SOA-C02 Monitoring, Logging, and Remediation Practice Question
A company runs a REST API on Amazon EC2 instances behind an Application Load Balancer. The SysOps administrator needs to monitor the API endpoint from multiple geographic locations and receive an alarm if the p90 latency exceeds 2 seconds for two consecutive checks. The solution must use AWS managed services and not require custom code running on EC2. Which approach should the administrator use?
⚠ Common exam trap
A common mix-up: candidates confuse VPC Flow Logs or CloudTrail with application-layer monitoring, but neither provides request-level latency metrics; CloudWatch Synthetics is the only AWS-managed service that can synthetically test an HTTP endpoint from multiple geographic locations and publish percentile latency metrics without custom EC2 code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up Amazon CloudWatch Synthetics canaries to run from multiple AWS Regions and publish custom metrics. Create a CloudWatch alarm on the p90 latency metric.
Amazon CloudWatch Synthetics canaries are AWS-managed Node.js scripts that run on a schedule to monitor endpoints from multiple AWS Regions, capturing metrics like duration and latency. By configuring canaries to report p90 latency as a custom metric, you can create a CloudWatch alarm that triggers when p90 exceeds 2 seconds for two consecutive data points, meeting all requirements without custom EC2 code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set up Amazon CloudWatch Synthetics canaries to run from multiple AWS Regions and publish custom metrics. Create a CloudWatch alarm on the p90 latency metric.
Why this is correct
CloudWatch Synthetics canaries execute Node.js or Python scripts on AWS-managed Lambda functions, and by configuring them in multiple Regions you can actively probe the REST API from geographically distributed vantage points. Each canary can record HTTP response time and success/failure, then publish those measurements as custom metrics to CloudWatch. Because the metric supports percentile statistics, you can create an alarm on the p90 latency (e.g., p90 over 5 minutes) to detect regional or global slowdowns, making this the only option that provides synthetic, multi-region, application-level latency monitoring.
- ✗
Configure VPC Flow Logs on the Application Load Balancer and use Amazon CloudWatch Logs Insights to query for high-latency requests.
Why it's wrong here
VPC Flow Logs capture metadata about IP traffic in the VPC — such as source/destination addresses, ports, protocol, and packet/byte counts — but they do not include HTTP request timing, status codes, or application endpoint response durations. Querying these logs with CloudWatch Logs Insights therefore cannot yield a p90 latency statistic for the REST API; it can only show network-level flow information. To troubleshoot high latency you would need ALB access logs or distributed tracing, not flow logs.
- ✗
Enable Amazon CloudWatch RUM (Real User Monitoring) on the client side and create a CloudWatch alarm on the Duration metric.
Why it's wrong here
CloudWatch RUM is a client-side observability feature that requires you to install a JavaScript agent in the web application, so it can only capture performance data from users who actually visit the site, not from synthetic probes in specified AWS Regions. Its Duration metric reflects page-load/rendering experience for real browsers, which mixes network, DOM, and resource timing and doesn't isolate API endpoint latency. Since the requirement calls for monitoring from multiple managed geographic locations regardless of user traffic, RUM does not fit the use case.
- ✗
Use AWS CloudTrail to log API calls and set a CloudWatch alarm on the event count for errors.
Why it's wrong here
AWS CloudTrail logs API calls made by users or services to the AWS control plane (for example, ec2:RunInstances or autoscaling:UpdateAutoScalingGroup), not HTTP requests hitting your custom REST API on EC2. The event count for errors in CloudTrail would indicate failed AWS API operations, not latency or response times of your application. Therefore, a CloudTrail-based alarm cannot detect p90 latency issues; it only provides an audit trail of AWS account activity.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.