SOA-C02 Monitoring, Logging, and Remediation Practice Test 9 — 15 Questions

Question 1

A SysOps administrator is managing a fleet of EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The administrator notices that the 'SurgeQueueLength' metric for the ALB is frequently high. What does this indicate, and what is the BEST remediation action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The targets are not able to handle the request rate; increase the desired capacity or add scaling policies.. The SurgeQueueLength metric measures the number of requests that are queued by the Application Load Balancer (ALB) because no healthy target is available to process them. A frequently high value indicates that the targets (EC2 instances) are overwhelmed and cannot keep up with the incoming request rate. The best remediation is to increase the desired capacity of the Auto Scaling group or add scaling policies (e.g., based on SurgeQueueLength or RequestCountPerTarget) to automatically add more instances to handle the load.

Answer

The targets are unhealthy; decrease the desired capacity to reduce load.

Answer

The load balancer is accepting too many connections; increase the idle timeout.

Answer

The load balancer is overloaded; replace it with a Network Load Balancer.

Question 2

A SysOps administrator needs to monitor the disk space utilization on a fleet of EC2 instances running Windows Server. Which TWO steps should the administrator take to collect and visualize this data? (Choose TWO.)

Accepted Answer

Install the CloudWatch agent on each EC2 instance to collect disk space metrics.. The CloudWatch agent is required to collect custom metrics like disk space utilization from EC2 instances running Windows Server. Default EC2 monitoring only collects hypervisor-level metrics (CPU, network, disk I/O), not guest OS metrics such as disk space. Installing the CloudWatch agent and configuring it to collect disk space metrics is the correct step. Creating a CloudWatch dashboard then allows visualization of those collected metrics.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log disk space changes.

Answer

Enable default EC2 monitoring to collect disk space metrics automatically.

Question 3

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that all API calls across all accounts are logged and retained for at least 7 years. Which THREE steps should the SysOps administrator take to meet this requirement? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail in all AWS accounts and all regions.. AWS CloudTrail is the service designed to record all API calls made within an AWS account. Enabling CloudTrail in all accounts and all regions ensures comprehensive logging of management events across the entire AWS Organization. This is a foundational step for meeting audit and compliance requirements.

Answer

Use AWS Config to record API calls and store them in an S3 bucket.

Answer

Store CloudTrail logs in Amazon CloudWatch Logs with a retention policy of 7 years.

Question 4

A SysOps administrator is investigating a performance issue with an Amazon RDS for PostgreSQL instance. The administrator has enabled Performance Insights. Which TWO metrics from Performance Insights can help identify the root cause of a sudden increase in database load? (Choose TWO.)

Accepted Answer

DB Load by Wait Events.. The correct answers are C and E. DB Load by Wait Events (C) breaks down the total load into wait event categories (e.g., CPU, I/O, locks), directly identifying the resource causing the bottleneck. Top SQL queries by DB Load (E) shows which specific SQL statements contribute the most to the load, enabling targeted optimization. Together, they provide a complete root cause analysis. Options A and D (Read/Write IOPS, CPUUtilization) are infrastructure-level metrics that may indicate resource pressure but do not reveal database-level contention or query-level impact. Option B (Average Active Sessions) is the overall load metric itself, not a breakdown, so it does not pinpoint the cause.

Answer

Read IOPS and Write IOPS.

Answer

Average Active Sessions.

Answer

CPUUtilization percentage.

Question 5

A SysOps administrator is responsible for a multi-tier web application running on AWS. The application consists of an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS for MySQL database. Recently, the operations team has been receiving alerts from CloudWatch that the ALB's 'HTTPCode_Target_5XX_Count' metric is spiking periodically. The team has also noticed that the database CPU utilization is high during these spikes. The application logs show that some requests are timing out. The administrator needs to identify the root cause and implement a remediation. After reviewing the architecture, the administrator rules out the database as the bottleneck because the database connections are pooled and the query response times are normal. The administrator suspects that the issue is related to the application server's health. Which course of action should the administrator take to diagnose and resolve the issue?

Accepted Answer

Increase the health check timeout and threshold to allow for transient high CPU usage.. The periodic spikes in ALB 5xx errors, high database CPU, and application timeouts, combined with normal query response times and pooled connections, strongly suggest that the application servers are becoming overwhelmed and failing health checks. By increasing the health check timeout and threshold, the ALB will allow the EC2 instances more time to recover from transient CPU or memory pressure before being marked unhealthy and removed from service, which prevents unnecessary instance replacement and reduces the cascading load on remaining instances and the database.

Answer

Add an Amazon ElastiCache cluster to cache database queries.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Answer

Increase the idle timeout on the ALB to keep connections open longer.

Question 6

A company uses Amazon RDS for MySQL and wants to monitor the number of database connections in real time. Which CloudWatch metric should the SysOps administrator use?

Accepted Answer

DatabaseConnections. Amazon RDS for MySQL exposes a CloudWatch metric named `DatabaseConnections` that reports the number of client connections to the DB instance. This metric is derived from the MySQL `Threads_connected` status variable and is updated every minute, providing real-time visibility into connection counts for monitoring and alarming.

Answer

CPUUtilization

Answer

ActiveConnections

Answer

ConnectionCount

Question 7

An organization uses AWS CloudTrail to log API calls across multiple accounts in AWS Organizations. The logs are delivered to a central S3 bucket. The security team wants to receive near-real-time notifications whenever an IAM user creates a new access key. Which solution is the MOST operationally efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event from CloudTrail and publishes to an Amazon SNS topic.. Amazon EventBridge can directly consume CloudTrail events (including `CreateAccessKey`) in near-real-time without polling or custom code. By creating a rule that matches this specific event and targets an SNS topic, the security team gets immediate notifications with minimal operational overhead. This approach is serverless, event-driven, and requires no intermediate services or custom functions.

Answer

Enable S3 Event Notifications on the CloudTrail bucket to trigger a Lambda function that scans new objects for access key creation.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and set up a metric filter that triggers an alarm.

Answer

Use Amazon CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 8

A SysOps administrator notices that an Amazon EC2 instance's CPU utilization is consistently above 90% during business hours. The instance is part of an Auto Scaling group with a simple scaling policy based on average CPU utilization. However, the Auto Scaling group is not launching new instances. What is the most likely cause?

Accepted Answer

The scaling policy is in a cooldown period after a previous scaling activity.. The simple scaling policy in Auto Scaling has a cooldown period (default 300 seconds) that prevents the group from launching or terminating instances immediately after a previous scaling activity. If the policy triggered a scale-out event recently, the cooldown period is still active, so even though CPU utilization remains above 90%, no new instances are launched until the cooldown expires. This is the most likely cause because the cooldown is designed to stabilize metrics and avoid thrashing.

Answer

The Auto Scaling group has a minimum size equal to the current number of instances.

Answer

The Auto Scaling group has a scheduled scaling action that is overriding the dynamic policy.

Answer

The instance is not healthy and is being terminated by the Auto Scaling group.

Question 9

Refer to the exhibit. A SysOps administrator created this IAM policy for an application that sends custom metrics to CloudWatch and writes logs to CloudWatch Logs. The application reports that it cannot publish logs. What is the most likely reason?

Accepted Answer

The resource ARN for the logs actions is incorrect; it should include 'log-group:' before the wildcard.. The IAM policy uses `arn:aws:logs:us-east-1:123456789012:*` for the `Resource` element of the `logs:PutLogEvents` and `logs:CreateLogGroup` actions. For CloudWatch Logs, the resource ARN must include the `log-group:` prefix before the log group name or wildcard, such as `arn:aws:logs:us-east-1:123456789012:log-group:*`. Without this prefix, the ARN does not match any valid CloudWatch Logs resource, causing the application to fail when attempting to publish logs.

Answer

The policy requires a condition key to restrict access to specific log groups.

Answer

The policy does not allow the cloudwatch:PutMetricData action for the specific metric.

Answer

The application must assume an IAM role to write logs.

Question 10

A company wants to monitor the health of its web application running on EC2 instances behind an Application Load Balancer (ALB). Which CloudWatch metric from the ALB can indicate that requests are failing due to server errors?

Accepted Answer

HTTPCode_Target_5XX_Count. The HTTPCode_Target_5XX_Count metric from the Application Load Balancer (ALB) specifically counts the number of HTTP response codes in the 5xx range returned by the target (EC2 instances). A 5xx status code indicates a server-side error, such as an internal server error (500), gateway timeout (504), or service unavailable (503), which directly reflects that requests are failing due to issues on the EC2 instances themselves.

Answer

HTTPCode_Target_4XX_Count

Answer

HTTPCode_Target_2XX_Count

Answer

HTTPCode_Target_3XX_Count

Question 11

A SysOps administrator is troubleshooting an issue where an Amazon RDS DB instance's storage space is running out. The administrator has enabled CloudWatch alarms for FreeStorageSpace, but the alarm did not trigger before the storage was exhausted. What is the most likely reason?

Accepted Answer

The alarm's evaluation period was too long and the storage filled up faster than the alarm could trigger.. CloudWatch alarms evaluate metrics based on a specified evaluation period (e.g., 5 minutes). If the storage fills up faster than the alarm's evaluation period, the alarm may not have enough data points to trigger before the storage is exhausted. This is a common issue when the rate of storage consumption exceeds the alarm's evaluation frequency.

Answer

The FreeStorageSpace metric is not available for the selected DB instance class.

Answer

The alarm was configured to use a static threshold but the metric is not emitted during storage operations.

Answer

The alarm was monitoring the wrong metric, such as 'Storage' instead of 'FreeStorageSpace'.

Question 12

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified if a stack creation fails. Which method is the most efficient way to achieve this?

Accepted Answer

Specify an SNS topic ARN in the 'NotificationARNs' parameter of the stack.. CloudFormation natively supports specifying an Amazon SNS topic ARN in the 'NotificationARNs' parameter of the stack. When a stack creation fails, CloudFormation automatically publishes a notification to the SNS topic, which can then deliver the message via email, SMS, or other protocols without any custom polling or additional services.

Answer

Use Amazon Simple Email Service (SES) to send emails on stack failure.

Answer

Create a Lambda function that polls the CloudFormation API for stack status changes.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' events.

Question 13

A SysOps administrator is managing a fleet of EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The administrator notices that the 'SurgeQueueLength' metric for the ALB is frequently high. What does this indicate, and what is the BEST remediation action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch alarm that publishes to an SNS topic, which triggers a Lambda function to terminate the instance.. CloudWatch alarms can trigger an SNS topic when a metric threshold is breached, and a Lambda function subscribed to that topic can execute custom code to terminate the EC2 instances. This provides a fully automated, event-driven remediation workflow without manual intervention.

Answer

Use AWS Config to detect the metric and terminate the instance.

Answer

Place the instances in an Auto Scaling group and use a lifecycle hook.

Answer

Configure a CloudWatch alarm to terminate the instance directly.

Question 14

A SysOps administrator is setting up centralized logging for multiple AWS accounts using CloudWatch Logs. Which TWO actions should the administrator take to ensure that logs from all accounts are aggregated in a single account?

Accepted Answer

In the central account, create a CloudWatch Logs destination and attach a resource policy that grants the source accounts permission to write logs.. A CloudWatch Logs destination in the central account, combined with a resource policy that grants the source accounts permission to write logs, is the standard mechanism for cross-account log aggregation. The destination acts as a target for subscription filters, and the resource policy explicitly allows the source accounts to call the PutLogEvents API against that destination. This setup ensures that log events from source accounts are delivered to the central account without requiring IAM roles or additional infrastructure.

Answer

In the central account, create an IAM role that trusts the source accounts and allows PutLogEvents.

Answer

In the central account, create a log group with the same name as the source accounts' log groups.

Answer

In each source account, create a Kinesis Data Firehose delivery stream that sends logs to the central account's S3 bucket.

Question 15

An organization uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. A SysOps administrator needs to be alerted when a canary run fails. Which THREE steps are required to set up this alerting?

Accepted Answer

Configure a CloudWatch alarm on the canary's `SuccessPercent` metric.. CloudWatch Synthetics canaries automatically publish a `SuccessPercent` metric to CloudWatch. By configuring a CloudWatch alarm on this metric (e.g., when `SuccessPercent` drops below 100), the administrator can trigger an alert whenever a canary run fails. This is the standard method for monitoring canary health without needing custom metrics.

Answer

Create a custom CloudWatch metric for canary failures.

Answer

Enable detailed monitoring on the canary.