SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator wants to receive an email when the average CPU utilization of an EC2 instance exceeds 90% for 5 minutes. What should the administrator create?
⚠ Common exam trap
Many exam-takers confuse CloudWatch Logs metric filters (which require log data) with CloudWatch metrics (which are numeric time-series data), or think AWS Config can monitor performance metrics instead of configuration compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A CloudWatch alarm on the CPUUtilization metric with an SNS notification.
A CloudWatch alarm on the CPUUtilization metric can be configured to evaluate the average CPU usage over a 5-minute period and trigger an action when it exceeds 90%. The alarm can send a notification via Amazon SNS, which can deliver an email to subscribed endpoints. This directly meets the requirement for email notification based on a sustained metric threshold.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A CloudWatch Logs metric filter on the instance logs.
Why it's wrong here
A CloudWatch Logs metric filter is designed to parse and extract metrics from textual log data, such as application logs or system logs sent by the CloudWatch Logs agent. It cannot capture the CPUUtilization metric, which is emitted natively by the EC2 hypervisor as a numeric data point, nor does it evaluate threshold breaches on that metric. Even with the unified CloudWatch agent, a metric filter would only apply to custom metrics derived from log entries, not the built-in CPU metric.
- ✗
An AWS Config rule to detect high CPU usage.
Why it's wrong here
AWS Config rules are purpose-built for evaluating resource configurations against compliance standards, such as checking whether an EC2 instance has the required instance type, tagging scheme, or encrypted volumes. They do not have visibility into real-time operational metrics like CPUUtilization, and they operate as periodic evaluations of configuration snapshots, not as continuous metric threshold detectors. Thus, an AWS Config rule could not detect or alert on high CPU usage.
- ✗
A CloudWatch Events rule on the EC2 instance state change.
Why it's wrong here
A CloudWatch Events rule (now part of Amazon EventBridge) responds to event patterns from AWS service changes, and for EC2 this includes instance lifecycle state changes such as pending, running, stopping, or terminated. CPU utilization is a metric, not a state-change event, and it never appears as an event in CloudWatch Events. Therefore, this rule type is completely unrelated to triggering a periodic high-CPU alert.
- ✓
A CloudWatch alarm on the CPUUtilization metric with an SNS notification.
Why this is correct
A CloudWatch alarm on the CPUUtilization metric with an SNS notification is the standard, correct mechanism. The alarm continuously evaluates the CPUUtilization metric (as a percentage) against a threshold over a specified number of consecutive periods, and when the alarm state is reached, it publishes a message to the configured SNS topic. An email subscription on that SNS topic then delivers the notification directly to the administrator, providing a simple and reliable real-time alert.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.