambda function is failing intermittently due to timeouts. The SysOps administrator needs to be notified immediately when the function times out. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch alarm on the Lambda Errors metric that sends an SNS notification. A CloudWatch alarm on the Lambda Errors metric directly monitors function invocations that result in errors, including timeouts. When the alarm state changes to ALARM, it can immediately trigger an SNS notification, providing the fastest and most efficient notification mechanism without requiring code changes or additional infrastructure.

Answer

Modify the Lambda function to catch the timeout exception and log it to CloudWatch Logs

Answer

Set up a CloudWatch Logs subscription filter to send error logs to an SNS topic

Answer

Configure an Amazon SNS topic as a Lambda destination for the function

Question 9

A SysOps administrator is setting up monitoring for an application that runs on Amazon ECS with Fargate launch type. The application's performance degrades when memory utilization exceeds 80%. The administrator wants to receive a notification when memory usage approaches this threshold. What should the administrator do?

Accepted Answer

Create a CloudWatch alarm on the ECS service's MemoryUtilization metric. Amazon ECS services automatically publish a `MemoryUtilization` metric to CloudWatch for Fargate tasks. By creating a CloudWatch alarm on this metric with a threshold of 80%, the administrator can trigger an SNS notification when memory usage approaches the threshold, enabling proactive remediation before performance degrades.

Answer

Install the CloudWatch agent on each Fargate task

Answer

Use Amazon CloudWatch Container Insights to view ReservedMemory metric

Answer

Enable Service Auto Scaling with a target tracking policy based on MemoryUtilization

Question 10

A company has an S3 bucket that stores sensitive data. A SysOps administrator needs to detect when objects in the bucket are publicly accessible. Which AWS service should the administrator use to continuously monitor and report on public access?

Accepted Answer

AWS Config. AWS Config provides a managed rule called 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that continuously evaluates S3 bucket policies and ACLs against the desired configuration. When a bucket becomes publicly accessible, AWS Config flags it as noncompliant and can trigger automated remediation or notifications. This makes it the correct service for ongoing monitoring and reporting of public access to sensitive data.

Answer

S3 server access logs

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 11

A SysOps administrator needs to ensure that all API calls in the AWS account are logged for auditing purposes. The administrator also wants to receive notifications when specific API calls are made. Which THREE services should the administrator use together to achieve this? (Choose THREE.)

Accepted Answer

Amazon EventBridge. AWS CloudTrail (Option E) is the primary service for logging all API calls in an AWS account, capturing detailed event records. Amazon CloudWatch Logs (Option D) can receive these CloudTrail events for centralized log storage and monitoring. Amazon EventBridge (Option A) can then be used to create rules that match specific API calls and trigger notifications, such as sending messages to an SNS topic, enabling real-time alerting.

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 12

A SysOps administrator wants to monitor the CPU utilization of an Amazon RDS instance and receive an alert if it exceeds 90% for 5 consecutive minutes. Which TWO AWS services are required to set up this monitoring? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch is the service that collects and stores metrics such as CPU utilization from RDS instances. Amazon CloudWatch Alarms allow you to set a threshold (e.g., CPU > 90%) and evaluate it over a specified period (e.g., 5 consecutive minutes) to trigger an action, such as sending a notification via SNS.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Answer

Amazon RDS Enhanced Monitoring

Question 13

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) for traffic distribution. The SysOps administrator has configured a CloudWatch alarm to monitor the ALB's `TargetResponseTime` metric, with a threshold of 5 seconds. The alarm triggers when the average response time exceeds 5 seconds for 2 consecutive periods. Recently, the alarm has been triggering frequently during peak hours, but the application team reports that the response time is acceptable and the application is performing normally. The administrator investigates and finds that a small number of requests are taking a very long time (over 30 seconds), skewing the average. The administrator needs to reduce the number of false alarms while still being alerted if the overall application performance degrades. Which course of action should the administrator take?

Accepted Answer

Change the statistic to p95 and keep the threshold at 5 seconds. Using the p95 (95th percentile) statistic instead of the average filters out the impact of the small number of outlier requests that take over 30 seconds. The p95 metric shows the response time below which 95% of requests fall, providing a more accurate representation of typical application performance. This reduces false alarms from skewed averages while still alerting if the majority of users experience degraded response times exceeding 5 seconds.

Answer

Increase the threshold to 30 seconds

Answer

Decrease the period to 60 seconds and lower the threshold to 3 seconds

Answer

Increase the evaluation periods to 5 consecutive periods

Question 14

A SysOps administrator notices that an EC2 instance's CPU utilization is consistently above 90% during business hours. The instance is part of an Auto Scaling group with a scaling policy based on average CPU utilization. Despite high utilization, no scaling events are triggered. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is too long, preventing new scaling activities.. The most likely cause is that the scaling policy has a cooldown period that is too long. After a scaling activity completes, the Auto Scaling group enters a cooldown period that prevents additional scaling activities from being triggered until the cooldown expires. If the cooldown period is set too long (e.g., 600 seconds or more), the group will not launch new instances even if the CloudWatch alarm remains in ALARM state with high CPU utilization, because the scaling policy is blocked from executing.

Answer

The instance type is not supported by the Auto Scaling group's launch configuration.

Answer

The CloudWatch alarm is in the ALARM state but the Auto Scaling group has a suspended process for Add instances.

Answer

The Auto Scaling group's health check type is set to ELB, causing the instance to be marked unhealthy.

Question 15

A company has an application running on EC2 instances that sends logs to CloudWatch Logs. The operations team wants to receive a notification when a specific error pattern appears in the logs. Which combination of steps should the team take? (Select TWO.)

Accepted Answer

Create a CloudWatch alarm on the metric to trigger an SNS notification.. A CloudWatch alarm can be configured to trigger an SNS notification when a metric crosses a defined threshold. In this scenario, the metric is derived from a metric filter that counts occurrences of the specific error pattern in the log group. The alarm monitors that metric and sends an SNS notification to subscribed endpoints, such as the operations team's email addresses, providing the required alert.

Answer

Enable CloudTrail to capture the log events and send to S3.

Answer

Create an SNS topic and subscribe the operations team's email addresses.

Answer

Create a subscription filter to send logs to Lambda for analysis.