SOA-C02 Monitoring, Logging, and Remediation Practice Question
Network Topology
Refer to the exhibit. A SysOps administrator runs the command shown to investigate a CloudWatch alarm named 'HighCPU'. What does the output indicate?
⚠ Common exam trap
The trap here is that candidates may misinterpret the two datapoints as separate unrelated events rather than recognizing them as a complete ALARM-to-OK cycle, leading them to incorrectly choose that the alarm never entered ALARM state or that it was recreated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The alarm entered the ALARM state and then returned to OK.
The output shows two state transition datapoints: one at timestamp 2021-03-15T10:30:00Z with 'oldState' OK and 'newState' ALARM, and another at 2021-03-15T10:35:00Z with 'oldState' ALARM and 'newState' OK. This sequence confirms the alarm entered the ALARM state and then returned to OK, which is exactly what the describe-alarm-history command reveals when an alarm has experienced a full ALARM-to-OK cycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The alarm entered the ALARM state and then returned to OK.
Why this is correct
CloudWatch alarm history records each state transition with a timestamp. In the exhibit, the alarm changed from OK to ALARM at 10:25 and then changed back to OK afterward, which is exactly what the history shows. Therefore, the correct interpretation is that the alarm entered the ALARM state and subsequently returned to OK.
- ✗
The alarm was deleted and recreated.
Why it's wrong here
If the alarm had been deleted, the CloudWatch Alarms console would no longer show it, and the alarm history would typically be absent or show a deletion event. The exhibit still displays the same alarm with continuous history entries, including a transition to ALARM and back to OK, with no evidence of a recreated alarm ID or a gap in the timeline. Thus, deletion and recreation did not occur.
- ✗
The alarm is currently in INSUFFICIENT_DATA state.
Why it's wrong here
The most recent state listed in the alarm history is OK, not INSUFFICIENT_DATA. INSUFFICIENT_DATA occurs when the alarm has insufficient metric data to evaluate, such as during the first evaluation period or when data is missing. Since the final recorded state is OK and the history shows the alarm resolved itself, the alarm is not currently in INSUFFICIENT_DATA.
- ✗
The alarm never entered the ALARM state.
Why it's wrong here
The alarm history explicitly shows a state transition to ALARM at 10:25. This entry in the history is definitive proof that the alarm did enter the ALARM state at that time. The subsequent transition back to OK does not negate that earlier ALARM state, so the claim that it never entered ALARM is contradicted by the displayed history.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.