SOA-C02 Monitoring, Logging, and Remediation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure an Auto Scaling group lifecycle hook to terminate instances after 24 hours.

  Why it's wrong here

  Auto Scaling lifecycle hooks only intercept instances during scale-in or scale-out transitions to perform custom actions, such as draining connections or running scripts, before the instance is terminated or launched. They do not provide a time-based scheduling mechanism to terminate instances after a set age; instead, they pause the lifecycle transition until a timeout or manual action occurs. Therefore, a lifecycle hook cannot enforce a 24-hour maximum instance age.

• ✗

  Create a CloudWatch alarm on the InstanceAge metric and set it to trigger the Lambda function.

  Why it's wrong here

  Amazon EC2 does not expose an 'InstanceAge' metric in CloudWatch, so you cannot create a native CloudWatch alarm on that metric to trigger a Lambda function. While you could publish a custom metric that tracks instance age, doing so would require your own code and a separate scheduling mechanism, defeating the simplicity of the intended solution. Moreover, CloudWatch alarms are designed to react to threshold breaches of monitored metrics, not to compute age from launch times directly.

• ✓

  Tag each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp).

  Why this is correct

  Tagging each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp) gives the Lambda function the necessary metadata to calculate the instance's age during each invocation. This tag can be read via the DescribeInstances API call, allowing the function to compare the stored timestamp with the current time and identify any instance older than 24 hours. It also makes the process stateless and independent of EC2's built-in attribute details, ensuring the solution works across instances in any state.

• ✓

  Create an Amazon EventBridge rule that triggers the Lambda function on a schedule (e.g., every hour).

  Why this is correct

  An Amazon EventBridge rule configured on a schedule, such as every hour or every 5 minutes, provides the event source that invokes the Lambda function regularly, ensuring age-based cleanup is performed even for instances launched between invocations. This scheduled trigger is a reliable, serverless way to drive periodic reconciliation without needing an external cron server or a continuously running process. The same rule can be scoped to run 24/7, guaranteeing that instances are terminated within the defined interval after they exceed the threshold.

• ✓

  Create an AWS Lambda function that uses the EC2 API to terminate instances older than 24 hours.

  Why this is correct

  Creating an AWS Lambda function that uses the EC2 API to terminate instances older than 24 hours is the core execution component that performs the actual termination. The function can call DescribeInstances to list instances, filter them based on the LaunchTime tag or the instance's launch time attribute, and then call TerminateInstances for those exceeding the age threshold. This approach provides full control over the cleanup logic, including handling of edge cases and adding logging or notifications, and it aligns with a serverless architecture.

Go deeper

Related to this question