SOA-C02 Monitoring, Logging, and Remediation Practice Test 17 — 15 Questions

Question 1

A company wants to centrally collect and analyze logs from all AWS accounts in an organization. The logs include CloudTrail, VPC Flow Logs, and AWS Config logs. Which solution is the most scalable and cost-effective?

Accepted Answer

Configure each account to deliver logs to a centralized S3 bucket and use Amazon Athena to query them.. Option D is correct because it uses a centralized S3 bucket to aggregate logs from all accounts, which is highly scalable and cost-effective due to S3's low storage costs and lifecycle policies. Amazon Athena then allows serverless, pay-per-query analysis of the logs without needing to provision or manage any infrastructure, making it ideal for ad-hoc and cross-account log analysis.

Answer

Stream all logs to a central CloudWatch Logs account using cross-account subscriptions.

Answer

Use CloudWatch Logs Insights to query logs from each account individually.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to an Amazon Elasticsearch Service cluster.

Question 2

A company uses Amazon RDS for MySQL and needs to be alerted when the database's CPU utilization exceeds 80% for 10 minutes. The administrator creates a CloudWatch alarm based on the 'CPUUtilization' metric. However, the alarm does not trigger even though the metric shows values above 80%. What is the most likely cause?

Accepted Answer

The alarm is configured to use the 'Maximum' statistic, but the metric chart shows 'Average'.. Option B is correct because the CloudWatch alarm is configured to use the 'Maximum' statistic, while the metric chart displays the 'Average' statistic. If the CPU utilization spikes above 80% but the average over the evaluation period remains below 80%, the alarm using 'Maximum' will not trigger. The alarm evaluates the metric based on its configured statistic, not the chart's default view.

Answer

The alarm's period is set to 5 minutes, so it checks only every 5 minutes.

Answer

The RDS instance is in a VPC that does not have internet access.

Answer

The administrator has not enabled Enhanced Monitoring on the RDS instance.

Question 3

A company has deployed a web application on EC2 instances with an Auto Scaling group. The SysOps administrator needs to automatically replace any instance that is in a 'failed' status as reported by the EC2 status checks. Which action should the administrator take?

Accepted Answer

Configure the Auto Scaling group to use EC2 status checks for health checks.. Option C is correct because an Auto Scaling group can be configured to use EC2 status checks (both system and instance) as the health check type. When the status check reports a failed status, the Auto Scaling group automatically terminates the unhealthy instance and launches a new one to replace it, ensuring self-healing without manual intervention.

Answer

Create an AWS Config rule to detect failed status checks and trigger a remediation action.

Answer

Create an AWS Lambda function that stops and starts the failed instance.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and trigger an SNS notification.

Question 4

A SysOps administrator receives a notification that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. What is the immediate impact on the application?

Accepted Answer

The Auto Scaling group will launch a new instance to replace the failed one, potentially causing temporary downtime.. When an EC2 instance fails a status check, the Auto Scaling group detects the failure and initiates a replacement by launching a new instance. However, the failed instance is not immediately terminated; it may remain in a stopped or impaired state until the replacement is fully in service, which can cause temporary downtime for the application if the instance was actively handling traffic.

Answer

The instance is still accessible and serving traffic.

Answer

The instance is immediately terminated.

Answer

The instance is automatically stopped and started.

Question 5

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. Options B and C are correct. CloudTrail logs API calls, and CloudWatch Logs can ingest those logs and use metric filters to detect suspicious patterns. Option A (AWS Config) records resource changes, not API calls. Option D (VPC Flow Logs) captures network traffic. Option E (Amazon Inspector) is for security assessments.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS Config

Question 6

A SysOps administrator needs to receive alerts when an S3 bucket is publicly accessible. Which TWO AWS services can be used to monitor and detect this configuration?

Accepted Answer

AWS Security Hub. AWS Security Hub (B) is correct because it aggregates security findings from multiple AWS services, including Amazon GuardDuty and AWS Config, and can detect publicly accessible S3 buckets via its built-in security standards (e.g., CIS AWS Foundations Benchmark). AWS Config (D) is correct because it can evaluate S3 bucket configurations against rules, such as the managed rule 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited', and trigger alerts when a bucket becomes publicly accessible.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Question 7

A company uses CloudWatch Logs to monitor application logs. The SysOps administrator wants to search for specific error patterns across multiple log groups. Which THREE AWS services can be used to achieve this?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is correct because it is a native AWS service designed specifically for querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) across multiple log groups to search for specific error patterns, making it a direct and efficient solution for this use case without requiring data export or additional infrastructure.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Question 8

A SysOps administrator notices that an EC2 instance's CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a CPU utilization-based scaling policy. However, no new instances have been launched. What is the most likely cause?

Accepted Answer

The Auto Scaling cooldown period is preventing additional scaling activities.. The most likely cause is that the Auto Scaling cooldown period is preventing additional scaling activities. When a scaling activity completes, a cooldown period (default 300 seconds) starts during which the Auto Scaling group ignores additional CloudWatch alarms to allow metrics to stabilize. If the instance has been above 90% CPU for an hour but no new instances launched, the cooldown period may have been triggered by a previous scaling event and is still active, blocking further scale-out actions despite sustained high utilization.

Answer

The EC2 instance is in a private subnet and cannot communicate with the Auto Scaling service.

Answer

The CloudWatch alarm is publishing to an S3 bucket that is full.

Answer

The scaling policy is based on memory utilization, not CPU.

Question 9

A company has an application running on EC2 instances behind an Application Load Balancer. They want to receive an email notification when the average latency exceeds 2 seconds. Which combination of steps should the SysOps administrator take? (Select TWO.)

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Option D is correct because Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when a metric threshold is breached. By creating an SNS topic and subscribing an email endpoint to it, the SysOps administrator can receive email alerts when the alarm state changes, such as when the average latency exceeds 2 seconds.

Answer

Enable AWS CloudTrail to capture API calls and monitor latency.

Answer

Use CloudWatch Logs to stream logs to Amazon ES for latency analysis.

Answer

Create a CloudWatch alarm on the EC2 instance's CPUUtilization metric.

Question 10

A SysOps administrator creates this IAM policy for a monitoring application. The application needs to publish custom metrics to CloudWatch and retrieve information about EC2 instances and Auto Scaling groups. The application reports that it cannot list EC2 instances. What is the most likely reason?

Accepted Answer

The policy uses a wildcard for the ec2:Describe action; it should specify ec2:DescribeInstances.. The policy uses a wildcard for the ec2:Describe action, but IAM does not support wildcards for action names in the format 'ec2:Describe*'. The correct action to list EC2 instances is 'ec2:DescribeInstances'. Because the wildcard is invalid, the policy grants no EC2 Describe permissions, causing the application to fail when listing instances.

Answer

The policy does not grant access to the us-east-1 region.

Answer

The policy is missing the cloudwatch:PutMetricData action for the monitoring application.

Answer

The policy should include ec2:DescribeTags to list instances.

Question 11

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Windows Server. Which steps are required to collect memory metrics?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the instance.. Amazon CloudWatch does not collect memory metrics from EC2 instances by default; it only captures hypervisor-level metrics such as CPU, network, and disk I/O. To monitor in-guest memory utilization on a Windows Server instance, you must install and configure the Amazon CloudWatch agent, which sends custom metrics (e.g., Memory % Committed Bytes In Use) to CloudWatch. The agent uses the Windows Performance Monitor (PerfMon) counters to gather this data.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and use Run Command.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Use the AWS Management Console to enable memory monitoring.

Question 12

A company runs a web application on EC2 instances behind an Application Load Balancer. The SysOps administrator creates a CloudWatch alarm on the ALB's HTTPCode_ELB_5XX_Count metric to trigger an SNS notification when there are many 5xx errors. However, the alarm remains in INSUFFICIENT_DATA state. What is a likely cause?

Accepted Answer

The ALB and the CloudWatch alarm are in different AWS Regions.. CloudWatch alarms can only evaluate metrics from the same AWS Region in which the alarm is created. If the ALB and the CloudWatch alarm are in different Regions, the alarm will never receive metric data points, causing it to remain in INSUFFICIENT_DATA state. This is a common cross-Region limitation for CloudWatch metrics.

Answer

The HTTPCode_ELB_5XX_Count metric is not available for ALBs.

Answer

The IAM role for CloudWatch does not have permission to read the ALB metrics.

Answer

The alarm's period is set to 1 minute, but the metric is published every 5 minutes.

Question 13

A SysOps administrator needs to ensure that all S3 buckets in the account are logged to CloudTrail for data events. The administrator enables CloudTrail with data events for S3 and selects 'All buckets' in the current account. However, after a week, they notice that some buckets are not being logged. What is the most likely reason?

Accepted Answer

The S3 buckets do not have a bucket policy that allows CloudTrail to write the log files.. When CloudTrail delivers S3 data event logs to a destination bucket, it writes log files on behalf of the trail. Even if the trail is configured to log data events for 'All buckets,' CloudTrail must have explicit permissions to write to the destination bucket. The destination bucket requires a bucket policy that grants CloudTrail the s3:PutObject action; without this policy, CloudTrail cannot deliver logs for any bucket, including those being monitored. Option B correctly identifies this missing bucket policy as the most likely reason some buckets are not logged.

Answer

The IAM user who created the trail does not have s3:PutObject permissions on the buckets.

Answer

The S3 buckets are in a different AWS Region from the CloudTrail trail.

Answer

The S3 buckets have server access logging enabled, which conflicts with CloudTrail logging.

Question 14

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending a notification via Amazon SNS, when a status check fails. This is the native AWS service designed for real-time monitoring and alerting on metric thresholds, making it the correct choice for this use case.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 15

A company has an application that writes logs to CloudWatch Logs. The SysOps administrator needs to search for a specific error pattern across multiple log groups. Which solution is the most efficient?

Accepted Answer

Use CloudWatch Logs Insights to query the log groups.. CloudWatch Logs Insights is purpose-built for interactive ad-hoc querying of log data across multiple log groups, enabling efficient pattern matching and filtering without requiring pre-configured infrastructure. It uses a dedicated query language optimized for searching, aggregating, and analyzing log events, making it the most efficient solution for searching a specific error pattern across multiple log groups.

Answer

Create a CloudWatch dashboard to visualize log data.

Answer

Create a metric filter to count the error pattern.

Answer

Create a subscription filter to stream logs to Amazon ES.