SOA-C02 Monitoring, Logging, and Remediation Practice Test 8 — 15 Questions

Question 1

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 5xx errors. CloudWatch metrics show that the ALB's 'HTTPCode_ELB_5XX_Count' is elevated. What is the MOST likely cause?

Accepted Answer

The load balancer is timing out waiting for a response from the target.. When the ALB's 'HTTPCode_ELB_5XX_Count' is elevated, it indicates that the load balancer itself is generating the 5xx error, not the target. The most common cause is that the load balancer is timing out while waiting for a response from the target instances, which occurs when the target takes longer than the configured idle timeout (default 60 seconds) to respond. This results in the ALB returning a 504 Gateway Timeout error, which is counted in the ELB 5xx metric.

Answer

The target instances are returning HTTP 503 errors.

Answer

The target instances have high latency but are still responding.

Answer

Client requests are malformed and being rejected by the load balancer.

Question 2

A company stores sensitive data in an S3 bucket. The security team requires that any access to the bucket from outside the corporate network be logged and immediately alerted. Which solution meets these requirements?

Accepted Answer

Enable S3 server access logging, stream logs to CloudWatch Logs, create a metric filter for external IP addresses, and set a CloudWatch alarm.. Option B is correct because it combines S3 server access logging with CloudWatch Logs streaming, metric filtering for external IP addresses, and a CloudWatch alarm. This provides both logging and immediate alerting for any access from outside the corporate network, meeting the security team's requirements.

Answer

Enable S3 server access logging and store logs in a separate bucket for later analysis.

Answer

Enable AWS CloudTrail and create a metric filter for 'GetObject' events, then set a CloudWatch alarm.

Answer

Use AWS Config rules to detect when the bucket policy is changed to allow public access.

Question 3

A SysOps administrator is investigating a performance issue where an Amazon RDS for MySQL instance's ReadIOPS metric is consistently high. The database is used by a web application. Which THREE actions should the administrator take to improve performance?

Accepted Answer

Increase the InnoDB buffer pool size to cache more data in memory.. Increasing the InnoDB buffer pool size allows more data and indexes to be cached in memory, reducing the need for disk reads and thus lowering ReadIOPS. This is a direct and effective tuning action for MySQL on RDS when read I/O is the bottleneck.

Answer

Change the storage type to Provisioned IOPS for better performance.

Answer

Enable Multi-AZ deployment for high availability.

Question 4

A company uses Amazon CloudWatch to monitor its AWS infrastructure. The operations team wants to receive notifications when any EC2 instance's status check fails. Which TWO steps should be taken to achieve this?

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Option B is correct because Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when the alarm state changes. This allows the operations team to receive immediate notifications (e.g., via email, SMS, or HTTP) when an EC2 instance's status check fails. Option E is also correct because the StatusCheckFailed metric (or StatusCheckFailed_Instance) directly reflects the result of the EC2 status check; setting an alarm with a threshold of greater than 0 triggers when any status check fails.

Answer

Create a CloudWatch alarm on the CPUUtilization metric with a threshold of 90%.

Answer

Enable AWS CloudTrail to capture instance state changes.

Answer

Install the CloudWatch agent on the instance and publish custom memory metrics.

Question 5

A company needs to monitor the CPU and memory utilization of its EC2 instances. Which TWO services can be used to collect and visualize these metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the native AWS monitoring service that collects and stores metrics such as CPU utilization and memory utilization from EC2 instances. However, by default, CloudWatch only captures hypervisor-level metrics (like CPU) and not in-guest metrics (like memory utilization). To collect memory utilization, you must install the Amazon CloudWatch Agent on the instance, which sends custom metrics to CloudWatch. Together, CloudWatch and the CloudWatch Agent provide both collection and visualization of CPU and memory metrics.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Systems Manager

Question 6

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to configure this monitoring and alerting?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it allows you to monitor a specific metric, such as EC2 CPUUtilization, and trigger an action (e.g., an SNS notification) when the metric crosses a defined threshold (80%) for a specified number of consecutive evaluation periods (10 minutes, which with the default 1-minute period equals 10 datapoints). This directly fulfills the requirement for threshold-based alerting on a single metric over a sustained duration.

Answer

Amazon EventBridge

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 7

A company's application running on EC2 instances is experiencing intermittent errors. The SysOps team needs to collect and analyze application logs from all instances centrally. The logs must be stored durably and searchable with minimal latency. Which solution meets these requirements?

Accepted Answer

Install the CloudWatch Logs agent on each EC2 instance and stream logs to Amazon CloudWatch Logs.. Option C is correct because the CloudWatch Logs agent (or unified CloudWatch agent) installed on each EC2 instance can stream application logs in near real-time to Amazon CloudWatch Logs, which provides durable storage, automatic encryption at rest, and a searchable interface via the console, CLI, or API with minimal latency. This centralized logging solution meets the requirements for collecting logs from all instances, storing them durably, and enabling immediate querying without additional infrastructure.

Answer

Enable AWS CloudTrail and store logs in an S3 bucket.

Answer

Use Amazon Kinesis Data Firehose to send logs directly from each instance to Amazon Redshift.

Answer

Store logs locally on each instance and periodically copy them to Amazon S3.

Question 8

An application running on EC2 instances behind an Application Load Balancer (ALB) sends custom metrics to CloudWatch. The team wants to set an alarm that triggers when the error rate exceeds 5% over a 5-minute period. The alarm must evaluate the metric every minute. Which configuration is required?

Accepted Answer

Period = 60 seconds, Statistic = Average, Evaluation Periods = 5, Datapoints to Alarm = 5. Option C is correct because the alarm must evaluate the error rate every minute (period = 60 seconds) over a 5-minute window. With evaluation periods = 5 and datapoints to alarm = 5, the alarm requires all five 1-minute datapoints to exceed the 5% threshold, ensuring the error rate is sustained for the full 5-minute period. The Average statistic is appropriate because the error rate is a percentage metric that should be averaged over each period.

Answer

Period = 300 seconds, Statistic = Average, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 300 seconds, Statistic = Sum, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 60 seconds, Statistic = Sum, Evaluation Periods = 5, Datapoints to Alarm = 5

Question 9

A SysOps administrator needs to track changes made to an Amazon S3 bucket policy and receive notifications when changes occur. Which AWS service should be used?

Accepted Answer

AWS Config. AWS Config records configuration changes and can trigger notifications via SNS. CloudTrail logs API calls but doesn't provide change notifications directly. CloudWatch Events (EventBridge) can capture API calls but Config is purpose-built for tracking resource changes.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Events

Answer

AWS CloudTrail

Question 10

A company has a fleet of EC2 instances that are part of an Auto Scaling group. The SysOps team wants to automatically replace any instance that fails the status check for 2 consecutive minutes. Which configuration should be used?

Accepted Answer

Configure an EC2 Auto Scaling group to use EC2 status checks and set the health check grace period to 2 minutes.. Option A is correct because an Auto Scaling group can use EC2 status checks to determine instance health. By setting the health check grace period to 2 minutes, the Auto Scaling group will wait 2 minutes after an instance enters the InService state before starting health checks, and then if the instance fails status checks for 2 consecutive minutes, the Auto Scaling group will mark it as unhealthy and automatically terminate and replace it.

Answer

Use AWS Systems Manager Automation to run a script that reboots the instance.

Answer

Configure an Amazon EventBridge rule to trigger an AWS Lambda function that terminates the instance.

Answer

Configure a CloudWatch Alarm on StatusCheckFailed metric to reboot the instance.

Question 11

A SysOps administrator is troubleshooting an application that runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The administrator checks the ALB access logs and finds entries with 'elb_status_code' 503 and 'target_status_code' '-'. What is the most likely cause?

Accepted Answer

The target instances are unhealthy, causing the ALB to return 503.. The ALB access log entry with `elb_status_code` 503 and `target_status_code` '-' indicates that the load balancer itself generated the 503 error because it could not establish a connection to any healthy target. The dash for the target status code means the request never reached a target instance, which occurs when all targets in the target group are marked unhealthy by the health checks. This is the most common cause of intermittent 503 errors with an ALB.

Answer

The SSL certificate on the ALB has expired.

Answer

The target instances have high CPU utilization.

Answer

The security group on the ALB is blocking traffic.

Question 12

A company wants to monitor the number of messages in an Amazon SQS queue and scale the number of EC2 instance consumers based on queue depth. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Amazon CloudWatch monitors the SQS queue depth (ApproximateNumberOfMessagesVisible metric) and triggers an Amazon EC2 Auto Scaling scaling policy based on a CloudWatch alarm. This allows the number of EC2 consumer instances to dynamically scale in or out in response to the queue depth, ensuring efficient processing without over-provisioning.

Answer

Amazon Elastic Load Balancing and Amazon EC2 Auto Scaling

Answer

Amazon CloudWatch and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Question 13

A SysOps administrator needs to ensure that an Amazon RDS instance automatically reboots if it becomes unavailable due to an operating system crash. The instance is a Multi-AZ deployment. What is the correct approach?

Accepted Answer

Enable Multi-AZ on the RDS instance to automatically failover to the standby.. Option D is correct because Multi-AZ deployments automatically handle failover to a standby replica in a different Availability Zone when the primary instance becomes unavailable due to an OS crash. This built-in mechanism ensures high availability without manual intervention, as the standby takes over with the same endpoint.

Answer

Use AWS Systems Manager Run Command to reboot the instance when a health check fails.

Answer

Create an Amazon EventBridge rule to trigger a Lambda function that reboots the instance.

Answer

Configure a CloudWatch Alarm on the DatabaseConnections metric to reboot the instance.

Question 14

An application writes logs to a file on an EC2 instance. The SysOps team needs to send these logs to Amazon CloudWatch Logs in real time. The logs must be encrypted at rest in CloudWatch Logs using a customer-managed KMS key. Which steps are required?

Accepted Answer

Install the CloudWatch Logs agent and associate a KMS key with the log group using the 'associate-kms-key' API.. Option D is correct because the CloudWatch Logs agent can send log data from an EC2 instance to CloudWatch Logs in real time, and the 'associate-kms-key' API (or the equivalent AWS CLI command 'put-log-group-encryption') allows you to associate a customer-managed KMS key with a log group, encrypting the logs at rest. This meets both the real-time delivery and customer-managed KMS encryption requirements without additional services or workarounds.

Answer

Use AWS CloudTrail to deliver logs to CloudWatch Logs with KMS encryption.

Answer

Store logs in S3 with KMS encryption and use S3 event notifications to trigger Lambda to put logs in CloudWatch Logs.

Answer

Install the CloudWatch Logs agent and enable encryption on the EC2 instance volume using KMS.

Question 15

Which TWO AWS services can be used to monitor the performance of an Amazon RDS database and set alarms based on metrics?

Accepted Answer

Amazon RDS Performance Insights. Amazon CloudWatch (Option D) is the primary monitoring service for AWS resources, including Amazon RDS. It collects metrics like CPU utilization, database connections, and read/write latency, and allows you to set CloudWatch Alarms that trigger actions (e.g., SNS notifications) when thresholds are breached. Amazon RDS Performance Insights (Option B) provides deeper database performance analysis by visualizing database load and identifying bottlenecks, and it can also publish metrics to CloudWatch for alarm purposes.

Answer

AWS Lambda

Answer

Amazon S3

Answer

AWS CloudTrail