Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

SOA-C03 · 66 questions

• The CloudWatch agent is running on a university's EC2 instances and its config lists the memory metric. The agent log reports AccessDenied for PutMetricData, and no memory datapoints arrive. Which change fixes the publish failure?
• A grocery chain sees CPU on every EC2 graph in CloudWatch, but memory-used percent does not appear for any instance. The instances run Amazon Linux and no extra agent is installed. What should the team configure so memory becomes a CloudWatch metric?
• A retailer puts EC2 state-change events on a custom EventBridge bus. A rule there should invoke a Lambda function, but the function never runs. A sample event has detail-type EC2 Instance State-change Notification, while the rule requires detail-type EC2 Instance State Change. What is the first fix?
• A CloudWatch alarm publishes to an SNS topic. An on-call email address was subscribed an hour ago, a test alarm fired, and no mail arrived. The subscription shows PendingConfirmation. What should the operator do first?
• A bank's Application Load Balancer 5xx rate jumped in one Region while the same application in another Region stayed steady and instance CPU looked normal. AWS Health Dashboard has an open event for the load balancing service in the affected Region. What should operators do before they rebuild the fleet?
• A game studio pages on-call when an instance is both high on CPU and failing its status check. Separate alarms already exist for each condition, and CPU-only spikes are waking people overnight. What should send the page?
• A logistics fleet of private EC2 instances needs the same agent restarted, using a procedure someone reviewed, without SSH keys or passwords pasted into chat. Which approach fits?
• A factory database data volume is gp2 and does random writes. During peak, its EBS burst balance sits at zero and write latency climbs. The team needs more IOPS without a much larger disk. Which change addresses that limit?
• A SaaS Lambda function's CloudWatch Errors metric is above zero, but operators cannot see the exception text. The function's log group exists and the execution role may write logs. Where is that exception text?
• A hospital security team must name the IAM principal that called StopInstances on a production instance yesterday. CPU graphs for that hour look normal. Where should the operator look first?
• A media company's Amazon Bedrock workload is slow, and operators need invocation latency and error counts for the model calls. They do not need a cost report. Which place should they instrument and watch?
• A logistics platform on EKS already scrapes metrics with Prometheus and wants a managed, Prometheus-compatible query endpoint instead of running its own long-term store. Which service fits?
• An ECS service on EC2 sends container logs with the awslogs driver, and those logs are arriving. Memory used on the container instances does not appear in CloudWatch. No agent is installed on the instances. What should be added for the memory metric?
• A grocery chain wants the depth of an application queue, a number the application already computes, on a CloudWatch graph. Default EC2 metrics show CPU only. What should the application publish?
• A city's CloudWatch agent is supposed to ship one application log file from each instance. Instead, operators are looking at Systems Manager Inventory and cannot find a log stream. What collects that file into CloudWatch Logs?
• A golden AMI carries a CloudWatch agent config that points at a retired log group. New instances keep shipping logs to that retired name. The team wants the current config applied without baking a new AMI for every edit. Where should the config live?
• An auditor asks a city for every s3:GetObject against a records bucket last week. The trail logs management events only. Lookups for those object reads return nothing. What should be enabled?
• An EKS cluster's nodes run out of disk, and CloudWatch shows no disk-used metric for them. No metrics agent is installed. The team does not want a trail of API calls as a substitute. What should they run on the nodes?
• A payments API pages on-call whenever the error count is at least one in five minutes. Overnight, a single failed call pages them even though almost nobody is using the API. They want a page only when errors are a large share of requests. What should the alarm use?
• A CPU alarm on a fleet flips between OK and ALARM every evaluation period, and on-call is paging on each flip. The metric really does bounce around the threshold. Deleting the alarm was proposed. What should they change so a brief bounce does not page?
• A CloudWatch alarm on a grocery chain's ECS service has stayed in INSUFFICIENTDATA since it was created. The CPU metric exists and has datapoints. The alarm's dimensions do not match the dimensions on that metric. What should change?
• A CloudWatch alarm on a hospital's API should start a Lambda function only when the alarm changes state. Someone suggested an S3 event notification as the trigger. What should invoke the function?
• A single EC2 instance fails its system status check, and a CloudWatch alarm sees that failure. The instance is not in an Auto Scaling group. What is the least disruptive recovery?
• The CloudWatch agent on a fleet in us-east-1 is running, and the memory metric never appears in that Region. The agent configuration file sets the Region to us-west-2. Where are the metrics going?
• A CloudWatch dashboard widget for an ALB went blank after the load balancer was recreated in another Region. The metric is healthy in the new Region. The widget still queries the old Region. What should change?
• Operators want one CloudWatch dashboard that shows metrics from three accounts. They currently paste screenshots into chat. What should be configured?
• An operations review wants the ELB 5xx graph and the state of its alarm on one screen. A teammate exported a Cost Explorer view instead. What should be on the dashboard?
• Operators must see a CloudWatch dashboard of the production fleet. They must not be able to edit the dashboard or administer the account. What should they be given?
• A bank built its CloudWatch dashboard in a central monitoring account, but widgets for two application accounts stay empty. Those accounts have not shared their metrics with the monitoring account. What must happen before the central dashboard can graph them?
• One CloudWatch alarm watches a heartbeat metric that the application publishes every minute. Another watches a sparse error metric that is published only when an error happens. How should missing data be treated?
• A media company's CloudWatch alarm is in ALARM, and the action names an SNS topic in a different Region from the alarm. Subscribers on a topic in the alarm's own Region receive tests, but this action never delivers. What should the action use?
• A hospital alarm already emails the on-call list from one SNS topic. The same alarm must also POST to the paging vendor's HTTPS endpoint. A teammate wants a second alarm with the same threshold. What should be added?
• A factory fleet's disks are filling, and a CloudWatch alarm already sees the disk metric cross the threshold. Operators have been SSHing to each instance to delete files. How should the alarm drive the cleanup?
• A SaaS alarm reboots an instance every time CPU crosses the threshold for a single one-minute period. The metric genuinely bounces, and production instances are rebooting all afternoon. What should change so a brief bounce does not reboot the fleet?
• A hospital alarm invokes a Lambda function that is supposed to restart a stuck agent through Systems Manager. The function log shows it ran, and the instance never changes. The function role has no ssm:SendCommand permission. What should be granted?
• A logistics job already pages operators through an SNS topic when a queue-depth alarm fires. The job also needs to page that same topic when the nightly run finishes cleanly. What should the job do?
• A freight broker must reshape each EventBridge event into the JSON a ticket API accepts. The application that publishes the event cannot be changed. What should they add?
• A factory runbook repaired the failed host, yet the CloudWatch alarm is still ALARM. The metric has not come back inside its threshold. Why has the alarm not cleared?
• A transit authority calls PutEvents and does not set an event bus name. The rule that should match those events is on a custom bus, and the rule never runs. What is going wrong?
• A university needs the caller and the error text for one failed API call. A CloudWatch alarm on the error count is already ALARM. Where should the team look first?
• Minutes before a bank's database outage, someone changed the instance. Operators need that API call and the identity that made it. Where should they look?
• A payments service has an EventBridge rule whose Lambda target shows failed invocations. The function logs never record a start. What should the operator inspect?
• A media Automation document must run only on instances tagged Env=prod. The ticket pastes private IP addresses copied from last week's spreadsheet. What should the document target?
• A factory Automation execution has been in Waiting for an hour. The security group on the instance already allows the traffic the document needs. Opening another port was proposed. What is the execution waiting for?
• Compute Optimizer shows no memory data for a university fleet, so the rightsizing view uses CPU only. The CloudWatch agent is not installed on those instances. What must happen before anyone trusts a rightsizing decision that depends on memory?
• A hospital must restart one clinical instance a single time. The ticket includes a shell script with long-lived access keys embedded in it. What should perform that restart?
• Compute Optimizer reports that a retail web instance is oversized and recommends a smaller size. Memory metrics for the instance are already being collected. A teammate wants the resize done during the next business rush. When should that smaller size be applied?
• A SaaS job must snapshot a data volume and only then run a cleanup script, every time an operator starts the job. A laptop cron that calls both steps with stored access keys was proposed. How should the steps run?
• On a data volume, VolumeQueueLength stays high and VolumeIdleTime stays near zero while the application waits on disk. Instance CPU is modest. An operator wants a larger instance family and no volume change. What should change?
• A large object upload from a distant branch office to an S3 bucket is slow. The long path from that office to the bucket Region is the constraint. A teammate wants a faster computer in the office. What should change?
• A lab cluster must attach one data volume to several instances at the same time in a single Availability Zone. The volume is gp3, and a second attach is rejected. What should they use instead?
• A logistics API runs a steady CPU load on a burstable instance, and the CPU credit balance is exhausted. Unlimited mode was proposed so this same size can stay the permanent home. The team does not want the steady load to depend on CPU credits. What should the load move to?
• CPU is hot only on a SaaS fleet's instances tagged payments. Instances with every other tag are idle. Scaling out every Auto Scaling group in the account was proposed. How should operators focus the response?
• A freight logger writes large sequential files to a data volume. Time is spent moving those bytes, not serving small random reads. An operator wants to raise the gp3 IOPS setting as high as it will go. Which volume change fits this workload?
• Security logs in an S3 bucket are rarely read after each investigation closes, and every object remains in the Standard storage class. Which change keeps the archives while storing them more cheaply?
• A media archive bucket keeps growing after the application stopped uploading. Inventory shows many multipart uploads that were started and never completed. Which change stops that unfinished data from accumulating?
• Applications must mount an existing S3 bucket as a file system and open objects without copying the entire bucket to disk first. The team will not run a gateway appliance. Versioning is turned off on that bucket. What should the team configure?
• An RDS instance is consuming high CPU. CloudWatch Database Insights shows that one write statement accounts for most of that load. The team is ready to move the instance to a larger class. What should they do first?
• A Windows line-of-business application must share one folder using SMB and Windows access control lists. Which service should host that share?
• Linux home directories on a build fleet must present the same files after an instance is replaced in any Availability Zone. Which storage should those home directories use?
• A weather service's short-lived workers open a new RDS connection for each request, and the database is refusing connections. Which change addresses that connection pattern?
• A telemetry database on RDS shows freeable memory near zero while swap usage climbs. The CPU credit balance stays steady. Which change matches that evidence?
• A large distributed cache must keep serving if one rack fails. The nodes can be divided across partitions, and someone suggested a cluster placement group to pack them close. Which placement group fits the failure goal?
• A handful of critical license servers must not run on the same underlying hardware. They may be placed in more than one Availability Zone. Which placement group matches that requirement?
• A simulation places tightly coupled compute nodes in a single Availability Zone and needs the lowest latency between those nodes. Which placement group should the nodes use?
• Performance Insights on a production RDS for MySQL instance recommends a parameter change that matches a wait the team has already confirmed. What should the team do with that recommendation?