SOA-C02 Monitoring, Logging, and Remediation Practice Test 3 — 15 Questions

Question 1

A SysOps administrator needs to receive an email notification when an IAM user's console login fails. Which AWS service should be used to set up this notification?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch can monitor AWS CloudTrail log events for IAM console login failures by creating a metric filter on the CloudTrail log group for the `ConsoleLogin` event with a `failure` status. When the filter matches, CloudWatch can trigger an alarm that sends an email notification via Amazon SNS. This is the correct service because CloudWatch is designed for monitoring and alerting on operational metrics and log patterns.

Answer

AWS CloudTrail

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 2

A SysOps administrator needs to audit all API calls made in an AWS account for compliance and security analysis. The logs must be stored securely for at least one year. Which AWS service should the administrator enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This audit log is essential for compliance and security analysis, and CloudTrail can be configured to store logs in an S3 bucket with lifecycle policies to retain them for at least one year.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

A SysOps administrator needs to monitor application logs in Amazon CloudWatch Logs for the occurrence of the string 'ERROR'. The administrator wants to create a custom metric that counts the number of 'ERROR' occurrences per 5-minute window and trigger an Amazon CloudWatch alarm when the count exceeds 10. Which action should the administrator take to create the custom metric?

Accepted Answer

Create a metric filter on the CloudWatch Logs log group that matches the term 'ERROR'.. Metric filters in CloudWatch Logs allow you to define a pattern (e.g., 'ERROR') that is evaluated against incoming log events. The filter counts occurrences and publishes a custom metric to CloudWatch, which can then be used to set an alarm with a period of 5 minutes and a threshold of 10.

Answer

Create a CloudWatch Events rule that triggers on 'ERROR' and publishes a metric.

Answer

Create a CloudWatch dashboard that displays the log group and set an alarm on the dashboard.

Answer

Enable AWS CloudTrail on the log group and select the 'ERROR' pattern.

Question 4

A SysOps administrator manages Amazon EC2 instances in multiple AWS accounts. The administrator needs to collect and analyze network traffic logs to identify the top IP addresses generating the most traffic to the instances. The administrator must centralize this analysis in a single monitoring account that has cross-account access to the logs. Which combination of AWS services should the administrator use?

Accepted Answer

Enable VPC Flow Logs in each account, publish them to an Amazon S3 bucket, and use Amazon Athena to query for top IPs.. Both A and C are valid ways to centralize VPC Flow Logs and identify top IPs. A uses S3 and Athena to query flow logs across accounts; C uses CloudWatch Logs and Contributor Insights with cross-account ingestion. The original explanation incorrectly states that A is not suitable.

Answer

Use AWS Config rules across accounts to aggregate network traffic data and generate a report in Amazon QuickSight.

Answer

Use Amazon CloudWatch Logs Insights with a saved query in the central account and schedule it to run every hour using EventBridge.

Question 5

An application logs user authentication attempts to Amazon CloudWatch Logs. The SysOps administrator needs to create a custom metric that counts the number of failed authentication attempts every 5 minutes and trigger an alarm when the count exceeds 5. Which combination of actions should the administrator take?

Accepted Answer

Create a metric filter on the log group for the string 'FAILED_AUTH', set the metric value to 1, then create an alarm on the resulting metric.. CloudWatch Logs metric filters allow you to extract a numeric value from log events and publish it as a custom metric. By creating a filter that matches the string 'FAILED_AUTH' and setting the metric value to 1, each failed attempt increments the metric. You can then set the metric's period to 5 minutes and create an alarm that triggers when the sum exceeds 5, meeting the requirement without modifying the application code.

Answer

Use the PutMetricData API in the application to publish the number of failed attempts as a custom metric, then create an alarm.

Answer

Use AWS CloudTrail to track authentication events and create a metric filter on the CloudTrail log group.

Answer

Use Amazon Athena to query the logs every 5 minutes and publish results to a CloudWatch metric.

Question 6

A company uses AWS Organizations with multiple accounts. The SysOps administrator needs to centralize the monitoring of all API calls made in any account for security analysis. The solution must collect logs from all accounts, both existing and future, and deliver them to a centralized S3 bucket in the management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudTrail organization trail. AWS CloudTrail organization trails allow you to log all API calls across all accounts in an AWS Organization from a single management account. When you create an organization trail, it automatically applies to all existing and future accounts, delivering logs to a centralized S3 bucket in the management account without requiring per-account configuration.

Answer

AWS Config aggregator

Answer

Amazon CloudWatch Logs with cross-account subscription

Answer

Amazon Detective

Question 7

A SysOps administrator needs to analyze application logs stored in Amazon CloudWatch Logs to find specific error patterns across multiple log groups. The administrator wants to run queries to filter and parse the logs. Which feature should the administrator use?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is the correct feature because it enables you to interactively search and analyze log data stored in CloudWatch Logs using a purpose-built query language. It allows you to run queries across multiple log groups, filter, parse, and aggregate logs to identify specific error patterns, making it ideal for ad-hoc log analysis and troubleshooting.

Answer

CloudWatch Logs subscriptions

Answer

CloudWatch Metric Filters

Answer

CloudWatch Contributor Insights

Question 8

A SysOps administrator manages multiple AWS accounts and wants to create a single Amazon CloudWatch dashboard that displays real-time metrics from all accounts in one view. The administrator needs to avoid managing separate dashboards for each account. Which solution should the administrator implement?

Accepted Answer

Use CloudWatch cross-account observability by setting up a monitoring account and sharing metrics from source accounts.. CloudWatch cross-account observability allows you to designate a monitoring account that can view metrics, logs, and traces from multiple source accounts. This feature uses AWS Organizations or CloudWatch cross-account links to share observability data in real time, enabling a single dashboard that aggregates metrics from all accounts without needing separate dashboards.

Answer

Export CloudWatch metrics to Amazon QuickSight and create a dashboard there.

Answer

Use AWS Config aggregator to collect metrics and display in CloudWatch.

Answer

Create a Lambda function that periodically pulls metrics from each account and publishes to a central account's CloudWatch.

Question 9

A SysOps administrator needs to detect unauthorized changes to security groups and automatically notify the operations team. Which two AWS services should be part of the solution? (Choose 2.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to create, modify, or delete security groups, providing the audit trail needed to detect unauthorized changes. By enabling CloudTrail on the account and configuring a trail to deliver logs to Amazon S3, the administrator can monitor security group events such as AuthorizeSecurityGroupIngress or RevokeSecurityGroupEgress. This log data is essential for identifying when a change occurred, who made it, and from which source IP.

Answer

Amazon S3 Transfer Acceleration.

Answer

AWS Snowball Edge.

Question 10

Multiple microservices each write structured JSON logs to separate CloudWatch log groups. The operations team needs to find all ERROR-level log entries across all log groups for the past 24 hours and count errors by service name. Which approach achieves this with the least operational overhead?

Accepted Answer

Run a CloudWatch Logs Insights query selecting all relevant log groups, filter where level = 'ERROR', and use stats count(*) by service. CloudWatch Logs Insights natively supports querying multiple log groups in a single query. By specifying all relevant log groups in the query scope, filtering for `level = 'ERROR'` using the `filter` command, and using `stats count(*) by service`, the operations team can directly aggregate error counts per service without any data movement, additional infrastructure, or manual scripting. This approach has the least operational overhead because it leverages existing CloudWatch capabilities with no setup or maintenance.

Answer

Export each log group to S3 and run an Athena query joining all exported files

Answer

Subscribe all log groups to a Kinesis Data Firehose stream and query the aggregated data in OpenSearch

Answer

Use the AWS CLI to download and grep log events from each log group separately, then sum the results

Question 11

Match each AWS service to its primary function.

Accepted Answer

CloudTrail: Records API activity for auditing. AWS CloudTrail records API calls for auditing; AWS Config evaluates resource configurations; AWS Trusted Advisor gives recommendations. Common confusions involve swapping CloudTrail and Config functions.

Answer

CloudTrail: Monitors resource configurations for compliance

Answer

Config: Records API activity for audit trail

Question 12

Match each AWS monitoring tool to its function.

Accepted Answer

Amazon CloudWatch: Collects and tracks metrics, logs, and monitors resources. Amazon CloudWatch collects metrics and logs, AWS CloudTrail records API calls for auditing, and AWS Config evaluates resource configurations for compliance. The incorrect options swap these functions.

Answer

Amazon CloudWatch: Records API calls to track user activity

Answer

AWS CloudTrail: Monitors CPU utilization and network traffic

Answer

Amazon CloudWatch: Assesses resources for compliance with rules

Question 13

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to set up this monitoring and alerting?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides the ability to monitor EC2 instance metrics, such as CPU utilization, and create CloudWatch Alarms that trigger when a metric crosses a defined threshold (e.g., 80%) for a specified number of consecutive evaluation periods (e.g., 10 minutes with a 1-minute period). This directly meets the requirement for monitoring and alerting on CPU utilization.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 14

A SysOps administrator is troubleshooting an issue where an EC2 instance is not sending logs to CloudWatch Logs. The instance has the CloudWatch agent installed, but no logs appear in the log group. The IAM role assigned to the instance has the following policy: {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"], "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:*"}]}. What is the most likely cause?

Accepted Answer

The log group name in the agent configuration does not match the policy resource.. The IAM policy grants permissions only for the log group named 'MyAppLogs' (with a wildcard for streams). If the CloudWatch agent configuration specifies a different log group name, the agent's API calls to CreateLogGroup, CreateLogStream, or PutLogEvents will fail with an AccessDenied error because the resource ARN in the policy does not match the actual log group being targeted. This is the most common cause when the agent is installed and running but no logs appear.

Answer

The CloudWatch agent is not running on the instance.

Answer

The IAM role does not have permission to describe log groups.

Answer

The instance does not have outbound internet access to reach CloudWatch Logs.

Question 15

A company wants to ensure that it receives notifications whenever any AWS Identity and Access Management (IAM) user in the account creates a new access key. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture API calls from AWS CloudTrail and trigger a notification (e.g., via SNS) when an IAM user creates a new access key. By setting up a rule that matches the `CreateAccessKey` API call, the company can receive real-time alerts for this specific action.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor