SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator needs to monitor application logs stored in Amazon CloudWatch Logs for the term 'CRITICAL'. When more than 5 'CRITICAL' entries appear in a 5-minute window, the administrator wants to automatically restart the underlying Amazon EC2 instance. Which solution should the administrator implement?
⚠ Common exam trap
The trap here is that candidates may overcomplicate the solution by choosing Lambda or Systems Manager, not realizing that CloudWatch alarms have a built-in EC2 action for reboot, stop, terminate, or recover, which is the simplest and most cost-effective method for this use case.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an EC2 Reboot Instances action.
CloudWatch Logs metric filters can count occurrences of the term 'CRITICAL' in log data, and a CloudWatch alarm can be configured to trigger an EC2 Reboot Instances action directly when the metric exceeds a threshold of 5 in a 5-minute period. This provides a native, simple, and fully managed solution without requiring additional services like Lambda or Systems Manager.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an AWS Systems Manager Automation document to restart the instance.
Why it's wrong here
This option is tempting as CloudWatch Logs metric filters and alarms, combined with AWS Systems Manager Automation, are standard for automated remediation. However, it fails to identify the specific EC2 instance generating the problematic logs. A CloudWatch alarm triggered by a log metric filter does not inherently pass the `InstanceId` of the source instance to the Automation document. This makes it unsuitable for dynamically restarting *the underlying* EC2 instance unless the log group is dedicated to a single instance or a pre-defined instance is always targeted.
- ✓
Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an EC2 Reboot Instances action.
Why this is correct
A CloudWatch Logs metric filter parses each log event and publishes a custom metric whenever a 'CRITICAL' pattern is matched. A CloudWatch alarm then evaluates that metric over a specified period and, when it enters the ALARM state, can directly trigger the built-in 'Reboot Instances' EC2 action. This is the most direct and reliable solution because it uses a native CloudWatch alarm action to restart the instance, requiring no custom code, Lambda functions, or extra orchestration layers.
- ✗
Create a CloudWatch Logs metric filter, then use Amazon CloudWatch Events (Amazon EventBridge) to trigger an AWS Lambda function that restarts the instance.
Why it's wrong here
Creating a CloudWatch Logs metric filter is the correct initial step to extract the 'CRITICAL' log entries into a metric. However, Amazon EventBridge is not designed to evaluate metric thresholds over a time window. EventBridge primarily reacts to specific events, such as API calls or state changes, rather than continuously monitoring a metric's value against a defined threshold. This solution would be appropriate for triggering a Lambda function based on an event, like an EC2 instance state change, or if a CloudWatch Alarm's state change was the direct trigger.
- ✗
Use Amazon CloudWatch Synthetics canary to monitor the logs and automatically stop the instance.
Why it's wrong here
Amazon CloudWatch Synthetics is designed to run scripted canaries that exercise HTTP endpoints, such as checking URL availability or performing UI tests, from a managed schedule. It has no ability to parse existing application log files or scan CloudWatch Logs groups for specific text patterns. Even if it could inspect logs, a canary's permissible actions are limited to script assertions and publishing its own metrics; it cannot call EC2 StopInstances or any other EC2 control-plane API to stop or modify an instance, so this option is both functionally and technically incorrect.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SysOps administrator needs to monitor application logs in Amazon CloudWatch Logs for the occurrence of the string 'ERROR'. The administrator wants to create a custom metric that counts the number of 'ERROR' occurrences per 5-minute window and trigger an Amazon CloudWatch alarm when the count exceeds 10. Which action should the administrator take to create the custom metric?
easy- A.Create a CloudWatch Events rule that triggers on 'ERROR' and publishes a metric.
- ✓ B.Create a metric filter on the CloudWatch Logs log group that matches the term 'ERROR'.
- C.Create a CloudWatch dashboard that displays the log group and set an alarm on the dashboard.
- D.Enable AWS CloudTrail on the log group and select the 'ERROR' pattern.
Why B: Metric filters in CloudWatch Logs allow you to define a pattern (e.g., 'ERROR') that is evaluated against incoming log events. The filter counts occurrences and publishes a custom metric to CloudWatch, which can then be used to set an alarm with a period of 5 minutes and a threshold of 10.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.