SOA-C02 Monitoring, Logging, and Remediation Practice Question
This SOA-C02 practice question tests your understanding of monitoring, logging, and remediation. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: composite alarms combine the states of multiple underlying alarms.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company runs a web application on Amazon EC2 instances. The SysOps administrator needs to monitor two metrics: high CPU utilization (greater than 90%) and high memory utilization (greater than 85%). An alarm should trigger when both conditions are true simultaneously for a period of 5 minutes. Which CloudWatch feature should the administrator use to create this alarm?
Why wrong: Metric math can produce a combined metric, but you would still need a single alarm on that metric; composite alarms are designed for combining multiple alarm states.
B
Composite alarm
Composite alarms can combine multiple underlying alarms with AND logic, triggering only when all conditions are met.
C
Anomaly detection
Why wrong: Anomaly detection models expected ranges and alerts on outliers, not on fixed thresholds combined with another metric.
D
Logs Insights
Why wrong: Logs Insights is for querying log data, not for metric-based alarms.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Composite alarm
A composite alarm in Amazon CloudWatch allows you to create an alarm that evaluates multiple conditions using logical operators (AND, OR, NOT). In this scenario, the administrator needs the alarm to trigger only when both CPU utilization > 90% AND memory utilization > 85% are true simultaneously for 5 minutes. Composite alarms evaluate the state of underlying metric alarms (e.g., two separate simple alarms for CPU and memory) and combine them with an AND condition, making it the correct feature for this requirement.
Key principle: Composite alarms combine the states of multiple underlying alarms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Metric math
Why it's wrong here
Metric math can produce a combined metric, but you would still need a single alarm on that metric; composite alarms are designed for combining multiple alarm states.
✓
Composite alarm
Why this is correct
Composite alarms can combine multiple underlying alarms with AND logic, triggering only when all conditions are met.
Related concept
Composite alarms combine the states of multiple underlying alarms.
✗
Anomaly detection
Why it's wrong here
Anomaly detection models expected ranges and alerts on outliers, not on fixed thresholds combined with another metric.
✗
Logs Insights
Why it's wrong here
Logs Insights is for querying log data, not for metric-based alarms.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Metric Math with composite alarms, thinking that arithmetic operations can simulate logical AND, but Metric Math cannot evaluate alarm states or combine them with logical operators—it only produces a new numeric metric series.
Detailed technical explanation
How to think about this question
Composite alarms work by referencing up to 100 underlying metric alarms (each with their own threshold and period) and evaluating their states using a composite alarm expression, such as ALARM(CPU_High) AND ALARM(Memory_High). The composite alarm's evaluation period is independent of the underlying alarms; it checks the state of each referenced alarm at the time of evaluation. A real-world scenario is when you need to trigger an auto scaling action only when both CPU and memory are high, avoiding false positives from a single metric spike.
KKey Concepts to Remember
Composite alarms combine the states of multiple underlying alarms.
They use a rule expression with logical operators (AND, OR, NOT).
Underlying alarms can be standard metric alarms or other composite alarms.
A composite alarm only changes state if its rule expression evaluates to a new state.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Composite alarms combine the states of multiple underlying alarms.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Composite alarms combine the states of multiple underlying alarms. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Got this wrong? Here's your next step.
Review composite alarms combine the states of multiple underlying alarms., then practise related SOA-C02 questions on the same topic to reinforce the concept.
Monitoring, Logging, and Remediation — This question tests Monitoring, Logging, and Remediation — Composite alarms combine the states of multiple underlying alarms..
What is the correct answer to this question?
The correct answer is: Composite alarm — A composite alarm in Amazon CloudWatch allows you to create an alarm that evaluates multiple conditions using logical operators (AND, OR, NOT). In this scenario, the administrator needs the alarm to trigger only when both CPU utilization > 90% AND memory utilization > 85% are true simultaneously for 5 minutes. Composite alarms evaluate the state of underlying metric alarms (e.g., two separate simple alarms for CPU and memory) and combine them with an AND condition, making it the correct feature for this requirement.
What should I do if I get this SOA-C02 question wrong?
Review composite alarms combine the states of multiple underlying alarms., then practise related SOA-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Composite alarms combine the states of multiple underlying alarms.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.