SOA-C02 Practice Question: CloudWatch composite alarms to reduce alert…
An environment has 12 individual CloudWatch metric alarms covering CPU, memory, disk, and network. When one instance degrades, all 12 alarms fire simultaneously and send 12 separate notifications to the on-call engineer. The team wants a single notification per incident regardless of how many individual alarms trigger. What CloudWatch feature addresses this?
⚠ Common exam trap
Watch out — candidates often think SNS batching or EventBridge deduplication can consolidate separate alarm notifications, but those services do not aggregate distinct alarm state changes into a single event; only composite alarms provide that logical grouping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a composite alarm that enters ALARM state when any of the 12 child alarms is in ALARM state, and configure a single SNS action on the composite alarm only
A composite alarm in CloudWatch can aggregate multiple child alarms into a single parent alarm. When any of the 12 child alarms enters the ALARM state, the composite alarm transitions to ALARM and triggers a single SNS notification, thereby reducing alert noise to one notification per incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a composite alarm that enters ALARM state when any of the 12 child alarms is in ALARM state, and configure a single SNS action on the composite alarm only
Why this is correct
The composite alarm's rule expression 'ALARM(alarm1) OR ALARM(alarm2) OR ...' triggers when any child fires. By routing all notifications through the composite alarm's action and removing actions from the child alarms, exactly one notification is sent per incident. Child alarm states remain visible in the console for root cause analysis.
- ✗
Increase the alarm evaluation period on all 12 alarms to 30 minutes so they fire less frequently
Why it's wrong here
Increasing the evaluation period delays detection and may cause alarms to aggregate naturally by waiting, but it does not reduce simultaneous notifications for a correlated event. If all metrics degrade together (as they do when an instance fails), all 12 alarms still fire after the longer period.
- ✗
Use an SNS topic with a delivery policy that batches notifications sent within a 60-second window
Why it's wrong here
SNS does not have a built-in batching policy that combines multiple messages into one delivery. Each alarm state change publishes a separate SNS message. Batching would require a custom Lambda subscriber that de-duplicates messages, adding custom code.
- ✗
Configure all 12 alarms to write to the same CloudWatch Events rule and suppress duplicate events with EventBridge deduplication
Why it's wrong here
EventBridge rules do not perform any deduplication or content-based filtering of duplicate alarm events. Each CloudWatch alarm state change publishes a distinct event to the default event bus, and an EventBridge rule matching those events will invoke its target once per event. Without a custom Lambda or Step Function workflow that tracks previously processed alarm ARNs and timestamps (e.g., using DynamoDB, ElastiCache, or an SQS FIFO queue with message deduplication), all 12 alarm events will still trigger downstream notifications. EventBridge's dead-letter queue or input transformers do not suppress duplicates, so this approach simply shifts the notification load to another AWS service without reducing the number of messages.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.