Monitoring, Logging, and Remediation

A SysOps administrator manages a fleet of Amazon EC2 Linux instances running a custom application that writes logs to /var/log/app/transactions.log. The security team requires that these application log files be centrally collected in CloudWatch Logs so they can be searched and retained for 90 days. The instances already have an IAM instance profile attached. What is the MOST operationally efficient way to meet this requirement?

A company runs workloads across 12 member AWS accounts in AWS Organizations. The central operations team needs to view CloudWatch metrics, logs, and traces from all member accounts in a single monitoring account without copying data or building custom aggregation scripts. What is the MOST operationally efficient way to achieve this?

A SysOps administrator publishes a high-resolution custom metric to CloudWatch with a storage resolution of 1 second to monitor a latency-sensitive trading application. After two weeks, a colleague reports that when querying the metric over a 90-day period, the 1-second data points are no longer available and only coarser aggregations appear. What is the reason for this behavior?

A SysOps administrator needs to create a CloudWatch alarm that triggers when memory utilization on a fleet of Amazon Linux 2 EC2 instances exceeds 80%. When reviewing the available CloudWatch metrics for the instances, the administrator cannot find any memory-related metrics. What is the correct way to make these metrics available in CloudWatch?

A development team runs a custom Java microservice on an EC2 instance. The application emits internal performance counters (such as queue depth and request processing time) using the StatsD protocol over UDP to localhost. The SysOps administrator must collect these application-generated metrics in Amazon CloudWatch so the team can build dashboards and alarms, with the least amount of custom code. What is the MOST appropriate solution?

A SysOps administrator is investigating intermittent slowness on a production application running on a single EC2 instance backed by a General Purpose SSD (gp2) EBS volume. CloudWatch shows the instance's CPUUtilization is consistently below 40%, but users report the application stalls during peak hours. Which combination of EBS CloudWatch metrics should the administrator examine FIRST to confirm whether the volume is the bottleneck?

A SysOps administrator configured a CloudWatch alarm on an RDS instance to publish to an SNS topic when FreeStorageSpace drops below a threshold. During recent testing, the metric clearly breached the threshold and the alarm state changed to ALARM in the console, but no SNS notification was ever delivered. The SNS topic works correctly when tested with a manual publish, and the subscription is confirmed. What is the MOST likely cause?

A SysOps administrator manages an Auto Scaling group behind an Application Load Balancer. Traffic is spiky, and brief one-minute CPU spikes frequently trigger the scale-out alarm, causing the group to add instances that are terminated moments later. The administrator wants scaling to occur only when high CPU is sustained, while still reacting reasonably quickly. Which change to the CloudWatch alarm best achieves this?

A SysOps administrator configures a CloudWatch alarm on the CPUUtilization metric for a production EC2 instance. The alarm is set to trigger when the average CPU exceeds 80% for 1 consecutive period of 1 minute. However, the alarm consistently reports INSUFFICIENT_DATA even during periods of high CPU load. The instance uses default monitoring settings. What is the MOST likely cause and correct resolution?

A SysOps administrator is investigating why a production Auto Scaling group scaled out unexpectedly three days ago. The administrator wants to review the exact sequence of CloudWatch alarm state changes (OK, ALARM, INSUFFICIENT_DATA) that occurred and the timestamps of those transitions. Which action allows the administrator to retrieve this information most directly?

A SysOps administrator configures a CloudWatch alarm on a custom metric named JobQueueDepth that a batch-processing application publishes only when jobs are actively running. During idle periods, the application stops publishing the metric entirely. The team reports that the alarm frequently enters the INSUFFICIENT_DATA state during these idle periods, generating unwanted SNS notifications. The team wants the alarm to be treated as healthy (not in ALARM) when no data is being reported. Which action should the administrator take to resolve this?

A company runs a customer-facing API backed by an AWS Lambda function that uses provisioned concurrency to avoid cold starts. During unpredictable traffic spikes, users experience latency because requests exceed the configured provisioned concurrency and spill over to on-demand invocations. A SysOps administrator must automatically increase provisioned concurrency when utilization is high, without over-provisioning during quiet periods. Which approach meets these requirements with the LEAST custom code?

A SysOps administrator configures a CloudWatch alarm on the CPUUtilization metric of a production EC2 instance with a threshold of 80%. The metric is emitted every minute, but the workload is naturally spiky — CPU frequently jumps above 80% for a single minute and then drops back down. These brief spikes are triggering frequent alarm state changes and paging the on-call team unnecessarily. The team wants the alarm to trigger ONLY when the instance is genuinely under sustained load, while still reacting reasonably quickly. Which configuration change should the administrator make?

A SysOps administrator configures a CloudWatch alarm on the RequestCount metric of an Application Load Balancer to detect when a downstream application stops receiving traffic (a value of 0). During periods of very low activity, the ALB publishes no data points for RequestCount at all, and the administrator notices the alarm sits in INSUFFICIENT_DATA instead of alerting on the traffic drop. The alarm must reliably enter the ALARM state and notify an SNS topic when request traffic falls to zero. Which configuration change should the administrator make?

A SysOps administrator monitors a customer-facing API served by an Application Load Balancer. Overall average latency looks healthy, but customers report intermittent slow responses. The administrator needs an alarm that fires when the slowest 1% of requests exceed 2 seconds over a 5-minute period, so that only the worst-affected requests trigger a notification. How should the administrator configure the CloudWatch alarm on the ALB TargetResponseTime metric?

A SysOps administrator manages a fleet of EC2 instances running a custom application. Occasionally the application process hangs while the instance itself remains healthy (both EC2 status checks pass). The team publishes a custom CloudWatch metric named ApplicationHeartbeat every 60 seconds; a healthy process reports a value of 1, and no data point is published when the process hangs. The administrator needs an automated solution that restarts the application service on the affected instance without human intervention. Which approach meets this requirement?

A SysOps administrator manages an e-commerce application whose request rate follows a strong daily and weekly pattern, peaking during lunchtime and dropping overnight. A static CloudWatch alarm on the RequestCount metric currently generates many false alarms overnight (threshold too high) and misses real problems during peaks (threshold too low). The administrator needs an approach that automatically adjusts expected values based on time-of-day and day-of-week patterns while still alerting on genuine deviations. What should the administrator do?

A SysOps administrator manages a three-tier web application. The team receives dozens of SNS notifications during minor, transient spikes because separate CloudWatch alarms exist for high CPU on the web tier, high latency on the load balancer, and elevated database connections. Leadership wants to be paged only when the application is genuinely degraded — specifically, when the load balancer latency alarm AND either the web tier CPU alarm OR the database connections alarm are all in the ALARM state at the same time. Which approach best meets this requirement while minimizing notification noise?

A SysOps administrator manages a workload deployed across three AWS Regions (us-east-1, eu-west-1, and ap-southeast-2). Leadership wants a single CloudWatch dashboard that displays EC2 CPU utilization and Application Load Balancer request counts from all three Regions on the same set of widgets, so operators can monitor global health from one screen. What is the MOST operationally efficient way to achieve this?

A development team runs a high-volume order-processing function on AWS Lambda. They want to publish custom business metrics (such as orders processed and payment failures) to CloudWatch without adding synchronous PutMetricData API calls that increase function duration and cost. The metrics must also remain queryable alongside the detailed structured log context that produced them. What is the MOST efficient way to meet these requirements?