SOA-C02 Monitoring, Logging, and Remediation — Timed 15 Questions

Question 1

A SysOps team needs to monitor application logs in Amazon CloudWatch Logs for specific error codes and automatically invoke an AWS Lambda function for remediation within 5 minutes of an error occurring. Which solution involves the least operational overhead?

15 minute time limit — choose an answer to begin.

Accepted Answer

Create a CloudWatch metric filter on the log group, create a CloudWatch alarm on the metric, and configure the alarm to post to an SNS topic that triggers the Lambda function.. It uses CloudWatch metric filters and alarms to detect error codes in logs and trigger remediation via SNS and Lambda, all within a fully managed AWS pipeline. This approach requires no custom code or infrastructure to maintain, and the alarm can be configured to evaluate logs within a 1-minute period, easily meeting the 5-minute requirement with minimal operational overhead.

Answer

Create a CloudWatch Logs subscription filter to stream logs directly to an AWS Lambda function.

Answer

Use a third-party log aggregation tool that sends webhook notifications to an API Gateway endpoint to invoke the Lambda function.

Answer

Write a custom script that runs on an EC2 instance to poll CloudWatch Logs every minute and invoke the Lambda function.

Question 2

A company uses an Amazon S3 bucket to store sensitive data. The SysOps administrator needs to be notified within 15 minutes if any object in the bucket becomes publicly accessible. Which solution will meet this requirement with the least operational overhead?

Accepted Answer

Enable Amazon CloudTrail data events for the S3 bucket and create a CloudWatch Logs metric filter for PutObjectAcl (or PutObject with public ACL) and set an alarm.. To be notified when any object becomes publicly accessible, you must detect object-level ACL changes and uploads with public ACLs. Amazon CloudTrail data events record PutObjectAcl and PutObject with x-amz-acl headers, allowing a CloudWatch Logs metric filter to capture these API calls and trigger an SNS alarm within 15 minutes. Option B's AWS Config rule 's3-bucket-public-read-prohibited' only checks bucket policies and bucket ACLs, not individual object ACLs, so it can miss scenarios where a single object is made public.

Answer

Configure an S3 event notification for all object creation events and publish to an Amazon SNS topic that sends an email alert.

Answer

Use an AWS Config managed rule to detect 's3-bucket-public-read-prohibited' and trigger an SNS notification via Amazon EventBridge.

Answer

Configure S3 event notifications for 's3:ObjectCreated:Put' and 's3:ObjectCreated:PutObjectAcl' with a suffix/prefix filter for public grants, sending to an SNS topic.

Question 3

A SysOps administrator manages an application that runs on Amazon EC2 instances and stores critical data in Amazon Elastic Block Store (EBS) volumes. The administrator needs to monitor the EBS volumes for any performance bottlenecks. The key metric of interest is the average number of I/O operations per second (IOPS) that are waiting to be completed. Which Amazon CloudWatch metric should the administrator examine?

Accepted Answer

VolumeQueueLength. The VolumeQueueLength metric measures the number of pending I/O requests waiting to be serviced by an EBS volume. A high value indicates that the volume is unable to keep up with the I/O demand, which is the direct indicator of a performance bottleneck related to IOPS waiting. This makes it the correct metric for the administrator's stated goal.

Answer

VolumeReadOps

Answer

VolumeIdleTime

Answer

VolumeTotalReadTime

Question 4

A company uses Amazon CloudFront to serve content from a custom origin. A SysOps administrator needs to detect IP addresses that generate a high rate of HTTP 403 (Forbidden) errors, which may indicate malicious bots attempting to access restricted content. The administrator wants to automatically add these IP addresses to a AWS WAF IP set to block them. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Enable CloudFront standard logs and stream them to Amazon CloudWatch Logs. Create a metric filter for 403 status codes, grouped by source IP. Set a CloudWatch alarm on the metric that triggers an AWS Lambda function to update the WAF IP set.. To achieve the requirement with minimal overhead, you would need to enable CloudFront access logs to S3, then use S3 events or a Lambda to ingest logs into CloudWatch Logs (or query them directly), and then set up metric filters and alarms to trigger a Lambda that updates WAF. Option D incorrectly implies a native 'standard logs to CloudWatch Logs' capability that does not exist.

Answer

Configure CloudFront access logs to be delivered to an Amazon S3 bucket, and use Amazon Athena to query logs for IPs with many 403 errors. Then manually add those IPs to a WAF IP set.

Answer

Enable AWS CloudTrail for CloudFront and create a CloudWatch metric filter for 'Forbidden' events. Use a CloudWatch alarm to notify the administrator via email, who then manually updates the WAF IP set.

Answer

Use AWS Config to monitor CloudFront distributions and trigger an AWS Lambda function when a high number of 403 errors is detected by evaluating access logs stored in S3.

Question 5

A SysOps administrator needs to view a graph of the average CPU utilization of an Auto Scaling group over the past 24 hours. The administrator wants to share this graph with the team via a link that does not require AWS console login. Which AWS service should be used to create and share this graph?

Accepted Answer

Amazon CloudWatch Dashboard. Amazon CloudWatch Dashboards allow you to create customizable graphs of metrics like average CPU utilization from an Auto Scaling group. You can share a dashboard via a link that does not require AWS console login by using the 'Share' feature, which generates a public URL that grants read-only access to the dashboard without authentication.

Answer

AWS CloudTrail

Answer

Amazon QuickSight

Answer

AWS Trusted Advisor

Question 6

A SysOps administrator manages Amazon EC2 instances in multiple AWS accounts. The administrator needs to collect and analyze network traffic logs to identify the top IP addresses generating the most traffic to the instances. The administrator must centralize this analysis in a single monitoring account that has cross-account access to the logs. Which combination of AWS services should the administrator use?

Accepted Answer

Enable VPC Flow Logs in each account, publish them to an Amazon S3 bucket, and use Amazon Athena to query for top IPs.. Both A and C are valid ways to centralize VPC Flow Logs and identify top IPs. A uses S3 and Athena to query flow logs across accounts; C uses CloudWatch Logs and Contributor Insights with cross-account ingestion. The original explanation incorrectly states that A is not suitable.

Answer

Use AWS Config rules across accounts to aggregate network traffic data and generate a report in Amazon QuickSight.

Answer

Use Amazon CloudWatch Logs Insights with a saved query in the central account and schedule it to run every hour using EventBridge.

Question 7

Match each AWS monitoring tool to its function.

Accepted Answer

Amazon CloudWatch: Collects and tracks metrics, logs, and monitors resources. Amazon CloudWatch collects metrics and logs, AWS CloudTrail records API calls for auditing, and AWS Config evaluates resource configurations for compliance. The incorrect options swap these functions.

Answer

Amazon CloudWatch: Records API calls to track user activity

Answer

AWS CloudTrail: Monitors CPU utilization and network traffic

Answer

Amazon CloudWatch: Assesses resources for compliance with rules

Question 8

A company has a CloudWatch dashboard that displays custom metrics from an application. Some metrics are missing from the dashboard, but the application is publishing them to CloudWatch. The SysOps administrator confirms the metrics are present in the CloudWatch console under the correct namespace. What could be causing the metrics to not appear on the dashboard?

Accepted Answer

The dashboard widget is configured with a period that is longer than the interval at which metrics are published.. If the dashboard widget's period (e.g., 5 minutes) is longer than the metric publication interval (e.g., 1 minute), CloudWatch will aggregate the data points into the larger period. If the metric was published recently, the aggregation may not have completed, or the data points may fall outside the visible range of the widget's period, causing them to not appear even though the raw metrics exist in the namespace.

Answer

The IAM user viewing the dashboard does not have cloudwatch:GetMetricData permission.

Answer

The dashboard's time range is set to the last 1 hour, but the metrics were published 2 hours ago.

Answer

The namespace of the custom metrics is misspelled in the dashboard configuration.

Question 9

A company is running a stateful web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent errors. The SysOps admin notices that the ALB's healthy host count is fluctuating. The admin wants to improve the health check configuration to reduce false positives. Which configuration change is most likely to help?

Accepted Answer

Increase the health check interval. Increasing the health check interval reduces the frequency of health checks, which helps prevent transient issues (e.g., brief CPU spikes or network jitter) from causing false positives. With a longer interval, the ALB waits longer between checks, giving the instance more time to recover before being marked unhealthy. This stabilizes the healthy host count and reduces unnecessary instance replacement.

Answer

Increase the unhealthy threshold count

Answer

Reduce the health check interval

Answer

Lower the healthy threshold count

Question 10

Which THREE metrics from Amazon CloudWatch are most useful for diagnosing an application performance bottleneck on an EC2 instance running a web server? (Choose 3.)

Accepted Answer

CPUUtilization. CPUUtilization (A) is a core EC2 hypervisor-level metric that reveals whether the web server is CPU-bound, which is one of the most common causes of an application performance bottleneck. NetworkIn (B) shows inbound traffic volume and can expose network saturation or unexpected traffic spikes that throttle request handling on the instance. StatusCheckFailed (E) indicates whether the instance has failed its system or instance status checks, which directly signals underlying host or instance-level problems that degrade application performance. DiskReadOps (C) is not among the marked answers and is less directly indicative of a web server bottleneck, since it only counts read operations rather than latency or throughput. MemoryUtilization (D) is not a default CloudWatch metric for EC2 — it requires the CloudWatch agent to be installed — so it is not one of the standard metrics relied on here.

Answer

DiskReadOps

Answer

MemoryUtilization

Question 11

A SysOps admin needs to set up centralized logging for multiple AWS accounts. Which TWO services should be used together to aggregate logs into a single S3 bucket? (Choose 2.)

Accepted Answer

AWS Config. AWS CloudTrail (C) is correct because it records API activity and account events across all accounts and can be configured with an organization trail to deliver log files to a single centralized S3 bucket. AWS Config (B) is correct because it continuously records resource configurations and configuration changes and can aggregate data from multiple accounts into a central account, with its configuration history and snapshots delivered to a centralized S3 bucket. Together, CloudTrail and AWS Config provide the API activity and resource configuration logging needed for centralized multi-account logging into one S3 bucket. VPC Flow Logs (A) only capture IP traffic metadata for a specific VPC, subnet, or ENI and are not a multi-account centralized logging service. S3 cross-region replication (D) replicates existing S3 objects between buckets but does not collect logs from AWS accounts. CloudWatch Logs subscription filters (E) stream log events to services like Kinesis or Lambda but are not the primary multi-account aggregation mechanism for CloudTrail and AWS Config data into S3.

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 cross-region replication

Answer

Amazon CloudWatch Logs subscription filter

Question 12

A company uses CloudWatch Logs to store application logs. The logs must be retained for 3 years for compliance. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Set the log group retention period to 3 years.. Option C is correct because CloudWatch Logs log groups support a retention setting that can be configured to 1096 days (3 years), which prevents the automatic deletion of log events before the compliance period ends. Option E is correct because CloudWatch Logs export tasks copy log data to an Amazon S3 bucket, where S3 durability and lifecycle policies can preserve the logs for 3 years or longer, satisfying compliance archival requirements. Option A is incorrect because transitioning objects to Glacier after 3 years does not itself retain logs for 3 years and assumes data is already in S3, which is not the case for CloudWatch Logs. Option B is incorrect because CloudWatch Logs Insights is only a query and analysis tool and does not affect log retention. Option D is incorrect because streaming logs to Kinesis Firehose is a real-time delivery mechanism, not a retention solution, and Firehose does not by itself guarantee 3-year storage.

Answer

Configure an S3 lifecycle policy to transition objects to Glacier after 3 years.

Answer

Enable CloudWatch Logs Insights.

Answer

Use CloudWatch Logs subscription filter to stream logs to Amazon Kinesis Firehose.

Question 13

A company wants to ensure that all S3 buckets are configured with server access logging. Which TWO AWS services can be used to detect non-compliant buckets? (Choose TWO.)

Accepted Answer

AWS Config. AWS Config (B) is correct because it continuously records S3 bucket configuration changes and can evaluate them against a managed or custom rule (for example, s3-bucket-logging-enabled) to flag buckets that lack server access logging. AWS CloudTrail (C) is correct because it logs S3 API activity such as PutBucketLogging, enabling detection of buckets where logging was never enabled or was disabled, and CloudTrail data/management events can feed analysis to identify non-compliant buckets. Amazon Inspector (A) is incorrect because it scans EC2 instances and container images for software vulnerabilities, not S3 bucket configuration. Amazon Macie (D) is incorrect because it discovers and classifies sensitive data in S3, not whether server access logging is enabled. Amazon GuardDuty (E) is incorrect because it detects threats and anomalous behavior via threat intelligence and ML, not configuration compliance for S3 logging.

Answer

Amazon Inspector

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 14

An application running on Amazon ECS with Fargate is experiencing intermittent failures. The application logs show connection timeouts to an RDS MySQL database. The database is in the same VPC but a different subnet. Which CloudWatch metric should be examined first to diagnose the issue?

Accepted Answer

VPC Flow Logs for the ECS task's elastic network interface.. VPC Flow Logs capture metadata about network traffic at the elastic network interface level, including whether packets were accepted or rejected. Since the application logs show connection timeouts (not authentication or resource exhaustion), the most likely cause is a network path issue, such as a missing route or security group rule blocking traffic between the ECS task's subnet and the RDS subnet. VPC Flow Logs will reveal if packets from the ECS task to the RDS database are being dropped, allowing you to pinpoint the exact network failure.

Answer

DatabaseConnections for the RDS instance.

Answer

MemoryUtilization for the RDS instance.

Answer

CPUUtilization for the ECS tasks.

Question 15

A company stores sensitive data in an S3 bucket. The security team requires that any access to the bucket from outside the corporate network be logged and immediately alerted. Which solution meets these requirements?

Accepted Answer

Enable S3 server access logging, stream logs to CloudWatch Logs, create a metric filter for external IP addresses, and set a CloudWatch alarm.. It combines S3 server access logging with CloudWatch Logs streaming, metric filtering for external IP addresses, and a CloudWatch alarm. This provides both logging and immediate alerting for any access from outside the corporate network, meeting the security team's requirements.

Answer

Enable S3 server access logging and store logs in a separate bucket for later analysis.

Answer

Enable AWS CloudTrail and create a metric filter for 'GetObject' events, then set a CloudWatch alarm.

Answer

Use AWS Config rules to detect when the bucket policy is changed to allow public access.