Monitoring, Logging, Analysis, Remediation, and Performance Optimization — SOA-C03 Practice Quiz

Question 1

A CloudOps engineer must ensure that any S3 bucket created without default encryption is automatically remediated within minutes, with no human intervention. AWS Config already has a managed rule (s3-bucket-server-side-encryption-enabled) evaluating bucket compliance. The team wants a low-maintenance, event-driven solution that applies default encryption to noncompliant buckets. Which approach best meets these requirements?

Accepted Answer

Configure the AWS Config rule with an automatic remediation action that invokes the AWS-EnableS3BucketEncryption Systems Manager Automation document.

Answer

Create a CloudWatch alarm on the AWS Config compliance metric that triggers an SNS notification to the security team for manual remediation.

Answer

Enable S3 Event Notifications for bucket creation events and forward them to an SQS queue polled by an EC2 instance running a remediation script.

Answer

Schedule a Lambda function every 5 minutes using EventBridge to scan all buckets and enable encryption on those missing it.

Question 2

A CloudOps engineer manages a fleet of 200 EC2 instances running a Java application. The team wants to centralize application logs in CloudWatch Logs and set an alarm when the number of ERROR entries exceeds a threshold across the fleet. The engineer must minimize custom code and ongoing maintenance. Which approach meets these requirements?

Accepted Answer

Install the CloudWatch agent to stream the application log file to a log group, create a metric filter that matches the ERROR pattern, and set a CloudWatch alarm on the resulting metric.

Answer

Write a cron job on each instance that greps for ERROR and calls PutMetricData with a custom metric, then alarm on the metric.

Answer

Create a Lambda function triggered every minute that connects to each instance via SSM Run Command to read the log file and count ERROR lines.

Answer

Enable EC2 detailed monitoring and create a CloudWatch alarm on the ApplicationErrors metric emitted automatically for each instance.

Question 3

A CloudOps engineer needs to build a CloudWatch dashboard showing memory utilization and disk space usage for a fleet of EC2 Linux instances. After creating the dashboard, they discover that only CPU, network, and disk I/O metrics are available in the CloudWatch console, but no memory or disk-space-used metrics appear. What is the correct way to make these metrics available?

Accepted Answer

Install and configure the CloudWatch agent on the instances to collect memory and disk metrics and publish them as custom metrics

Answer

Enable detailed monitoring on the EC2 instances to reduce the metric interval to 1 minute

Answer

Attach an IAM role with CloudWatchReadOnlyAccess so the console can display the hypervisor-level memory metrics

Answer

Create a CloudWatch metric filter on the instances' system logs to extract memory and disk usage values

Question 4

A CloudOps engineer manages a fleet of EC2 instances running a Java application that emits application-level performance counters (queue depth, active session count) using the StatsD protocol. The team wants these counters visible as CloudWatch custom metrics without modifying application code to call the PutMetricData API directly, and with the least operational overhead. What should the engineer do?

Accepted Answer

Configure the CloudWatch agent with the StatsD plugin enabled so it listens on the local UDP port and forwards the received metrics to CloudWatch.

Answer

Deploy a Lambda function on a schedule that SSH-connects to each instance, reads the StatsD socket, and calls PutMetricData.

Answer

Enable EC2 detailed monitoring so the StatsD counters are automatically collected as one-minute custom metrics.

Answer

Install the AWS Distro for OpenTelemetry Collector and enable the X-Ray exporter to publish the StatsD counters as metrics.

Question 5

A CloudOps engineer manages a fleet of EC2 instances running a custom Java application that writes JSON-formatted application logs to /var/log/app/events.log. The team wants these logs centralized in CloudWatch Logs and needs to create a metric filter that counts log events where the JSON field "level" equals "ERROR". Currently no logs are being collected from the instances. What is the correct sequence of actions to achieve this?

Accepted Answer

Install and configure the CloudWatch agent to stream /var/log/app/events.log to a log group, then create a metric filter using a JSON filter pattern like { $.level = "ERROR" } and set an alarm on the resulting metric.

Answer

Enable EC2 detailed monitoring, which automatically ingests application log files, then create a subscription filter to count ERROR events.

Answer

Configure a CloudWatch dashboard to read the log file directly from the instance, then add a text-based filter widget matching "ERROR".

Answer

Install the CloudWatch agent to collect the logs, then use CloudWatch Logs Insights on a schedule to create a metric because metric filters cannot parse JSON fields.

Question 6

A CloudOps engineer manages a fleet of EC2 instances behind an Application Load Balancer. The team wants an automated response when average CPU utilization across the Auto Scaling group exceeds 70% for 5 minutes: the group should add capacity, and the on-call team should be notified via email. The engineer creates a CloudWatch alarm on the ASGAverageCPUUtilization metric. Which combination of alarm actions should be configured to meet BOTH requirements with the least custom code?

Accepted Answer

Add an Auto Scaling policy action and an SNS topic notification action to the same CloudWatch alarm, with the on-call team subscribed to the SNS topic.

Answer

Configure the alarm to invoke a Lambda function that both calls the Auto Scaling API to add instances and sends an email via Amazon SES.

Answer

Create two separate alarms on the same metric: one with an Auto Scaling action and one with an SNS action, each with different thresholds.

Answer

Attach only an SNS action to the alarm and configure an EventBridge rule on the SNS delivery event to trigger the scaling policy.

Question 7

A CloudOps engineer manages a fleet of EC2 instances running a legacy monolithic application that stores state on the instance's local root volume. Occasionally, an underlying host experiences a hardware failure, causing the instance to become unreachable. The team wants an automated way to recover the affected instance while preserving its instance ID, private IP address, Elastic IP, and attached EBS volumes, without launching a replacement instance. What should the engineer configure?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed_System metric with an EC2 action to recover the instance.

Answer

Create an Auto Scaling group with a minimum and maximum capacity of one so that a failed instance is replaced automatically.

Answer

Create a CloudWatch alarm on the StatusCheckFailed_Instance metric with an EC2 action to reboot the instance.

Answer

Create an EventBridge rule matching EC2 instance state-change events that triggers a Lambda function to launch a new instance from an AMI.

Question 8

A CloudOps engineer manages a three-tier web application. During deployments, individual CloudWatch alarms for high CPU, elevated latency, and increased 5XX errors all fire simultaneously, generating a flood of duplicate notifications to the on-call team. The engineer wants to notify the team only when multiple related conditions indicate a genuine service degradation, while reducing alarm noise. What is the MOST appropriate solution?

Accepted Answer

Create a composite alarm that combines the existing metric alarms using an alarm rule (e.g., AND/OR logic) and send notifications only from the composite alarm

Answer

Increase the evaluation periods and datapoints-to-alarm on each individual metric alarm so they trigger less frequently

Answer

Configure a single metric math alarm that averages CPU, latency, and 5XX error rates into one aggregated metric

Answer

Add all three alarms to a CloudWatch dashboard and disable their SNS notification actions during deployment windows

Question 9

A CloudOps engineer manages a fleet of application servers behind an Application Load Balancer. The team wants a single CloudWatch alarm that triggers when the HTTP 5XX error rate exceeds 5% of total requests, rather than alarming on a raw count of errors. Both HTTPCode_Target_5XX_Count and RequestCount metrics are available. What is the most appropriate way to create this alarm?

Accepted Answer

Create a metric math expression that divides HTTPCode_Target_5XX_Count by RequestCount, multiply by 100, and set the alarm threshold on the resulting expression at 5

Answer

Create a static alarm on HTTPCode_Target_5XX_Count with a threshold of 5 for one evaluation period

Answer

Enable CloudWatch anomaly detection on HTTPCode_Target_5XX_Count and alarm when the value is outside the expected band

Answer

Create a composite alarm combining separate alarms on HTTPCode_Target_5XX_Count and RequestCount

Question 10

A CloudOps engineer configures a CloudWatch alarm on a custom metric that a batch application publishes only when it processes jobs. Between job runs, the application publishes no data points at all. The team notices the alarm frequently enters the INSUFFICIENT_DATA state during idle periods, generating confusing notifications. They want the alarm to remain in the OK state during idle periods and only trigger when actual reported values breach the threshold. What is the most appropriate configuration change?

Accepted Answer

Set the alarm's 'Treat missing data as' setting to 'notBreaching' (treat as good).

Answer

Set the alarm's 'Treat missing data as' setting to 'breaching' (treat as bad).

Answer

Increase the alarm evaluation period to 24 hours to span multiple job runs.

Answer

Enable anomaly detection on the metric so idle periods are learned as normal behavior.

Question 11

A CloudOps engineer manages an e-commerce application whose request rate follows a strong daily and weekly pattern, with predictable spikes during business hours and much lower traffic overnight and on weekends. The team currently uses a static CloudWatch alarm on the RequestCount metric with a fixed threshold, but it generates false alarms during normal daily peaks and fails to catch abnormal drops during off-hours. The engineer needs an approach that adapts the alarm threshold to the metric's expected behavior throughout the day and week with minimal ongoing maintenance. Which solution meets these requirements?

Accepted Answer

Enable CloudWatch anomaly detection on the RequestCount metric and create an alarm based on the anomaly detection band.

Answer

Create multiple static alarms, one for each hour of the day, and use EventBridge scheduled rules to enable or disable them.

Answer

Configure a metric math expression that averages RequestCount over 24 hours and alarm when the current value exceeds that average.

Answer

Increase the static threshold to accommodate peak traffic and set the alarm to trigger only after 15 consecutive breaching datapoints.

Question 12

A CloudOps engineer manages a multi-account AWS Organization with separate accounts for production, staging, and development workloads. Leadership wants a single CloudWatch dashboard in a central monitoring account that displays EC2 and RDS metrics from all three workload accounts in one view. The solution must minimize ongoing operational overhead and avoid custom scripts that copy metric data between accounts. What should the engineer do?

Accepted Answer

Enable CloudWatch cross-account observability by linking the source accounts to the central monitoring account as the monitoring account, then build the dashboard referencing metrics from each linked source account.

Answer

Create a Lambda function in each workload account that uses GetMetricData and PutMetricData to periodically push metrics into the central monitoring account, then build the dashboard on the copied metrics.

Answer

Configure metric streams in each account to send metrics to a Kinesis Data Firehose that writes to a central S3 bucket, then build the dashboard from the S3 data.

Answer

Grant the central account IAM users cross-account roles and manually switch roles to view each account's separate dashboards side by side.

Question 13

A CloudOps engineer manages an Application Load Balancer fronting a fleet of EC2 instances. Users report that some requests are extremely slow even though the CloudWatch dashboard widget showing the Average of the TargetResponseTime metric appears healthy at around 120 ms. The team wants the dashboard to accurately surface the slow-request experience affecting a subset of users. What should the engineer do to the dashboard widget?

Accepted Answer

Change the widget statistic to the p99 percentile of TargetResponseTime to reveal tail latency affecting the slowest requests.

Answer

Change the widget statistic to Sum of TargetResponseTime so the total time reflects the slow requests.

Answer

Add the RequestCount metric to the same widget so spikes in traffic correlate with the average latency.

Answer

Enable detailed monitoring on the ALB to increase the metric resolution to one minute for the average statistic.

Question 14

A CloudOps engineer supports a serverless order-processing application built on AWS Lambda. The team wants to publish custom business metrics (such as order value and processing duration) from within the Lambda function code without adding synchronous API latency, and they need these metrics to be automatically extracted and queryable in CloudWatch. Which approach best meets these requirements?

Accepted Answer

Write structured logs using the CloudWatch Embedded Metric Format (EMF) to stdout, which CloudWatch automatically parses into metrics from the log data

Answer

Call the CloudWatch PutMetricData API synchronously at the end of each function invocation for every metric

Answer

Install the CloudWatch agent inside the Lambda execution environment to collect and push custom metrics

Answer

Create a CloudWatch metric filter on the Lambda log group and manually define a pattern for each numeric value

Question 15

A CloudOps engineer manages a fleet of Lambda functions that write verbose logs to Amazon CloudWatch Logs. The finance team reports that CloudWatch Logs storage costs have grown significantly over the past year. Investigation shows that most log groups were created with the default retention setting and contain years of data, but the compliance team only requires 90 days of retention for these operational logs. What is the MOST cost-effective action to reduce ongoing storage costs while meeting the compliance requirement?

Accepted Answer

Set a 90-day retention policy on the affected log groups so CloudWatch Logs automatically deletes log events older than 90 days.

Answer

Create an EventBridge scheduled rule that triggers a Lambda function every day to delete individual log streams older than 90 days.

Answer

Export all log groups to Amazon S3 with a lifecycle policy and delete the CloudWatch log groups entirely.

Answer

Enable a metric filter on each log group to count old log events and alarm when data exceeds 90 days.

Question 16

A CloudOps engineer manages a fleet of application servers that stream structured JSON logs to a single Amazon CloudWatch Logs log group. During a recent incident, users reported intermittent slowness. The engineer needs to quickly identify, across all log streams in that log group, which API endpoints had a response time greater than 2000 ms during a specific 30-minute window, and count how many times each occurred. Which approach lets the engineer perform this analysis fastest without provisioning additional infrastructure?

Accepted Answer

Run a CloudWatch Logs Insights query on the log group that filters on the response-time field, groups by endpoint, and counts occurrences within the time range.

Answer

Create a CloudWatch metric filter for slow responses, wait for the metric to populate, then graph it on a dashboard.

Answer

Configure a subscription filter to stream the logs to an Amazon Kinesis Data Firehose delivery stream that writes to Amazon S3, then query with Amazon Athena.

Answer

Export the log group to Amazon S3 using a create-export-task, then load the objects into Amazon OpenSearch Service for ad hoc searching.

Question 17

A CloudOps engineer is optimizing costs for an EC2-based e-commerce fleet. The application runs behind an Application Load Balancer, and CloudWatch shows average CPU utilization consistently between 8% and 15% across all instances during a full week of monitoring, including the daily peak traffic window. The instances are memory-intensive m5.2xlarge types, but the CloudWatch agent reports memory utilization never exceeds 30%. Network throughput and EBS metrics are also well below limits. What is the MOST appropriate action to reduce cost while maintaining performance?

Accepted Answer

Right-size the instances to a smaller instance size within the same or a more cost-effective family based on the observed utilization

Answer

Enable EC2 detailed monitoring to collect one-minute metrics before making any changes

Answer

Add a CloudWatch alarm that triggers Auto Scaling to add instances during peak windows

Answer

Purchase Reserved Instances for the current m5.2xlarge fleet to lock in a discount

Question 18

A CloudOps engineer needs to stream application log events from a CloudWatch Logs log group to an Amazon OpenSearch Service domain in near real time so the team can build searchable dashboards. Only log entries containing the string "ERROR" should be delivered to reduce indexing costs. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch Logs subscription filter with a filter pattern matching "ERROR" that delivers matching events to the OpenSearch Service domain.

Answer

Create a CloudWatch Logs metric filter for "ERROR" and configure an alarm that publishes to an SNS topic subscribed to OpenSearch.

Answer

Schedule a Lambda function every 5 minutes to call FilterLogEvents, filter for "ERROR", and index results into OpenSearch.

Answer

Export the log group to Amazon S3 on a daily basis and use an OpenSearch ingestion pipeline to load and filter the objects.

Question 19

A CloudOps engineer must retain all VPC Flow Logs and application logs for long-term compliance in Amazon S3, then run periodic ad-hoc SQL queries against them for security investigations. The logs currently arrive in a CloudWatch Logs log group. The solution must be cost-effective, require minimal ongoing management, and avoid running continuous compute. Which approach best meets these requirements?

Accepted Answer

Create a CloudWatch Logs subscription filter that streams the log group to Amazon Data Firehose, which delivers records to an S3 bucket, then query the data with Amazon Athena.

Answer

Configure a CloudWatch Logs subscription filter to invoke a Lambda function that writes each log event to Amazon DynamoDB, and query the table with PartiQL.

Answer

Use CloudWatch Logs Insights to query the log group directly and set the log group retention to 10 years for compliance.

Answer

Export the log group to S3 on a recurring schedule using the CreateExportTask API triggered by EventBridge, then query the exported files with an always-on EMR cluster.

Question 20

A CloudOps engineer manages a fleet of application servers that write logs to a CloudWatch Logs log group. The application writes a log line containing the string "PaymentDeclined" whenever a transaction fails. The business wants to be notified via an SNS topic whenever more than 10 payment declines occur within any 5-minute period, and they want to visualize the decline count over time on a dashboard. Which approach meets these requirements with the least custom code?

Accepted Answer

Create a CloudWatch Logs metric filter that matches "PaymentDeclined" and publishes a custom metric, then create a CloudWatch alarm on that metric with a threshold of 10 over a 5-minute period targeting the SNS topic, and add the metric to a dashboard.

Answer

Create a CloudWatch Logs subscription filter that streams all log events to a Lambda function which counts occurrences and calls the SNS Publish API when the count exceeds 10.

Answer

Enable CloudWatch anomaly detection on the log group and configure an anomaly detection alarm to notify the SNS topic when decline counts deviate from the expected band.

Answer

Create an EventBridge rule that matches "PaymentDeclined" log events and routes them to an SNS topic, then build a QuickSight dashboard from the log data.

More SOA-C03 practice