SOA-C02 Monitoring, Logging, and Remediation Practice Test 8 — 15 Questions

Question 1

A company uses Amazon CloudWatch Logs to collect logs from multiple EC2 instances. The SysOps administrator needs to create a metric filter that counts the number of ERROR-level log entries per hour and triggers an alarm when the count exceeds 100 in any 5-minute period. Which metric filter pattern should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the pattern "ERROR" and set the metric value to 1.. A CloudWatch Logs metric filter counts each log event that matches the pattern. Setting the metric value to 1 ensures that each matching log entry increments the metric by 1, allowing the alarm to evaluate the sum over a 5-minute period against the threshold of 100. The pattern "ERROR" matches any log entry containing the string "ERROR" anywhere in the message.

Answer

Use the pattern "ERROR" and set the metric value to 100.

Answer

Use the pattern "ERROR *" to match any log entry starting with ERROR.

Answer

Use the pattern "[ERROR, 5]" to match 5 consecutive ERROR entries.

Question 2

A company uses AWS CloudTrail to log all management events. The SysOps administrator needs to be notified when an IAM user creates a new access key. Which configuration is the MOST efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers an SNS notification.. CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail in real time and trigger an SNS notification. This is the most efficient solution as it requires no additional log analysis or polling, and it reacts immediately when the API call occurs.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

Answer

Use AWS Trusted Advisor to check for excessive access keys.

Answer

Use AWS Config to monitor the 'iam-user' resource type for changes to access keys.

Question 3

A SysOps administrator notices that an Amazon RDS for MySQL instance's CPU utilization is consistently above 80% during business hours. The administrator wants to identify the queries causing the high load without impacting performance. Which action should be taken?

Accepted Answer

Enable Performance Insights on the RDS instance.. Performance Insights provides a database-specific performance schema that visualizes database load and identifies the SQL queries responsible for high CPU utilization. It operates with minimal overhead by sampling the database engine's internal performance data, making it ideal for diagnosing query performance issues without impacting the production workload.

Answer

Enable the MySQL slow query log and store it in CloudWatch Logs.

Answer

Enable Enhanced Monitoring to get OS-level metrics.

Answer

Increase the retention period for CloudWatch metrics to 15 months.

Question 4

A company wants to visualize the geographic distribution of failed login attempts to their web application. The application runs on EC2 instances behind an ALB. They have access logs enabled for the ALB. Which service should be used to create the visualization?

Accepted Answer

Amazon QuickSight with S3 as a data source.. Amazon QuickSight is a fully managed business intelligence service that can directly query ALB access logs stored in Amazon S3, enabling the creation of geospatial visualizations (e.g., heat maps) of failed login attempts. ALB access logs are delivered to S3 in a structured format, and QuickSight can parse and visualize this data without additional processing. This makes QuickSight with S3 as a data source the correct choice for building the required geographic visualization.

Answer

Amazon CloudWatch Dashboard with a custom widget.

Answer

Amazon Kinesis Data Analytics with a Lambda function.

Answer

Amazon S3 Select with Athena.

Question 5

A company is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances. The SysOps administrator needs to ensure that log data is encrypted at rest and in transit. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Encrypt the CloudWatch Logs log group using an AWS KMS customer managed key.. CloudWatch Logs supports encryption at rest using AWS KMS customer managed keys (CMKs). By associating a KMS key with a log group, all log data stored in that log group is encrypted at rest, meeting the encryption-at-rest requirement. Option D is correct because the CloudWatch Logs agent can be configured to use TLS/SSL (port 443) for log delivery, ensuring encryption in transit between the EC2 instances and CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the CloudWatch Logs log group.

Answer

Apply an S3 bucket policy that requires encryption for objects uploaded to the bucket.

Answer

Install an AWS Certificate Manager (ACM) certificate on the EC2 instances.

Question 6

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The SysOps administrator needs to detect and automatically replace an instance that is not responding to health checks. Which THREE steps should the administrator take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch alarm to take the action of terminating the instance.. Creating a CloudWatch alarm on the 'StatusCheckFailed' metric detects when an instance fails EC2 health checks. Option B is correct because you can configure the CloudWatch alarm to directly terminate the unhealthy instance via an Auto Scaling action, initiating automatic replacement. Option D is correct because the Auto Scaling group must be configured to use ELB health checks (or EC2 health checks) to ensure that the instance is considered unhealthy by the group and that a new instance is launched to replace the terminated one. Together, these steps enable fully automated detection and replacement without manual intervention.

Answer

Manually terminate the unhealthy instance after the alarm triggers.

Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.

Question 7

A SysOps administrator is creating a monitoring solution for a web application that uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The administrator wants to monitor the average request count per minute and the number of healthy hosts. Which TWO CloudWatch metrics should the administrator use? (Choose TWO.)

Accepted Answer

AWS/ApplicationELB HealthyHostCount. AWS/ApplicationELB HealthyHostCount, is correct because it directly reports the number of registered instances that are passing health checks, which is exactly what the administrator needs to monitor the number of healthy hosts behind the ALB. Option E, AWS/ApplicationELB RequestCount, is correct because it tracks the total number of requests handled by the ALB, and by dividing by the time period, the administrator can calculate the average request count per minute.

Answer

AWS/ApplicationELB Latency

Answer

AWS/EC2 CPUUtilization

Answer

AWS/AutoScaling GroupInServiceInstances

Question 8

A company is using Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team needs to receive an alert when the number of healthy hosts drops below 50% of the desired capacity for more than 5 minutes. Which CloudWatch metric and alarm configuration should be used?

Accepted Answer

Use the 'HealthyHostCount' metric with a statistic of 'Sum' and a threshold of 0.5 * desired capacity.. The 'HealthyHostCount' metric from the Application Load Balancer (ALB) directly reports the number of registered instances that are passing health checks. By setting the statistic to 'Sum' and the threshold to 0.5 * desired capacity, the alarm triggers when the count of healthy hosts falls below 50% of the Auto Scaling group's desired capacity for the specified evaluation period of 5 minutes, meeting the exact requirement.

Answer

Use the 'RequestCount' metric with a statistic of 'Sum' and a threshold of 50% of the average request count.

Answer

Use the 'UnhealthyHostCount' metric with a threshold of 50% of desired capacity.

Answer

Use the 'TargetResponseTime' metric with a statistic of 'p90' and a threshold of 2 seconds.

Question 9

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for MySQL DB instance. The administrator wants to receive a notification when the average CPU utilization exceeds 80% for 10 consecutive minutes. Which steps should the administrator take to set up this monitoring?

Accepted Answer

Create a CloudWatch alarm on the 'CPUUtilization' metric with a threshold of 80% and an SNS topic for notifications.. Amazon RDS automatically publishes the 'CPUUtilization' metric to CloudWatch, and a CloudWatch alarm can be configured with a threshold of 80% for the 'Average' statistic over a period of 10 consecutive minutes (e.g., 10 evaluation periods of 1 minute each). The alarm can then trigger an SNS topic to send notifications when the threshold is breached. This directly meets the requirement without additional services.

Answer

Use CloudWatch Logs to monitor the database logs and create an alarm based on log patterns.

Answer

Enable Enhanced Monitoring and create an alarm on the 'CPUUtilization' metric in RDS console.

Answer

Enable CloudTrail and create a metric filter for CPU utilization.

Question 10

A company is running a critical application on Amazon EC2 instances. The application performance has degraded over the past week. The SysOps administrator suspects a memory leak. The administrator needs to collect detailed memory usage metrics every minute and store them for 30 days. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. The CloudWatch agent is specifically designed to collect custom metrics like memory utilization from EC2 instances, which are not available through default or detailed EC2 monitoring. By installing the agent and configuring it to publish memory metrics to CloudWatch every minute, the administrator can meet the requirement for 1-minute granularity and 30-day retention cost-effectively, as CloudWatch retains metric data at 1-minute resolution for 15 days by default, but can be extended to 30 days via a custom metric retention setting.

Answer

Use AWS CloudTrail to log memory usage and store the logs in Amazon S3.

Answer

Enable default EC2 monitoring to collect memory metrics every 5 minutes.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics every 1 minute.

Question 11

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance running Amazon Linux 2 is not sending logs to CloudWatch Logs. The CloudWatch agent is installed and configured. Which step should the administrator take FIRST to diagnose the issue?

Accepted Answer

Check the CloudWatch agent status and review its log files on the instance.. The CloudWatch agent is already installed and configured, so the first step is to check its operational status and review its own log files (typically in /var/log/aws/amazon-cloudwatch-agent/). This directly reveals whether the agent is running, encountering configuration errors, or failing to connect to the CloudWatch Logs service endpoint, without making unnecessary changes.

Answer

Reinstall the CloudWatch agent from the AWS Systems Manager.

Answer

Update the IAM role attached to the instance to include CloudWatch Logs permissions.

Answer

Verify the EC2 instance status in the AWS Management Console.

Question 12

A company uses Amazon CloudWatch to monitor its AWS resources. The operations team needs to receive email notifications when the root user performs any action in the AWS account. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs metric filter, and Amazon SNS.. AWS CloudTrail logs all API activity, including root user actions. By sending these logs to CloudWatch Logs, you can create a metric filter that matches root user events (e.g., `userIdentity.type = "Root"`). When the metric filter triggers a CloudWatch alarm, it publishes a notification to an SNS topic, which sends an email to subscribers. This combination ensures real-time notification of root user actions.

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS).

Answer

AWS Trusted Advisor and Amazon Simple Email Service (SES).

Answer

AWS Config, Amazon CloudWatch Events, and Amazon SNS.

Question 13

An organization has a production AWS environment with multiple VPCs and hundreds of EC2 instances. The security team wants to be alerted when any security group is modified. Which approach should a SysOps administrator use to meet this requirement with minimal overhead?

Accepted Answer

Use AWS Config rules to detect security group changes and trigger an SNS notification.. AWS Config rules can continuously evaluate security group configurations against desired settings and trigger an SNS notification when a change is detected. This approach provides automated, event-driven monitoring with minimal operational overhead, as it does not require custom scripts or manual log analysis.

Answer

Enable CloudTrail and create a CloudWatch alarm for each security group modification event.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena for security group changes.

Answer

Deploy Amazon GuardDuty to monitor for security group modifications.

Question 14

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The administrator needs to investigate which queries are consuming the most CPU. Which action should the administrator take?

Accepted Answer

Enable Performance Insights for the RDS instance and review the top SQL queries.. Performance Insights is the correct tool because it provides a database-specific performance schema that visualizes database load and identifies the top SQL queries consuming resources. By enabling Performance Insights on the RDS instance, the administrator can directly view which queries are responsible for the high CPU utilization during peak hours, allowing targeted optimization.

Answer

Use CloudWatch Logs Insights to query the database error log for slow queries.

Answer

Enable detailed CloudWatch metrics for the RDS instance and analyze the CPUUtilization metric.

Answer

Enable RDS Enhanced Monitoring and review the 'cpuCreditUsage' metric.

Question 15

A company has an Amazon S3 bucket that stores critical data. The security team wants to be notified whenever an object in the bucket is deleted. Which solution should the SysOps administrator implement?

Accepted Answer

Enable CloudTrail data events for the S3 bucket, create a CloudWatch Events rule for 'DeleteObject' API calls, and send notifications via SNS.. It uses CloudTrail data events to capture 'DeleteObject' API calls specifically for the S3 bucket, then routes those events via CloudWatch Events to an SNS topic for notification. This provides a reliable, real-time notification mechanism for object deletions without requiring custom code or post-hoc analysis.

Answer

Configure an S3 event notification for 's3:ObjectRemoved:*' events to trigger an AWS Lambda function that sends an email.

Answer

Use AWS Config to monitor S3 bucket resources and trigger an SNS notification on configuration changes.

Answer

Enable S3 server access logs and use Amazon Athena to query for delete events, then send notifications.