SOA-C02 Monitoring, Logging, and Remediation Practice Test 18 — 15 Questions

Question 1

A company has a production environment that includes an Amazon RDS for MySQL database. The SysOps administrator receives an alert that the database's CPU utilization has been above 90% for the past hour. The administrator checks the CloudWatch metrics and sees that the DatabaseConnections metric is also high. The application team reports that users are experiencing slow response times. The administrator wants to investigate which queries are causing the high CPU. The database is already configured to send logs to CloudWatch Logs. Which course of action should the administrator take to identify the problematic queries?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the slow query log in the RDS parameter group and publish it to CloudWatch Logs. Then use CloudWatch Logs Insights to query the logs for slow queries.. Enabling the slow query log in the RDS parameter group and publishing it to CloudWatch Logs allows the administrator to use CloudWatch Logs Insights to query for queries that exceed a defined execution time threshold. Slow queries are a common cause of high CPU and database connection spikes, and this approach directly surfaces the problematic SQL statements without requiring additional infrastructure.

Answer

Use CloudWatch Logs Insights to query the existing RDS log group for any SQL statements.

Answer

Enable AWS CloudTrail to capture database queries and send them to CloudWatch Logs.

Answer

Enable Amazon RDS Performance Insights and use the dashboard to identify top SQL queries.

Question 2

A company runs a web application on an EC2 instance that uses Amazon EBS volumes. The SysOps administrator notices that the instance's disk queue length is consistently high, and the application is experiencing I/O latency. The administrator wants to set up monitoring to alert when the disk queue length exceeds a threshold. Which steps should the administrator take to achieve this? The instance is already sending CloudWatch metrics.

Accepted Answer

Create a CloudWatch alarm on the EBS metric VolumeQueueLength for the attached volume.. EBS volumes automatically send the VolumeQueueLength metric to CloudWatch without needing the CloudWatch agent. Creating an alarm on this metric allows monitoring disk queue length. Option A is incorrect because while the CloudWatch agent can collect disk metrics, it is unnecessary for EBS metrics already available. Option C is wrong because VPC Flow Logs capture network traffic, not disk I/O. Option D is incorrect because there is no EC2-level DiskQueueLength metric; the metric is per EBS volume.

Answer

Install the CloudWatch agent on the instance and configure it to collect disk queue length.

Answer

Enable VPC Flow Logs to capture disk I/O metrics.

Answer

Create a CloudWatch alarm on the EC2 metric DiskQueueLength.

Question 3

A company has a multi-account AWS environment using AWS Organizations. The security team requires that all API calls made in any account be logged to a centralized S3 bucket in the management account. Additionally, the team wants to be alerted when an IAM user in any account creates a new access key. Currently, CloudTrail is enabled in each account but logs are stored locally. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a new CloudTrail organization trail in the management account that logs events to a centralized S3 bucket. Then create an Amazon EventBridge rule in the management account that matches the CreateAccessKey event and sends a notification via SNS.. An organization trail in the management account automatically logs API calls from all accounts in the AWS Organization to a centralized S3 bucket, fulfilling the logging requirement with minimal setup. Additionally, EventBridge (formerly CloudWatch Events) in the management account can capture CreateAccessKey events from all member accounts and trigger an SNS notification, providing centralized alerting without per-account configuration. This solution eliminates the need for cross-account log forwarding, Lambda functions, or individual SNS topics, making it the least operational overhead. Option A is incorrect because it requires setting up CloudWatch Logs cross-account subscriptions, which adds complexity. Option B is incorrect because it uses separate SNS topics per account, not centralized alerting. Option C is incorrect because it relies on a Lambda function to copy logs, increasing overhead.

Answer

Use CloudWatch Logs cross-account subscription to send logs from each account's CloudTrail log group to a central account. Create a metric filter and alarm on CreateAccessKey events.

Answer

Create a CloudTrail trail in each account that sends logs to a centralized S3 bucket in the management account. Create an SNS topic in each account to alert on CreateAccessKey.

Answer

Enable CloudTrail in all accounts and use an AWS Lambda function to copy logs from each account's S3 bucket to the centralized bucket. Create a CloudWatch Events rule in each account to send alerts on CreateAccessKey.

Question 4

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning HTTP 503 errors to clients. The target group is healthy, and the instances are passing health checks. What is the most likely cause of the 503 errors?

Accepted Answer

The target instances have reached the maximum number of concurrent connections allowed by the application or operating system.. When an Application Load Balancer returns HTTP 503 errors despite a healthy target group, the most likely cause is that the target instances have exhausted their connection limits. ALB maintains persistent connections to targets, and if the application or OS connection backlog (e.g., `net.core.somaxconn` or application thread pool) is full, new requests are rejected, resulting in 503 responses. Health checks may still pass because they use separate, low-frequency connections that do not hit the limit.

Answer

The target instances do not have enough capacity to handle the request volume.

Answer

The health check settings are configured incorrectly, causing healthy instances to be marked as unhealthy.

Answer

The security group for the targets does not allow traffic from the ALB.

Question 5

Which TWO actions should a SysOps administrator take to set up centralized logging from multiple Amazon EC2 instances running Amazon Linux 2 to Amazon CloudWatch Logs?

Accepted Answer

Attach an IAM role to each EC2 instance that includes permission for logs:PutLogEvents.. The EC2 instances need an IAM role with the logs:PutLogEvents permission to authenticate and authorize log delivery to CloudWatch Logs. Without this permission, the CloudWatch agent cannot send log data to the log stream, resulting in authorization failures.

Answer

Create an S3 bucket and configure the EC2 instances to write logs directly to the bucket.

Answer

Create a VPC endpoint for CloudWatch Logs to allow private connectivity.

Answer

Export the logs from CloudWatch Logs to an Amazon S3 bucket for long-term retention.

Question 6

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which THREE steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Configure the Lambda function to publish a custom metric to CloudWatch.. The Lambda function processes CloudWatch Logs subscription filter events and publishes a custom metric to CloudWatch. This custom metric can then trigger a CloudWatch alarm (Option C) to send an SNS notification, meeting the requirement. The combination of a CloudWatch Logs subscription filter (Option D) with a Lambda function is the standard pattern for real-time log-based alerting when CloudTrail logs are delivered to CloudWatch Logs.

Answer

Configure the CloudTrail trail to deliver logs directly to an SNS topic.

Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an SNS notification.

Question 7

A SysOps administrator is troubleshooting a Lambda function that does not write logs to CloudWatch Logs. The IAM role attached to the function includes the policy shown. What is the most likely reason the logs are not being created?

Accepted Answer

The log group name in the Resource ARN does not match the actual log group created by the Lambda function.. The IAM policy shown in the question includes a Resource ARN that specifies a specific log group name (e.g., `/aws/lambda/MyFunction`). If the Lambda function is configured to write to a different log group (e.g., `/aws/lambda/MyOtherFunction` or a custom log group), the `logs:CreateLogGroup` and `logs:CreateLogStream` permissions will fail because the ARN does not match. This mismatch prevents the function from creating the log group or stream, so no logs are written to CloudWatch Logs.

Answer

The IAM role is not assigned to the Lambda function's execution role.

Answer

The Lambda function is in a VPC without a VPC endpoint for CloudWatch Logs.

Answer

The policy does not include the logs:PutLogEvents permission.

Question 8

A SysOps team needs to monitor application logs in Amazon CloudWatch Logs for specific error codes and automatically invoke an AWS Lambda function for remediation within 5 minutes of an error occurring. Which solution involves the least operational overhead?

Accepted Answer

Create a CloudWatch metric filter on the log group, create a CloudWatch alarm on the metric, and configure the alarm to post to an SNS topic that triggers the Lambda function.. It uses CloudWatch metric filters and alarms to detect error codes in logs and trigger remediation via SNS and Lambda, all within a fully managed AWS pipeline. This approach requires no custom code or infrastructure to maintain, and the alarm can be configured to evaluate logs within a 1-minute period, easily meeting the 5-minute requirement with minimal operational overhead.

Answer

Create a CloudWatch Logs subscription filter to stream logs directly to an AWS Lambda function.

Answer

Use a third-party log aggregation tool that sends webhook notifications to an API Gateway endpoint to invoke the Lambda function.

Answer

Write a custom script that runs on an EC2 instance to poll CloudWatch Logs every minute and invoke the Lambda function.

Question 9

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda. It uses Amazon CloudWatch alarms to monitor CPU utilization metrics and trigger an SNS topic, which then invokes an AWS Lambda function. The Lambda function can execute the logic to stop the EC2 instance when the alarm state indicates CPU utilization above 90% for 30 minutes, providing automated cost control without manual intervention.

Answer

Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation

Answer

Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions

Answer

AWS CloudTrail + Amazon EventBridge + AWS CodePipeline

Question 10

A SysOps administrator manages an Amazon RDS for MySQL instance that handles a critical web application. During peak traffic, the number of database connections exceeds 500 for more than 15 minutes, leading to connection timeouts. The administrator wants to automatically increase the DB instance size when the connection count remains high, and decrease it when the load drops, to balance performance and cost. Which combination of AWS services should be used to achieve this automation with the least operational overhead?

Accepted Answer

Set up an Amazon CloudWatch alarm on the DatabaseConnections metric that triggers an AWS Lambda function to modify the DB instance class via the RDS API.. It uses a CloudWatch alarm to monitor the DatabaseConnections metric, which triggers an AWS Lambda function that directly calls the RDS ModifyDBInstance API to change the instance class. This approach provides the least operational overhead by leveraging native AWS services without additional infrastructure, custom resources, or periodic polling, and it enables real-time, event-driven scaling based on the specified threshold.

Answer

Configure a CloudWatch alarm on DatabaseConnections that triggers an Amazon CloudWatch Events rule, which directly modifies the DB instance class using a CloudFormation custom resource.

Answer

Use an AWS Config rule to monitor DatabaseConnections and invoke an AWS Lambda function to scale the RDS instance when the threshold is breached.

Answer

Use an AWS Systems Manager Automation runbook to periodically check the DatabaseConnections metric and adjust the RDS instance class if needed.

Question 11

A SysOps administrator needs to monitor AWS CloudTrail logs for any calls to the 'CreateUser' API in AWS Identity and Access Management (IAM). When such an API call is detected, the administrator wants to receive a notification within a few minutes and also log the event to a central log group in Amazon CloudWatch Logs. The solution should use minimal custom code. Which combination of services should be used?

Accepted Answer

Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.. Amazon EventBridge can directly consume CloudTrail events in near-real time via the 'aws.cloudtrail' event source, allowing you to create a rule that matches the 'CreateUser' API call. This rule can then target both an Amazon SNS topic for immediate notification and a CloudWatch Logs log group for centralized logging, all without custom code.

Answer

Configure AWS CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the 'CreateUser' API call, and set up a CloudWatch alarm that sends an Amazon SNS notification.

Answer

Write an AWS Lambda function that is triggered by Amazon S3 events when a new CloudTrail log is delivered to S3. The Lambda parses the log file for 'CreateUser' and if found, sends an SNS notification.

Answer

Enable AWS Config and create a custom rule that evaluates CloudTrail trail configurations for events.

Question 12

A SysOps administrator needs to automatically restart an Amazon RDS DB instance when the 'DatabaseConnections' metric exceeds a threshold of 200 for 5 consecutive minutes. The administrator wants a solution that uses minimal custom code and leverages AWS managed services. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch alarm with an AWS Systems Manager Automation action.. AWS Systems Manager Automation provides a built-in 'AWSSupport-StartRDSInstance' or 'AWSSystemsManager-RestartRDSInstance' runbook that can be triggered directly by a CloudWatch alarm action, requiring no custom code. This leverages a managed service to restart the RDS instance automatically when the 'DatabaseConnections' metric exceeds 200 for 5 consecutive minutes, meeting the minimal custom code requirement.

Answer

Amazon CloudWatch alarm with an Auto Scaling policy.

Answer

Amazon CloudWatch alarm with an Amazon Simple Notification Service (SNS) topic that triggers an AWS Lambda function to restart the instance.

Answer

Amazon RDS event subscription that triggers an AWS Lambda function.

Question 13

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an email notification when the metric exceeds 90% for 5 consecutive minutes. The solution should use the least operational overhead. Which combination of AWS services should be used?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric and configure the alarm to send a notification to an Amazon SNS topic with email subscriptions.. A CloudWatch alarm directly monitors the CPUUtilization metric for an EC2 instance and can be configured to evaluate whether the metric exceeds 90% for 5 consecutive minutes (e.g., 5 evaluation periods of 1 minute each). The alarm then publishes to an Amazon SNS topic, which sends email notifications to subscribed endpoints, requiring no additional infrastructure or code, thus minimizing operational overhead.

Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to check the CPUUtilization metric and send an email via Amazon SES.

Answer

Configure the EC2 instance to publish CPU logs to Amazon CloudWatch Logs, then create a metric filter to detect high CPU and trigger an SNS notification.

Answer

Use AWS CloudTrail to monitor EC2 CPU metrics and send notifications to an Amazon SQS queue.

Question 14

A SysOps administrator needs to monitor application logs stored in Amazon CloudWatch Logs for the term 'CRITICAL'. When more than 5 'CRITICAL' entries appear in a 5-minute window, the administrator wants to automatically restart the underlying Amazon EC2 instance. Which solution should the administrator implement?

Accepted Answer

Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an EC2 Reboot Instances action.. CloudWatch Logs metric filters can count occurrences of the term 'CRITICAL' in log data, and a CloudWatch alarm can be configured to trigger an EC2 Reboot Instances action directly when the metric exceeds a threshold of 5 in a 5-minute period. This provides a native, simple, and fully managed solution without requiring additional services like Lambda or Systems Manager.

Answer

Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an AWS Systems Manager Automation document to restart the instance.

Answer

Create a CloudWatch Logs metric filter, then use Amazon CloudWatch Events (Amazon EventBridge) to trigger an AWS Lambda function that restarts the instance.

Answer

Use Amazon CloudWatch Synthetics canary to monitor the logs and automatically stop the instance.

Question 15

A web application publishes a custom metric 'FailedLoginAttempts' to Amazon CloudWatch. The SysOps administrator needs to be notified via Amazon SNS when the number of failed login attempts exceeds 100 within a 5-minute period. Which AWS service or feature should be used to create this notification?

Accepted Answer

Amazon CloudWatch alarm. An Amazon CloudWatch alarm is the correct service because it monitors a specific CloudWatch metric (such as 'FailedLoginAttempts') and triggers an action (such as sending an SNS notification) when the metric crosses a defined threshold over a specified period. In this case, the alarm evaluates whether the sum of 'FailedLoginAttempts' exceeds 100 within a 5-minute period, and upon breaching, it publishes to the SNS topic to notify the SysOps administrator.

Answer

Amazon CloudWatch Logs metric filter

Answer

Amazon CloudWatch dashboard

Answer

AWS Config rule