SOA-C02 Monitoring, Logging, and Remediation Practice Test 17 — 15 Questions

Question 1

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Amazon Linux 2. Which of the following is required to publish memory metrics to CloudWatch?

Accepted Answer

Install and configure the CloudWatch agent on the instance.. The CloudWatch agent is specifically designed to collect custom metrics, such as memory utilization, from EC2 instances and publish them to CloudWatch. Unlike the default EC2 monitoring, which only captures hypervisor-level metrics (CPU, network, disk), memory utilization requires an in-guest agent to read from the operating system's /proc/meminfo or similar interfaces. The CloudWatch agent can be configured via a JSON file to collect memory metrics and send them to CloudWatch using the PutMetricData API.

Answer

Use the CloudWatch Logs agent to parse memory usage from system logs.

Answer

Enable detailed monitoring on the instance.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and configure it to send metrics.

Question 2

An application running on an EC2 instance writes logs to a local file. The operations team needs to monitor these logs in near real-time for troubleshooting. Which solution provides the most efficient way to stream these logs to CloudWatch Logs?

Accepted Answer

Install the CloudWatch Logs agent on the instance and configure it to tail the log file.. The CloudWatch Logs agent (or the newer unified CloudWatch agent) is designed specifically to tail log files from EC2 instances and stream them to CloudWatch Logs in near real-time. This provides the most efficient solution because it continuously monitors the file for new entries and sends them with minimal latency, without requiring periodic uploads or complex event-driven pipelines.

Answer

Use the AWS CLI to periodically upload the log file using the put-log-events command.

Answer

Install the Amazon Kinesis Agent on the instance and configure it to send logs to CloudWatch Logs.

Answer

Configure the application to write logs to an S3 bucket and use S3 Event Notifications to trigger a Lambda function that puts logs to CloudWatch.

Question 3

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to send logs to CloudWatch Logs. Which steps are necessary to allow this without traversing the internet? (Select TWO.)

Accepted Answer

Attach an IAM role to the instance with permissions to call PutLogEvents.. The EC2 instance must have an IAM role attached that includes permissions for `logs:PutLogEvents` to authenticate and authorize log delivery to CloudWatch Logs. Without this role, the instance cannot sign API requests, even if network connectivity exists. Option C is correct because a VPC endpoint for CloudWatch Logs (com.amazonaws.region.logs) provides private connectivity via AWS PrivateLink, allowing the instance to send logs without traversing the internet or a NAT gateway.

Answer

Place the instance in a public subnet with a public IP.

Answer

Ensure the instance is in the default VPC.

Answer

Attach a NAT gateway to the private subnet's route table.

Question 4

A SysOps administrator wants to be alerted when an EC2 instance is terminated unexpectedly. Which CloudWatch event should be used to trigger a notification?

Accepted Answer

An Amazon EventBridge rule that matches EC2 Instance State-change Notification events.. Amazon EventBridge can capture EC2 Instance State-change Notification events, which are emitted whenever an EC2 instance transitions between states (e.g., running, stopped, terminated). By creating a rule that matches the 'terminated' state, the administrator can trigger an SNS notification or Lambda function to alert on unexpected termination, providing a real-time, event-driven response.

Answer

A CloudWatch alarm on the CPUUtilization metric dropping to zero.

Answer

A CloudTrail trail that logs TerminateInstances API calls.

Answer

A CloudWatch alarm on the StatusCheckFailed metric.

Question 5

An organization has a CloudWatch dashboard that displays metrics for multiple AWS services. The dashboard is shared with the operations team. Recently, some team members reported that the dashboard is not loading for them. Which action should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Confirm that the team members have the necessary IAM permissions for cloudwatch:GetDashboard.. The most likely cause of the dashboard not loading is that the team members lack the required IAM permission to retrieve the dashboard definition. CloudWatch dashboards are stored as JSON objects, and the `cloudwatch:GetDashboard` action is necessary to fetch and render that data in the console. Without this permission, the API call fails silently, resulting in a blank or non-loading dashboard.

Answer

Verify that the team members have subscribed to the metric streams.

Answer

Ensure the CloudWatch agent is installed on the instances displaying the dashboard.

Answer

Check that the dashboard is in the same region as the resources.

Question 6

A company is using AWS CloudTrail to log API activity in their account. The security team needs to be alerted when an IAM user creates a new access key. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and targets an SNS topic.. Amazon EventBridge can directly match the `CreateAccessKey` API call from CloudTrail and trigger an SNS topic to send an alert in real time, requiring no custom code or polling. This provides the least operational overhead by using a fully managed, event-driven rule.

Answer

Enable CloudTrail email notifications for management events.

Answer

Configure the IAM user's permissions to require MFA for access key creation.

Answer

Write a Lambda function that periodically scans CloudTrail logs in S3 and sends alerts.

Question 7

A SysOps administrator needs to audit all changes to security groups in an AWS account. Which AWS service should be used to capture these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including all CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and DeleteSecurityGroup API actions. By enabling CloudTrail trail logging, the SysOps administrator can capture a complete audit trail of who made changes, when, and from which source IP, which is essential for security group change auditing.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Answer

AWS Config

Question 8

An application is running on an EC2 instance and is experiencing intermittent connection timeouts. The SysOps administrator wants to capture network traffic to analyze the issue. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including accepted and rejected connection attempts. This allows the SysOps administrator to analyze the source/destination IPs, ports, protocols, and whether the traffic was allowed or denied, which is essential for diagnosing intermittent connection timeouts.

Answer

CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 9

A company uses AWS Organizations to manage multiple accounts. The security team needs a centralized view of all API calls made across all accounts. Which solution should the SysOps administrator implement?

Accepted Answer

Create a CloudTrail trail in the management account that logs events for all accounts in the organization.. AWS CloudTrail supports an organization trail that, when created in the management account, automatically logs API calls for all member accounts in the AWS Organization. This provides a centralized, single point of access to all API activity across the organization without needing to configure individual trails per account.

Answer

Use AWS Config aggregator to view configuration changes across accounts.

Answer

Use CloudWatch cross-account dashboards to view metrics from all accounts.

Answer

Enable CloudTrail in each account and have each account send logs to its own S3 bucket.

Question 10

A SysOps administrator is investigating a security incident and needs to determine who deleted an S3 bucket. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across AWS services, including S3 bucket deletion events. When a user or role deletes an S3 bucket, CloudTrail logs the `DeleteBucket` API call with details such as the IAM user or role, source IP address, and timestamp, enabling the administrator to identify the responsible entity.

Answer

AWS Trusted Advisor

Answer

S3 server access logs

Answer

CloudWatch Logs for the S3 service

Question 11

A company has a CloudWatch alarm that monitors the CPU utilization of an EC2 instance. The alarm is set to trigger when CPU utilization exceeds 80% for 5 consecutive minutes. The alarm state is 'INSUFFICIENT_DATA'. What does this mean?

Accepted Answer

The alarm does not have enough data to determine the state.. The INSUFFICIENT_DATA state in CloudWatch indicates that the alarm has not received enough metric data points to evaluate whether the threshold (CPU utilization > 80% for 5 consecutive minutes) has been breached. This typically occurs when the EC2 instance is newly launched, the CloudWatch agent is not reporting, or there are gaps in metric collection due to network issues or instance stops. It does not imply any conclusion about the CPU utilization level itself.

Answer

The CPU utilization is below 80% for 5 minutes.

Answer

The CPU utilization has exceeded 80% for 5 minutes.

Answer

The alarm is missing data points for the past 5 minutes.

Question 12

A SysOps administrator needs to set up monitoring for an application that runs on an EC2 instance. The application generates custom metrics that should be available for analysis in CloudWatch. Which steps are required to achieve this? (Select TWO.)

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to call PutMetricData.. The EC2 instance must have an IAM role attached with permissions to call PutMetricData, which authorizes the instance to publish custom metrics to CloudWatch. Without this IAM role, any attempt to send metrics from the instance will fail due to missing credentials.

Answer

Create an SNS topic and subscribe the application to send metrics.

Answer

Install the CloudWatch Logs agent to send custom metrics.

Answer

Enable detailed monitoring on the EC2 instance to collect custom metrics.

Question 13

A company is using AWS CloudTrail to log API activity. The security team wants to be notified when an IAM user attempts to modify an S3 bucket policy. Which actions should be taken to meet this requirement? (Select THREE.)

Accepted Answer

Create an Amazon EventBridge rule that matches the PutBucketPolicy API call via CloudTrail.. Amazon EventBridge can match specific API calls (like PutBucketPolicy) by using CloudTrail as an event source. This allows the security team to trigger a notification when an IAM user attempts to modify an S3 bucket policy, without needing to poll or set up custom monitoring.

Answer

Create a CloudWatch alarm on the number of PutBucketPolicy calls.

Answer

Enable CloudTrail data events for S3 to capture bucket policy changes.

Question 14

A company has a CloudWatch dashboard that displays metrics for several EC2 instances. The SysOps administrator wants to share the dashboard with external stakeholders who do not have AWS accounts. Which actions should the administrator take? (Select TWO.)

Accepted Answer

Use the CloudWatch dashboard sharing feature to make the dashboard public.. CloudWatch dashboards have a built-in sharing feature that allows you to make a dashboard public by generating a shareable URL. This URL can be accessed by anyone, even without an AWS account, and the dashboard data is encrypted in transit using HTTPS. The feature also supports time-range and time-zone customization via URL parameters.

Answer

Create a web application that reads CloudWatch metrics and host it on EC2.

Answer

Create IAM users for each stakeholder and assign appropriate permissions.

Answer

Export the dashboard to Amazon QuickSight and share it via email.

Question 15

A SysOps administrator is tasked with setting up a solution that automatically terminates EC2 instances that have been running for more than 24 hours. Which steps should the administrator take? (Select THREE.)

Accepted Answer

Tag each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp).. Tagging each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp) provides a reliable, queryable metadata point that a Lambda function can use to calculate instance age. This approach avoids reliance on the EC2 instance's launch time attribute, which can be altered or unavailable in certain scenarios (e.g., stopped/started instances). The tag serves as a deterministic reference for the Lambda function to compare against the current time and decide termination.

Answer

Configure an Auto Scaling group lifecycle hook to terminate instances after 24 hours.

Answer

Create a CloudWatch alarm on the InstanceAge metric and set it to trigger the Lambda function.