SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator wants to be alerted when an EC2 instance is terminated unexpectedly. Which CloudWatch event should be used to trigger a notification?
⚠ Common exam trap
Watch out — candidates often confuse CloudWatch alarms on metrics (like CPUUtilization or StatusCheckFailed) with event-driven notifications, overlooking that EventBridge rules directly capture state-change events for immediate, precise alerting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Amazon EventBridge rule that matches EC2 Instance State-change Notification events.
Amazon EventBridge can capture EC2 Instance State-change Notification events, which are emitted whenever an EC2 instance transitions between states (e.g., running, stopped, terminated). By creating a rule that matches the 'terminated' state, the administrator can trigger an SNS notification or Lambda function to alert on unexpected termination, providing a real-time, event-driven response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A CloudWatch alarm on the CPUUtilization metric dropping to zero.
Why it's wrong here
A CPUUtilization alarm with a threshold of zero is triggered whenever the instance is idle or when CloudWatch stops receiving metrics, which can occur during normal operation or after the instance is stopped but not terminated. Because a terminated instance no longer emits metrics, the alarm may enter INSUFFICIENT_DATA rather than ALARM, so this metric cannot reliably identify a termination event in real time.
- ✗
A CloudTrail trail that logs TerminateInstances API calls.
Why it's wrong here
A CloudTrail trail records TerminateInstances API calls for auditing and compliance, but the trail itself delivers log files to S3 and does not actively alert on events. To send a notification, you would need an additional EventBridge rule watching AWS API call events for TerminateInstances, which means CloudTrail is merely the data source, not the alerting mechanism. Moreover, some terminations such as Spot reclamation are not initiated by TerminateInstances, so a trail is an incomplete detection method.
- ✗
A CloudWatch alarm on the StatusCheckFailed metric.
Why it's wrong here
The StatusCheckFailed metric aggregates system and instance status checks that detect hardware, network, or software issues, yet an instance failing a status check remains running and does not indicate that a termination has occurred. Terminated instances change lifecycle state to terminated, and the status check metric stops updating only after the instance is gone, making it useless for proactively catching the termination itself.
- ✓
An Amazon EventBridge rule that matches EC2 Instance State-change Notification events.
Why this is correct
An EventBridge rule can match the EC2 Instance State-change Notification event, which is emitted synchronously as an instance transitions among states such as pending, running, stopping, stopped, and terminated. By configuring an event pattern for detail.state = "terminated" and targeting an SNS topic or Lambda function, you receive a near-real-time notification that is the native, purpose-built mechanism for alerting on lifecycle changes.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.