SOA-C02 Monitoring, Logging, and Remediation Practice Test 3 — 15 Questions

Question 1

A SysOps administrator is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. The administrator suspects that a specific query is causing high I/O. Which tools should be used together to identify the query and its I/O impact? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon RDS Performance Insights. Option A, Amazon RDS Performance Insights, is correct because it provides a database load view that identifies the top SQL statements contributing to load, letting the administrator pinpoint the specific query causing high I/O. Option D, Amazon RDS Enhanced Monitoring, is correct because it delivers OS-level metrics (e.g., disk I/O, read/write latency, IOPS) at up to 1-second granularity, showing the actual I/O impact on the underlying instance. Option E, RDS Performance Insights with database load and wait events, is correct because slicing database load by wait events (such as IO:DataFileRead or IO:WALWrite) attributes the I/O pressure to the exact query and wait type, which is the precise diagnostic needed here. Option B, Amazon CloudWatch Logs, is not correct because it stores log output such as PostgreSQL error or slow-query logs but does not correlate query text with I/O metrics or wait events. Option C, AWS CloudTrail, is not correct because it records API activity and management events, not database query performance or I/O behavior.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 2

A SysOps administrator needs to track changes to IAM policies in the AWS account for auditing purposes. Which service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to IAM, including changes to IAM policies (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These logs are stored in a CloudTrail trail and can be delivered to Amazon S3 for long-term auditing. CloudTrail is specifically designed for auditing API activity, making it the appropriate choice for tracking policy modifications.

Answer

IAM Access Analyzer

Answer

AWS Config

Answer

Amazon CloudWatch

Question 3

An application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing increased latency. The SysOps administrator checks CloudWatch and sees that the ALB's TargetResponseTime is high, but the backend EC2 instance's CPUUtilization and MemoryUtilization are low. What is the most likely cause?

Accepted Answer

The ALB is experiencing connection queuing due to a high number of concurrent requests.. When TargetResponseTime is high but backend CPU and memory are low, the bottleneck is not the compute capacity of the instances but rather the ALB's ability to forward requests. The ALB has a default connection queue limit (typically 1024 pending connections per target group), and when concurrent requests exceed that, new requests are queued, increasing response time without stressing the backend. This is a classic sign of connection queuing at the load balancer level.

Answer

The application is CPU-bound on the EC2 instances.

Answer

The EC2 instances are throttled due to a burst balance limit.

Answer

The application is waiting on a database query that is slow.

Question 4

A SysOps administrator is configuring a CloudWatch dashboard to monitor an application. Which TWO of the following are valid widget types that can be added to a CloudWatch dashboard?

Accepted Answer

Alarm. Option B (Alarm) is correct because CloudWatch dashboards support an alarm widget that displays the status of one or more CloudWatch alarms, showing whether each is in OK, ALARM, or INSUFFICIENT_DATA state. Option D (Number) is correct because the number widget displays the most recent value of a single metric as a large numeric figure, which is a supported dashboard widget type. Options A (Line), C (Bar chart), and E (Time Series) are not distinct CloudWatch widget types; line and stacked area visualizations are provided by the time series widget, and bar charts are not a separate selectable widget type in CloudWatch dashboards.

Answer

Line

Answer

Bar chart

Answer

Time Series

Question 5

A SysOps administrator is setting up monitoring for an Amazon RDS instance. Which TWO metrics are available by default in Amazon CloudWatch for RDS?

Accepted Answer

DatabaseConnections. Option A, DatabaseConnections, is correct because Amazon RDS automatically publishes this metric to CloudWatch, reporting the number of client connections to the DB instance. Option B, CPUUtilization, is also correct because RDS natively emits this metric to CloudWatch, showing the percentage of CPU used by the DB instance. Option C, FreeableMemory, is not one of the two default metrics asked for here, as it is a host-level metric that RDS does not publish by default to CloudWatch. Option D, FailedLoginAttempts, is not a default RDS CloudWatch metric; it is typically surfaced through database engine logs or enhanced monitoring, not standard CloudWatch metrics. Option E, WriteLatency, is not a default RDS CloudWatch metric; latency metrics such as ReadLatency and WriteLatency are available through Enhanced Monitoring or Performance Insights, not the default CloudWatch metric set.

Answer

FreeableMemory

Answer

FailedLoginAttempts

Answer

WriteLatency

Question 6

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The administrator notices that the ALB returns 503 errors during peak traffic. The instances are healthy according to the ALB health checks. What is the MOST likely cause and what metric should the administrator check?

Accepted Answer

The ALB's surge queue is full; check the SurgeQueueLength metric.. The ALB returns 503 errors despite healthy targets, which indicates that the ALB itself is overwhelmed and cannot process incoming requests. The ALB uses a surge queue to buffer requests when traffic exceeds its capacity; when the queue is full, new requests are rejected with a 503. The SurgeQueueLength metric directly measures this queue depth, making it the correct metric to check.

Answer

The SSL certificate has expired; check the TLS handshake errors.

Answer

The ALB is overloaded; check the ALB's CPUUtilization metric.

Answer

The targets are failing health checks; check the HealthyHostCount metric.

Question 7

A SysOps administrator is designing a monitoring solution for a critical application running on EC2 instances. The application requires that all API calls to the environment are logged for security analysis. Which TWO services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (C) is correct because it records every AWS API call made in the account, including the identity of the caller, the time, source IP, and request parameters, which is exactly the API-call audit trail required for security analysis. Amazon CloudWatch Logs (B) is correct because it is the service used to centralize, store, and analyze those log streams (including CloudTrail logs delivered to a log group), enabling querying, metric filters, and alarms for security monitoring. Together they satisfy the requirement to capture and retain all API activity for analysis. Amazon GuardDuty (A) is a threat-detection service that consumes logs but does not itself log API calls, AWS Config (D) tracks resource configuration changes and compliance rather than API call auditing, and VPC Flow Logs (E) capture IP traffic metadata at the ENI/subnet/VPC level, not AWS API calls.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 8

A company uses Amazon RDS for MySQL and needs to be alerted when the database's CPU utilization exceeds 80% for 10 minutes. The administrator creates a CloudWatch alarm based on the 'CPUUtilization' metric. However, the alarm does not trigger even though the metric shows values above 80%. What is the most likely cause?

Accepted Answer

The alarm is configured to use the 'Maximum' statistic, but the metric chart shows 'Average'.. The CloudWatch alarm is configured to use the 'Maximum' statistic, while the metric chart displays the 'Average' statistic. If the CPU utilization spikes above 80% but the average over the evaluation period remains below 80%, the alarm using 'Maximum' will not trigger. The alarm evaluates the metric based on its configured statistic, not the chart's default view.

Answer

The alarm's period is set to 5 minutes, so it checks only every 5 minutes.

Answer

The RDS instance is in a VPC that does not have internet access.

Answer

The administrator has not enabled Enhanced Monitoring on the RDS instance.

Question 9

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (E) is correct because it records API activity in the account as event logs, capturing who made which API call, from where, and when, which is the foundation for detecting suspicious API behavior. Amazon CloudWatch Logs (B) is correct because CloudTrail can deliver its event logs to a CloudWatch Logs log group, where metric filters and alarms can be created to detect and alert on suspicious API patterns. Together, CloudTrail provides the API call records and CloudWatch Logs provides the monitoring, filtering, and alerting layer. VPC Flow Logs (A) capture IP traffic metadata at the ENI/subnet/VPC level, not API calls, so they don't fit. Amazon Inspector (C) is a vulnerability management service that scans EC2 instances and container images, not API activity. AWS Config (D) tracks resource configuration changes and compliance, not the full set of API calls needed for this monitoring scenario.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS Config

Question 10

A company has an application running on EC2 instances behind an Application Load Balancer. They want to receive an email notification when the average latency exceeds 2 seconds. Which combination of steps should the SysOps administrator take? (Select TWO.)

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when a metric threshold is breached. By creating an SNS topic and subscribing an email endpoint to it, the SysOps administrator can receive email alerts when the alarm state changes, such as when the average latency exceeds 2 seconds.

Answer

Enable AWS CloudTrail to capture API calls and monitor latency.

Answer

Use CloudWatch Logs to stream logs to Amazon ES for latency analysis.

Answer

Create a CloudWatch alarm on the EC2 instance's CPUUtilization metric.

Question 11

A SysOps administrator creates this IAM policy for a monitoring application. The application needs to publish custom metrics to CloudWatch and retrieve information about EC2 instances and Auto Scaling groups. The application reports that it cannot list EC2 instances. What is the most likely reason?

Accepted Answer

The policy uses a wildcard for the ec2:Describe action; it should specify ec2:DescribeInstances.. The policy specifies 'ec2:Describe' as an action, but 'ec2:Describe' is not a valid IAM action. IAM does support wildcards in action names (e.g., 'ec2:Describe*'), but without a wildcard or a specific action like 'ec2:DescribeInstances', the policy grants no EC2 Describe permissions. Therefore, the application cannot list EC2 instances.

Answer

The policy does not grant access to the us-east-1 region.

Answer

The policy is missing the cloudwatch:PutMetricData action for the monitoring application.

Answer

The policy should include ec2:DescribeTags to list instances.

Question 12

A SysOps administrator examines the output of the describe-alarms command for the 'HighCPU' alarm. The alarm is in ALARM state. What action will be taken automatically?

Accepted Answer

Send a notification to an SNS topic.. The 'HighCPU' alarm is a CPU utilization metric alarm. EC2 instance recovery actions are only valid for alarms based on StatusCheckFailed metrics, not for CPU alarms. Without specific configuration indicating an Auto Scaling policy, the most common automatic action for a CPU alarm is to send a notification to an SNS topic if one is configured. Therefore, the correct answer is D.

Answer

Recover the EC2 instance using EC2 instance recovery.

Answer

Launch a new EC2 instance in an Auto Scaling group.

Answer

Reboot the EC2 instance.

Question 13

A company wants to ensure that all IAM user changes are logged and that an alert is sent when a new IAM user is created. Which services should be used together to achieve this? (Select THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can receive and store log events from AWS CloudTrail, which records all IAM user changes including user creation. By sending CloudTrail logs to CloudWatch Logs, you can then create metric filters to detect specific API calls like 'CreateUser' and trigger CloudWatch Alarms to send notifications via SNS.

Answer

AWS Config

Answer

Amazon S3

Question 14

A SysOps administrator notices that an Amazon RDS for MySQL instance's CPU utilization has been consistently above 80% for the past hour. Which CloudWatch metric should the administrator examine to determine whether the high CPU is due to a specific SQL query?

Accepted Answer

DatabaseConnections. DatabaseConnections, because a high number of database connections can indicate that many concurrent queries are running, which could be caused by a specific SQL query that is inefficient or blocking others. However, to directly identify a specific SQL query causing high CPU, you would need to use Performance Insights or the slow query log, not a CloudWatch metric alone. DatabaseConnections is the closest metric among the options that correlates with query activity, as a sudden spike in connections often points to problematic queries.

Answer

WriteIOPS

Answer

FreeableMemory

Answer

ReadLatency

Question 15

A SysOps administrator is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. The administrator suspects that a specific query is causing high I/O. Which tools should be used together to identify the query and its I/O impact? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon RDS Enhanced Monitoring. Amazon RDS Enhanced Monitoring provides real-time OS-level metrics for the DB instance, including per-process CPU, memory, and disk I/O utilization. While it does not directly break down storage by table or database, it helps identify which database process (e.g., a specific query or session) is consuming significant disk I/O. Once the offending process is identified, the administrator can use database-level queries (e.g., querying information_schema.tables) to pinpoint the specific table causing the storage increase.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail