SOA-C02 Monitoring, Logging, and Remediation Practice Test 20 — 15 Questions

Question 1

An application writes logs to a file on an EC2 instance. The SysOps team needs to send these logs to Amazon CloudWatch Logs in real time. The logs must be encrypted at rest in CloudWatch Logs using a customer-managed KMS key. Which steps are required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the CloudWatch Logs agent and associate a KMS key with the log group using the 'associate-kms-key' API.. The CloudWatch Logs agent can send log data from an EC2 instance to CloudWatch Logs in real time, and the 'associate-kms-key' API (or the equivalent AWS CLI command 'put-log-group-encryption') allows you to associate a customer-managed KMS key with a log group, encrypting the logs at rest. This meets both the real-time delivery and customer-managed KMS encryption requirements without additional services or workarounds.

Answer

Use AWS CloudTrail to deliver logs to CloudWatch Logs with KMS encryption.

Answer

Store logs in S3 with KMS encryption and use S3 event notifications to trigger Lambda to put logs in CloudWatch Logs.

Answer

Install the CloudWatch Logs agent and enable encryption on the EC2 instance volume using KMS.

Question 2

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 3

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

Accepted Answer

The log group contains too many log events, causing the query to time out.. In CloudWatch Logs Insights, `stats count() by bin(5m)` is valid syntax; `bin()` does not require a preceding field. Therefore option A is not the cause. The most likely cause among the options is that the log group contains too many log events, causing the query to time out before results are returned. Retention policy does not affect events from the last hour, and `@message` is a valid field.

Answer

The 'stats' command requires a 'by' clause with a field name, but 'bin(5m)' is invalid.

Answer

The @message field is not a valid field in CloudWatch Logs Insights.

Answer

The log group's retention policy is set to 1 day and the data is older than the retention period.

Question 4

A company uses CloudWatch Logs to collect application logs from EC2 instances. The logs are critical for troubleshooting. The operations team notices that some log entries are missing during peak hours. The CloudWatch Logs agent is configured with a batch size of 1 MB and a batch timeout of 10 seconds. Which TWO actions should the administrator take to reduce the chance of missing log events?

Accepted Answer

Increase the batch size to 5 MB.. Increasing the batch size from 1 MB to 5 MB allows the CloudWatch Logs agent to buffer more log data before sending a request. During peak hours, log volume spikes can cause the agent to drop events if the batch fills up faster than it can be transmitted. A larger batch size reduces the frequency of API calls and helps ensure that all log entries are successfully delivered.

Answer

Use PutLogEvents directly from the application.

Answer

Reduce the retry count for failed requests.

Answer

Increase the batch timeout to 30 seconds.

Question 5

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

Accepted Answer

Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.. CloudWatch Events (now part of Amazon EventBridge) can capture log events in real-time and trigger a Lambda function. The Lambda function can then compute job duration by correlating JOB_START and JOB_END events (e.g., using a DynamoDB table to store start times) and publish a custom metric or trigger an alarm if duration exceeds 1 hour. This approach handles the per-job correlation that metric filters cannot achieve.

Answer

Use CloudWatch Logs Insights to run a query every hour and check the duration.

Answer

Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.

Answer

Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.

Question 6

A company has an S3 bucket that stores sensitive data. The security team requires an alert whenever an object in the bucket is deleted. What is the MOST efficient way to achieve this?

Accepted Answer

Enable S3 event notifications and send them to Amazon EventBridge, then create a rule to publish to SNS.. S3 event notifications can be sent directly to Amazon EventBridge, which allows you to create a rule that triggers an SNS topic for real-time alerts on object deletions. This approach is the most efficient as it avoids the overhead of log analysis or polling, providing immediate notification with minimal latency.

Answer

Configure S3 access logs and stream them to CloudWatch Logs, then create a metric filter.

Answer

Use S3 Inventory to generate a daily report and check for deletes.

Answer

Enable AWS CloudTrail data events for the S3 bucket and create a CloudWatch metric filter.

Question 7

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail event history.. AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Answer

AWS IAM credential report.

Question 8

An application running on EC2 instances occasionally throws 'Connection refused' errors when connecting to an RDS database. The SysOps administrator needs to determine if the issue is due to database connection limits or network security groups. Which metrics and logs should the administrator examine?

Accepted Answer

Examine the RDS CloudWatch metric DatabaseConnections and analyze VPC Flow Logs for the EC2 instance's network interface.. 'Connection refused' errors typically stem from either the database exhausting its maximum connections or network-level security groups blocking traffic. The RDS CloudWatch metric `DatabaseConnections` directly shows the current number of active connections against the instance's `max_connections` limit, while VPC Flow Logs capture whether packets are being accepted or rejected by security groups or network ACLs, pinpointing network blockages.

Answer

Check CloudWatch RDS CPUUtilization and CloudTrail logs for RDS API calls.

Answer

Review RDS error logs in CloudWatch Logs and check the EC2 instance's system log.

Answer

Look at the EC2 instance's CloudWatch NetworkIn and NetworkOut metrics and RDS FreeableMemory metric.

Question 9

A SysOps administrator is designing a monitoring solution for a critical application running on EC2 instances. The application requires that all API calls to the environment are logged for security analysis. Which TWO services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS CLI, SDKs, and other services. CloudTrail logs provide the identity of the caller, the time of the call, the source IP address, and the request parameters, which are essential for security analysis. Option B (Amazon CloudWatch Logs) is also correct because CloudTrail logs can be delivered to CloudWatch Logs for centralized monitoring, alerting, and retention, enabling real-time analysis and integration with other AWS services.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 10

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. Options B and E are correct. AWS CloudTrail logs all API calls made to the AWS environment, providing an audit trail. Amazon CloudWatch Logs can ingest CloudTrail logs and use metric filters to detect patterns indicative of suspicious activity. Option A (VPC Flow Logs) captures IP traffic information, not API calls. Option C (Amazon Inspector) is a vulnerability assessment service. Option D (AWS Config) records resource configuration changes, not API calls.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS Config

Question 11

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Windows Server. Which steps are required to collect memory metrics?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the instance.. Amazon CloudWatch does not collect memory metrics from EC2 instances by default; it only captures hypervisor-level metrics such as CPU, network, and disk I/O. To monitor in-guest memory utilization on a Windows Server instance, you must install and configure the Amazon CloudWatch agent, which sends custom metrics (e.g., Memory % Committed Bytes In Use) to CloudWatch. The agent uses the Windows Performance Monitor (PerfMon) counters to gather this data.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and use Run Command.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Use the AWS Management Console to enable memory monitoring.

Question 12

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending a notification via Amazon SNS, when a status check fails. This is the native AWS service designed for real-time monitoring and alerting on metric thresholds, making it the correct choice for this use case.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 13

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 14

A SysOps administrator is troubleshooting an application that runs on an EC2 instance. The application is experiencing high latency, and the administrator suspects a memory leak. Which metrics should the administrator examine first?

Accepted Answer

Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.. A memory leak causes the application to consume increasing amounts of memory over time, leading to high latency as the OS begins swapping or the kernel reclaims memory. The CloudWatch agent can publish custom metrics like `mem_used_percent`, which directly tracks memory usage percentage and is the most relevant metric to confirm a memory leak. Default EC2 metrics do not include memory utilization, so the administrator must rely on custom metrics from the CloudWatch agent.

Answer

CloudWatch metrics from the Detailed Monitoring feature, such as DiskReadOps.

Answer

CloudWatch metrics for the instance's Elastic Network Interface.

Answer

CloudWatch default EC2 metrics, such as CPUUtilization and NetworkIn.

Question 15

A company has a production environment with multiple EC2 instances running a web application. The SysOps administrator wants to automate the remediation of instances that fail the EC2 status check. Which approach should the administrator use?

Accepted Answer

Create an Amazon EventBridge rule that matches EC2 status check failures and triggers an AWS Lambda function to terminate the instance and launch a new one.. It provides a fully automated, event-driven remediation workflow. When an EC2 instance fails a status check, an EventBridge rule detects the state change and triggers a Lambda function that terminates the unhealthy instance and launches a replacement. This approach directly addresses the requirement to automate remediation without manual intervention.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure an SNS notification to alert the team.

Answer

Use AWS Systems Manager Automation to create a document that runs a script on the instance to fix the issue.

Answer

Configure the Auto Scaling group's health check to use EC2 status checks and set a custom termination policy.