SOA-C02 Monitoring, Logging, and Remediation Practice Test 6 — 15 Questions

Question 1

A SysOps administrator needs to monitor application logs stored in Amazon CloudWatch Logs for the term 'CRITICAL'. When more than 5 'CRITICAL' entries appear in a 5-minute window, the administrator wants to automatically restart the underlying Amazon EC2 instance. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an EC2 Reboot Instances action.. CloudWatch Logs metric filters can count occurrences of the term 'CRITICAL' in log data, and a CloudWatch alarm can be configured to trigger an EC2 Reboot Instances action directly when the metric exceeds a threshold of 5 in a 5-minute period. This provides a native, simple, and fully managed solution without requiring additional services like Lambda or Systems Manager.

Answer

Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an AWS Systems Manager Automation document to restart the instance.

Answer

Create a CloudWatch Logs metric filter, then use Amazon CloudWatch Events (Amazon EventBridge) to trigger an AWS Lambda function that restarts the instance.

Answer

Use Amazon CloudWatch Synthetics canary to monitor the logs and automatically stop the instance.

Question 2

A company runs containerized applications on Amazon ECS using the Fargate launch type. The SysOps administrator needs to monitor CPU and memory utilization at the task level. Which AWS service provides pre-built dashboards and metrics for this purpose?

Accepted Answer

Amazon CloudWatch Container Insights. Amazon CloudWatch Container Insights provides pre-built dashboards and metrics specifically for monitoring containerized applications, including CPU and memory utilization at the task level for Amazon ECS with the Fargate launch type. It automatically collects, aggregates, and summarizes metrics and logs from containerized applications, offering out-of-the-box visualizations without requiring custom setup.

Answer

Amazon CloudWatch custom metrics

Answer

Amazon CloudWatch Logs

Answer

Amazon CloudWatch Synthetics

Question 3

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS DB instance and receive an alarm when CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the native AWS monitoring service that can track RDS DB instance metrics, such as CPU utilization, and trigger alarms based on thresholds and time periods. In this scenario, you would create a CloudWatch alarm on the `CPUUtilization` metric for the specific DB instance, with a threshold of 80% and a period of 5 consecutive minutes (e.g., 5 datapoints of 1-minute periods).

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 4

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator needs to monitor the application's HTTP 5xx error rate and set an alarm when the error rate exceeds 5% over a 5-minute period. The alarm must trigger an Amazon SNS notification. Which metric should be used for the alarm?

Accepted Answer

HTTPCode_Target_5XX_Count. The alarm must monitor the error rate from the application targets (EC2 instances) behind the ALB. HTTPCode_Target_5XX_Count tracks HTTP 5xx responses generated by the targets themselves, which directly reflects application-level errors. To calculate the error rate, you would divide this metric by RequestCount, but the metric itself is the correct source for target-side 5xx errors.

Answer

HTTPCode_ELB_5XX_Count

Answer

RequestCount

Answer

TargetResponseTime

Question 5

A SysOps administrator needs to monitor application logs stored in Amazon CloudWatch Logs for the term 'CRITICAL'. When more than 5 'CRITICAL' entries appear in a 5-minute window, the administrator wants to automatically restart the underlying Amazon EC2 instance. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and disable the alarm outside business hours using a Lambda function triggered by CloudWatch Events.. To trigger when 'OrdersPerMinute' exceeds 100 for more than 2 consecutive data points, the alarm must require 3 consecutive breaching data points. This is achieved by setting evaluation periods to 3 and datapoints to alarm to 3. The Lambda/EventBridge approach to disable the alarm outside business hours is correct, but option B's evaluation period settings are incorrect. As written, no option fully satisfies the requirement.

Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a math expression to filter time range.

Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a metric math expression 'IF(IN_BUSINESS_HOURS(), OrdersPerMinute, 0)' but CloudWatch does not have IN_BUSINESS_HOURS function.

Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 1, datapoints to alarm of 2 (impossible).

Question 6

An application writes error logs to Amazon CloudWatch Logs. The SysOps administrator needs to monitor for the occurrence of the string 'ERROR' in the logs and trigger an Amazon SNS notification if more than 10 errors occur within a 5-minute window. The administrator also wants to visualize the error count over time. Which approach should be used to meet these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch Logs metric filter to count 'ERROR' entries, then create a CloudWatch alarm on that metric with a period of 5 minutes and a threshold of 10.. CloudWatch Logs metric filters can extract a count of 'ERROR' occurrences from incoming log events and emit a custom metric. A CloudWatch alarm on that metric with a period of 5 minutes and a threshold of 10 directly triggers an SNS notification when the error count exceeds 10 within the window, and the metric itself can be graphed in CloudWatch dashboards for visualization—all with minimal configuration and no custom code.

Answer

Use CloudWatch Logs Insights to run a query every 5 minutes and send notifications via a scheduled AWS Lambda function.

Answer

Create an AWS Lambda function that processes log events in real-time and publishes to Amazon SNS when the error count exceeds 10 in 5 minutes.

Answer

Use Amazon EventBridge to match log events with the pattern 'ERROR' and send them to an SNS topic.

Question 7

A company runs a web application on Amazon EC2 instances. The SysOps administrator needs to monitor two metrics: high CPU utilization (greater than 90%) and high memory utilization (greater than 85%). An alarm should trigger when both conditions are true simultaneously for a period of 5 minutes. Which CloudWatch feature should the administrator use to create this alarm?

Accepted Answer

Composite alarm. A composite alarm in Amazon CloudWatch allows you to create an alarm that evaluates multiple conditions using logical operators (AND, OR, NOT). In this scenario, the administrator needs the alarm to trigger only when both CPU utilization > 90% AND memory utilization > 85% are true simultaneously for 5 minutes. Composite alarms evaluate the state of underlying metric alarms (e.g., two separate simple alarms for CPU and memory) and combine them with an AND condition, making it the correct feature for this requirement.

Answer

Metric math

Answer

Anomaly detection

Answer

Logs Insights

Question 8

A web application publishes a custom metric 'FailedLoginAttempts' to Amazon CloudWatch. The SysOps administrator needs to be notified via Amazon SNS when the number of failed login attempts exceeds 100 within a 5-minute period. Which AWS service or feature should be used to create this notification?

Accepted Answer

Amazon CloudWatch alarm. An Amazon CloudWatch alarm is the correct service because it monitors a specific CloudWatch metric (such as 'FailedLoginAttempts') and triggers an action (such as sending an SNS notification) when the metric crosses a defined threshold over a specified period. In this case, the alarm evaluates whether the sum of 'FailedLoginAttempts' exceeds 100 within a 5-minute period, and upon breaching, it publishes to the SNS topic to notify the SysOps administrator.

Answer

Amazon CloudWatch Logs metric filter

Answer

Amazon CloudWatch dashboard

Answer

AWS Config rule

Question 9

A company runs a REST API on Amazon EC2 instances behind an Application Load Balancer. The SysOps administrator needs to monitor the API endpoint from multiple geographic locations and receive an alarm if the p90 latency exceeds 2 seconds for two consecutive checks. The solution must use AWS managed services and not require custom code running on EC2. Which approach should the administrator use?

Accepted Answer

Set up Amazon CloudWatch Synthetics canaries to run from multiple AWS Regions and publish custom metrics. Create a CloudWatch alarm on the p90 latency metric.. Amazon CloudWatch Synthetics canaries are AWS-managed Node.js scripts that run on a schedule to monitor endpoints from multiple AWS Regions, capturing metrics like duration and latency. By configuring canaries to report p90 latency as a custom metric, you can create a CloudWatch alarm that triggers when p90 exceeds 2 seconds for two consecutive data points, meeting all requirements without custom EC2 code.

Answer

Configure VPC Flow Logs on the Application Load Balancer and use Amazon CloudWatch Logs Insights to query for high-latency requests.

Answer

Enable Amazon CloudWatch RUM (Real User Monitoring) on the client side and create a CloudWatch alarm on the Duration metric.

Answer

Use AWS CloudTrail to log API calls and set a CloudWatch alarm on the event count for errors.

Question 10

A company runs a multi-tier application that uses an Amazon RDS for PostgreSQL database. The SysOps administrator needs to monitor the database for performance anomalies, such as sudden spikes in connections or query latencies. The administrator wants to receive alerts when metrics deviate from their expected baseline. The solution must automatically adjust to changes in normal behavior over time, such as seasonal patterns. Which AWS service or feature should the administrator use?

Accepted Answer

Configure Amazon CloudWatch Anomaly Detection on the relevant RDS metrics (e.g., DatabaseConnections, ReadLatency, WriteLatency) and set an alarm to notify when the metric breaches the anomaly band.. Amazon CloudWatch Anomaly Detection uses machine learning to continuously analyze metric patterns and establish a dynamic baseline that adapts to seasonal trends and gradual changes in normal behavior. By applying anomaly detection to RDS metrics like DatabaseConnections, ReadLatency, and WriteLatency, the administrator can set an alarm that triggers when a metric deviates outside the calculated anomaly band, automatically adjusting to evolving traffic patterns without manual threshold updates.

Answer

Use Amazon RDS Performance Insights to analyze database load and set CloudWatch alarms on the DBLoad metric with static thresholds.

Answer

Enable Amazon CloudWatch Metrics Explorer to create a dashboard that visualizes the metrics and manually review for anomalies.

Answer

Use AWS X-Ray to trace database queries and set alarms on trace segment durations.

Question 11

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and send an alert when it exceeds 90% for 5 consecutive minutes. Which combination of AWS services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch metric (CPUUtilization), a CloudWatch alarm, and an Amazon SNS topic.. The correct approach is to use a CloudWatch metric for CPUUtilization, which is automatically published by EC2 instances. A CloudWatch alarm can be configured to evaluate this metric over a period of 5 consecutive minutes with a threshold of 90%, and when the alarm state is triggered, it publishes to an SNS topic to send notifications. This is the native, efficient, and recommended method for monitoring and alerting on EC2 CPU utilization.

Answer

Amazon CloudWatch Logs, a metric filter to extract CPU utilization from logs, and an alarm on that metric.

Answer

A CloudWatch dashboard and an AWS Lambda function that checks the dashboard periodically.

Answer

Amazon EventBridge (CloudWatch Events) and a Lambda function that calls the EC2 DescribeInstances API.

Question 12

A company uses Amazon CloudWatch Logs to store application logs. The SysOps administrator needs to count the occurrences of the string 'ERROR' in the logs and trigger an Amazon SNS notification when more than 10 errors occur within a 5-minute window. Which steps should the administrator take?

Accepted Answer

Create a metric filter on the log group and then create a CloudWatch alarm on the resulting metric. A metric filter on a CloudWatch Logs log group extracts a numeric metric (e.g., count of 'ERROR' occurrences) and publishes it to a CloudWatch custom metric. A CloudWatch alarm can then be configured on that metric to evaluate a threshold (e.g., >10) over a specified period (e.g., 5 minutes) and trigger an SNS notification when breached. This is the native, serverless, and cost-effective approach for counting log patterns and alerting.

Answer

Create a CloudWatch alarm directly on the log group

Answer

Create an AWS Lambda function to parse the logs and send a notification to Amazon SNS

Answer

Create an Amazon EventBridge rule to filter log events and send to SNS

Question 13

A company uses AWS CloudTrail to record all API activity. The SysOps administrator needs to be alerted in real time when an IAM user creates a new access key. Which combination of AWS services should be used to create this alert?

Accepted Answer

CloudTrail + Amazon EventBridge + Amazon SNS. Amazon EventBridge can directly consume CloudTrail events in real time and trigger an SNS notification when an IAM user creates a new access key. EventBridge provides a serverless event bus that matches specific API calls (e.g., CreateAccessKey) using event patterns, enabling immediate alerting without additional polling or log processing.

Answer

CloudTrail + Amazon S3 + Amazon SNS

Answer

CloudTrail + Amazon CloudWatch Logs + Amazon SNS

Answer

CloudTrail + AWS Config + Amazon SNS

Question 14

A company needs to continuously scan Amazon EC2 instances for software vulnerabilities and unintended network exposure. Which AWS service should be used?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to automatically scan Amazon EC2 instances for software vulnerabilities (CVEs) and unintended network exposure (network reachability). It uses a combination of a managed agent (for OS-level assessment) and network configuration analysis to produce a detailed findings report, directly meeting the requirement for continuous scanning.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 15

A SysOps administrator needs to monitor application logs stored in Amazon CloudWatch Logs for the term 'CRITICAL'. When more than 5 'CRITICAL' entries appear in a 5-minute window, the administrator wants to automatically restart the underlying Amazon EC2 instance. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the CloudWatch agent on each instance using SSM Run Command, configure the agent to collect disk metrics, and use CloudWatch cross-account observability to aggregate metrics from multiple accounts.. The CloudWatch agent is required to collect custom metrics like disk space from EC2 instances, as these are not available by default. SSM Run Command enables scalable, agentless installation across instances. CloudWatch cross-account observability allows you to aggregate metrics from multiple AWS accounts into a single monitoring account, meeting the requirement for a unified dashboard.

Answer

Enable detailed monitoring on the EC2 instances, create a custom metric in CloudWatch for disk space, and use CloudWatch Logs to forward logs to a central account.

Answer

Use AWS Config to track disk space and send metrics to CloudWatch.

Answer

Use AWS Trusted Advisor to monitor disk space and send alerts via SNS.