SOA-C02 Monitoring, Logging, and Remediation Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. A SysOps administrator runs the command to find 'CreateKeyPair' events in January 2023 but gets an empty list. The administrator knows that key pairs were created during that time. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The events occurred in a different AWS region.. The `aws cloudtrail lookup-events` command returns events only from the region specified in the AWS CLI configuration (or the `--region` parameter). If the administrator did not specify a region, the command defaults to the region set in the CLI profile. Since `CreateKeyPair` events are regional (each key pair is created in a specific region), the empty result indicates the events occurred in a different AWS region than the one queried.

Answer

The start and end times are outside the 90-day retention period.

Answer

CloudTrail is not enabled in the account.

Answer

The IAM user does not have 'cloudtrail:LookupEvents' permission.

Question 2

A company is experiencing intermittent performance issues with an application running on an EC2 instance. The CloudWatch metrics show high CPU utilization but no correlation with the timing of the issue. The SysOps administrator needs to collect detailed performance data to identify the root cause. Which AWS service should the administrator use to capture network-level metrics and logs?

Accepted Answer

Enable VPC Flow Logs for the EC2 instance's subnet.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) at the network interface level, which is essential for diagnosing network-related performance issues. Since the problem is intermittent and uncorrelated with CPU, network-level metrics can reveal issues like packet loss, throttling, or latency that application logs or CPU metrics alone cannot. This directly addresses the need for detailed network-level data.

Answer

Configure a CloudWatch Logs agent on the instance to send application logs.

Answer

Use AWS CloudTrail to log all API calls made to the instance.

Answer

Enable AWS Config to track configuration changes to the instance.

Question 3

A SysOps administrator receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group behind an Application Load Balancer. The administrator needs to ensure that the instance is automatically replaced and that the root cause is investigated. What is the MOST efficient combination of actions to achieve this?

Accepted Answer

Configure an Auto Scaling lifecycle hook to terminate the unhealthy instance and send the instance system log to an S3 bucket for analysis.. It combines automatic instance replacement via the Auto Scaling group's health check (which marks the instance unhealthy and terminates it) with a lifecycle hook that captures the instance's system log before termination and sends it to S3 for root cause analysis. This is the most efficient approach as it requires no manual intervention and preserves diagnostic data.

Answer

Create a CloudWatch alarm that triggers an SNS notification to the administrator to manually replace the instance.

Answer

Reboot the instance from the AWS Management Console and then review CloudTrail logs.

Answer

Manually stop and start the instance to recover it, then check the system logs.

Question 4

A company needs to monitor for unauthorized changes to critical IAM policies. The SysOps administrator must receive notifications within minutes of any change. Which combination of AWS services should the administrator use?

Accepted Answer

Use AWS CloudTrail to log IAM changes, and create a CloudWatch Events rule that triggers an SNS notification when specific API calls are made.. AWS CloudTrail logs all IAM API calls (e.g., PutRolePolicy, AttachRolePolicy) as events. A CloudWatch Events rule (now called Amazon EventBridge rule) can be configured to match these specific API calls and trigger an SNS topic, delivering near-instant notifications within minutes. This combination provides real-time, event-driven monitoring without polling or delays.

Answer

Use AWS Config rules to detect changes and send notifications via SNS.

Answer

Use CloudWatch Logs to monitor IAM activity and create a metric filter to trigger an alarm.

Answer

Use a Lambda function that periodically checks IAM policies and sends an SNS message if changes are detected.

Question 5

A SysOps administrator notices that an RDS instance's CPU utilization is consistently above 80% during peak hours. The administrator wants to set up automated actions to scale the database and also notify the team. What should the administrator do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization that triggers a Lambda function to modify the RDS instance class to a larger size.. It uses a CloudWatch alarm on CPU utilization to trigger a Lambda function, which can programmatically call the ModifyDBInstance API to scale the RDS instance class up during peak hours. This provides automated, event-driven scaling based on actual utilization, and the same alarm can be configured to send an SNS notification to the team. This approach is flexible and allows custom logic in Lambda, such as checking current metrics before scaling.

Answer

Configure a scheduled scaling action to change the instance class during peak hours.

Answer

Add the RDS instance to an Auto Scaling group.

Answer

Enable RDS Auto Scaling for the instance.

Question 6

An application running on EC2 instances occasionally throws 'Connection refused' errors when connecting to an RDS database. The SysOps administrator needs to determine if the issue is due to database connection limits or network security groups. Which metrics and logs should the administrator examine?

Accepted Answer

Examine the RDS CloudWatch metric DatabaseConnections and analyze VPC Flow Logs for the EC2 instance's network interface.. 'Connection refused' errors typically stem from either the database exhausting its maximum connections or network-level security groups blocking traffic. The RDS CloudWatch metric `DatabaseConnections` directly shows the current number of active connections against the instance's `max_connections` limit, while VPC Flow Logs capture whether packets are being accepted or rejected by security groups or network ACLs, pinpointing network blockages.

Answer

Check CloudWatch RDS CPUUtilization and CloudTrail logs for RDS API calls.

Answer

Review RDS error logs in CloudWatch Logs and check the EC2 instance's system log.

Answer

Look at the EC2 instance's CloudWatch NetworkIn and NetworkOut metrics and RDS FreeableMemory metric.

Question 7

A SysOps administrator needs to ensure that all S3 buckets in the account are configured with server access logging. Which AWS service can evaluate the buckets and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously evaluate your S3 buckets against a managed rule (s3-bucket-server-access-logging-enabled) and automatically remediate non-compliant buckets using AWS Systems Manager Automation documents. This allows the SysOps administrator to enforce server access logging as a compliance requirement without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 8

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is not reachable from the internet. The instance has a public IP and is in a public subnet. The security group allows HTTP and HTTPS from 0.0.0.0/0. The network ACL allows all inbound and outbound traffic. What should the administrator check NEXT?

Accepted Answer

Verify that the subnet's route table has a route to an internet gateway.. The instance is in a public subnet with a public IP and security group allowing HTTP/HTTPS, and the network ACL allows all traffic. The most likely remaining issue is that the subnet's route table lacks a route to an internet gateway (IGW), which is required for traffic to and from the internet. Without this route, the instance cannot send responses back to internet clients, making it unreachable despite having a public IP.

Answer

Check that the instance is associated with an Elastic IP address.

Answer

Confirm that the instance's operating system firewall is disabled.

Answer

Review the VPC Flow Logs for the instance's network interface.

Question 9

A company stores critical data in an S3 bucket and wants to be notified immediately when any object is deleted from the bucket. Which combination of services should the SysOps administrator use?

Accepted Answer

Configure an S3 event notification for 's3:ObjectRemoved:*' events to send to an SNS topic.. S3 event notifications can be configured to trigger on 's3:ObjectRemoved:*' events, which cover both permanent and versioned object deletions. These notifications can be sent directly to an SNS topic, enabling immediate notification without additional compute or logging overhead. This is the simplest and most direct approach for real-time alerts on object deletions.

Answer

Enable S3 server access logging and send logs to CloudWatch Logs, then create a metric filter and alarm.

Answer

Use S3 event notifications to invoke a Lambda function that checks the object and sends an email.

Answer

Use AWS CloudTrail to log DeleteObject calls and create a CloudWatch Events rule to send an SNS notification.

Question 10

A company is using an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. The SysOps administrator notices that the scaling is not triggering as expected. Which THREE steps should the administrator take to troubleshoot the issue?

Accepted Answer

Check the scaling activity history in the Auto Scaling group for any errors or cooldown periods.. The scaling activity history provides a log of all scaling actions, including errors, cooldown periods, and why a scaling event was or was not triggered. By reviewing this history, the administrator can identify if the scaling policy was blocked by a cooldown period, if the alarm state was not reached, or if there were any configuration errors that prevented the scaling action from executing.

Answer

Ensure that the EC2 instances are passing the ELB health checks.

Answer

Manually increase the desired capacity to see if the scaling policy takes effect.

Question 11

A SysOps administrator wants to be alerted when the root user of the AWS account signs in. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including root user sign-ins, as `RootLogin` events in the management events trail. Option D is correct because Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches these CloudTrail log events and triggers a notification action, such as sending an SNS alert, when the root user signs in.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 12

Refer to the exhibit. A SysOps administrator runs the command to find 'CreateKeyPair' events in January 2023 but gets an empty list. The administrator knows that key pairs were created during that time. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The average statistic over a period of 300 seconds can smooth out spikes, and the overall average of 75% may be due to a high spike after the idle period.. The average statistic over a 300-second period can smooth out brief but intense spikes in CPU utilization. In this scenario, the instance was idle for the first 15 minutes, so the average of 75% over the entire hour must be driven by a very high CPU spike later in the period. The period of 300 seconds aggregates data into 5-minute intervals, which can mask the idle period and make the overall average misleading.

Answer

The period is too long; a shorter period like 60 seconds would show more granular data.

Answer

The command should include --unit Percent to get accurate data.

Answer

The --statistics parameter should be set to 'Sum' to capture total usage.

Question 13

Refer to the exhibit. An EC2 instance is running the CloudWatch Logs agent and uses the IAM policy shown. The agent is configured to send logs to the log group 'MyAppLogGroup'. However, logs are not appearing. What is the MOST likely cause?

Accepted Answer

The policy is missing permission to create the log group if it does not exist.. The CloudWatch Logs agent cannot automatically create a log group; it requires explicit permission via the `logs:CreateLogGroup` action in the IAM policy. Without this permission, if the log group 'MyAppLogGroup' does not already exist, the agent will fail to send logs, even though the `logs:PutLogEvents` action is allowed. The policy shown only grants `logs:PutLogEvents` and `logs:DescribeLogStreams`, missing the necessary `logs:CreateLogGroup` and `logs:CreateLogStream` actions for initial setup.

Answer

The log group name in the policy does not match the agent configuration.

Answer

The policy does not allow the 'logs:PutLogEvents' action.

Answer

The Resource ARN incorrectly specifies a wildcard after the log group name.

Question 14

Refer to the exhibit. A SysOps administrator runs the command to find 'CreateKeyPair' events in January 2023 but gets an empty list. The administrator knows that key pairs were created during that time. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The alarm statistic should be 'Maximum' instead of 'Average' to catch CPU spikes that may not sustain the average above 80% for 5 minutes.. The alarm is configured with the 'Average' statistic, which smooths out CPU utilization over the 5-minute period. If CPU utilization spikes above 80% but does not sustain an average above that threshold for the entire duration, the alarm will not trigger. Using the 'Maximum' statistic would catch any single data point exceeding 80% within the period, making it appropriate for detecting short-lived spikes.

Answer

The alarm action is missing a valid SNS topic ARN.

Answer

The alarm dimension is incorrect; it should use the instance's private IP.

Answer

The user data script fails to start the web server, causing the instance to be unhealthy.

Question 15

A company uses AWS CloudTrail to log API calls in a multi-account environment. The security team wants to be alerted when an IAM user in the production account modifies a security group to allow inbound SSH from 0.0.0.0/0. Which combination of actions should be taken to meet this requirement?

Accepted Answer

Stream CloudTrail logs to CloudWatch Logs, create a metric filter for the specific API call, and set a CloudWatch Alarm that sends a notification to an SNS topic.. CloudTrail logs can be streamed to CloudWatch Logs, where a metric filter can be created to match the specific API call (e.g., AuthorizeSecurityGroupIngress with a CIDR of 0.0.0.0/0 and port 22). A CloudWatch Alarm based on that metric can then trigger an SNS notification, providing a real-time alert for the exact security group modification.

Answer

Use AWS Config managed rule 'restricted-ssh' to detect the security group change and trigger an SNS notification.

Answer

Enable AWS Security Hub and configure a custom insight to detect the security group modification.

Answer

Create an AWS Lambda function that is triggered by CloudTrail events and publishes to SNS.