DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch alarm on the GroupTotalInstances metric.

  Why it's wrong here

  CloudWatch alarms evaluate the GroupTotalInstances metric over a period (e.g., 5-minute averages) and only trigger ALARM after a threshold is breached. This is polling/threshold-based, not event-driven, so there is no immediate notification at the exact moment an instance launches or terminates. Additionally, an alarm would not provide details about which instance was affected or the lifecycle event type, making it unsuitable for real-time event notifications.

• ✗

  AWS Config rules to detect changes in Auto Scaling groups.

  Why it's wrong here

  AWS Config operates by recording configuration history of resources like Auto Scaling group settings and evaluating rules periodically or on configuration changes. Instance launch and termination events do not change the Auto Scaling group's configuration item (the group's desired/min/max capacity may even remain unchanged), so Config would not even record these transient events. While Config rules can trigger SNS notifications for noncompliance, they are not designed for low-latency, per-event notifications and typically run with evaluation delays.

• ✗

  AWS CloudTrail to monitor Auto Scaling API calls.

  Why it's wrong here

  CloudTrail captures API calls made to the Auto Scaling service, such as SetDesiredCapacity or CreateAutoScalingGroup, but it delivers log files for auditing and security analysis, not real-time event notifications. To get any notification, you'd have to build a separate pipeline: create a CloudWatch Events rule matching CloudTrail events, attach a Lambda function, then publish to SNS — that is a custom integration, not the direct notification mechanism. CloudTrail itself does not emit notifications when instances launch or terminate.

• ✓

  Amazon SNS notifications from the Auto Scaling group.

  Why this is correct

  Auto Scaling groups have a built-in notification feature that publishes messages to an SNS topic on lifecycle events like ec2-instance-launch and ec2-instance-terminate. This provides immediate, event-driven delivery of the instance ID, the Auto Scaling group name, and the event type to all subscribers (email, SMS, Lambda, HTTP endpoints). It is the simplest native way to receive real-time notifications for the exact scaling actions the company cares about.

Go deeper

Related to this question