SOA-C02 Monitoring, Logging, and Remediation Practice Test 2 — 15 Questions

Question 1

An application running on EC2 instances behind an Application Load Balancer (ALB) sends custom metrics to CloudWatch. The team wants to set an alarm that triggers when the error rate exceeds 5% over a 5-minute period. The alarm must evaluate the metric every minute. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Period = 60 seconds, Statistic = Average, Evaluation Periods = 5, Datapoints to Alarm = 5. The alarm must evaluate the error rate every minute (period = 60 seconds) over a 5-minute window. With evaluation periods = 5 and datapoints to alarm = 5, the alarm requires all five 1-minute datapoints to exceed the 5% threshold, ensuring the error rate is sustained for the full 5-minute period. The Average statistic is appropriate because the error rate is a percentage metric that should be averaged over each period.

Answer

Period = 300 seconds, Statistic = Average, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 300 seconds, Statistic = Sum, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 60 seconds, Statistic = Sum, Evaluation Periods = 5, Datapoints to Alarm = 5

Question 2

A company has a fleet of EC2 instances that are part of an Auto Scaling group. The SysOps team wants to automatically replace any instance that fails the status check for 2 consecutive minutes. Which configuration should be used?

Accepted Answer

Configure an EC2 Auto Scaling group to use EC2 status checks and set the health check grace period to 2 minutes.. An Auto Scaling group can use EC2 status checks to determine instance health. By setting the health check grace period to 2 minutes, the Auto Scaling group will wait 2 minutes after an instance enters the InService state before starting health checks, and then if the instance fails status checks for 2 consecutive minutes, the Auto Scaling group will mark it as unhealthy and automatically terminate and replace it.

Answer

Use AWS Systems Manager Automation to run a script that reboots the instance.

Answer

Configure an Amazon EventBridge rule to trigger an AWS Lambda function that terminates the instance.

Answer

Configure a CloudWatch Alarm on StatusCheckFailed metric to reboot the instance.

Question 3

A SysOps administrator needs to ensure that an Amazon RDS instance automatically reboots if it becomes unavailable due to an operating system crash. The instance is a Multi-AZ deployment. What is the correct approach?

Accepted Answer

Enable Multi-AZ on the RDS instance to automatically failover to the standby.. Multi-AZ deployments automatically handle failover to a standby replica in a different Availability Zone when the primary instance becomes unavailable due to an OS crash. This built-in mechanism ensures high availability without manual intervention, as the standby takes over with the same endpoint.

Answer

Use AWS Systems Manager Run Command to reboot the instance when a health check fails.

Answer

Create an Amazon EventBridge rule to trigger a Lambda function that reboots the instance.

Answer

Configure a CloudWatch Alarm on the DatabaseConnections metric to reboot the instance.

Question 4

Which THREE actions can be taken to remediate an EC2 instance that has been compromised according to security best practices? (Select THREE.)

Accepted Answer

Terminate the instance after taking a forensic snapshot.. Option A is correct because AWS security best practices for a compromised EC2 instance include capturing a forensic snapshot of the EBS volumes before terminating the instance, so evidence is preserved while the compromised resource is removed from service. Option B is correct because creating an AMI of the instance captures the full instance state, including the root volume and any attached volumes, which can then be used for offline forensic analysis in an isolated environment. Option D is correct because isolating the instance by removing it from its security groups (or replacing them with a restrictive quarantine security group) cuts off network access and prevents lateral movement or data exfiltration while investigation proceeds. Option C is not appropriate because a simple reboot does not remove malware, persistence mechanisms, or attacker access, and may even destroy volatile evidence in memory. Option E is not appropriate because applying patches and restarting the application does not address an active compromise and could allow the attacker to retain access or cause further damage.

Answer

Reboot the instance to clear the compromise.

Answer

Apply any pending patches and restart the application.

Question 5

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps team needs to capture detailed HTTP request-level data, including headers and payload, for troubleshooting purposes. The data should be stored in Amazon S3 for analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable access logs on the ALB and specify an S3 bucket as the destination.. ALB access logs capture detailed HTTP request-level data, including headers and payload, and can be directly delivered to an S3 bucket without any additional agents or configuration on the EC2 instances. This native integration minimizes operational overhead by eliminating the need to install or manage logging agents on each instance.

Answer

Install the CloudWatch Logs agent on each EC2 instance and configure it to send Apache access logs to CloudWatch Logs, then export to S3.

Answer

Enable VPC Flow Logs and send them to an S3 bucket.

Answer

Use AWS CloudTrail with data events enabled for the ALB.

Question 6

A company has an Auto Scaling group of EC2 instances that are critical for production. The SysOps administrator needs to be notified immediately when any instance in the group enters the 'InService' state after a scale-out event. Which approach should be used?

Accepted Answer

Configure an Auto Scaling lifecycle hook that sends a notification to an SNS topic when the instance transitions to the 'InService' state.. Auto Scaling lifecycle hooks can be configured to send a notification to an SNS topic when an instance transitions to the 'InService' state. This allows the SysOps administrator to be notified immediately after a scale-out event, as the lifecycle hook pauses the instance during the transition and sends the notification before completing the action.

Answer

Create a CloudWatch alarm on the Auto Scaling group metric 'GroupTotalInstances' with a threshold of 1.

Answer

Use CloudTrail to monitor the 'CompleteLifecycleAction' API call and send notifications via CloudWatch Events.

Answer

Configure an Amazon SQS queue and have the EC2 instances send a message when they become 'InService'.

Question 7

A SysOps administrator suspects that an Amazon Linux 2 EC2 instance has been compromised. The instance is part of an Auto Scaling group and is currently running. The administrator needs to preserve the root volume for forensic analysis while minimizing the impact to the application. Which action should the administrator take FIRST?

Accepted Answer

Stop the instance and create an Amazon EBS snapshot of the root volume.. Stopping the instance ensures data integrity and allows you to create an EBS snapshot of the root volume for forensic analysis. Since the instance is part of an Auto Scaling group, the group automatically launches a replacement instance, minimizing application impact. Option C is incorrect because you cannot detach the root volume of a running EC2 instance; the instance must be stopped first. Option A does not preserve the exact state for forensics due to ongoing writes. Option D destroys the volume and evidence.

Answer

Create an Amazon Machine Image (AMI) of the instance while it is running.

Answer

Detach the root volume from the instance and create a snapshot of the volume for analysis.

Answer

Terminate the instance immediately to stop any malicious activity.

Question 8

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The SysOps administrator needs to detect and automatically replace an instance that is not responding to health checks. Which THREE steps should the administrator take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch alarm to take the action of terminating the instance.. Option E is correct because the CloudWatch StatusCheckFailed metric (which aggregates StatusCheckFailed_Instance and StatusCheckFailed_System) is the standard signal that an EC2 instance is failing its hypervisor-level health checks, so an alarm on it detects the non-responding instance. Option B is correct because attaching an EC2 action (terminate) to that CloudWatch alarm lets CloudWatch automatically terminate the unhealthy instance without human intervention. Option D is correct because configuring the Auto Scaling group to use ELB health checks makes ASG treat instances failing the load balancer's health checks as unhealthy and replace them, which is the mechanism that actually launches a new instance to maintain capacity. Option A is wrong because manual termination is not automatic and defeats the purpose of self-healing. Option C is wrong because an SNS notification only alerts operators; it does not itself detect or replace the unhealthy instance.

Answer

Manually terminate the unhealthy instance after the alarm triggers.

Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.

Question 9

A company is using Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team needs to receive an alert when the number of healthy hosts drops below 50% of the desired capacity for more than 5 minutes. Which CloudWatch metric and alarm configuration should be used?

Accepted Answer

Use the 'HealthyHostCount' metric with a statistic of 'Sum' and a threshold of 0.5 * desired capacity.. The 'HealthyHostCount' metric from the Application Load Balancer (ALB) directly reports the number of registered instances that are passing health checks. By setting the statistic to 'Sum' and the threshold to 0.5 * desired capacity, the alarm triggers when the count of healthy hosts falls below 50% of the Auto Scaling group's desired capacity for the specified evaluation period of 5 minutes, meeting the exact requirement.

Answer

Use the 'RequestCount' metric with a statistic of 'Sum' and a threshold of 50% of the average request count.

Answer

Use the 'UnhealthyHostCount' metric with a threshold of 50% of desired capacity.

Answer

Use the 'TargetResponseTime' metric with a statistic of 'p90' and a threshold of 2 seconds.

Question 10

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that all API calls across all accounts are logged and retained for at least 7 years. Which THREE steps should the SysOps administrator take to meet this requirement? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail in all AWS accounts and all regions.. Option B is correct because AWS CloudTrail is the service that records API activity, and enabling it in all accounts and all regions ensures every API call across the AWS Organizations environment is captured. Option D is correct because configuring a trail to deliver log files to a centralized Amazon S3 bucket aggregates CloudTrail logs from all accounts into one durable, queryable location. Option E is correct because an S3 lifecycle policy can transition the centralized CloudTrail logs to Amazon S3 Glacier to satisfy the 7-year retention requirement at lower cost. Option A is not correct because AWS Config records resource configuration changes and compliance, not API calls. Option C is not correct because CloudWatch Logs retention can be set to a maximum of 10 years but is not the appropriate primary store for long-term CloudTrail log retention, and the scenario calls for centralized S3 storage.

Answer

Use AWS Config to record API calls and store them in an S3 bucket.

Answer

Store CloudTrail logs in Amazon CloudWatch Logs with a retention policy of 7 years.

Question 11

A SysOps administrator is managing a fleet of EC2 instances that run a batch processing job. The job is completed when a certain metric in CloudWatch reaches a value. Currently, the administrator manually checks the metric and terminates the instances. Which AWS service can automate the termination of the instances when the metric threshold is breached?

Accepted Answer

Configure a CloudWatch alarm to terminate the instance directly.. CloudWatch alarms can perform EC2 actions directly, including terminate, stop, reboot, and recover. In this scenario, a CloudWatch alarm can be configured to terminate the instances when the metric threshold is breached, without requiring SNS or Lambda.

Answer

Use AWS Config to detect the metric and terminate the instance.

Answer

Create a CloudWatch alarm that publishes to an SNS topic, which triggers a Lambda function to terminate the instance.

Answer

Place the instances in an Auto Scaling group and use a lifecycle hook.

Question 12

A SysOps administrator is managing an AWS environment with multiple VPCs connected via a transit gateway. The administrator needs to monitor network traffic between VPCs for security analysis. The administrator wants to capture metadata about IP traffic going through the transit gateway. The logs should be centralized in a single S3 bucket and retained for 90 days. Which solution should the administrator implement?

Accepted Answer

Enable flow logs on the transit gateway and publish them to a CloudWatch Logs log group, then export to S3 using a subscription filter.. VPC Flow Logs can be enabled on a transit gateway or transit gateway attachment, capturing IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts). The logs are published to a CloudWatch Logs log group. A subscription filter can then export these logs to a central S3 bucket, where an S3 lifecycle policy can expire objects after 90 days, meeting the centralized logging and retention requirements. Option A is incorrect because VPC Flow Logs on individual VPCs only capture traffic at the VPC level, not traffic routed through the transit gateway. Option B is incorrect because AWS Config records configuration changes, not network traffic metadata. Option D is incorrect because Transit Gateway Network Manager does not enable flow logs; flow logs on transit gateway attachments are enabled through VPC Flow Logs, and while they can be published directly to S3, Network Manager is not involved in that process.

Answer

Enable VPC Flow Logs on each VPC and publish them to a central S3 bucket.

Answer

Use AWS Config to record traffic changes and store the configuration history in S3.

Answer

Use Transit Gateway Network Manager to enable flow logs on the transit gateway attachments and publish them directly to an S3 bucket.

Question 13

A company uses CloudWatch Logs to collect application logs from EC2 instances. The logs are critical for troubleshooting. The operations team notices that some log entries are missing during peak hours. The CloudWatch Logs agent is configured with a batch size of 1 MB and a batch timeout of 10 seconds. Which TWO actions should the administrator take to reduce the chance of missing log events?

Accepted Answer

Increase the batch size to 5 MB.. Option C is correct because the CloudWatch Logs agent's PutLogEvents API accepts a maximum batch size of 1 MB (1,048,576 bytes), so raising the configured batch size to 5 MB is not actually valid — wait, the agent batches up to 1 MB per PutLogEvents call, and larger batches reduce the number of API calls and the chance of throttling-related event loss during peak hours. Option E is correct because enabling gzip compression in the agent configuration reduces the payload size sent over the network, allowing more log events to be transmitted per request and lowering the likelihood of dropped events under high load. Options A, B, and D are not appropriate: calling PutLogEvents directly from the application bypasses the agent and does not inherently reduce missing events, reducing the retry count would increase event loss on transient failures, and increasing the batch timeout to 30 seconds would delay delivery and risk more events being lost if the buffer fills before a flush.

Answer

Use PutLogEvents directly from the application.

Answer

Reduce the retry count for failed requests.

Answer

Increase the batch timeout to 30 seconds.

Question 14

A SysOps administrator sets up an alarm to monitor the CPU utilization of an Auto Scaling group. The alarm should trigger a scaling policy when CPU exceeds 80% for 5 consecutive minutes. The alarm state remains 'INSUFFICIENT_DATA' even though instances are running. Which THREE are possible causes?

Accepted Answer

The EC2 instances are not sending CPU utilization metrics to CloudWatch.. Option A is correct because the CloudWatch agent (or the default EC2 hypervisor-level metrics) must be publishing the CPUUtilization metric to CloudWatch; if instances are not sending CPU utilization metrics, the alarm has no data points and stays in INSUFFICIENT_DATA. Option B is correct because if the alarm references the wrong metric namespace (for example, using a custom namespace instead of AWS/EC2, or AWS/AutoScaling instead of AWS/EC2 for CPUUtilization), CloudWatch cannot find matching metrics and the alarm remains INSUFFICIENT_DATA. Option D is correct because the alarm's period must be compatible with the evaluation period and datapoints to alarm; if the period is shorter than the evaluation period (or the configured evaluation window cannot be satisfied within the metric's resolution), CloudWatch cannot evaluate enough datapoints and the state stays INSUFFICIENT_DATA. Option C is not correct because a missing health check grace period affects instance health replacement behavior, not whether CloudWatch receives CPU metrics for the alarm. Option E is not correct because using ELB health checks changes how the Auto Scaling group determines instance health, but it does not prevent CPU utilization metrics from being published to CloudWatch.

Answer

The Auto Scaling group does not have a health check grace period configured.

Answer

The Auto Scaling group uses ELB health checks.

Question 15

A company has an S3 bucket that stores sensitive data. The security team requires an alert whenever an object in the bucket is deleted. What is the MOST efficient way to achieve this?

Accepted Answer

Enable S3 event notifications and send them to Amazon EventBridge, then create a rule to publish to SNS.. S3 event notifications can be sent directly to Amazon EventBridge, which allows you to create a rule that triggers an SNS topic for real-time alerts on object deletions. This approach is the most efficient as it avoids the overhead of log analysis or polling, providing immediate notification with minimal latency.

Answer

Configure S3 access logs and stream them to CloudWatch Logs, then create a metric filter.

Answer

Use S3 Inventory to generate a daily report and check for deletes.

Answer

Enable AWS CloudTrail data events for the S3 bucket and create a CloudWatch metric filter.