Examkin

Question

Difficulty: Very hardCloudWatch Metrics and Alarms

A SysOps Administrator is troubleshooting a CloudWatch alarm configured for a critical database client application running on Amazon EC2 instances. The application publishes a custom metric named `ConnectionFailures` under the namespace `DatabaseMonitor` with the dimension `DatabaseClusterId`. The alarm is configured to monitor `ConnectionFailures` over a 55-minute period, with a threshold of greater than 55, and is set to notify an Amazon SNS topic. During a recent database outage, users experienced dozens of connection failures, and the failures were visible as data points in the CloudWatch metric graph. However, the alarm remained in the `OK` state and did not trigger any notification. Which of the following configurations could explain why the alarm failed to transition to the `ALARM` state? (Select TWO.)

  1. The alarm is configured to use the `Average` statistic instead of the `Sum` statistic to evaluate the custom metric.Answer
  2. The alarm is configured with a dimension of `InstanceId` instead of `DatabaseClusterId`, and the alarm's `TreatMissingData` setting is set to `notBreaching`.Answer
  3. C
    The custom metric is being published at 1010-second intervals, but the EC2 instances running the application do not have detailed monitoring enabled.
  4. D
    The SNS topic's access policy does not grant the Amazon EventBridge service principal (`events.amazonaws.com`) permission to publish messages.
  5. E
    The Auto Scaling Group's cooldown period is set to 300300 seconds, which suspends all CloudWatch alarm evaluations during scaling activity.

Answer

The correct options are: configuring the alarm to use the `Average` statistic instead of the `Sum` statistic, and configuring the alarm with the dimension `InstanceId` instead of `DatabaseClusterId` while having `TreatMissingData` set to `notBreaching`.
The alarm fails to trigger because of either a statistic mismatch or a dimension mismatch combined with the missing data treatment policy. First, when a metric represents a count of failures and is published with a value of 11 per occurrence, evaluating it using the `Average` statistic results in a value of 11 regardless of frequency, which fails to exceed the threshold of 55. Second, CloudWatch metrics are uniquely identified by their dimensions. If the alarm specifies the dimension `InstanceId` but the metric is published with the dimension `DatabaseClusterId`, CloudWatch finds no data matching the alarm's query. If `TreatMissingData` is set to `notBreaching`, this lack of data is evaluated as non-breaching, keeping the alarm in the `OK` state.

Step-by-Step Solution

1
Analyze the metric definition and how the application publishes the data.
The application publishes the metric `ConnectionFailures` with the dimension `DatabaseClusterId`. Each failure publishes a value of 11.
This establishes the expected schema and reporting mechanism of the metric.
2
Evaluate the effect of using the `Average` statistic on count-based custom metrics.
If multiple failures occur and each publishes a value of 11, the average value of these data points over 55 minutes is 11. This is below the alarm threshold of 55.
This explains why the alarm statistic selection prevents the alarm from transitioning to the `ALARM` state.
3
Evaluate the impact of a dimension mismatch combined with the `TreatMissingData` setting.
An alarm looking for the `InstanceId` dimension will find no data because the metric is published with the `DatabaseClusterId` dimension. With `TreatMissingData` set to `notBreaching`, the missing data is treated as OK, preventing the alarm from transitioning.
This explains the second configuration combination that causes the alarm to remain in the `OK` state.

Key Concept

CloudWatch alarms require exact metric namespace, name, and dimension matches. Furthermore, metric statistics must align with the logic of the metric payload to trigger alarms correctly.
Rate this question

Topics

CloudWatch Metrics and Alarms

More questions from this topic