SOA-C02 Monitoring, Logging, and Remediation Practice Test 7 — 15 Questions

Question 1

A SysOps administrator needs to track changes made to an Amazon S3 bucket policy and receive notifications when changes occur. Which AWS service should be used?

Accepted Answer

AWS Config. AWS Config records configuration changes and can trigger notifications via SNS. CloudTrail logs API calls but doesn't provide change notifications directly. CloudWatch Events (EventBridge) can capture API calls but Config is purpose-built for tracking resource changes.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Events

Answer

AWS CloudTrail

Question 2

A company has a fleet of EC2 instances that are part of an Auto Scaling group. The SysOps team wants to automatically replace any instance that fails the status check for 2 consecutive minutes. Which configuration should be used?

Accepted Answer

Configure an EC2 Auto Scaling group to use EC2 status checks and set the health check grace period to 2 minutes.. An Auto Scaling group can use EC2 status checks to determine instance health. By setting the health check grace period to 2 minutes, the Auto Scaling group will wait 2 minutes after an instance enters the InService state before starting health checks, and then if the instance fails status checks for 2 consecutive minutes, the Auto Scaling group will mark it as unhealthy and automatically terminate and replace it.

Answer

Use AWS Systems Manager Automation to run a script that reboots the instance.

Answer

Configure an Amazon EventBridge rule to trigger an AWS Lambda function that terminates the instance.

Answer

Configure a CloudWatch Alarm on StatusCheckFailed metric to reboot the instance.

Question 3

A SysOps administrator is troubleshooting an application that runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The administrator checks the ALB access logs and finds entries with 'elb_status_code' 503 and 'target_status_code' '-'. What is the most likely cause?

Accepted Answer

The target instances are unhealthy, causing the ALB to return 503.. The ALB access log entry with `elb_status_code` 503 and `target_status_code` '-' indicates that the load balancer itself generated the 503 error because it could not establish a connection to any healthy target. The dash for the target status code means the request never reached a target instance, which occurs when all targets in the target group are marked unhealthy by the health checks. This is the most common cause of intermittent 503 errors with an ALB.

Answer

The SSL certificate on the ALB has expired.

Answer

The target instances have high CPU utilization.

Answer

The security group on the ALB is blocking traffic.

Question 4

A company wants to monitor the number of messages in an Amazon SQS queue and scale the number of EC2 instance consumers based on queue depth. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Amazon CloudWatch monitors the SQS queue depth (ApproximateNumberOfMessagesVisible metric) and triggers an Amazon EC2 Auto Scaling scaling policy based on a CloudWatch alarm. This allows the number of EC2 consumer instances to dynamically scale in or out in response to the queue depth, ensuring efficient processing without over-provisioning.

Answer

Amazon Elastic Load Balancing and Amazon EC2 Auto Scaling

Answer

Amazon CloudWatch and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Question 5

A SysOps administrator needs to ensure that an Amazon RDS instance automatically reboots if it becomes unavailable due to an operating system crash. The instance is a Multi-AZ deployment. What is the correct approach?

Accepted Answer

Enable Multi-AZ on the RDS instance to automatically failover to the standby.. Multi-AZ deployments automatically handle failover to a standby replica in a different Availability Zone when the primary instance becomes unavailable due to an OS crash. This built-in mechanism ensures high availability without manual intervention, as the standby takes over with the same endpoint.

Answer

Use AWS Systems Manager Run Command to reboot the instance when a health check fails.

Answer

Create an Amazon EventBridge rule to trigger a Lambda function that reboots the instance.

Answer

Configure a CloudWatch Alarm on the DatabaseConnections metric to reboot the instance.

Question 6

Which TWO AWS services can be used to monitor the performance of an Amazon RDS database and set alarms based on metrics?

Accepted Answer

Amazon RDS Performance Insights. Amazon CloudWatch (Option D) is the primary monitoring service for AWS resources, including Amazon RDS. It collects metrics like CPU utilization, database connections, and read/write latency, and allows you to set CloudWatch Alarms that trigger actions (e.g., SNS notifications) when thresholds are breached. Amazon RDS Performance Insights (Option B) provides deeper database performance analysis by visualizing database load and identifying bottlenecks, and it can also publish metrics to CloudWatch for alarm purposes.

Answer

AWS Lambda

Answer

Amazon S3

Answer

AWS CloudTrail

Question 7

Which THREE actions can be taken to remediate an EC2 instance that has been compromised according to security best practices? (Select THREE.)

Accepted Answer

Terminate the instance after taking a forensic snapshot.. When an EC2 instance is compromised, security best practices emphasize preserving evidence, containing the threat, and eradicating it. Option A (terminate after forensic snapshot) is correct because terminating removes the instance while an EBS snapshot preserves the root volume and memory for offline analysis. Option B (create an AMI) is also correct; an AMI captures the entire instance state, including attached volumes and configuration, which can be used for forensic investigation without destroying evidence. Option D (isolate by removing from security groups) is correct because it blocks all network traffic to/from the instance, preventing further malicious activity while preserving the instance for later analysis. Options C and E are incorrect because rebooting or patching destroys volatile evidence and may not remove the attacker's persistence. These actions do not address the root compromise.

Answer

Reboot the instance to clear the compromise.

Answer

Apply any pending patches and restart the application.

Question 8

Which TWO options are valid ways to send custom metrics to Amazon CloudWatch?

Accepted Answer

Use the CloudWatch agent to collect and publish custom metrics.. The CloudWatch agent can be installed on EC2 instances or on-premises servers to collect system-level metrics (like memory and disk usage) and custom application metrics, then publish them to CloudWatch. Option B is correct because the PutMetricData API call allows direct programmatic ingestion of custom metrics into CloudWatch, supporting up to 1,000 metrics per call with a maximum payload of 1 MB.

Answer

Use Amazon SQS to send metric data to CloudWatch.

Answer

Use AWS CloudTrail to log custom metrics.

Answer

Use Amazon Kinesis Data Firehose to deliver metrics to CloudWatch.

Question 9

Refer to the exhibit. A SysOps administrator runs the 'list-metrics' command for CPUUtilization. Based on the output, what can the administrator conclude?

Accepted Answer

There are two EC2 instances that have reported CPUUtilization metrics at some point.. The 'list-metrics' output shows two distinct dimensions (i-12345678 and i-87654321) for the CPUUtilization metric, indicating that two EC2 instances have reported this metric at some point. Option B is correct because the presence of two unique instance IDs in the metric data confirms that CPUUtilization has been recorded for both instances, regardless of whether they are currently active or have alarms configured.

Answer

The CPUUtilization metric is only available for EC2 instances.

Answer

Both instances are actively publishing CPUUtilization metrics.

Answer

An alarm has been set on both instances for CPUUtilization.

Question 10

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance attempts to write logs to a log group named 'MyAppLogs' in CloudWatch Logs but fails. What is the likely cause?

Accepted Answer

The policy does not grant permission to create the log group because the resource for CreateLogGroup is specified as the log stream ARN.. The policy grants `logs:CreateLogGroup` but specifies the resource as the log stream ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:log-stream:*`). CloudWatch Logs requires the resource for `CreateLogGroup` to be the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:*` or a specific log group name), not a log stream. Since the application is attempting to write logs to a log group that does not yet exist, the `CreateLogGroup` call fails due to the incorrect resource ARN, causing the overall write operation to fail.

Answer

The EC2 instance does not have an internet gateway to reach CloudWatch Logs.

Answer

The log group name in the policy does not match the application's log group.

Answer

The policy lacks permission for 'logs:DescribeLogGroups'.

Question 11

Refer to the exhibit. A SysOps administrator reviews the CloudWatch alarm configuration. The alarm is in ALARM state. Which statement accurately describes the alarm's behavior?

Accepted Answer

The alarm triggered because the average CPU utilization over 5 minutes exceeded 80% for one consecutive period.. The alarm configuration shows 'Period: 5 minutes' and 'Statistic: Average' with 'Threshold: 80%' and 'Datapoints to alarm: 1 out of 1'. This means the alarm evaluates the average CPU utilization over a single 5-minute period, and if that average exceeds 80%, the alarm transitions to ALARM state immediately after one period's data point is available.

Answer

The alarm evaluates CPU utilization every 5 minutes and requires 3 consecutive breaches to trigger.

Answer

The alarm will automatically resolve when CPU utilization drops below 80% for one period.

Answer

The alarm sends a notification to the SNS topic every 5 minutes while in ALARM state.

Question 12

A company is using AWS CloudTrail to log API activity. They need to ensure that log files are protected from unauthorized modification and can be used to verify the integrity of log files. Which AWS feature should be enabled?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to create a digest file that can be used to verify that log files have not been modified, deleted, or tampered with after delivery. This feature is specifically designed to provide cryptographic assurance of log file integrity, meeting the requirement to protect against unauthorized modification and enable verification.

Answer

Enable S3 server-side encryption on the CloudTrail S3 bucket.

Answer

Stream CloudTrail logs to Amazon CloudWatch Logs.

Answer

Enable S3 Multi-Factor Authentication (MFA) Delete on the CloudTrail S3 bucket.

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps team needs to capture detailed HTTP request-level data, including headers and payload, for troubleshooting purposes. The data should be stored in Amazon S3 for analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable access logs on the ALB and specify an S3 bucket as the destination.. ALB access logs capture detailed HTTP request-level data, including headers and payload, and can be directly delivered to an S3 bucket without any additional agents or configuration on the EC2 instances. This native integration minimizes operational overhead by eliminating the need to install or manage logging agents on each instance.

Answer

Install the CloudWatch Logs agent on each EC2 instance and configure it to send Apache access logs to CloudWatch Logs, then export to S3.

Answer

Enable VPC Flow Logs and send them to an S3 bucket.

Answer

Use AWS CloudTrail with data events enabled for the ALB.

Question 14

A company has an Auto Scaling group of EC2 instances that are critical for production. The SysOps administrator needs to be notified immediately when any instance in the group enters the 'InService' state after a scale-out event. Which approach should be used?

Accepted Answer

Configure an Auto Scaling lifecycle hook that sends a notification to an SNS topic when the instance transitions to the 'InService' state.. Auto Scaling lifecycle hooks can be configured to send a notification to an SNS topic when an instance transitions to the 'InService' state. This allows the SysOps administrator to be notified immediately after a scale-out event, as the lifecycle hook pauses the instance during the transition and sends the notification before completing the action.

Answer

Create a CloudWatch alarm on the Auto Scaling group metric 'GroupTotalInstances' with a threshold of 1.

Answer

Use CloudTrail to monitor the 'CompleteLifecycleAction' API call and send notifications via CloudWatch Events.

Answer

Configure an Amazon SQS queue and have the EC2 instances send a message when they become 'InService'.

Question 15

A SysOps administrator suspects that an Amazon Linux 2 EC2 instance has been compromised. The instance is part of an Auto Scaling group and is currently running. The administrator needs to preserve the root volume for forensic analysis while minimizing the impact to the application. Which action should the administrator take FIRST?

Accepted Answer

Stop the instance and create an Amazon EBS snapshot of the root volume.. Stopping the instance ensures data integrity and allows you to create an EBS snapshot of the root volume for forensic analysis. Since the instance is part of an Auto Scaling group, the group automatically launches a replacement instance, minimizing application impact. Option C is incorrect because you cannot detach the root volume of a running EC2 instance; the instance must be stopped first. Option A does not preserve the exact state for forensics due to ongoing writes. Option D destroys the volume and evidence.

Answer

Create an Amazon Machine Image (AMI) of the instance while it is running.

Answer

Detach the root volume from the instance and create a snapshot of the volume for analysis.

Answer

Terminate the instance immediately to stop any malicious activity.