SOA-C02 Monitoring, Logging, and Remediation Practice Test 5 — 15 Questions

Question 1

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes. The SysOps administrator needs to identify the root cause. Which set of CloudWatch metrics should be analyzed first?

Accepted Answer

ALB TargetResponseTime and EC2 CPUUtilization. The correct answer is A because intermittent latency spikes in a web application behind an Application Load Balancer (ALB) are most directly investigated by correlating ALB TargetResponseTime (which measures the time taken for the target to respond to the ALB) with EC2 CPUUtilization (which indicates whether the instance is under compute pressure). A spike in TargetResponseTime alongside high CPUUtilization suggests the EC2 instance is struggling to process requests, pointing to a compute bottleneck as the root cause.

Answer

EC2 CPUUtilization and NetworkIn

Answer

EC2 StatusCheckFailed and ALB UnhealthyHostCount

Answer

ALB RequestCount and HealthyHostCount

Question 2

A SysOps administrator is troubleshooting an issue where an EC2 instance is not sending logs to CloudWatch Logs. The instance has the CloudWatch agent installed, but no logs appear in the log group. The IAM role assigned to the instance has the following policy: {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"], "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:*"}]}. What is the most likely cause?

Accepted Answer

The log group name in the agent configuration does not match the policy resource.. The IAM policy grants permissions only for the log group named 'MyAppLogs' (with a wildcard for streams). If the CloudWatch agent configuration specifies a different log group name, the agent's API calls to CreateLogGroup, CreateLogStream, or PutLogEvents will fail with an AccessDenied error because the resource ARN in the policy does not match the actual log group being targeted. This is the most common cause when the agent is installed and running but no logs appear.

Answer

The CloudWatch agent is not running on the instance.

Answer

The IAM role does not have permission to describe log groups.

Answer

The instance does not have outbound internet access to reach CloudWatch Logs.

Question 3

A company wants to ensure that it receives notifications whenever any AWS Identity and Access Management (IAM) user in the account creates a new access key. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture API calls from AWS CloudTrail and trigger a notification (e.g., via SNS) when an IAM user creates a new access key. By setting up a rule that matches the `CreateAccessKey` API call, the company can receive real-time alerts for this specific action.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 4

A SysOps administrator notices that an EC2 instance's status check fails intermittently. The instance is part of an Auto Scaling group. What is the most efficient way to automatically recover the instance?

Accepted Answer

Create a CloudWatch alarm on StatusCheckFailed and configure an EC2 recovery action.. Option B is correct because creating a CloudWatch alarm on the StatusCheckFailed metric and configuring an EC2 recovery action (using the 'recover' alarm action) automatically restarts the instance on a new underlying host if a system status check fails. This is the most efficient recovery method for an instance in an Auto Scaling group, as it preserves the instance ID, private IP, and Elastic IP, while Auto Scaling handles only instance replacement if the instance is terminated.

Answer

Increase the Auto Scaling group's cooldown period.

Answer

Terminate the instance and wait for Auto Scaling to launch a new one.

Answer

Place the instance in a different Availability Zone.

Question 5

A company has a CloudWatch dashboard that displays custom metrics from an application. Some metrics are missing from the dashboard, but the application is publishing them to CloudWatch. The SysOps administrator confirms the metrics are present in the CloudWatch console under the correct namespace. What could be causing the metrics to not appear on the dashboard?

Accepted Answer

The dashboard widget is configured with a period that is longer than the interval at which metrics are published.. Option C is correct because if the dashboard widget's period (e.g., 5 minutes) is longer than the metric publication interval (e.g., 1 minute), CloudWatch will aggregate the data points into the larger period. If the metric was published recently, the aggregation may not have completed, or the data points may fall outside the visible range of the widget's period, causing them to not appear even though the raw metrics exist in the namespace.

Answer

The IAM user viewing the dashboard does not have cloudwatch:GetMetricData permission.

Answer

The dashboard's time range is set to the last 1 hour, but the metrics were published 2 hours ago.

Answer

The namespace of the custom metrics is misspelled in the dashboard configuration.

Question 6

A SysOps administrator needs to track changes to security groups in the AWS account. Which AWS service should be used to record configuration changes and provide a history of security group modifications?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides a detailed inventory of AWS resources, records configuration changes, and maintains a historical timeline of those changes. For security groups, AWS Config can track modifications such as rule additions, deletions, or updates, and it can trigger evaluations against desired configurations. This makes it the ideal service for auditing and compliance use cases involving security group changes.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Question 7

A company is using Amazon RDS for MySQL. The SysOps administrator needs to monitor the number of database connections and set an alarm when connections exceed 80% of the maximum. Which CloudWatch metric and alarm threshold should be used?

Accepted Answer

Metric: DatabaseConnections; Threshold: 0.8 * max_connections (using a math expression). Option D is correct because Amazon RDS for MySQL does not expose a direct 'DatabaseConnections' metric that represents the current connection count relative to the maximum. Instead, you must use the 'DatabaseConnections' CloudWatch metric (which reports the number of client connections) and create a CloudWatch math expression to compare it against the RDS instance's 'max_connections' parameter (e.g., 0.8 * max_connections). This allows you to set an alarm that triggers when connections exceed 80% of the configured maximum, which is the accurate way to monitor connection utilization.

Answer

Metric: DBConnections; Threshold: 80

Answer

Metric: DatabaseConnections; Threshold: 80

Answer

Metric: FreeableMemory; Threshold: 20%

Question 8

A SysOps administrator is investigating a security incident where an EC2 instance was used to launch an attack. The administrator needs to determine the source IP addresses that were used to access the instance prior to the attack. Which AWS service and feature should be used to capture this information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including the source IP address, destination IP address, port, protocol, and timestamps. This allows the administrator to identify the source IP addresses that accessed the EC2 instance prior to the attack, as the logs record all accepted and rejected traffic at the network interface level.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail with data events enabled for EC2

Answer

AWS Config with recording of security groups

Question 9

A SysOps administrator needs to monitor the CPU and memory utilization of an EC2 instance running a legacy application that cannot be modified. Which TWO methods can be used to collect this information? (Choose TWO.)

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. Option B is correct because the CloudWatch agent can be installed on an EC2 instance to collect custom metrics, including memory utilization, which is not available by default from the hypervisor. The agent sends these metrics to CloudWatch using the PutMetricData API, enabling monitoring of in-guest resources like memory and disk.

Answer

Enable detailed monitoring on the instance to get memory metrics.

Answer

Use the EC2 hypervisor metrics available from CloudWatch.

Answer

Use AWS Systems Manager Inventory to collect memory utilization.

Question 10

A company wants to receive real-time notifications when specific API calls are made in their AWS account. Which TWO services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures all API calls made in the AWS account and can deliver those events to CloudWatch Logs. Amazon CloudWatch Events (now part of Amazon EventBridge) can then process those log entries in real time using event rules that match specific API calls, triggering a target such as an SNS notification or Lambda function. This combination provides real-time notification without polling or custom code.

Answer

AWS Config

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 11

A SysOps administrator is troubleshooting an issue where an EC2 instance has failed a status check. The instance is still running but is unresponsive. Which THREE actions should the administrator take to diagnose and resolve the issue? (Choose THREE.)

Accepted Answer

Check the system status checks in the EC2 console.. System status checks (Option B) monitor the underlying physical host for issues like network or power loss, while instance status checks (like system log in Option C) detect OS-level problems. Reviewing the system log helps identify kernel panics or boot failures. Stopping and starting the instance (Option E) forces a migration to a new physical host, which can resolve host-level impairments without losing the instance's configuration or data.

Answer

Reboot the instance.

Answer

Restore the instance from the latest AMI.

Question 12

A SysOps administrator needs to send a notification when an EC2 instance's CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should be used to create the alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms are the correct service because they allow you to monitor a specific metric (e.g., EC2 CPUUtilization) and trigger an action when the metric crosses a defined threshold for a specified number of consecutive evaluation periods. In this case, you can create a CloudWatch alarm with a statistic of 'Average', a threshold of 90%, and set the 'Datapoints to Alarm' and 'Evaluation Periods' to 5 (with a period of 1 minute) to achieve the '5 consecutive minutes' requirement. The alarm can then send a notification via Amazon SNS.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon EventBridge

Question 13

A company is running a stateful web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent errors. The SysOps admin notices that the ALB's healthy host count is fluctuating. The admin wants to improve the health check configuration to reduce false positives. Which configuration change is most likely to help?

Accepted Answer

Increase the health check interval. Increasing the health check interval reduces the frequency of health checks, which helps prevent transient issues (e.g., brief CPU spikes or network jitter) from causing false positives. With a longer interval, the ALB waits longer between checks, giving the instance more time to recover before being marked unhealthy. This stabilizes the healthy host count and reduces unnecessary instance replacement.

Answer

Increase the unhealthy threshold count

Answer

Reduce the health check interval

Answer

Lower the healthy threshold count

Question 14

A SysOps admin is troubleshooting an Auto Scaling group that fails to launch instances. The group uses a launch template with an Amazon Linux 2 AMI. The admin reviews the scaling activity history and sees: 'Launching a new EC2 instance. Status: Failed. Description: Your spot request price is lower than the minimum required Spot price.' Which change should the admin make to resolve the issue?

Accepted Answer

Increase the maximum price for the Spot request in the launch template. The error message indicates that the Spot Instance request failed because the maximum price specified in the launch template is below the current Spot market price. By increasing the maximum price in the launch template (Option A), you allow the Spot request to meet or exceed the minimum required Spot price, enabling the Auto Scaling group to successfully launch instances. This is the direct fix for the price-related failure.

Answer

Modify the Auto Scaling group to use On-Demand instances instead of Spot

Answer

Change the Auto Scaling group to a different AWS Region

Answer

Increase the desired capacity of the Auto Scaling group

Question 15

A company wants to receive a real-time notification whenever an IAM user creates a new access key. Which combination of AWS services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail captures IAM API calls, including CreateAccessKey, as management events. Amazon EventBridge can be configured with a rule that matches this specific API call pattern and triggers a real-time notification (e.g., via SNS or Lambda). This combination provides the exact event-driven monitoring required without polling or custom code.

Answer

Amazon GuardDuty and Amazon SQS

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

AWS Config and Amazon SNS