SOA-C02 Monitoring, Logging, and Remediation Practice Test 18 — 15 Questions

Question 1

A SysOps administrator notices that an EC2 instance's CPU utilization has been at 100% for the past hour. The administrator checks CloudWatch metrics and sees no anomalies in network or disk I/O. Which step should the administrator take to investigate further?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable detailed monitoring on the EC2 instance to get 1-minute CloudWatch metrics.. Detailed monitoring (1-minute metrics) provides higher-resolution data than the default 5-minute metrics, allowing the administrator to identify short-lived CPU spikes or patterns that might be averaged out in the standard 5-minute interval. Since network and disk I/O appear normal, the issue is likely a process or application consuming CPU, and finer-grained metrics help pinpoint the timing and correlate with specific events or logs.

Answer

Install the CloudWatch Logs agent on the instance to capture system logs.

Answer

Check the EC2 instance's CPU credit balance in CloudWatch.

Answer

Stop the EC2 instance and start it again to reset the CPU.

Question 2

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The function fails intermittently with a timeout error. What should the SysOps administrator do to monitor and resolve this issue?

Accepted Answer

Increase the Lambda function timeout and review the function logs in CloudWatch Logs.. Increasing the Lambda function timeout directly addresses the intermittent timeout error by allowing the function more time to complete execution before Lambda terminates it. Reviewing CloudWatch Logs is essential to identify the root cause, such as slow downstream dependencies or inefficient code, enabling targeted optimization. This approach aligns with standard troubleshooting for Lambda timeout issues.

Answer

Place the S3 bucket in a different AWS region to reduce latency.

Answer

Enable provisioned concurrency for the Lambda function.

Answer

Configure EC2 Auto Scaling to launch more instances for the Lambda function.

Question 3

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator needs to be notified if the ALB's error rate exceeds 5% for 5 consecutive minutes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use a CloudWatch alarm on the ALB's 'HTTPCode_ELB_5XX_Count' metric with a math expression to calculate error rate.. CloudWatch can directly monitor the ALB's 'HTTPCode_ELB_5XX_Count' metric and combine it with the 'RequestCount' metric using a math expression to calculate the error rate as a percentage. This approach requires no additional logging or external services, and a CloudWatch alarm can be configured to trigger an SNS notification when the error rate exceeds 5% for 5 consecutive minutes, minimizing operational overhead.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena to detect error rates.

Answer

Enable CloudTrail for the ALB and create a metric filter for 5xx errors.

Answer

Use AWS Config rules to monitor the ALB configuration and trigger a notification on changes.

Question 4

A SysOps administrator is troubleshooting an EC2 instance that is unresponsive. The administrator can SSH into the instance but finds that the CloudWatch agent is not sending custom metrics. The CloudWatch agent configuration file is at '/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'. What should the administrator check first?

Accepted Answer

Verify that the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy.. The correct first check is to verify the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy. The CloudWatch agent uses the instance's IAM role to obtain credentials for publishing metrics to CloudWatch. Without this policy, the agent will fail to send custom metrics even if it is running correctly and the instance has network connectivity.

Answer

Ensure that the IAM user has permissions to access CloudWatch.

Answer

Check if the security group allows outbound traffic on port 443.

Answer

Run 'sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status' to check the agent status.

Question 5

A company wants to centrally collect and analyze logs from all AWS accounts in an organization. The logs include CloudTrail, VPC Flow Logs, and AWS Config logs. Which solution is the most scalable and cost-effective?

Accepted Answer

Configure each account to deliver logs to a centralized S3 bucket and use Amazon Athena to query them.. It uses a centralized S3 bucket to aggregate logs from all accounts, which is highly scalable and cost-effective due to S3's low storage costs and lifecycle policies. Amazon Athena then allows serverless, pay-per-query analysis of the logs without needing to provision or manage any infrastructure, making it ideal for ad-hoc and cross-account log analysis.

Answer

Stream all logs to a central CloudWatch Logs account using cross-account subscriptions.

Answer

Use CloudWatch Logs Insights to query logs from each account individually.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to an Amazon Elasticsearch Service cluster.

Question 6

A company has deployed a web application on EC2 instances with an Auto Scaling group. The SysOps administrator needs to automatically replace any instance that is in a 'failed' status as reported by the EC2 status checks. Which action should the administrator take?

Accepted Answer

Configure the Auto Scaling group to use EC2 status checks for health checks.. An Auto Scaling group can be configured to use EC2 status checks (both system and instance) as the health check type. When the status check reports a failed status, the Auto Scaling group automatically terminates the unhealthy instance and launches a new one to replace it, ensuring self-healing without manual intervention.

Answer

Create an AWS Config rule to detect failed status checks and trigger a remediation action.

Answer

Create an AWS Lambda function that stops and starts the failed instance.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and trigger an SNS notification.

Question 7

A SysOps administrator receives a notification that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. What is the immediate impact on the application?

Accepted Answer

The Auto Scaling group will launch a new instance to replace the failed one, potentially causing temporary downtime.. When an EC2 instance fails a status check, the Auto Scaling group detects the failure and initiates a replacement by launching a new instance. However, the failed instance is not immediately terminated; it may remain in a stopped or impaired state until the replacement is fully in service, which can cause temporary downtime for the application if the instance was actively handling traffic.

Answer

The instance is still accessible and serving traffic.

Answer

The instance is immediately terminated.

Answer

The instance is automatically stopped and started.

Question 8

A SysOps administrator needs to receive alerts when an S3 bucket is publicly accessible. Which TWO AWS services can be used to monitor and detect this configuration?

Accepted Answer

AWS Security Hub. AWS Security Hub (B) is correct because it aggregates security findings from multiple AWS services, including Amazon GuardDuty and AWS Config, and can detect publicly accessible S3 buckets via its built-in security standards (e.g., CIS AWS Foundations Benchmark). AWS Config (D) is correct because it can evaluate S3 bucket configurations against rules, such as the managed rule 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited', and trigger alerts when a bucket becomes publicly accessible.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Question 9

A company uses CloudWatch Logs to monitor application logs. The SysOps administrator wants to search for specific error patterns across multiple log groups. Which THREE AWS services can be used to achieve this?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is correct because it is a native AWS service designed specifically for querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) across multiple log groups to search for specific error patterns, making it a direct and efficient solution for this use case without requiring data export or additional infrastructure.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Question 10

A SysOps administrator notices that an EC2 instance's CPU utilization has been at 100% for the past hour. The administrator checks CloudWatch metrics and sees no anomalies in network or disk I/O. Which step should the administrator take to investigate further?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Auto Scaling cooldown period is preventing additional scaling activities.. The most likely cause is that the Auto Scaling cooldown period is preventing additional scaling activities. When a scaling activity completes, a cooldown period (default 300 seconds) starts during which the Auto Scaling group ignores additional CloudWatch alarms to allow metrics to stabilize. If the instance has been above 90% CPU for an hour but no new instances launched, the cooldown period may have been triggered by a previous scaling event and is still active, blocking further scale-out actions despite sustained high utilization.

Answer

The EC2 instance is in a private subnet and cannot communicate with the Auto Scaling service.

Answer

The CloudWatch alarm is publishing to an S3 bucket that is full.

Answer

The scaling policy is based on memory utilization, not CPU.

Question 11

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Windows Server. Which steps are required to collect memory metrics?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the instance.. Amazon CloudWatch does not collect memory metrics from EC2 instances by default; it only captures hypervisor-level metrics such as CPU, network, and disk I/O. To monitor in-guest memory utilization on a Windows Server instance, you must install and configure the Amazon CloudWatch agent, which sends custom metrics (e.g., Memory % Committed Bytes In Use) to CloudWatch. The agent uses the Windows Performance Monitor (PerfMon) counters to gather this data.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and use Run Command.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Use the AWS Management Console to enable memory monitoring.

Question 12

A company runs a web application on EC2 instances behind an Application Load Balancer. The SysOps administrator creates a CloudWatch alarm on the ALB's HTTPCode_ELB_5XX_Count metric to trigger an SNS notification when there are many 5xx errors. However, the alarm remains in INSUFFICIENT_DATA state. What is a likely cause?

Accepted Answer

The ALB and the CloudWatch alarm are in different AWS Regions.. CloudWatch alarms can only evaluate metrics from the same AWS Region in which the alarm is created. If the ALB and the CloudWatch alarm are in different Regions, the alarm will never receive metric data points, causing it to remain in INSUFFICIENT_DATA state. This is a common cross-Region limitation for CloudWatch metrics.

Answer

The HTTPCode_ELB_5XX_Count metric is not available for ALBs.

Answer

The IAM role for CloudWatch does not have permission to read the ALB metrics.

Answer

The alarm's period is set to 1 minute, but the metric is published every 5 minutes.

Question 13

A SysOps administrator needs to ensure that all S3 buckets in the account are logged to CloudTrail for data events. The administrator enables CloudTrail with data events for S3 and selects 'All buckets' in the current account. However, after a week, they notice that some buckets are not being logged. What is the most likely reason?

Accepted Answer

The S3 buckets are in a different AWS Region from the CloudTrail trail.. The most likely reason some buckets are not being logged is that those buckets reside in a different AWS Region than the one where the CloudTrail trail is configured. If the administrator creates a single-region trail and selects ‘All buckets’ for data events, the trail will only capture data events for S3 buckets in that specific region. Buckets in other regions will not be logged, resulting in partial logging coverage. Option C correctly identifies this regional mismatch.

Answer

The IAM user who created the trail does not have s3:PutObject permissions on the buckets.

Answer

The S3 buckets do not have a bucket policy that allows CloudTrail to write the log files.

Answer

The S3 buckets have server access logging enabled, which conflicts with CloudTrail logging.

Question 14

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending a notification via Amazon SNS, when a status check fails. This is the native AWS service designed for real-time monitoring and alerting on metric thresholds, making it the correct choice for this use case.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 15

A company has an application that writes logs to CloudWatch Logs. The SysOps administrator needs to search for a specific error pattern across multiple log groups. Which solution is the most efficient?

Accepted Answer

Use CloudWatch Logs Insights to query the log groups.. CloudWatch Logs Insights is purpose-built for interactive ad-hoc querying of log data across multiple log groups, enabling efficient pattern matching and filtering without requiring pre-configured infrastructure. It uses a dedicated query language optimized for searching, aggregating, and analyzing log events, making it the most efficient solution for searching a specific error pattern across multiple log groups.

Answer

Create a CloudWatch dashboard to visualize log data.

Answer

Create a metric filter to count the error pattern.

Answer

Create a subscription filter to stream logs to Amazon ES.