Question 533 of 247
SOA-C02 Monitoring, Logging, and Remediation Practice Question
A web application publishes a custom metric 'FailedLoginAttempts' to Amazon CloudWatch. The SysOps administrator needs to be notified via Amazon SNS when the number of failed login attempts exceeds 100 within a 5-minute period. Which AWS service or feature should be used to create this notification?
⚠ Common exam trap
Many candidates confuse CloudWatch Logs metric filters (which extract metrics from logs) with CloudWatch alarms (which evaluate metrics and trigger actions), leading them to choose Option A even though the custom metric is already published to CloudWatch and does not require log extraction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch alarm
An Amazon CloudWatch alarm is the correct service because it monitors a specific CloudWatch metric (such as 'FailedLoginAttempts') and triggers an action (such as sending an SNS notification) when the metric crosses a defined threshold over a specified period. In this case, the alarm evaluates whether the sum of 'FailedLoginAttempts' exceeds 100 within a 5-minute period, and upon breaching, it publishes to the SNS topic to notify the SysOps administrator.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs metric filter
Why it's wrong here
A CloudWatch Logs metric filter is designed to parse log events and extract metric values from them, but in this scenario the failedloginattempts data is already published as a CloudWatch metric, not written to log files. Even if a metric filter created a new metric, it would still require a separate CloudWatch alarm to send an SNS notification, so it is not the direct alerting solution.
- ✓
Amazon CloudWatch alarm
Why this is correct
A CloudWatch alarm continuously evaluates a single metric against a defined threshold over a specified number of evaluation periods. When the metric crosses the threshold (for example, failedloginattempts exceeding a certain count within 5 minutes), the alarm state changes to ALARM and triggers an action such as publishing to an Amazon SNS topic, which can then send email or SMS notifications. This is the only option that directly monitors the existing custom metric and initiates a notification with built-in alerting logic.
- ✗
Amazon CloudWatch dashboard
Why it's wrong here
A CloudWatch dashboard provides a graphical view of one or more metrics on a single page, allowing you to monitor operational health at a glance, but it has no stateful evaluation or threshold logic. While dashboards can be displayed on large screens and shared, they cannot invoke actions like sending an SNS message when a metric spikes; they are purely for visual monitoring and do not generate alerts.
- ✗
AWS Config rule
Why it's wrong here
An AWS Config rule is a function that evaluates the configuration settings of your AWS resources, such as whether an S3 bucket has encryption enabled or whether an EC2 instance has the correct tags. It does not ingest or analyze CloudWatch custom metrics in real time, and its evaluation is based on resource configurations rather than time-series application data. Therefore, it cannot detect a spike in failed login attempts and is not suitable for triggering an SNS notification based on metric thresholds.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.