SOA-C02 Monitoring, Logging, and Remediation Practice Test 20 — 15 Questions

Question 1

An application is running on an EC2 instance and is experiencing intermittent connection timeouts. The SysOps administrator wants to capture network traffic to analyze the issue. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including accepted and rejected connection attempts. This allows the SysOps administrator to analyze the source/destination IPs, ports, protocols, and whether the traffic was allowed or denied, which is essential for diagnosing intermittent connection timeouts.

Answer

CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 2

A company uses AWS Organizations to manage multiple accounts. The security team needs a centralized view of all API calls made across all accounts. Which solution should the SysOps administrator implement?

Accepted Answer

Create a CloudTrail trail in the management account that logs events for all accounts in the organization.. Option B is correct because AWS CloudTrail supports an organization trail that, when created in the management account, automatically logs API calls for all member accounts in the AWS Organization. This provides a centralized, single point of access to all API activity across the organization without needing to configure individual trails per account.

Answer

Use AWS Config aggregator to view configuration changes across accounts.

Answer

Use CloudWatch cross-account dashboards to view metrics from all accounts.

Answer

Enable CloudTrail in each account and have each account send logs to its own S3 bucket.

Question 3

A SysOps administrator is investigating a security incident and needs to determine who deleted an S3 bucket. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across AWS services, including S3 bucket deletion events. When a user or role deletes an S3 bucket, CloudTrail logs the `DeleteBucket` API call with details such as the IAM user or role, source IP address, and timestamp, enabling the administrator to identify the responsible entity.

Answer

AWS Trusted Advisor

Answer

S3 server access logs

Answer

CloudWatch Logs for the S3 service

Question 4

A company has a CloudWatch alarm that monitors the CPU utilization of an EC2 instance. The alarm is set to trigger when CPU utilization exceeds 80% for 5 consecutive minutes. The alarm state is 'INSUFFICIENT_DATA'. What does this mean?

Accepted Answer

The alarm does not have enough data to determine the state.. The INSUFFICIENT_DATA state in CloudWatch indicates that the alarm has not received enough metric data points to evaluate whether the threshold (CPU utilization > 80% for 5 consecutive minutes) has been breached. This typically occurs when the EC2 instance is newly launched, the CloudWatch agent is not reporting, or there are gaps in metric collection due to network issues or instance stops. It does not imply any conclusion about the CPU utilization level itself.

Answer

The CPU utilization is below 80% for 5 minutes.

Answer

The CPU utilization has exceeded 80% for 5 minutes.

Answer

The alarm is missing data points for the past 5 minutes.

Question 5

A SysOps administrator needs to set up monitoring for an application that runs on an EC2 instance. The application generates custom metrics that should be available for analysis in CloudWatch. Which steps are required to achieve this? (Select TWO.)

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to call PutMetricData.. Option A is correct because the EC2 instance must have an IAM role attached with permissions to call PutMetricData, which authorizes the instance to publish custom metrics to CloudWatch. Without this IAM role, any attempt to send metrics from the instance will fail due to missing credentials.

Answer

Create an SNS topic and subscribe the application to send metrics.

Answer

Install the CloudWatch Logs agent to send custom metrics.

Answer

Enable detailed monitoring on the EC2 instance to collect custom metrics.

Question 6

A company is using AWS CloudTrail to log API activity. The security team wants to be notified when an IAM user attempts to modify an S3 bucket policy. Which actions should be taken to meet this requirement? (Select THREE.)

Accepted Answer

Create an Amazon EventBridge rule that matches the PutBucketPolicy API call via CloudTrail.. Option C is correct because Amazon EventBridge can match specific API calls (like PutBucketPolicy) by using CloudTrail as an event source. This allows the security team to trigger a notification when an IAM user attempts to modify an S3 bucket policy, without needing to poll or set up custom monitoring.

Answer

Create a CloudWatch alarm on the number of PutBucketPolicy calls.

Answer

Enable CloudTrail data events for S3 to capture bucket policy changes.

Question 7

A SysOps administrator needs to monitor the disk space usage on an EC2 instance running Windows Server. Which actions are required to collect this metric? (Select TWO.)

Accepted Answer

Create an IAM role with permissions to publish custom metrics and attach it to the instance.. Option D is correct because the CloudWatch agent requires permissions to publish custom metrics to CloudWatch. An IAM role with the appropriate policy (e.g., CloudWatchAgentServerPolicy) must be attached to the EC2 instance to allow the agent to send disk space metrics. Option E is correct because the CloudWatch agent must be installed and configured with a JSON configuration file that includes the "disk" section to collect disk space utilization metrics, which are not available by default from EC2.

Answer

Install the CloudWatch Logs agent to monitor disk usage logs.

Answer

Enable EC2 status checks to monitor disk health.

Answer

Use Windows Performance Monitor to track disk space and send to CloudWatch.

Question 8

A company has a CloudWatch dashboard that displays metrics for several EC2 instances. The SysOps administrator wants to share the dashboard with external stakeholders who do not have AWS accounts. Which actions should the administrator take? (Select TWO.)

Accepted Answer

Use the CloudWatch dashboard sharing feature to make the dashboard public.. Option A is correct because CloudWatch dashboards have a built-in sharing feature that allows you to make a dashboard public by generating a shareable URL. This URL can be accessed by anyone, even without an AWS account, and the dashboard data is encrypted in transit using HTTPS. The feature also supports time-range and time-zone customization via URL parameters.

Answer

Create a web application that reads CloudWatch metrics and host it on EC2.

Answer

Create IAM users for each stakeholder and assign appropriate permissions.

Answer

Export the dashboard to Amazon QuickSight and share it via email.

Question 9

A SysOps administrator is tasked with setting up a solution that automatically terminates EC2 instances that have been running for more than 24 hours. Which steps should the administrator take? (Select THREE.)

Accepted Answer

Tag each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp).. Options A, B, and D are correct. Option A creates a Lambda function to terminate instances. Option B creates an EventBridge rule that triggers the Lambda function. Option D tags instances with a launch time for the function to evaluate. Option C is wrong because CloudWatch alarms are for metric thresholds, not time-based. Option E is wrong because Auto Scaling lifecycle hooks are for lifecycle actions, not time-based termination.

Answer

Configure an Auto Scaling group lifecycle hook to terminate instances after 24 hours.

Answer

Create a CloudWatch alarm on the InstanceAge metric and set it to trigger the Lambda function.

Question 10

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The operations team uses CloudWatch alarms to monitor the application's health. Recently, they noticed that the application's error rate has increased sporadically, but the CPU utilization and memory usage remain normal. The team suspects that the issue is related to a specific HTTP endpoint returning 5xx errors. They want to set up monitoring that will alert them when the error rate exceeds 5% of total requests over a 5-minute period. The application logs are already sent to CloudWatch Logs. Which combination of steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Create a metric filter in CloudWatch Logs to extract error codes and total requests from the application logs. Create two custom metrics: one for error count and one for total requests. Then create a CloudWatch alarm using a math expression that calculates error rate (error count / total requests) and triggers when >0.05 for 5 minutes.. Option A is correct because it creates a metric filter on the log group to count errors and total requests, then an alarm on the error rate. Option B is wrong because it uses the ALB's HTTPCode_ELB_5XX metric, but the issue is application-specific, not ALB-level. Option C is wrong because it relies on the CloudWatch agent to generate metrics, which is not already set up. Option D is wrong because it uses AWS X-Ray, which is for tracing, not for error rate monitoring from logs.

Answer

Enable AWS X-Ray on the application to trace requests and identify error patterns. Create a CloudWatch alarm on the X-Ray error rate metric.

Answer

Install the CloudWatch agent on the EC2 instances to collect application-level metrics. Configure the agent to emit a custom metric for error rate. Then create an alarm on that metric.

Answer

Enable detailed monitoring on the ALB and create a CloudWatch alarm on the HTTPCode_ELB_5XX metric with a threshold of 5% of the request count. Use the ALB's RequestCount metric to compute the percentage.

Question 11

A company has a production environment that includes an Amazon RDS for MySQL database. The SysOps administrator receives an alert that the database's CPU utilization has been above 90% for the past hour. The administrator checks the CloudWatch metrics and sees that the DatabaseConnections metric is also high. The application team reports that users are experiencing slow response times. The administrator wants to investigate which queries are causing the high CPU. The database is already configured to send logs to CloudWatch Logs. Which course of action should the administrator take to identify the problematic queries?

Accepted Answer

Enable the slow query log in the RDS parameter group and publish it to CloudWatch Logs. Then use CloudWatch Logs Insights to query the logs for slow queries.. Option B is correct because RDS can publish slow query logs to CloudWatch Logs, which can then be queried. Option A is wrong because Performance Insights shows performance data but not raw queries. Option C is wrong because CloudWatch Logs Insights can query logs, but the slow query logs need to be enabled first. Option D is wrong because CloudTrail does not capture database queries.

Answer

Use CloudWatch Logs Insights to query the existing RDS log group for any SQL statements.

Answer

Enable AWS CloudTrail to capture database queries and send them to CloudWatch Logs.

Answer

Enable Amazon RDS Performance Insights and use the dashboard to identify top SQL queries.

Question 12

A company runs a web application on an EC2 instance that uses Amazon EBS volumes. The SysOps administrator notices that the instance's disk queue length is consistently high, and the application is experiencing I/O latency. The administrator wants to set up monitoring to alert when the disk queue length exceeds a threshold. Which steps should the administrator take to achieve this? The instance is already sending CloudWatch metrics.

Accepted Answer

Create a CloudWatch alarm on the EBS metric VolumeQueueLength for the attached volume.. Option C is correct because the EBS volume metrics (e.g., VolumeQueueLength) are sent to CloudWatch automatically. Option A is wrong because EC2 metrics do not include disk queue length. Option B is wrong because the CloudWatch agent is not required for EBS metrics. Option D is wrong because VPC Flow Logs capture network traffic, not disk metrics.

Answer

Install the CloudWatch agent on the instance and configure it to collect disk queue length.

Answer

Enable VPC Flow Logs to capture disk I/O metrics.

Answer

Create a CloudWatch alarm on the EC2 metric DiskQueueLength.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The security team requires that all API calls made in any account be logged to a centralized S3 bucket in the management account. Additionally, the team wants to be alerted when an IAM user in any account creates a new access key. Currently, CloudTrail is enabled in each account but logs are stored locally. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a new CloudTrail organization trail in the management account that logs events to a centralized S3 bucket. Then create an Amazon EventBridge rule in the management account that matches the CreateAccessKey event and sends a notification via SNS.. Option A is correct because an organization trail logs API calls from all accounts to a single S3 bucket, and EventBridge can be set up to alert on CreateAccessKey events across accounts. Option B is wrong because it requires a Lambda function to aggregate logs, adding complexity. Option C is wrong because it replicates the organization trail but uses separate SNS topics per account. Option D is wrong because it uses CloudWatch Logs cross-account subscription, which is more complex.

Answer

Use CloudWatch Logs cross-account subscription to send logs from each account's CloudTrail log group to a central account. Create a metric filter and alarm on CreateAccessKey events.

Answer

Create a CloudTrail trail in each account that sends logs to a centralized S3 bucket in the management account. Create an SNS topic in each account to alert on CreateAccessKey.

Answer

Enable CloudTrail in all accounts and use an AWS Lambda function to copy logs from each account's S3 bucket to the centralized bucket. Create a CloudWatch Events rule in each account to send alerts on CreateAccessKey.

Question 14

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning HTTP 503 errors to clients. The target group is healthy, and the instances are passing health checks. What is the most likely cause of the 503 errors?

Accepted Answer

The target instances have reached the maximum number of concurrent connections allowed by the application or operating system.. Option C is correct because HTTP 503 errors from an ALB typically indicate the load balancer cannot establish a connection to the target due to the target's connection queue being full. Option A is wrong because insufficient capacity usually causes 502 or timeout errors, not 503. Option B is wrong because misconfigured health checks would show unhealthy targets. Option D is wrong because a missing security group rule would cause 502 or timeout.

Answer

The target instances do not have enough capacity to handle the request volume.

Answer

The health check settings are configured incorrectly, causing healthy instances to be marked as unhealthy.

Answer

The security group for the targets does not allow traffic from the ALB.

Question 15

Which TWO actions should a SysOps administrator take to set up centralized logging from multiple Amazon EC2 instances running Amazon Linux 2 to Amazon CloudWatch Logs?

Accepted Answer

Attach an IAM role to each EC2 instance that includes permission for logs:PutLogEvents.. Options A and C are correct. Installing and configuring the CloudWatch Logs agent on each EC2 instance is required to send logs to CloudWatch. The IAM role must grant the logs:PutLogEvents permission to allow the agent to write log events. Option B is wrong because CloudWatch Logs does not support S3 as a direct target for real-time log ingestion; S3 is a destination for log exports. Option D is wrong because there is no 'export' action needed; the agent pushes logs. Option E is wrong because CloudWatch Logs does not require VPC endpoints for internet-facing instances; it uses public endpoints.

Answer

Create an S3 bucket and configure the EC2 instances to write logs directly to the bucket.

Answer

Create a VPC endpoint for CloudWatch Logs to allow private connectivity.

Answer

Export the logs from CloudWatch Logs to an Amazon S3 bucket for long-term retention.