Monitoring, Logging, Analysis, Remediation, and Performance Optimization — AWS Certified CloudOps Engineer SOA-C03 practice questions

A static website on S3 + CloudFront saw a cost spike from repeated range requests; ops wants a first-line optimization.

1. Enable CloudFront caching + Origin Shield to consolidate origin fetches for range requests
2. Disable CloudFront entirely and serve directly from the S3 bucket via a static site config
3. Move the site to an EC2 Apache instance so the ops team can tune serving behavior manually
4. Migrate the assets to S3 Glacier so retrieval costs replace the current CloudFront charges now

Answer: A — Enable CloudFront caching + Origin Shield to consolidate origin fetches for range requests

A) Correct - Caching + Origin Shield reduces origin requests dramatically. B) Loses CDN. C) More expensive. D) Wrong storage class.

A team wants a graph of CloudWatch metrics from two regions on the same dashboard widget for a global services fleet.

1. Export metrics to S3 nightly and stitch them together in QuickSight for viewing
2. Create a cross-region CloudWatch dashboard widget that references both regions
3. Publish a duplicate copy of one region's metrics into the other using a Lambda
4. Attach the widget to CloudWatch Metric Streams and correlate them downstream later

Answer: B — Create a cross-region CloudWatch dashboard widget that references both regions

A) Overkill and delayed. B) Correct — CloudWatch supports cross-region metrics in dashboard widgets. C) Duplicate publishing is wasteful. D) Metric Streams export, not display.

An organization needs a single CloudWatch dashboard combining metrics from three accounts in the same region for a leadership operations view.

1. Grant IAM console access in each account and page-flip between them during meetings
2. Enable CloudWatch cross-account observability to a central monitoring account
3. Publish metrics to a central S3 bucket and render dashboards through QuickSight only
4. Use AWS Organizations to move all workloads into a single account for shared view

Answer: B — Enable CloudWatch cross-account observability to a central monitoring account

A) Manual and unmaintainable. B) Correct — cross-account observability aggregates metrics/logs/traces for unified views. C) QuickSight is BI, not real-time ops. D) Consolidation is not an ops solution.

An EventBridge rule intermittently fails to deliver events to its Lambda target, and the team suspects malformed input pattern matching. What is the FIRST troubleshooting step per SOA-C03 Domain 1 guidance?

1. Delete and recreate the EventBridge bus, since buses can silently corrupt over time
2. Increase the Lambda function's reserved concurrency to rule out a throttling cause
3. Use the EventBridge sandbox/test-pattern tool to validate the rule's event pattern against sample events
4. Switch the target from Lambda to an SQS queue, which never drops events by design

Answer: C — Use the EventBridge sandbox/test-pattern tool to validate the rule's event pattern against sample events

A) Buses don't silently corrupt; this doesn't address pattern-matching. B) Addresses a different failure mode (throttling), not the suspected pattern issue. C) Correct — validating the event pattern against sample events is the direct, fastest way to confirm whether malformed matching is the cause. D) Changes the target rather than diagnosing the actual issue, and SQS still depends on the same upstream rule pattern.

An on-call engineer wants to be paged only when an error rate exceeds threshold for 5 minutes AND request rate is above a floor for the same window.

1. Publish both metrics to a Kinesis stream and correlate them in a Lambda function
2. Author a CloudWatch composite alarm that combines both metric alarms via AND logic
3. Add a math expression alarm dividing errors by requests and alert on the ratio only
4. Configure two separate alarms and rely on the SNS topic to filter overlapping alerts

Answer: B — Author a CloudWatch composite alarm that combines both metric alarms via AND logic

A) Reinvents composite alarms. B) Correct — composite alarms compose alarm states with boolean logic to reduce noise. C) Half-right — ratio ignores absolute volume floor. D) SNS cannot filter based on other alarm states.

An alarm should transition to ALARM only after three consecutive 5-minute breaches so a single spike does not page the on-call engineer at night.

1. Add three separate alarms and wire an SNS topic that suppresses duplicate messages
2. Configure the alarm with an evaluation period of three and a period of 300 seconds
3. Enable EventBridge scheduled rule to poll the metric only every fifteen minutes
4. Set the missing-data behavior to 'ignore' so the alarm ignores random spikes

Answer: B — Configure the alarm with an evaluation period of three and a period of 300 seconds

A) Reinvents alarm evaluation. B) Correct — datapoints-to-alarm + evaluation periods control the M-of-N flap suppression. C) EventBridge cannot poll metrics. D) Missing-data behavior addresses gaps, not spike suppression.

An organization needs Cost Explorer breakouts by team and environment across all resources but sees blanks for the 'Team' tag in most reports.

1. Activate 'Team' as a user-defined cost allocation tag in the billing console
2. Enforce tag compliance through a Service Control Policy that requires the key
3. Create Cost Explorer saved views filtered on the Team dimension for each team
4. Turn on AWS Config to record the Team tag on every resource for auditing

Answer: A — Activate 'Team' as a user-defined cost allocation tag in the billing console

A) Correct — cost allocation tags must be activated in billing before Cost Explorer surfaces them. B) SCP enforces creation but does not populate historical Cost Explorer. C) Views cannot filter on a tag not activated. D) Config tracks tags but does not feed Cost Explorer.

An S3 bucket holds infrequently-accessed logs older than 30 days and rarely-accessed logs older than 90 days.

1. Transition to Standard-IA at 30 days and to Glacier Instant Retrieval at 90 days per rules
2. Use S3 Standard for everything and rely on default replication for cost-fit across the board
3. Transition to Glacier Deep Archive at day one to secure the lowest possible storage cost now
4. Enable S3 Intelligent-Tiering with no rules and rely on random access-pattern classification

Answer: A — Transition to Standard-IA at 30 days and to Glacier Instant Retrieval at 90 days per rules

A) Correct - lifecycle transitions match the described access pattern. B) Wastes money. C) Retrieval costs on hot data are high. D) Half-right; Intelligent-Tiering is an alternative but explicit rules are more predictable.

An EC2 instance appears CPU-bound and the team wants the built-in CloudWatch metric that surfaces this without extra agents installed on the host OS.

1. MemoryUtilization, reported by the hypervisor at basic-monitoring granularity
2. CPUUtilization, a default EC2 metric available without the CloudWatch agent
3. DiskReadOps, a default metric that rises whenever compute is saturated
4. StatusCheckFailed_System, which flips when a host-level CPU issue occurs

Answer: B — CPUUtilization, a default EC2 metric available without the CloudWatch agent

A) Look-alike — memory is not a hypervisor-visible metric; it needs the CloudWatch agent. B) Correct — CPUUtilization is emitted by default at 5-minute basic monitoring. C) True but irrelevant — disk ops do not measure CPU saturation. D) Right-concept/wrong-scenario — status checks flag host failures, not utilization.

An Auto Scaling group should scale out on custom application queue depth published from a Lambda every minute to a CloudWatch metric.

1. Configure a scheduled scaling action every minute to add capacity based on the graph
2. Attach a target-tracking policy referencing the custom queue-depth CloudWatch metric
3. Rely on ASG default health-check settings to indirectly scale when latency climbs
4. Use ASG lifecycle hooks that trigger on the CloudWatch metric to launch instances

Answer: B — Attach a target-tracking policy referencing the custom queue-depth CloudWatch metric

A) Scheduled is time-based, not demand-based. B) Correct — target tracking supports any CloudWatch metric. C) Health checks are for health, not scaling. D) Lifecycle hooks pause transitions, not trigger scaling.

CloudWatch composite alarms?

Combine multiple alarms with AND/OR logic. Reduces alert noise.

EBS-optimized?

Dedicated network bandwidth between EC2 and EBS. Better performance.

Savings Plans vs Reserved Instances?

SP: flexible commitment ($/hr). RI: locked to specific instance type. SP usually preferred.

CloudTrail log file integrity validation?

Detect if logs were modified. Uses cryptographic hashing.