SOA-C02 Monitoring, Logging, and Remediation Practice Test 19 — 15 Questions

Question 1

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 2

A SysOps administrator needs to ensure that all API calls in the AWS account are logged for auditing purposes. The administrator also wants to receive notifications when specific API calls are made. Which THREE services should the administrator use together to achieve this? (Choose THREE.)

Accepted Answer

Amazon EventBridge. AWS CloudTrail (Option E) is the primary service for logging all API calls in an AWS account, capturing detailed event records. Amazon CloudWatch Logs (Option D) can receive these CloudTrail events for centralized log storage and monitoring. Amazon EventBridge (Option A) can then be used to create rules that match specific API calls and trigger notifications, such as sending messages to an SNS topic, enabling real-time alerting.

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 3

A SysOps administrator wants to monitor the CPU utilization of an Amazon RDS instance and receive an alert if it exceeds 90% for 5 consecutive minutes. Which TWO AWS services are required to set up this monitoring? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch is the service that collects and stores metrics such as CPU utilization from RDS instances. Amazon CloudWatch Alarms allow you to set a threshold (e.g., CPU > 90%) and evaluate it over a specified period (e.g., 5 consecutive minutes) to trigger an action, such as sending a notification via SNS.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Answer

Amazon RDS Enhanced Monitoring

Question 4

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) for traffic distribution. The SysOps administrator has configured a CloudWatch alarm to monitor the ALB's `TargetResponseTime` metric, with a threshold of 5 seconds. The alarm triggers when the average response time exceeds 5 seconds for 2 consecutive periods. Recently, the alarm has been triggering frequently during peak hours, but the application team reports that the response time is acceptable and the application is performing normally. The administrator investigates and finds that a small number of requests are taking a very long time (over 30 seconds), skewing the average. The administrator needs to reduce the number of false alarms while still being alerted if the overall application performance degrades. Which course of action should the administrator take?

Accepted Answer

Change the statistic to p95 and keep the threshold at 5 seconds. The correct answer is A because using the p95 (95th percentile) statistic instead of the average filters out the impact of the small number of outlier requests that take over 30 seconds. The p95 metric shows the response time below which 95% of requests fall, providing a more accurate representation of typical application performance. This reduces false alarms from skewed averages while still alerting if the majority of users experience degraded response times exceeding 5 seconds.

Answer

Increase the threshold to 30 seconds

Answer

Decrease the period to 60 seconds and lower the threshold to 3 seconds

Answer

Increase the evaluation periods to 5 consecutive periods

Question 5

A SysOps administrator notices that an EC2 instance's CPU utilization is consistently above 90% during business hours. The instance is part of an Auto Scaling group with a scaling policy based on average CPU utilization. Despite high utilization, no scaling events are triggered. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is too long, preventing new scaling activities.. The most likely cause is that the scaling policy has a cooldown period that is too long. After a scaling activity completes, the Auto Scaling group enters a cooldown period that prevents additional scaling activities from being triggered until the cooldown expires. If the cooldown period is set too long (e.g., 600 seconds or more), the group will not launch new instances even if the CloudWatch alarm remains in ALARM state with high CPU utilization, because the scaling policy is blocked from executing.

Answer

The instance type is not supported by the Auto Scaling group's launch configuration.

Answer

The CloudWatch alarm is in the ALARM state but the Auto Scaling group has a suspended process for Add instances.

Answer

The Auto Scaling group's health check type is set to ELB, causing the instance to be marked unhealthy.

Question 6

A company has an application running on EC2 instances that sends logs to CloudWatch Logs. The operations team wants to receive a notification when a specific error pattern appears in the logs. Which combination of steps should the team take? (Select TWO.)

Accepted Answer

Create a CloudWatch alarm on the metric to trigger an SNS notification.. Option A is correct because a CloudWatch alarm can be configured to trigger an SNS notification when a metric crosses a defined threshold. In this scenario, the metric is derived from a metric filter that counts occurrences of the specific error pattern in the log group. The alarm monitors that metric and sends an SNS notification to subscribed endpoints, such as the operations team's email addresses, providing the required alert.

Answer

Enable CloudTrail to capture the log events and send to S3.

Answer

Create an SNS topic and subscribe the operations team's email addresses.

Answer

Create a subscription filter to send logs to Lambda for analysis.

Question 7

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Amazon Linux 2. Which of the following is required to publish memory metrics to CloudWatch?

Accepted Answer

Install and configure the CloudWatch agent on the instance.. The CloudWatch agent is specifically designed to collect custom metrics, such as memory utilization, from EC2 instances and publish them to CloudWatch. Unlike the default EC2 monitoring, which only captures hypervisor-level metrics (CPU, network, disk), memory utilization requires an in-guest agent to read from the operating system's /proc/meminfo or similar interfaces. The CloudWatch agent can be configured via a JSON file to collect memory metrics and send them to CloudWatch using the PutMetricData API.

Answer

Use the CloudWatch Logs agent to parse memory usage from system logs.

Answer

Enable detailed monitoring on the instance.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and configure it to send metrics.

Question 8

An application running on an EC2 instance writes logs to a local file. The operations team needs to monitor these logs in near real-time for troubleshooting. Which solution provides the most efficient way to stream these logs to CloudWatch Logs?

Accepted Answer

Install the CloudWatch Logs agent on the instance and configure it to tail the log file.. The CloudWatch Logs agent (or the newer unified CloudWatch agent) is designed specifically to tail log files from EC2 instances and stream them to CloudWatch Logs in near real-time. This provides the most efficient solution because it continuously monitors the file for new entries and sends them with minimal latency, without requiring periodic uploads or complex event-driven pipelines.

Answer

Use the AWS CLI to periodically upload the log file using the put-log-events command.

Answer

Install the Amazon Kinesis Agent on the instance and configure it to send logs to CloudWatch Logs.

Answer

Configure the application to write logs to an S3 bucket and use S3 Event Notifications to trigger a Lambda function that puts logs to CloudWatch.

Question 9

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to send logs to CloudWatch Logs. Which steps are necessary to allow this without traversing the internet? (Select TWO.)

Accepted Answer

Attach an IAM role to the instance with permissions to call PutLogEvents.. Option B is correct because the EC2 instance must have an IAM role attached that includes permissions for `logs:PutLogEvents` to authenticate and authorize log delivery to CloudWatch Logs. Without this role, the instance cannot sign API requests, even if network connectivity exists. Option C is correct because a VPC endpoint for CloudWatch Logs (com.amazonaws.region.logs) provides private connectivity via AWS PrivateLink, allowing the instance to send logs without traversing the internet or a NAT gateway.

Answer

Place the instance in a public subnet with a public IP.

Answer

Ensure the instance is in the default VPC.

Answer

Attach a NAT gateway to the private subnet's route table.

Question 10

A SysOps administrator wants to be alerted when an EC2 instance is terminated unexpectedly. Which CloudWatch event should be used to trigger a notification?

Accepted Answer

An Amazon EventBridge rule that matches EC2 Instance State-change Notification events.. Option D is correct because Amazon EventBridge can capture EC2 Instance State-change Notification events, which are emitted whenever an EC2 instance transitions between states (e.g., running, stopped, terminated). By creating a rule that matches the 'terminated' state, the administrator can trigger an SNS notification or Lambda function to alert on unexpected termination, providing a real-time, event-driven response.

Answer

A CloudWatch alarm on the CPUUtilization metric dropping to zero.

Answer

A CloudTrail trail that logs TerminateInstances API calls.

Answer

A CloudWatch alarm on the StatusCheckFailed metric.

Question 11

An organization has a CloudWatch dashboard that displays metrics for multiple AWS services. The dashboard is shared with the operations team. Recently, some team members reported that the dashboard is not loading for them. Which action should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Confirm that the team members have the necessary IAM permissions for cloudwatch:GetDashboard.. The most likely cause of the dashboard not loading is that the team members lack the required IAM permission to retrieve the dashboard definition. CloudWatch dashboards are stored as JSON objects, and the `cloudwatch:GetDashboard` action is necessary to fetch and render that data in the console. Without this permission, the API call fails silently, resulting in a blank or non-loading dashboard.

Answer

Verify that the team members have subscribed to the metric streams.

Answer

Ensure the CloudWatch agent is installed on the instances displaying the dashboard.

Answer

Check that the dashboard is in the same region as the resources.

Question 12

A company is using AWS CloudTrail to log API activity in their account. The security team needs to be alerted when an IAM user creates a new access key. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and targets an SNS topic.. Option C is correct because Amazon EventBridge can directly match the `CreateAccessKey` API call from CloudTrail and trigger an SNS topic to send an alert in real time, requiring no custom code or polling. This provides the least operational overhead by using a fully managed, event-driven rule.

Answer

Enable CloudTrail email notifications for management events.

Answer

Configure the IAM user's permissions to require MFA for access key creation.

Answer

Write a Lambda function that periodically scans CloudTrail logs in S3 and sends alerts.

Question 13

A SysOps administrator is troubleshooting an application that runs on an EC2 instance. The application is experiencing high latency, and the administrator suspects a memory leak. Which metrics should the administrator examine first?

Accepted Answer

Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.. A memory leak causes the application to consume increasing amounts of memory over time, leading to high latency as the OS begins swapping or the kernel reclaims memory. The CloudWatch agent can publish custom metrics like `mem_used_percent`, which directly tracks memory usage percentage and is the most relevant metric to confirm a memory leak. Default EC2 metrics do not include memory utilization, so the administrator must rely on custom metrics from the CloudWatch agent.

Answer

CloudWatch metrics from the Detailed Monitoring feature, such as DiskReadOps.

Answer

CloudWatch metrics for the instance's Elastic Network Interface.

Answer

CloudWatch default EC2 metrics, such as CPUUtilization and NetworkIn.

Question 14

A company has a production environment with multiple EC2 instances running a web application. The SysOps administrator wants to automate the remediation of instances that fail the EC2 status check. Which approach should the administrator use?

Accepted Answer

Create an Amazon EventBridge rule that matches EC2 status check failures and triggers an AWS Lambda function to terminate the instance and launch a new one.. Option C is correct because it provides a fully automated, event-driven remediation workflow. When an EC2 instance fails a status check, an EventBridge rule detects the state change and triggers a Lambda function that terminates the unhealthy instance and launches a replacement. This approach directly addresses the requirement to automate remediation without manual intervention.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure an SNS notification to alert the team.

Answer

Use AWS Systems Manager Automation to create a document that runs a script on the instance to fix the issue.

Answer

Configure the Auto Scaling group's health check to use EC2 status checks and set a custom termination policy.

Question 15

A SysOps administrator needs to audit all changes to security groups in an AWS account. Which AWS service should be used to capture these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including all CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and DeleteSecurityGroup API actions. By enabling CloudTrail trail logging, the SysOps administrator can capture a complete audit trail of who made changes, when, and from which source IP, which is essential for security group change auditing.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Answer

AWS Config