AWS SysOps Administrator Associate - SOA-C02

1. 1.A SysOps administrator must alarm on the memory utilization and disk space of Amazon EC2 instances. These values do not appear in the Amazon CloudWatch console. What must the administrator do to collect them?

   • AInstall and configure the CloudWatch agent on the instances to publish memory and disk metrics.Correct answer
   • BEnable detailed monitoring on the instances.
   • CEnable VPC Flow Logs for the subnets that contain the instances.
   • DChange the instances to a larger instance type that reports memory metrics.

   Why

   Memory and disk utilization are guest operating system metrics that the hypervisor cannot see, so they are not published by default. Installing and configuring the CloudWatch agent on the instances publishes them as custom metrics that alarms can then evaluate. Detailed monitoring only increases the frequency of the existing EC2 metrics to one minute. VPC Flow Logs record network traffic. A larger instance type does not change which metrics are published.

2. 2.An application writes errors to Amazon CloudWatch Logs as lines containing the text ERROR_CRITICAL. The SysOps administrator must receive an email whenever more than five of these lines appear within five minutes. Which combination of steps meets this requirement? (Select TWO.)

   • ACreate a metric filter on the log group that matches ERROR_CRITICAL and publishes to a custom metric.Correct answer
   • BCreate a CloudWatch alarm on that metric with an Amazon SNS topic action that has an email subscription.Correct answer
   • CCreate a CloudWatch Logs subscription filter that streams the log group to Amazon Kinesis.
   • DSchedule a CloudWatch Logs Insights query to run every five minutes.
   • EIncrease the retention period of the log group to one year.

   Why

   A metric filter converts matching log events into a CloudWatch metric that can be evaluated over time. An alarm on that metric with a threshold of five over a five-minute period and an Amazon SNS topic action delivers the email. A CloudWatch Logs subscription filter streams logs to a destination such as Kinesis rather than producing an alarm. Logs Insights queries are run on demand. Increasing retention has no effect on alerting.

3. 3.A SysOps administrator must determine which IAM principal deleted an Amazon S3 bucket last week, including the source IP address of the request. Which service provides this information?

   • AAWS CloudTrail event historyCorrect answer
   • BAmazon CloudWatch metrics for Amazon S3
   • CAWS Config configuration timeline
   • DVPC Flow Logs for the VPC

   Why

   AWS CloudTrail records management API calls with the identity of the caller, the time, the source IP address, and the request parameters, which answers who deleted the bucket and from where. Amazon CloudWatch metrics show resource utilization, not API attribution. AWS Config tracks configuration state and change history but does not capture the caller source IP the way CloudTrail does. VPC Flow Logs capture network traffic, not API calls.

4. 4.A CloudWatch alarm on a custom metric changes to INSUFFICIENT_DATA whenever the application is idle and stops publishing data points. The team wants the alarm to stay in OK state during idle periods. What should the SysOps administrator configure?

   • ASet the alarm to treat missing data as notBreaching.Correct answer
   • BSet the alarm to treat missing data as breaching.
   • CIncrease the alarm evaluation period to one hour.
   • DRaise the alarm threshold above the highest expected value.

   Why

   Treating missing data as notBreaching makes the alarm evaluate an interval with no data points as if the metric were within the threshold, so an idle period keeps the alarm in OK instead of INSUFFICIENT_DATA. Treating missing data as breaching would trigger the alarm while idle. Lengthening the period or raising the threshold does not change how absent data points are interpreted.

5. 5.A SysOps administrator must build a single view that shows CPU utilization from Amazon EC2, request latency from an Application Load Balancer, and a custom application metric, refreshed automatically for the operations team. What should the administrator create?

   • AA CloudWatch dashboard with widgets for each metric.Correct answer
   • BA CloudWatch composite alarm covering all three metrics.
   • CA CloudWatch Logs Insights saved query.
   • DAn AWS Config aggregator across the accounts.

   Why

   A CloudWatch dashboard combines widgets from multiple namespaces, including custom metrics, into one automatically refreshing view that can be shared with the team. An alarm evaluates a single metric expression and notifies. A Logs Insights query returns log results on demand rather than a live metric view. AWS Config aggregators report configuration compliance across accounts.

Practice all 65 questions

Frequently asked questions