SOA-C02 Monitoring, Logging, and Remediation Practice Test 4 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The SysOps administrator needs to centralize the monitoring of all API calls made in any account for security analysis. The solution must collect logs from all accounts, both existing and future, and deliver them to a centralized S3 bucket in the management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudTrail organization trail. AWS CloudTrail organization trails allow you to log all API calls across all accounts in an AWS Organization from a single management account. When you create an organization trail, it automatically applies to all existing and future accounts, delivering logs to a centralized S3 bucket in the management account without requiring per-account configuration.

Answer

AWS Config aggregator

Answer

Amazon CloudWatch Logs with cross-account subscription

Answer

Amazon Detective

Question 2

A SysOps administrator needs to analyze application logs stored in Amazon CloudWatch Logs to find specific error patterns across multiple log groups. The administrator wants to run queries to filter and parse the logs. Which feature should the administrator use?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is the correct feature because it enables you to interactively search and analyze log data stored in CloudWatch Logs using a purpose-built query language. It allows you to run queries across multiple log groups, filter, parse, and aggregate logs to identify specific error patterns, making it ideal for ad-hoc log analysis and troubleshooting.

Answer

CloudWatch Logs subscriptions

Answer

CloudWatch Metric Filters

Answer

CloudWatch Contributor Insights

Question 3

A SysOps administrator manages multiple AWS accounts and wants to create a single Amazon CloudWatch dashboard that displays real-time metrics from all accounts in one view. The administrator needs to avoid managing separate dashboards for each account. Which solution should the administrator implement?

Accepted Answer

Use CloudWatch cross-account observability by setting up a monitoring account and sharing metrics from source accounts.. CloudWatch cross-account observability allows you to designate a monitoring account that can view metrics, logs, and traces from multiple source accounts. This feature uses AWS Organizations or CloudWatch cross-account links to share observability data in real time, enabling a single dashboard that aggregates metrics from all accounts without needing separate dashboards.

Answer

Export CloudWatch metrics to Amazon QuickSight and create a dashboard there.

Answer

Use AWS Config aggregator to collect metrics and display in CloudWatch.

Answer

Create a Lambda function that periodically pulls metrics from each account and publishes to a central account's CloudWatch.

Question 4

A SysOps administrator needs to detect unauthorized changes to security groups and automatically notify the operations team. Which two AWS services should be part of the solution? (Choose 2.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to create, modify, or delete security groups, providing the audit trail needed to detect unauthorized changes. By enabling CloudTrail on the account and configuring a trail to deliver logs to Amazon S3, the administrator can monitor security group events such as AuthorizeSecurityGroupIngress or RevokeSecurityGroupEgress. This log data is essential for identifying when a change occurred, who made it, and from which source IP.

Answer

Amazon S3 Transfer Acceleration.

Answer

AWS Snowball Edge.

Question 5

A SysOps administrator needs to monitor memory utilization on an Amazon EC2 instance. Memory metrics are not available by default in Amazon CloudWatch for EC2 instances. Which action should the administrator take to collect memory utilization metrics?

Accepted Answer

Install the CloudWatch agent on the EC2 instance. The CloudWatch agent is the correct solution because it can collect custom metrics, including memory utilization, from EC2 instances. Unlike the default hypervisor-level metrics (CPU, network, disk), memory metrics require an in-guest agent to read the operating system's memory counters and publish them to CloudWatch.

Answer

Enable detailed monitoring on the EC2 instance

Answer

Use an AWS Lambda function to query the EC2 instance for memory metrics

Answer

Use Amazon Inspector to collect memory metrics

Question 6

An EC2 instance runs a Java application. The operations team wants to monitor heap memory utilization in CloudWatch and set alarms when it exceeds 85 percent. EC2 does not natively publish memory metrics to CloudWatch. What is the simplest way to get this metric into CloudWatch?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect mem_used_percent; publish JVM heap metrics from the application using PutMetricData. Option A is correct because the CloudWatch agent can collect custom metrics like memory utilization from the EC2 instance, and the Java application can directly publish JVM heap metrics to CloudWatch using the PutMetricData API. This combination provides the simplest and most direct way to monitor heap memory utilization and set alarms at the 85% threshold, as EC2 does not natively expose memory metrics.

Answer

Enable detailed monitoring on the EC2 instance to increase metric resolution to 1-minute intervals

Answer

Configure a CloudWatch Logs metric filter on the application log stream to count lines containing 'OutOfMemoryError'

Answer

Use AWS Systems Manager Inventory to collect memory data and sync it to CloudWatch

Question 7

Multiple microservices each write structured JSON logs to separate CloudWatch log groups. The operations team needs to find all ERROR-level log entries across all log groups for the past 24 hours and count errors by service name. Which approach achieves this with the least operational overhead?

Accepted Answer

Run a CloudWatch Logs Insights query selecting all relevant log groups, filter where level = 'ERROR', and use stats count(*) by service. CloudWatch Logs Insights natively supports querying multiple log groups in a single query using the `SELECT` and `stats` commands. By specifying all relevant log groups in the query scope, filtering for `level = 'ERROR'`, and using `stats count(*) by service`, the operations team can directly aggregate error counts per service without any data movement, additional infrastructure, or manual scripting. This approach has the least operational overhead because it leverages existing CloudWatch capabilities with no setup or maintenance.

Answer

Export each log group to S3 and run an Athena query joining all exported files

Answer

Subscribe all log groups to a Kinesis Data Firehose stream and query the aggregated data in OpenSearch

Answer

Use the AWS CLI to download and grep log events from each log group separately, then sum the results

Question 8

An environment has 12 individual CloudWatch metric alarms covering CPU, memory, disk, and network. When one instance degrades, all 12 alarms fire simultaneously and send 12 separate notifications to the on-call engineer. The team wants a single notification per incident regardless of how many individual alarms trigger. What CloudWatch feature addresses this?

Accepted Answer

Create a composite alarm that enters ALARM state when any of the 12 child alarms is in ALARM state, and configure a single SNS action on the composite alarm only. Option A is correct because a composite alarm in CloudWatch can aggregate multiple child alarms into a single parent alarm. When any of the 12 child alarms enters the ALARM state, the composite alarm transitions to ALARM and triggers a single SNS notification, thereby reducing alert noise to one notification per incident.

Answer

Increase the alarm evaluation period on all 12 alarms to 30 minutes so they fire less frequently

Answer

Use an SNS topic with a delivery policy that batches notifications sent within a 60-second window

Answer

Configure all 12 alarms to write to the same CloudWatch Events rule and suppress duplicate events with EventBridge deduplication

Question 9

The security team requires that no S3 bucket in the account ever has public read or write ACLs enabled. They want non-compliant buckets automatically remediated within 5 minutes of detection without any manual intervention. What is the correct implementation?

Accepted Answer

Create an AWS Config rule for s3-bucket-public-read-prohibited; configure auto-remediation using the AWS-DisableS3BucketPublicReadWrite SSM Automation document. Option A is correct because AWS Config can evaluate S3 bucket ACLs against the `s3-bucket-public-read-prohibited` managed rule and automatically trigger an AWS Systems Manager (SSM) Automation document (`AWS-DisableS3BucketPublicReadWrite`) as a remediation action. This ensures non-compliant buckets are fixed within minutes without manual intervention, meeting the 5-minute requirement.

Answer

Create an EventBridge rule that matches S3 PutBucketAcl API calls and triggers a Lambda function to re-apply a private ACL

Answer

Enable S3 Block Public Access at the account level to prevent public ACLs from being set in the first place

Answer

Schedule a daily Lambda function that lists all buckets, checks ACLs, and removes public grants if found

Question 10

The monitoring team needs to collect per-process CPU and memory utilization for a specific Java process (named 'app.jar') running on EC2 Linux instances. Standard EC2 metrics show aggregate CPU but not per-process details. Which CloudWatch agent configuration section enables this?

Accepted Answer

Add a procstat section under metrics_collected in the CloudWatch agent config, specifying process_name = 'app.jar' to collect per-process CPU and memory. The CloudWatch agent's `procstat` plugin is specifically designed to collect per-process metrics such as CPU and memory utilization. By adding a `procstat` section under `metrics_collected` in the agent configuration file and specifying the process name (e.g., `process_name = 'app.jar'`), the agent will gather the required per-process metrics and send them to CloudWatch. This is the only native method within the CloudWatch ecosystem to achieve per-process monitoring on EC2 Linux instances.

Answer

Enable enhanced monitoring on the EC2 instance and select 'per-process metrics' from the console

Answer

Configure a CloudWatch Logs metric filter on the Java GC log output to derive CPU and memory figures

Answer

Use the aws ec2 describe-instance-status API on a schedule to pull process metrics from the instance's system status checks

Question 11

Drag and drop the steps to troubleshoot an unhealthy target in an Application Load Balancer target group into the correct order.

Question 12

Drag and drop the steps to migrate an on-premises application to AWS using AWS Application Migration Service (MGN) into the correct order.

Question 13

Match each AWS service to its primary function.

Question 14

Match each AWS monitoring tool to its function.

Question 15

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to set up this monitoring and alerting?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides the ability to monitor EC2 instance metrics, such as CPU utilization, and create CloudWatch Alarms that trigger when a metric crosses a defined threshold (e.g., 80%) for a specified number of consecutive evaluation periods (e.g., 10 minutes with a 1-minute period). This directly meets the requirement for monitoring and alerting on CPU utilization.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail