SOA-C02 Monitoring, Logging, and Remediation Practice Test 4 — 15 Questions

Question 1

A SysOps administrator needs to ensure that all API calls in the AWS account are logged for auditing purposes. The administrator also wants to receive notifications when specific API calls are made. Which THREE services should the administrator use together to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EventBridge. AWS CloudTrail (E) is the foundational service that records all API activity in the account as events, which is exactly what is required to log every API call for auditing. Amazon CloudWatch Logs (D) is used to store and retain those CloudTrail events by delivering the trail to a log group, enabling durable, queryable audit logs. Amazon EventBridge (A) is used to match specific API calls (via event patterns on CloudTrail events) and route them to targets so notifications can be triggered when those calls occur. AWS Config (B) is for evaluating resource configuration compliance and recording configuration changes, not for capturing or notifying on arbitrary API calls, and Amazon SNS (C) is only a notification delivery mechanism that would be a target of EventBridge rather than a service used to detect the API calls itself.

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 2

A company has an application running on EC2 instances that sends logs to CloudWatch Logs. The operations team wants to receive a notification when a specific error pattern appears in the logs. Which combination of steps should the team take? (Select TWO.)

Accepted Answer

Create a CloudWatch alarm on the metric to trigger an SNS notification.. A CloudWatch alarm can be configured to trigger an SNS notification when a metric crosses a defined threshold. In this scenario, the metric is derived from a metric filter that counts occurrences of the specific error pattern in the log group. The alarm monitors that metric and sends an SNS notification to subscribed endpoints, such as the operations team's email addresses, providing the required alert.

Answer

Enable CloudTrail to capture the log events and send to S3.

Answer

Create an SNS topic and subscribe the operations team's email addresses.

Answer

Create a subscription filter to send logs to Lambda for analysis.

Question 3

A company has a production environment with multiple EC2 instances running a web application. The SysOps administrator wants to automate the remediation of instances that fail the EC2 status check. Which approach should the administrator use?

Accepted Answer

Create an Amazon EventBridge rule that matches EC2 status check failures and triggers an AWS Lambda function to terminate the instance and launch a new one.. It provides a fully automated, event-driven remediation workflow. When an EC2 instance fails a status check, an EventBridge rule detects the state change and triggers a Lambda function that terminates the unhealthy instance and launches a replacement. This approach directly addresses the requirement to automate remediation without manual intervention.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure an SNS notification to alert the team.

Answer

Use AWS Systems Manager Automation to create a document that runs a script on the instance to fix the issue.

Answer

Configure the Auto Scaling group's health check to use EC2 status checks and set a custom termination policy.

Question 4

A company has a production environment that includes an Amazon RDS for MySQL database. The SysOps administrator receives an alert that the database's CPU utilization has been above 90% for the past hour. The administrator checks the CloudWatch metrics and sees that the DatabaseConnections metric is also high. The application team reports that users are experiencing slow response times. The administrator wants to investigate which queries are causing the high CPU. The database is already configured to send logs to CloudWatch Logs. Which course of action should the administrator take to identify the problematic queries?

Accepted Answer

Enable the slow query log in the RDS parameter group and publish it to CloudWatch Logs. Then use CloudWatch Logs Insights to query the logs for slow queries.. Enabling the slow query log in the RDS parameter group and publishing it to CloudWatch Logs allows the administrator to use CloudWatch Logs Insights to query for queries that exceed a defined execution time threshold. Slow queries are a common cause of high CPU and database connection spikes, and this approach directly surfaces the problematic SQL statements without requiring additional infrastructure.

Answer

Use CloudWatch Logs Insights to query the existing RDS log group for any SQL statements.

Answer

Enable AWS CloudTrail to capture database queries and send them to CloudWatch Logs.

Answer

Enable Amazon RDS Performance Insights and use the dashboard to identify top SQL queries.

Question 5

A company runs a web application on an EC2 instance that uses Amazon EBS volumes. The SysOps administrator notices that the instance's disk queue length is consistently high, and the application is experiencing I/O latency. The administrator wants to set up monitoring to alert when the disk queue length exceeds a threshold. Which steps should the administrator take to achieve this? The instance is already sending CloudWatch metrics.

Accepted Answer

Create a CloudWatch alarm on the EBS metric VolumeQueueLength for the attached volume.. Amazon EBS volumes publish the VolumeQueueLength metric to CloudWatch, which represents the number of read and write requests waiting to be processed. Creating a CloudWatch alarm on this metric directly monitors disk queue length for the attached volume. Since the instance is already sending CloudWatch metrics, no additional agent is needed for this EBS metric.

Answer

Install the CloudWatch agent on the instance and configure it to collect disk queue length.

Answer

Enable VPC Flow Logs to capture disk I/O metrics.

Answer

Create a CloudWatch alarm on the EC2 metric DiskQueueLength.

Question 6

A company has a multi-account AWS environment using AWS Organizations. The security team requires that all API calls made in any account be logged to a centralized S3 bucket in the management account. Additionally, the team wants to be alerted when an IAM user in any account creates a new access key. Currently, CloudTrail is enabled in each account but logs are stored locally. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a new CloudTrail organization trail in the management account that logs events to a centralized S3 bucket. Then create an Amazon EventBridge rule in the management account that matches the CreateAccessKey event and sends a notification via SNS.. An organization trail in the management account automatically logs API calls from all accounts in the AWS Organization to a centralized S3 bucket, fulfilling the logging requirement with minimal setup. Additionally, EventBridge (formerly CloudWatch Events) in the management account can capture CreateAccessKey events from all member accounts and trigger an SNS notification, providing centralized alerting without per-account configuration. This solution eliminates the need for cross-account log forwarding, Lambda functions, or individual SNS topics, making it the least operational overhead. Option A is incorrect because it requires setting up CloudWatch Logs cross-account subscriptions, which adds complexity. Option B is incorrect because it uses separate SNS topics per account, not centralized alerting. Option C is incorrect because it relies on a Lambda function to copy logs, increasing overhead.

Answer

Use CloudWatch Logs cross-account subscription to send logs from each account's CloudTrail log group to a central account. Create a metric filter and alarm on CreateAccessKey events.

Answer

Create a CloudTrail trail in each account that sends logs to a centralized S3 bucket in the management account. Create an SNS topic in each account to alert on CreateAccessKey.

Answer

Enable CloudTrail in all accounts and use an AWS Lambda function to copy logs from each account's S3 bucket to the centralized bucket. Create a CloudWatch Events rule in each account to send alerts on CreateAccessKey.

Question 7

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning HTTP 503 errors to clients. The target group is healthy, and the instances are passing health checks. What is the most likely cause of the 503 errors?

Accepted Answer

The target instances have reached the maximum number of concurrent connections allowed by the application or operating system.. When an Application Load Balancer returns HTTP 503 errors despite a healthy target group, the most likely cause is that the target instances have exhausted their connection limits. ALB maintains persistent connections to targets, and if the application or OS connection backlog (e.g., `net.core.somaxconn` or application thread pool) is full, new requests are rejected, resulting in 503 responses. Health checks may still pass because they use separate, low-frequency connections that do not hit the limit.

Answer

The target instances do not have enough capacity to handle the request volume.

Answer

The health check settings are configured incorrectly, causing healthy instances to be marked as unhealthy.

Answer

The security group for the targets does not allow traffic from the ALB.

Question 8

A SysOps administrator needs to collect custom application metrics from a fleet of Amazon EC2 instances running Amazon Linux 2 and publish them to Amazon CloudWatch. The administrator wants to minimize operational overhead and avoid installing and managing a separate agent. Which solution should be used?

Accepted Answer

Install the CloudWatch agent on each instance and configure it to collect the custom metrics.. The CloudWatch agent is the standard AWS tool for collecting custom metrics from EC2 instances. It supports multiple protocols and requires minimal setup, reducing operational overhead. The other options either do not collect custom metrics or require significant custom scripting. The correct answer is the one that uses the CloudWatch agent.

Answer

Use the AWS Systems Manager (SSM) Agent to run a script that publishes metrics using the AWS CLI.

Answer

Enable Detailed Monitoring for the instances and use the default metrics.

Answer

Configure AWS CloudTrail to log application metrics and send them to CloudWatch.

Question 9

A SysOps administrator is responsible for a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The administrator needs to monitor the number of HTTP 5xx errors returned by the ALB and receive an alert if the error rate exceeds 5% over a 5-minute period. Which CloudWatch metric and alarm configuration should be used?

Accepted Answer

Use the HTTPCode_ELB_5XX_Count metric with a sum statistic, and create an alarm with a threshold based on the ratio to RequestCount.. To monitor the ALB's 5xx error rate, use the HTTPCode_ELB_5XX_Count metric and calculate the rate as a percentage of total requests using a metric math expression. Then create an alarm on that expression with a threshold of 5%. This accurately reflects the requirement. The other options either use the wrong metric or incorrect statistic/threshold.

Answer

Use the HTTPCode_ELB_5XX_Count metric with a sample count statistic, and set the alarm threshold to 5.

Answer

Use the HTTPCode_Target_5XX_Count metric with an average statistic, and set the alarm threshold to 5.

Answer

Use the RequestCount metric with a sum statistic, and set the alarm threshold to 5% of the average request count.

Question 10

A SysOps administrator needs to track changes to security groups in an AWS account. The administrator wants to receive an alert whenever a security group rule is modified. Which service should be used to detect and alert on this change?

Accepted Answer

AWS CloudTrail with CloudWatch Logs and a metric filter.. CloudTrail captures API calls that modify security groups. By integrating CloudTrail with CloudWatch Logs and creating a metric filter for those API calls, you can set an alarm to notify you. This is the most direct and real-time method. The other services do not provide immediate alerting on security group changes.

Answer

Amazon GuardDuty with findings for security group changes.

Answer

AWS Trusted Advisor with security group checks.

Answer

AWS Config with a configuration change rule.

Question 11

A SysOps administrator is using AWS Systems Manager (SSM) to manage a fleet of EC2 instances. The administrator needs to receive an alert when an instance's SSM Agent stops reporting to Systems Manager. Which CloudWatch metric and alarm should be used?

Accepted Answer

Use the SSM Agent ping status metric in the AWS/SSM namespace and create an alarm for the 'ConnectionLost' status.. The SSM Agent ping status metric in the AWS/SSM namespace reflects whether the agent is connected to Systems Manager. Alarming on the 'ConnectionLost' status directly detects when the agent stops reporting. The other metrics do not specifically monitor SSM Agent connectivity.

Answer

Use the CloudWatch agent's 'mem_used_percent' metric and alarm on high memory usage.

Answer

Use the EC2 status check metric 'StatusCheckFailed' and alarm on it.

Answer

Use the AWS/SSM 'Commands' metric and alarm on failed command executions.

Question 12

A company uses AWS CloudTrail to log API calls across all regions. The SysOps administrator notices that logs for a specific region are missing from the centralized S3 bucket. What is the most likely cause?

Accepted Answer

The CloudTrail trail is not enabled for that region.. CloudTrail trails can be configured to log API calls from specific regions or all regions. If logs for a particular region are missing from the centralized S3 bucket, the most likely cause is that the trail was not enabled for that region during trail creation or update. By default, a trail applied to all regions will automatically log activity from every region, but if the trail is configured for a single region or a subset, other regions will not have their logs delivered.

Answer

The S3 bucket policy denies write access from CloudTrail for that region.

Answer

CloudTrail log file validation is disabled.

Answer

The IAM role for CloudTrail does not have permissions to write logs from that region.

Question 13

A SysOps administrator is troubleshooting an application that runs on AWS Lambda. The application occasionally fails with timeout errors. The administrator needs to identify the exact lines of code that are causing the delays. Which AWS service or feature should be used to gather this information?

Accepted Answer

Use AWS X-Ray to trace the Lambda function and view segment details.. AWS X-Ray provides end-to-end tracing for Lambda functions, capturing segment details and subsegments that pinpoint the exact lines of code causing delays. By analyzing the trace timeline and annotations, the administrator can identify which specific function calls or operations exceed the timeout threshold, unlike CloudWatch Logs which only show aggregate duration or error strings without code-level granularity.

Answer

Enable detailed CloudWatch Logs and search for 'timeout' strings.

Answer

Set a CloudWatch Metric Filter for 'Duration' and create an alarm.

Answer

Enable AWS CloudTrail data events for the Lambda function.

Question 14

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda. It uses Amazon CloudWatch alarms to monitor CPU utilization metrics and trigger an SNS topic, which then invokes an AWS Lambda function. The Lambda function can execute the logic to stop the EC2 instance when the alarm state indicates CPU utilization above 90% for 30 minutes, providing automated cost control without manual intervention.

Answer

Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation

Answer

Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions

Answer

AWS CloudTrail + Amazon EventBridge + AWS CodePipeline

Question 15

A SysOps administrator manages an Amazon RDS for MySQL instance that handles a critical web application. During peak traffic, the number of database connections exceeds 500 for more than 15 minutes, leading to connection timeouts. The administrator wants to automatically increase the DB instance size when the connection count remains high, and decrease it when the load drops, to balance performance and cost. Which combination of AWS services should be used to achieve this automation with the least operational overhead?

Accepted Answer

Set up an Amazon CloudWatch alarm on the DatabaseConnections metric that triggers an AWS Lambda function to modify the DB instance class via the RDS API.. It uses a CloudWatch alarm to monitor the DatabaseConnections metric, which triggers an AWS Lambda function that directly calls the RDS ModifyDBInstance API to change the instance class. This approach provides the least operational overhead by leveraging native AWS services without additional infrastructure, custom resources, or periodic polling, and it enables real-time, event-driven scaling based on the specified threshold.

Answer

Configure a CloudWatch alarm on DatabaseConnections that triggers an Amazon CloudWatch Events rule, which directly modifies the DB instance class using a CloudFormation custom resource.

Answer

Use an AWS Config rule to monitor DatabaseConnections and invoke an AWS Lambda function to scale the RDS instance when the threshold is breached.

Answer

Use an AWS Systems Manager Automation runbook to periodically check the DatabaseConnections metric and adjust the RDS instance class if needed.