SOA-C02 Monitoring, Logging, and Remediation Practice Test 4 — 15 Questions

Question 1

A SysOps administrator notices that an EC2 instance's status check fails intermittently. The instance is part of an Auto Scaling group. What is the most efficient way to automatically recover the instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch alarm on StatusCheckFailed and configure an EC2 recovery action.. Creating a CloudWatch alarm on the StatusCheckFailed metric and configuring an EC2 recovery action (using the 'recover' alarm action) automatically restarts the instance on a new underlying host if a system status check fails. This is the most efficient recovery method for an instance in an Auto Scaling group, as it preserves the instance ID, private IP, and Elastic IP, while Auto Scaling handles only instance replacement if the instance is terminated.

Answer

Increase the Auto Scaling group's cooldown period.

Answer

Terminate the instance and wait for Auto Scaling to launch a new one.

Answer

Place the instance in a different Availability Zone.

Question 2

A company has a CloudWatch dashboard that displays custom metrics from an application. Some metrics are missing from the dashboard, but the application is publishing them to CloudWatch. The SysOps administrator confirms the metrics are present in the CloudWatch console under the correct namespace. What could be causing the metrics to not appear on the dashboard?

Accepted Answer

The dashboard widget is configured with a period that is longer than the interval at which metrics are published.. If the dashboard widget's period (e.g., 5 minutes) is longer than the metric publication interval (e.g., 1 minute), CloudWatch will aggregate the data points into the larger period. If the metric was published recently, the aggregation may not have completed, or the data points may fall outside the visible range of the widget's period, causing them to not appear even though the raw metrics exist in the namespace.

Answer

The IAM user viewing the dashboard does not have cloudwatch:GetMetricData permission.

Answer

The dashboard's time range is set to the last 1 hour, but the metrics were published 2 hours ago.

Answer

The namespace of the custom metrics is misspelled in the dashboard configuration.

Question 3

A SysOps administrator needs to track changes to security groups in the AWS account. Which AWS service should be used to record configuration changes and provide a history of security group modifications?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides a detailed inventory of AWS resources, records configuration changes, and maintains a historical timeline of those changes. For security groups, AWS Config can track modifications such as rule additions, deletions, or updates, and it can trigger evaluations against desired configurations. This makes it the ideal service for auditing and compliance use cases involving security group changes.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Question 4

A company is using Amazon RDS for MySQL. The SysOps administrator needs to monitor the number of database connections and set an alarm when connections exceed 80% of the maximum. Which CloudWatch metric and alarm threshold should be used?

Accepted Answer

Metric: DatabaseConnections; Threshold: 0.8 * max_connections (using a math expression). Amazon RDS for MySQL does not expose a direct 'DatabaseConnections' metric that represents the current connection count relative to the maximum. Instead, you must use the 'DatabaseConnections' CloudWatch metric (which reports the number of client connections) and create a CloudWatch math expression to compare it against the RDS instance's 'max_connections' parameter (e.g., 0.8 * max_connections). This allows you to set an alarm that triggers when connections exceed 80% of the configured maximum, which is the accurate way to monitor connection utilization.

Answer

Metric: DBConnections; Threshold: 80

Answer

Metric: DatabaseConnections; Threshold: 80

Answer

Metric: FreeableMemory; Threshold: 20%

Question 5

A SysOps administrator is investigating a security incident where an EC2 instance was used to launch an attack. The administrator needs to determine the source IP addresses that were used to access the instance prior to the attack. Which AWS service and feature should be used to capture this information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including the source IP address, destination IP address, port, protocol, and timestamps. This allows the administrator to identify the source IP addresses that accessed the EC2 instance prior to the attack, as the logs record all accepted and rejected traffic at the network interface level.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail with data events enabled for EC2

Answer

AWS Config with recording of security groups

Question 6

A SysOps administrator needs to monitor the CPU and memory utilization of an EC2 instance running a legacy application that cannot be modified. Which TWO methods can be used to collect this information? (Choose TWO.)

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. The CloudWatch agent can be installed on an EC2 instance to collect custom metrics, including memory utilization, which is not available by default from the hypervisor. The agent sends these metrics to CloudWatch using the PutMetricData API, enabling monitoring of in-guest resources like memory and disk.

Answer

Enable detailed monitoring on the instance to get memory metrics.

Answer

Use the EC2 hypervisor metrics available from CloudWatch.

Answer

Use AWS Systems Manager Inventory to collect memory utilization.

Question 7

A company wants to receive real-time notifications when specific API calls are made in their AWS account. Which TWO services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures API calls and can send events directly to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events rules can match specific API call patterns and trigger real-time notifications via targets like SNS or Lambda. No CloudWatch Logs involvement is required for this integration, so the solution uses exactly two services: CloudTrail and CloudWatch Events.

Answer

AWS Config

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 8

A SysOps administrator is troubleshooting an issue where an EC2 instance has failed a status check. The instance is still running but is unresponsive. Which THREE actions should the administrator take to diagnose and resolve the issue? (Choose THREE.)

Accepted Answer

Check the system status checks in the EC2 console.. System status checks (Option B) monitor the underlying physical host for issues like network or power loss, while instance status checks (like system log in Option C) detect OS-level problems. Reviewing the system log helps identify kernel panics or boot failures. Stopping and starting the instance (Option E) forces a migration to a new physical host, which can resolve host-level impairments without losing the instance's configuration or data.

Answer

Reboot the instance.

Answer

Restore the instance from the latest AMI.

Question 9

A SysOps administrator needs to send a notification when an EC2 instance's CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should be used to create the alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms are the correct service because they allow you to monitor a specific metric (e.g., EC2 CPUUtilization) and trigger an action when the metric crosses a defined threshold for a specified number of consecutive evaluation periods. In this case, you can create a CloudWatch alarm with a statistic of 'Average', a threshold of 90%, and set the 'Datapoints to Alarm' and 'Evaluation Periods' to 5 (with a period of 1 minute) to achieve the '5 consecutive minutes' requirement. The alarm can then send a notification via Amazon SNS.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon EventBridge

Question 10

A company is running a stateful web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent errors. The SysOps admin notices that the ALB's healthy host count is fluctuating. The admin wants to improve the health check configuration to reduce false positives. Which configuration change is most likely to help?

Accepted Answer

Increase the health check interval. Increasing the health check interval reduces the frequency of health checks, which helps prevent transient issues (e.g., brief CPU spikes or network jitter) from causing false positives. With a longer interval, the ALB waits longer between checks, giving the instance more time to recover before being marked unhealthy. This stabilizes the healthy host count and reduces unnecessary instance replacement.

Answer

Increase the unhealthy threshold count

Answer

Reduce the health check interval

Answer

Lower the healthy threshold count

Question 11

A SysOps admin is troubleshooting an Auto Scaling group that fails to launch instances. The group uses a launch template with an Amazon Linux 2 AMI. The admin reviews the scaling activity history and sees: 'Launching a new EC2 instance. Status: Failed. Description: Your spot request price is lower than the minimum required Spot price.' Which change should the admin make to resolve the issue?

Accepted Answer

Increase the maximum price for the Spot request in the launch template. The error message indicates that the Spot Instance request failed because the maximum price specified in the launch template is below the current Spot market price. By increasing the maximum price in the launch template (Option A), you allow the Spot request to meet or exceed the minimum required Spot price, enabling the Auto Scaling group to successfully launch instances. This is the direct fix for the price-related failure.

Answer

Modify the Auto Scaling group to use On-Demand instances instead of Spot

Answer

Change the Auto Scaling group to a different AWS Region

Answer

Increase the desired capacity of the Auto Scaling group

Question 12

A company wants to receive a real-time notification whenever an IAM user creates a new access key. Which combination of AWS services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail captures IAM API calls, including CreateAccessKey, as management events. Amazon EventBridge can be configured with a rule that matches this specific API call pattern and triggers a real-time notification (e.g., via SNS or Lambda). This combination provides the exact event-driven monitoring required without polling or custom code.

Answer

Amazon GuardDuty and Amazon SQS

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

AWS Config and Amazon SNS

Question 13

An application running on EC2 instances sends custom metrics to CloudWatch using the PutMetricData API. The SysOps admin notices that some metrics are missing from the CloudWatch console. What is the most likely cause?

Accepted Answer

The namespace in the PutMetricData call does not match the namespace in the CloudWatch console. Custom metrics in CloudWatch are uniquely identified by the combination of namespace, metric name, and dimensions. If the namespace used in the PutMetricData API call does not match the namespace being viewed in the CloudWatch console, the metrics will not appear under that namespace. CloudWatch does not automatically merge or alias namespaces, so mismatched namespaces cause the data to be stored under a different namespace, making it invisible in the console view.

Answer

The metric data does not include a unit

Answer

The metric data does not include a dimension

Answer

The metric data is being sent with a timestamp older than 14 days

Question 14

A SysOps admin is investigating why a CloudWatch alarm did not trigger an SNS notification when a metric breached the threshold. The alarm state is visible in the console as 'ALARM'. What is the most likely reason the notification was not sent?

Accepted Answer

The SNS topic's subscription is not confirmed. The most likely reason the notification was not sent is that the SNS topic's subscription is not confirmed. When an SNS topic sends a notification to an endpoint such as email, HTTP, or SMS, the subscription must first be confirmed by the subscriber. If the subscription remains in a 'Pending confirmation' state, SNS will not deliver messages to that endpoint, even if the CloudWatch alarm transitions to the ALARM state and publishes to the topic.

Answer

The alarm name contains special characters

Answer

The alarm's evaluation period is set to 1 minute

Answer

The metric has a resolution of 1 minute

Question 15

A SysOps admin notices that an EC2 instance's status check fails intermittently. The instance is part of an Auto Scaling group. What is the most appropriate first step to diagnose the issue?

Accepted Answer

Review the instance's status check history in the EC2 console. The most appropriate first step is to review the instance's status check history in the EC2 console (Option D). This allows the SysOps admin to determine whether the failures are due to system status checks (e.g., underlying hardware issues) or instance status checks (e.g., OS-level problems). Since the instance is part of an Auto Scaling group, understanding the root cause is critical before taking any corrective action, as premature termination or reboot could mask the issue or lead to unnecessary replacements.

Answer

Stop and start the instance

Answer

Terminate the instance and let Auto Scaling replace it

Answer

Reboot the instance