DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Install the CloudWatch Logs agent on each EC2 instance and configure a metric filter to trigger an SNS notification

  Why it's wrong here

  The CloudWatch Logs agent collects application and OS log files into CloudWatch Logs, where a metric filter can count or extract values from log lines to create custom metrics. However, the EC2 CPUUtilization metric is already published to CloudWatch by the instance's hypervisor, so it does not require log collection or a metric filter. An alarm on the built-in CPUUtilization metric is the direct, standard mechanism for detecting sustained high CPU usage.

• ✓

  Create a CloudWatch alarm on CPUUtilization with a threshold of 90% for 5 consecutive periods, and configure an SNS topic to send email

  Why this is correct

  CloudWatch automatically emits the CPUUtilization metric for each EC2 instance, expressed as a percentage, so an alarm can directly evaluate it. Configuring the alarm with a threshold of 90% for five consecutive evaluation periods (5-minute periods, or 1-minute if detailed monitoring is enabled) ensures the alert only fires on sustained load, not transient spikes. The action sends an SNS notification to a topic with an email subscription, which is the canonical AWS approach for metric-based alerting.

• ✗

  Use AWS CloudTrail to monitor CPU utilization and send notifications via SNS

  Why it's wrong here

  AWS CloudTrail is an API auditing service that records user activity and API calls in your account, producing event history for security and governance purposes. It has no mechanism to ingest or analyze performance metrics such as CPU utilization, and it cannot evaluate thresholds or generate SNS alerts based on instance load. Because it operates at the control plane level, CloudTrail is fundamentally unsuited for telemetry-driven notifications.

• ✗

  Use AWS Config to create a rule that triggers an SNS notification when CPU utilization exceeds 90%

  Why it's wrong here

  AWS Config assesses resource configurations — such as instance types, security group settings, or resource tags — against compliance rules and can trigger remediation or SNS when a rule is noncompliant. CPU utilization is an ephemeral runtime performance metric, not a persistent configuration attribute that AWS Config inventories or evaluates. Even though Config rules can react to state changes, they have no concept of a CPU percentage threshold, so this approach cannot work for the stated requirement.

Go deeper

Related to this question