SOA-C02 Monitoring, Logging, and Remediation Practice Test 5 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. A SysOps admin wants to receive a notification when a stack update fails. Which approach is the most efficient?

Accepted Answer

Create an EventBridge rule that matches CloudFormation stack events. Amazon EventBridge can directly capture CloudFormation stack events (e.g., CREATE_FAILED, UPDATE_FAILED) in real time and trigger a notification via SNS or Lambda. This approach is serverless, requires no polling, and is the most efficient method for reacting to stack update failures as they occur.

Answer

Write a script that polls the CloudFormation API and sends notifications

Answer

Use AWS Config to monitor stack resources

Answer

Enable CloudTrail and create a metric filter for stack update failures

Question 2

Which TWO actions should a SysOps admin take to troubleshoot an Amazon RDS instance that is experiencing high CPU utilization? (Choose 2.)

Accepted Answer

Enable Enhanced Monitoring to view OS-level metrics. Enhanced Monitoring provides OS-level metrics (e.g., CPU, memory, disk I/O) for the RDS instance, which helps identify resource contention at the operating system level. This granularity is essential for diagnosing high CPU utilization that may be caused by OS processes (e.g., backup, patching) rather than database queries alone.

Answer

Enable Multi-AZ to distribute the load

Answer

Delete the slow query log to free up CPU

Answer

Increase the instance size to reduce CPU utilization

Question 3

Which THREE metrics from Amazon CloudWatch are most useful for diagnosing an application performance bottleneck on an EC2 instance running a web server? (Choose 3.)

Accepted Answer

CPUUtilization. CPUUtilization (A) is correct because high CPU usage directly indicates that the CPU is a bottleneck, limiting the web server's ability to process incoming requests. For a web server, sustained CPU saturation often correlates with poor response times and reduced throughput, making it a primary metric for performance diagnosis.

Answer

DiskReadOps

Answer

MemoryUtilization

Question 4

A SysOps admin needs to set up centralized logging for multiple AWS accounts. Which TWO services should be used together to aggregate logs into a single S3 bucket? (Choose 2.)

Accepted Answer

AWS Config. AWS Config and AWS CloudTrail are the correct pair because CloudTrail records API activity across accounts, and AWS Config records resource configuration changes. Both can be configured to deliver log files to a centralized S3 bucket by setting up a trail (CloudTrail) or a delivery channel (Config) that points to the same bucket, often using a bucket policy that grants cross-account write permissions. This enables aggregated logging for multiple AWS accounts in a single S3 bucket.

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 cross-region replication

Answer

Amazon CloudWatch Logs subscription filter

Question 5

A company is using CloudWatch Logs to centralize logs from multiple EC2 instances. The operations team notices that some log entries are missing from CloudWatch Logs. The CloudWatch agent is installed and running on all instances. What is the most likely cause?

Accepted Answer

The IAM role attached to the EC2 instance does not have the 'logs:PutLogEvents' permission.. The most likely cause is that the IAM role attached to the EC2 instance lacks the 'logs:PutLogEvents' permission. Without this permission, the CloudWatch agent can authenticate and connect to CloudWatch Logs but cannot actually write log data to the log stream, resulting in missing entries. The agent may appear to be running and healthy, but API calls to PutLogEvents will fail silently or log errors, leading to gaps in the centralized logs.

Answer

The CloudWatch agent is not configured to send logs to the correct log group.

Answer

The CloudWatch agent is sending logs to a different AWS Region.

Answer

The log group has been encrypted with a KMS key that the agent does not have access to.

Question 6

A SysOps administrator is setting up a CloudWatch dashboard to monitor an application. The application runs on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The administrator wants to track the number of healthy hosts and the request count per target group. Which two metrics should be used? (Choose TWO.)

Accepted Answer

HealthyHostCount (per TargetGroup). `HealthyHostCount` (per TargetGroup) is a CloudWatch metric that reports the number of healthy EC2 instances in a specific target group, which directly indicates the health of the backend fleet. Option D is correct because `RequestCount` (per TargetGroup) tracks the number of requests routed to that target group, allowing the administrator to correlate traffic load with host health. Together, these two metrics provide the exact visibility needed for an Auto Scaling group behind an ALB.

Answer

RequestCount (per ALB)

Answer

ActiveConnectionCount

Answer

HealthyHostCount (per ALB)

Question 7

A company wants to receive alerts when an Auto Scaling group launches or terminates instances. They already have a CloudTrail trail enabled. What is the simplest way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches Auto Scaling event patterns and sends notifications to an SNS topic.. CloudWatch Events (now part of Amazon EventBridge) can automatically capture Auto Scaling group state changes (launch and terminate) via CloudTrail API calls. By creating a rule that matches the specific event pattern for Auto Scaling events (e.g., 'EC2 Instance Launch Successful' and 'EC2 Instance Terminate Successful'), you can directly route those events to an SNS topic, which then sends notifications (e.g., email or SMS). This requires no custom code, lifecycle hooks, or additional monitoring configuration, making it the simplest solution.

Answer

Write a script on each EC2 instance to call the CloudWatch Logs API on launch/termination.

Answer

Configure the Auto Scaling group to publish lifecycle hooks and use Lambda to send notifications.

Answer

Enable CloudWatch detailed monitoring on the Auto Scaling group and create alarms.

Question 8

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is becoming unresponsive under high load. The administrator has enabled detailed monitoring and set up CPUUtilization alarms. Which THREE additional steps could help diagnose the root cause? (Choose THREE.)

Accepted Answer

Install the CloudWatch agent and collect disk space metrics.. Under high load, the web server could become unresponsive due to disk space exhaustion (e.g., from log files filling the root partition). The CloudWatch agent can collect disk space metrics, which are not available by default, allowing the administrator to correlate disk usage with performance degradation.

Answer

Place the instance behind an Auto Scaling group.

Answer

Increase the instance size to handle more load.

Question 9

Refer to the exhibit. An application running on EC2 is using the AWS SDK to publish custom metrics to CloudWatch. The application fails to publish metrics. The IAM role attached to the EC2 instance has this policy. What is the issue?

Accepted Answer

The application may be using a different namespace than 'MyApp'.. The IAM policy explicitly allows 'cloudwatch:PutMetricData' on the condition that the namespace is 'MyApp'. If the application's AWS SDK code publishes metrics under a different namespace (e.g., 'AWS/EC2' or a custom namespace like 'MyOtherApp'), the condition fails and the API call is denied. This is the most likely cause of the failure, as the policy is otherwise correctly configured for the specified namespace.

Answer

The condition key 'cloudwatch:namespace' is misspelled.

Answer

The policy does not specify a specific resource ARN.

Answer

The action 'cloudwatch:PutMetricData' is not allowed for custom metrics.

Question 10

A company has a production environment with multiple EC2 instances that send logs to CloudWatch Logs. The operations team wants to search across all log groups for a specific error pattern. What is the most efficient way to achieve this?

Accepted Answer

Use CloudWatch Logs Insights to query across all log groups.. CloudWatch Logs Insights allows you to run SQL-like queries across multiple log groups in a single query, making it the most efficient way to search for a specific error pattern across all log groups without needing to set up additional infrastructure or manually query each group individually.

Answer

Set up a subscription filter to stream logs to an Amazon ES domain.

Answer

Use CloudWatch Logs filter patterns on each log group.

Answer

Download all logs to an S3 bucket and use Amazon Athena to query.

Question 11

An administrator needs to be notified when the root user signs in to the AWS Management Console. Which method should be used?

Accepted Answer

Create a CloudWatch Events rule for 'AWS Console Sign-In' events and set the target to an SNS topic.. You can create an Amazon CloudWatch Events rule (now called Amazon EventBridge rule) that matches the 'AWS Console Sign-In' event from AWS CloudTrail. When the root user signs in, this event is generated, and the rule can trigger an SNS topic to send a notification to the administrator. This is the recommended approach for real-time alerting on root user activity.

Answer

Enable CloudTrail Insights to detect root login anomalies.

Answer

Create a CloudWatch alarm on the RootAccountUsage metric.

Answer

Use AWS Config to track IAM password policy changes.

Question 12

A company uses CloudWatch Logs to store application logs. The logs must be retained for 3 years for compliance. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Set the log group retention period to 3 years.. Setting the CloudWatch Logs retention period to 3 years directly satisfies the compliance requirement. Additionally, exporting logs to S3 is a valid alternative for long-term retention. Since the question asks for two steps, the correct options should be C (set retention) and E (export to S3), as both are complete actions that achieve retention. Option A is not correct by itself because it only configures a lifecycle policy without any S3 objects to manage.

Answer

Configure an S3 lifecycle policy to transition objects to Glacier after 3 years.

Answer

Enable CloudWatch Logs Insights.

Answer

Use CloudWatch Logs subscription filter to stream logs to Amazon Kinesis Firehose.

Question 13

A SysOps administrator wants to receive an email when the average CPU utilization of an EC2 instance exceeds 90% for 5 minutes. What should the administrator create?

Accepted Answer

A CloudWatch alarm on the CPUUtilization metric with an SNS notification.. A CloudWatch alarm on the CPUUtilization metric can be configured to evaluate the average CPU usage over a 5-minute period and trigger an action when it exceeds 90%. The alarm can send a notification via Amazon SNS, which can deliver an email to subscribed endpoints. This directly meets the requirement for email notification based on a sustained metric threshold.

Answer

A CloudWatch Logs metric filter on the instance logs.

Answer

An AWS Config rule to detect high CPU usage.

Answer

A CloudWatch Events rule on the EC2 instance state change.

Question 14

A company wants to ensure that all S3 buckets are configured with server access logging. Which TWO AWS services can be used to detect non-compliant buckets? (Choose TWO.)

Accepted Answer

AWS Config. AWS Config is correct because it provides managed rules (e.g., s3-bucket-server-access-logging-enabled) that continuously evaluate S3 bucket configurations against desired settings. When a bucket lacks server access logging, AWS Config marks it as non-compliant and can trigger automated remediation via AWS Systems Manager Automation or custom Lambda functions.

Answer

Amazon Inspector

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 15

A SysOps administrator is investigating why a CloudWatch alarm did not trigger an SNS notification. The alarm state changed to ALARM, but the notification was not sent. The SNS topic has a subscription to an email endpoint. What is the most likely cause?

Accepted Answer

The email subscription to the SNS topic has not been confirmed.. The most likely cause is that the email subscription to the SNS topic has not been confirmed. When an SNS topic has an email subscription, AWS sends a confirmation email to the endpoint, and the subscriber must click the confirmation link before notifications can be delivered. Until the subscription is confirmed, the SNS topic will not send any messages to that endpoint, even if the CloudWatch alarm enters the ALARM state and successfully publishes to the topic.

Answer

The alarm's evaluation period is too short.

Answer

The alarm's actions are not configured to send to the SNS topic.

Answer

The SNS topic is encrypted with a KMS key that the alarm does not have permissions to use.