SOA-C02 Monitoring, Logging, and Remediation Practice Test 6 — 15 Questions

Question 1

An application running on EC2 instances sends custom metrics to CloudWatch using the PutMetricData API. The SysOps admin notices that some metrics are missing from the CloudWatch console. What is the most likely cause?

Accepted Answer

The namespace in the PutMetricData call does not match the namespace in the CloudWatch console. Option D is correct because custom metrics in CloudWatch are uniquely identified by the combination of namespace, metric name, and dimensions. If the namespace used in the PutMetricData API call does not match the namespace being viewed in the CloudWatch console, the metrics will not appear under that namespace. CloudWatch does not automatically merge or alias namespaces, so mismatched namespaces cause the data to be stored under a different namespace, making it invisible in the console view.

Answer

The metric data does not include a unit

Answer

The metric data does not include a dimension

Answer

The metric data is being sent with a timestamp older than 14 days

Question 2

A SysOps admin is investigating why a CloudWatch alarm did not trigger an SNS notification when a metric breached the threshold. The alarm state is visible in the console as 'ALARM'. What is the most likely reason the notification was not sent?

Accepted Answer

The SNS topic's subscription is not confirmed. The most likely reason the notification was not sent is that the SNS topic's subscription is not confirmed. When an SNS topic sends a notification to an endpoint such as email, HTTP, or SMS, the subscription must first be confirmed by the subscriber. If the subscription remains in a 'Pending confirmation' state, SNS will not deliver messages to that endpoint, even if the CloudWatch alarm transitions to the ALARM state and publishes to the topic.

Answer

The alarm name contains special characters

Answer

The alarm's evaluation period is set to 1 minute

Answer

The metric has a resolution of 1 minute

Question 3

A company needs to retain API call logs for 7 years for compliance. Which AWS service should be used to store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure and can be configured to store logs in an S3 bucket with lifecycle policies that retain data for 7 years. CloudTrail is specifically designed for auditing and compliance, capturing management and data plane API calls, and supports long-term retention via S3 object locking or lifecycle rules.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 4

A SysOps admin notices that an EC2 instance's status check fails intermittently. The instance is part of an Auto Scaling group. What is the most appropriate first step to diagnose the issue?

Accepted Answer

Review the instance's status check history in the EC2 console. The most appropriate first step is to review the instance's status check history in the EC2 console (Option D). This allows the SysOps admin to determine whether the failures are due to system status checks (e.g., underlying hardware issues) or instance status checks (e.g., OS-level problems). Since the instance is part of an Auto Scaling group, understanding the root cause is critical before taking any corrective action, as premature termination or reboot could mask the issue or lead to unnecessary replacements.

Answer

Stop and start the instance

Answer

Terminate the instance and let Auto Scaling replace it

Answer

Reboot the instance

Question 5

A company uses AWS CloudFormation to deploy infrastructure. A SysOps admin wants to receive a notification when a stack update fails. Which approach is the most efficient?

Accepted Answer

Create an EventBridge rule that matches CloudFormation stack events. Option C is correct because Amazon EventBridge can directly capture CloudFormation stack events (e.g., CREATE_FAILED, UPDATE_FAILED) in real time and trigger a notification via SNS or Lambda. This approach is serverless, requires no polling, and is the most efficient method for reacting to stack update failures as they occur.

Answer

Write a script that polls the CloudFormation API and sends notifications

Answer

Use AWS Config to monitor stack resources

Answer

Enable CloudTrail and create a metric filter for stack update failures

Question 6

Which TWO actions should a SysOps admin take to troubleshoot an Amazon RDS instance that is experiencing high CPU utilization? (Choose 2.)

Accepted Answer

Enable Enhanced Monitoring to view OS-level metrics. Option A is correct because Enhanced Monitoring provides OS-level metrics (e.g., CPU, memory, disk I/O) for the RDS instance, which helps identify resource contention at the operating system level. This granularity is essential for diagnosing high CPU utilization that may be caused by OS processes (e.g., backup, patching) rather than database queries alone.

Answer

Enable Multi-AZ to distribute the load

Answer

Delete the slow query log to free up CPU

Answer

Increase the instance size to reduce CPU utilization

Question 7

Which THREE metrics from Amazon CloudWatch are most useful for diagnosing an application performance bottleneck on an EC2 instance running a web server? (Choose 3.)

Accepted Answer

CPUUtilization. CPUUtilization (A) is correct because high CPU usage directly indicates that the CPU is a bottleneck, limiting the web server's ability to process incoming requests. For a web server, sustained CPU saturation often correlates with poor response times and reduced throughput, making it a primary metric for performance diagnosis.

Answer

DiskReadOps

Answer

MemoryUtilization

Question 8

A SysOps admin needs to set up centralized logging for multiple AWS accounts. Which TWO services should be used together to aggregate logs into a single S3 bucket? (Choose 2.)

Accepted Answer

AWS Config. AWS Config and AWS CloudTrail are the correct pair because CloudTrail records API activity across accounts, and AWS Config records resource configuration changes. Both can be configured to deliver log files to a centralized S3 bucket by setting up a trail (CloudTrail) or a delivery channel (Config) that points to the same bucket, often using a bucket policy that grants cross-account write permissions. This enables aggregated logging for multiple AWS accounts in a single S3 bucket.

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 cross-region replication

Answer

Amazon CloudWatch Logs subscription filter

Question 9

A company is using CloudWatch Logs to centralize logs from multiple EC2 instances. The operations team notices that some log entries are missing from CloudWatch Logs. The CloudWatch agent is installed and running on all instances. What is the most likely cause?

Accepted Answer

The IAM role attached to the EC2 instance does not have the 'logs:PutLogEvents' permission.. The most likely cause is that the IAM role attached to the EC2 instance lacks the 'logs:PutLogEvents' permission. Without this permission, the CloudWatch agent can authenticate and connect to CloudWatch Logs but cannot actually write log data to the log stream, resulting in missing entries. The agent may appear to be running and healthy, but API calls to PutLogEvents will fail silently or log errors, leading to gaps in the centralized logs.

Answer

The CloudWatch agent is not configured to send logs to the correct log group.

Answer

The CloudWatch agent is sending logs to a different AWS Region.

Answer

The log group has been encrypted with a KMS key that the agent does not have access to.

Question 10

A SysOps administrator is setting up a CloudWatch dashboard to monitor an application. The application runs on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The administrator wants to track the number of healthy hosts and the request count per target group. Which two metrics should be used? (Choose TWO.)

Accepted Answer

HealthyHostCount (per TargetGroup). Option A is correct because `HealthyHostCount` (per TargetGroup) is a CloudWatch metric that reports the number of healthy EC2 instances in a specific target group, which directly indicates the health of the backend fleet. Option D is correct because `RequestCount` (per TargetGroup) tracks the number of requests routed to that target group, allowing the administrator to correlate traffic load with host health. Together, these two metrics provide the exact visibility needed for an Auto Scaling group behind an ALB.

Answer

RequestCount (per ALB)

Answer

ActiveConnectionCount

Answer

HealthyHostCount (per ALB)

Question 11

Refer to the exhibit. The command returns no datapoints for CPUUtilization for the specified instance. What is the most likely reason?

Accepted Answer

The instance was stopped or did not emit metrics during the specified time range.. The most likely reason for no datapoints is that the instance was stopped or did not emit metrics during the specified time range. CloudWatch only retains and returns metric data when the instance is running and the CloudWatch agent or EC2 hypervisor is actively publishing CPUUtilization. If the instance was in a stopped state, no metrics are generated, resulting in an empty response from the GetMetricStatistics API call.

Answer

The metric name is incorrect.

Answer

The instance does not have detailed monitoring enabled.

Answer

The period of 300 seconds is too short.

Question 12

A company wants to receive alerts when an Auto Scaling group launches or terminates instances. They already have a CloudTrail trail enabled. What is the simplest way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches Auto Scaling event patterns and sends notifications to an SNS topic.. Option A is correct because CloudWatch Events (now part of Amazon EventBridge) can automatically capture Auto Scaling group state changes (launch and terminate) via CloudTrail API calls. By creating a rule that matches the specific event pattern for Auto Scaling events (e.g., 'EC2 Instance Launch Successful' and 'EC2 Instance Terminate Successful'), you can directly route those events to an SNS topic, which then sends notifications (e.g., email or SMS). This requires no custom code, lifecycle hooks, or additional monitoring configuration, making it the simplest solution.

Answer

Write a script on each EC2 instance to call the CloudWatch Logs API on launch/termination.

Answer

Configure the Auto Scaling group to publish lifecycle hooks and use Lambda to send notifications.

Answer

Enable CloudWatch detailed monitoring on the Auto Scaling group and create alarms.

Question 13

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is becoming unresponsive under high load. The administrator has enabled detailed monitoring and set up CPUUtilization alarms. Which THREE additional steps could help diagnose the root cause? (Choose THREE.)

Accepted Answer

Install the CloudWatch agent and collect disk space metrics.. Option A is correct because under high load, the web server could become unresponsive due to disk space exhaustion (e.g., from log files filling the root partition). The CloudWatch agent can collect disk space metrics, which are not available by default, allowing the administrator to correlate disk usage with performance degradation.

Answer

Place the instance behind an Auto Scaling group.

Answer

Increase the instance size to handle more load.

Question 14

Refer to the exhibit. An application running on EC2 is using the AWS SDK to publish custom metrics to CloudWatch. The application fails to publish metrics. The IAM role attached to the EC2 instance has this policy. What is the issue?

Accepted Answer

The application may be using a different namespace than 'MyApp'.. The IAM policy explicitly allows 'cloudwatch:PutMetricData' on the condition that the namespace is 'MyApp'. If the application's AWS SDK code publishes metrics under a different namespace (e.g., 'AWS/EC2' or a custom namespace like 'MyOtherApp'), the condition fails and the API call is denied. This is the most likely cause of the failure, as the policy is otherwise correctly configured for the specified namespace.

Answer

The condition key 'cloudwatch:namespace' is misspelled.

Answer

The policy does not specify a specific resource ARN.

Answer

The action 'cloudwatch:PutMetricData' is not allowed for custom metrics.

Question 15

A company has a production environment with multiple EC2 instances that send logs to CloudWatch Logs. The operations team wants to search across all log groups for a specific error pattern. What is the most efficient way to achieve this?

Accepted Answer

Use CloudWatch Logs Insights to query across all log groups.. CloudWatch Logs Insights allows you to run SQL-like queries across multiple log groups in a single query, making it the most efficient way to search for a specific error pattern across all log groups without needing to set up additional infrastructure or manually query each group individually.

Answer

Set up a subscription filter to stream logs to an Amazon ES domain.

Answer

Use CloudWatch Logs filter patterns on each log group.

Answer

Download all logs to an S3 bucket and use Amazon Athena to query.