SOA-C02 Monitoring, Logging, and Remediation Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. The command returns no events for RunInstances during the specified time period. The administrator knows that instances were launched during that time. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudTrail is not configured to log management events.. CloudTrail can be configured to log either management events, data events, or both. If only data events are logged, management events such as RunInstances will not appear in the CloudTrail event history. The command `aws cloudtrail lookup-events` queries the CloudTrail event history, which only contains events that CloudTrail is configured to record. Since the administrator knows instances were launched but no events are returned, the most likely cause is that CloudTrail is not configured to log management events.

Answer

CloudTrail logs are being delivered to an S3 bucket, not to CloudWatch Logs.

Answer

The command is run in the wrong AWS Region.

Answer

The IAM user does not have permission to view CloudTrail events.

Question 2

A company wants to be able to query application logs in near real-time using a SQL-like syntax. Which AWS service should be used?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is the correct service because it enables interactive querying of log data stored in CloudWatch Logs using a purpose-built SQL-like query language. It is designed for ad-hoc analysis of logs in near real-time, allowing users to filter, aggregate, and visualize log events without needing to export data to another analytics platform.

Answer

CloudWatch Metrics Insights

Answer

CloudWatch Events

Answer

CloudWatch Logs subscription filters

Question 3

A company is using Amazon CloudWatch Logs to monitor application logs from EC2 instances. The operations team wants to receive a notification when a specific error pattern appears in the logs. Which solution requires the least operational overhead?

Accepted Answer

Install the CloudWatch agent on EC2 instances and configure it to stream logs to CloudWatch Logs. Create a metric filter for the error pattern and set a CloudWatch alarm that sends an SNS notification.. It uses native CloudWatch capabilities: the CloudWatch agent streams logs to CloudWatch Logs, a metric filter extracts the error pattern, and a CloudWatch alarm directly sends an SNS notification. This approach requires no additional compute resources like Lambda and no custom code, resulting in the least operational overhead. Option C requires creating and managing a Lambda function, which adds complexity and maintenance. Options B and D are more complex with extra services.

Answer

Use Amazon Kinesis Data Firehose to stream all logs to Amazon S3, then run an AWS Glue job to search for the error pattern and trigger an SNS notification.

Answer

Install the CloudWatch agent on EC2 instances, stream logs to CloudWatch Logs, and use a subscription filter to invoke an AWS Lambda function that publishes a message to an SNS topic.

Answer

Configure the application to write logs to a file, use the CloudWatch agent to send logs to CloudWatch Logs, set a metric filter, and use the filter to send data to Amazon EventBridge, which then triggers a Lambda function to send an SNS notification.

Question 4

A SysOps administrator is troubleshooting a slow-running application on an EC2 instance. CloudWatch metrics show high CPU utilization but low disk I/O. The instance type is t3.medium. Which action would most likely improve performance?

Accepted Answer

Change the instance type to c5.large, which provides dedicated CPU performance.. The t3.medium is a burstable instance that relies on CPU credits. High CPU utilization with low disk I/O indicates the application is CPU-bound and the instance has likely exhausted its CPU credits, causing performance throttling. Changing to a c5.large provides dedicated, consistent CPU performance without credit-based limitations, directly addressing the bottleneck.

Answer

Increase the instance memory by changing to r5.large.

Answer

Enable EBS-optimized on the instance and use provisioned IOPS SSD volumes.

Answer

Increase the size of the EBS volume to improve disk throughput.

Question 5

A company has enabled AWS CloudTrail in all regions and is logging to an S3 bucket. The security team needs to be alerted within minutes if any IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs. Create a metric filter for the IAM event 'CreateAccessKey' and set a CloudWatch alarm that sends an SNS notification.. CloudTrail can be configured to deliver events to CloudWatch Logs, where a metric filter can be created to match the 'CreateAccessKey' event. A CloudWatch alarm based on that metric filter can then trigger an SNS notification within minutes, providing the most efficient and native AWS solution for real-time alerting without custom code or polling.

Answer

Enable S3 event notifications on the CloudTrail bucket to trigger a Lambda function that parses logs and sends an alert.

Answer

Use AWS Config rules to detect changes to IAM access keys and trigger an SNS notification.

Answer

Run a script on an EC2 instance that polls CloudTrail API for new events every minute and sends alerts.

Question 6

An application running on Amazon ECS with Fargate is experiencing intermittent failures. The application logs show connection timeouts to an RDS MySQL database. The database is in the same VPC but a different subnet. Which CloudWatch metric should be examined first to diagnose the issue?

Accepted Answer

VPC Flow Logs for the ECS task's elastic network interface.. VPC Flow Logs capture metadata about network traffic at the elastic network interface level, including whether packets were accepted or rejected. Since the application logs show connection timeouts (not authentication or resource exhaustion), the most likely cause is a network path issue, such as a missing route or security group rule blocking traffic between the ECS task's subnet and the RDS subnet. VPC Flow Logs will reveal if packets from the ECS task to the RDS database are being dropped, allowing you to pinpoint the exact network failure.

Answer

DatabaseConnections for the RDS instance.

Answer

MemoryUtilization for the RDS instance.

Answer

CPUUtilization for the ECS tasks.

Question 7

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The application is read-heavy and can tolerate eventual consistency. Which action would MOST effectively reduce CPU load?

Accepted Answer

Create one or more read replicas and direct read traffic to them.. The application is read-heavy and can tolerate eventual consistency, making read replicas the ideal solution. By offloading read traffic to one or more read replicas, the primary RDS instance's CPU load is reduced because it no longer has to process all read queries. This directly addresses the high CPU utilization during peak hours without requiring a larger instance or other changes.

Answer

Increase the instance size from db.r5.large to db.r5.xlarge.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the storage type to Provisioned IOPS.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack update fails. What is the simplest way to achieve this?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's notification options.. CloudFormation natively supports specifying an SNS topic in the stack's notification options, which automatically sends notifications on stack events such as failures, without requiring any additional services or custom code. This is the simplest and most direct method to notify the operations team when a stack update fails.

Answer

Enable CloudTrail and create a metric filter for 'UpdateStack' events, then set an alarm.

Answer

Write a script that periodically checks the CloudFormation console for stack status and sends an email.

Answer

Create an Amazon EventBridge rule that matches CloudFormation events and triggers a Lambda function to send an SNS notification.

Question 9

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 5xx errors. CloudWatch metrics show that the ALB's 'HTTPCode_ELB_5XX_Count' is elevated. What is the MOST likely cause?

Accepted Answer

The load balancer is timing out waiting for a response from the target.. When the ALB's 'HTTPCode_ELB_5XX_Count' is elevated, it indicates that the load balancer itself is generating the 5xx error, not the target. The most common cause is that the load balancer is timing out while waiting for a response from the target instances, which occurs when the target takes longer than the configured idle timeout (default 60 seconds) to respond. This results in the ALB returning a 504 Gateway Timeout error, which is counted in the ELB 5xx metric.

Answer

The target instances are returning HTTP 503 errors.

Answer

The target instances have high latency but are still responding.

Answer

Client requests are malformed and being rejected by the load balancer.

Question 10

A company stores sensitive data in an S3 bucket. The security team requires that any access to the bucket from outside the corporate network be logged and immediately alerted. Which solution meets these requirements?

Accepted Answer

Enable S3 server access logging, stream logs to CloudWatch Logs, create a metric filter for external IP addresses, and set a CloudWatch alarm.. It combines S3 server access logging with CloudWatch Logs streaming, metric filtering for external IP addresses, and a CloudWatch alarm. This provides both logging and immediate alerting for any access from outside the corporate network, meeting the security team's requirements.

Answer

Enable S3 server access logging and store logs in a separate bucket for later analysis.

Answer

Enable AWS CloudTrail and create a metric filter for 'GetObject' events, then set a CloudWatch alarm.

Answer

Use AWS Config rules to detect when the bucket policy is changed to allow public access.

Question 11

A SysOps administrator is investigating a performance issue where an Amazon RDS for MySQL instance's ReadIOPS metric is consistently high. The database is used by a web application. Which THREE actions should the administrator take to improve performance?

Accepted Answer

Increase the InnoDB buffer pool size to cache more data in memory.. Increasing the InnoDB buffer pool size allows more data and indexes to be cached in memory, reducing the need for disk reads and thus lowering ReadIOPS. This is a direct and effective tuning action for MySQL on RDS when read I/O is the bottleneck.

Answer

Change the storage type to Provisioned IOPS for better performance.

Answer

Enable Multi-AZ deployment for high availability.

Question 12

A company uses Amazon CloudWatch to monitor its AWS infrastructure. The operations team wants to receive notifications when any EC2 instance's status check fails. Which TWO steps should be taken to achieve this?

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when the alarm state changes. This allows the operations team to receive immediate notifications (e.g., via email, SMS, or HTTP) when an EC2 instance's status check fails. Option E is also correct because the StatusCheckFailed metric (or StatusCheckFailed_Instance) directly reflects the result of the EC2 status check; setting an alarm with a threshold of greater than 0 triggers when any status check fails.

Answer

Create a CloudWatch alarm on the CPUUtilization metric with a threshold of 90%.

Answer

Enable AWS CloudTrail to capture instance state changes.

Answer

Install the CloudWatch agent on the instance and publish custom memory metrics.

Question 13

A company needs to monitor the CPU and memory utilization of its EC2 instances. Which TWO services can be used to collect and visualize these metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the native AWS monitoring service that collects and stores metrics such as CPU utilization and memory utilization from EC2 instances. However, by default, CloudWatch only captures hypervisor-level metrics (like CPU) and not in-guest metrics (like memory utilization). To collect memory utilization, you must install the Amazon CloudWatch Agent on the instance, which sends custom metrics to CloudWatch. Together, CloudWatch and the CloudWatch Agent provide both collection and visualization of CPU and memory metrics.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Systems Manager

Question 14

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to configure this monitoring and alerting?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it allows you to monitor a specific metric, such as EC2 CPUUtilization, and trigger an action (e.g., an SNS notification) when the metric crosses a defined threshold (80%) for a specified number of consecutive evaluation periods (10 minutes, which with the default 1-minute period equals 10 datapoints). This directly fulfills the requirement for threshold-based alerting on a single metric over a sustained duration.

Answer

Amazon EventBridge

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 15

A company's application running on EC2 instances is experiencing intermittent errors. The SysOps team needs to collect and analyze application logs from all instances centrally. The logs must be stored durably and searchable with minimal latency. Which solution meets these requirements?

Accepted Answer

Install the CloudWatch Logs agent on each EC2 instance and stream logs to Amazon CloudWatch Logs.. The CloudWatch Logs agent (or unified CloudWatch agent) installed on each EC2 instance can stream application logs in near real-time to Amazon CloudWatch Logs, which provides durable storage, automatic encryption at rest, and a searchable interface via the console, CLI, or API with minimal latency. This centralized logging solution meets the requirements for collecting logs from all instances, storing them durably, and enabling immediate querying without additional infrastructure.

Answer

Enable AWS CloudTrail and store logs in an S3 bucket.

Answer

Use Amazon Kinesis Data Firehose to send logs directly from each instance to Amazon Redshift.

Answer

Store logs locally on each instance and periodically copy them to Amazon S3.