SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator needs to monitor a custom application metric 'OrdersPerMinute' published to Amazon CloudWatch. The metric should trigger an alarm when the count exceeds 100 for more than 2 consecutive data points, but only during business hours (9 AM to 5 PM weekdays). The alarm must evaluate the metric as a rate per minute. How should the administrator configure the alarm?
⚠ Common exam trap
A common mix-up: candidates assume CloudWatch has a built-in time-based filtering function (like IN_BUSINESS_HOURS) or that math expressions can evaluate time, when in reality AWS requires external scheduling via Lambda or EventBridge to manage alarm activation windows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and disable the alarm outside business hours using a Lambda function triggered by CloudWatch Events.
To trigger when 'OrdersPerMinute' exceeds 100 for more than 2 consecutive data points, the alarm must require 3 consecutive breaching data points. This is achieved by setting evaluation periods to 3 and datapoints to alarm to 3. The Lambda/EventBridge approach to disable the alarm outside business hours is correct, but option B's evaluation period settings are incorrect. As written, no option fully satisfies the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a math expression to filter time range.
Why it's wrong here
CloudWatch metric math cannot act as a time-based filter because it operates on the full time series of the underlying metric and has no built-in function for wall-clock time or business hours. The alarm would still evaluate during non-business hours, making the metric-math expression ineffective for this requirement. While the period, evaluation periods, and datapoints to alarm are correct for detecting two consecutive breaching minutes, the time-filtering component is not supported by CloudWatch.
- ✓
Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and disable the alarm outside business hours using a Lambda function triggered by CloudWatch Events.
Why this is correct
This solution uses a scheduled Lambda function (via CloudWatch Events) to enable/disable the alarm. The alarm itself is configured with the correct evaluation criteria (2 out of 2 datapoints above 100). This meets the requirement while using automated remediation.
- ✗
Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a metric math expression 'IF(IN_BUSINESS_HOURS(), OrdersPerMinute, 0)' but CloudWatch does not have IN_BUSINESS_HOURS function.
Why it's wrong here
CloudWatch metric math does not include an IN_BUSINESS_HOURS() function, so this expression would be syntactically invalid and the alarm would fail to be created or would never evaluate properly. Even if the function existed, using 0 outside business hours would alter the metric data and could cause the alarm to misbehave or generate false transitions when the expression output changes. Scheduled Lambda-driven alarm actions are a practical alternative because they disable notifications outside the business window without modifying the metric.
- ✗
Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 1, datapoints to alarm of 2 (impossible).
Why it's wrong here
This alarm configuration is impossible because datapoints to alarm cannot be greater than the number of evaluation periods. With evaluation periods set to 1, the alarm can only consider a single most recent data point, so it cannot require two datapoints to be breaching. To trigger after two consecutive minutes of the metric exceeding 100, the alarm must have evaluation periods set to 2 and datapoints to alarm set to 2, with a period of 1 minute.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.