DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS CloudTrail

  Why it's wrong here

  AWS CloudTrail is an API auditing service that records every action taken through the AWS Management Console, SDKs, or CLI as an event in a trail. It captures who made the request, when, from which IP, and what the request was, but it has no awareness of infrastructure performance metrics like CPU utilization. CloudTrail events can be used to detect unauthorized API calls or changes, but they cannot monitor the periodic CPU load of an EC2 instance, so it is incorrect for this monitoring use case.

• ✗

  VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs capture metadata about IP traffic flowing through Elastic Network Interfaces in a VPC, including source/destination IPs, ports, protocol, and packet/byte counts. This data is useful for network diagnostics, security analysis, and traffic forensics, but it does not include any information from inside the guest OS or hypervisor, such as CPU utilization. Since CPU usage is a server-level metric and not represented in network flows, VPC Flow Logs are irrelevant for detecting CPU utilization thresholds.

• ✓

  Amazon CloudWatch Alarms

  Why this is correct

  Amazon CloudWatch Alarms are the correct service because they directly evaluate CloudWatch metrics, and CPUUtilization is a built-in metric emitted by EC2 instances. You can configure an alarm to transition to an ALARM state when the average CPU utilization exceeds a threshold, and then trigger actions like Auto Scaling, Amazon SNS notifications, or EC2 actions (reboot, stop, terminate). Alarm evaluation periods and statistic types (e.g., average, maximum) allow precise control over when an alarm fires, making it the natural choice for CPU monitoring.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is a configuration management and compliance service that records resource configurations, relationships, and changes over time, evaluating them against rules you define. While Config can detect drift in EC2 instance types, AMIs, security groups, or tags, it is not designed to ingest time-series performance metrics like CPU utilization. AWS Config rules can use AWS Lambda for custom logic, but they are still triggered by configuration changes, not metric thresholds, so they are unsuitable for continuous CPU monitoring.

Go deeper

Related to this question