Tüm alıştırma soruları

976 soru

Tüm türler976 Çoktan seçmeli502 Çoklu seçim450 Sıralama24

A SysOps Administrator is configuring an Amazon CloudWatch alarm to trigger a scale-out policy for an Auto Scaling group when the average CPU utilization exceeds 75%. The EC2 instances are launched using a template with default monitoring. The administrator sets the CloudWatch alarm period to 1 minute and the evaluation periods to 3. However, after a traffic spike, the scaling policy does not execute, and the CloudWatch alarm remains in the INSUFFICIENT_DATA state. Which action will resolve this issue and allow the alarm to transition to the ALARM state?

Enable detailed monitoring in the launch template used by the Auto Scaling group.

Reduce the Auto Scaling group cooldown period to 60 seconds to align with the alarm period.

Configure the alarm to use a high-resolution period of 10 seconds for the CPUUtilization metric.

Create an Amazon EventBridge rule that monitors the CPUUtilization metric and targets the scaling policy directly.

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring in the launch template used by the Auto Scaling group.

Cevap

Enable detailed monitoring in the launch template used by the Auto Scaling group.

Enabling detailed monitoring in the launch template ensures that the EC2 instances publish metrics to CloudWatch every 1 minute instead of the default 5 minutes. This satisfies the alarm's configuration of a 1-minute period with 3 evaluation periods, allowing the alarm to retrieve enough data points to evaluate its state and trigger the scaling policy.

Adım Adım Çözüm

Identify the cause of the INSUFFICIENT_DATA state.

By default, Amazon EC2 sends metrics to CloudWatch at 5-minute intervals (standard monitoring).

Since the alarm is configured with a 1-minute period and requires 3 consecutive evaluation periods, it expects three consecutive 1-minute data points. Under standard monitoring, data points are only available every 5 minutes, leaving gaps.

Modify the instance configuration to publish metrics at a higher frequency.

Enable detailed monitoring in the Auto Scaling group launch template.

Detailed monitoring publishes EC2 metrics to CloudWatch at 1-minute intervals, which ensures the alarm has continuous, consecutive 1-minute data points to evaluate.

Anahtar Kavram

CloudWatch Metric Granularity for EC2 Instances

Tahmini Süre:1m 30s

Soru 122Soru →

A SysOps Administrator is configuring a monitoring and remediation setup for a batch processing application running on Amazon EC2. The application publishes a custom metric named `QueueBacklog` to Amazon CloudWatch every 1 minute. The administrator needs to configure a CloudWatch alarm that meets the following requirements:

- The alarm must transition to the ALARM state if the queue backlog is greater than 1000 items for a continuous duration of 15 minutes.
- If there is a temporary network interruption preventing the application from publishing metrics, the alarm must default to the ALARM state to ensure visibility.

Which TWO of the following configurations are required to meet these requirements?

Geçerli olan tümünü seçin

Set the alarm Period to 1 minute and the Evaluation Periods to 15.

Configure the alarm's missing data treatment to treat missing data as breaching.

Enable detailed monitoring on the EC2 instances to allow the custom metric to be published at 1-minute intervals.

Create an Amazon EventBridge rule that monitors the QueueBacklog metric directly to trigger an Amazon SNS topic.

Increase the Auto Scaling group cooldown period to 15 minutes to pause metric collection during instance scale-out.

Cevabı ve açıklamayı göster

Cevap: Set the alarm Period to 1 minute and the Evaluation Periods to 15.; Configure the alarm's missing data treatment to treat missing data as breaching.

Cevap

The correct configurations are setting the alarm period to 1 minute with 15 evaluation periods, and configuring the missing data treatment to treat missing data as breaching.

To monitor a continuous 15-minute window for a metric published every 1 minute, the alarm needs to evaluate 15 individual 1-minute periods (or datapoints). Additionally, to force the alarm into the ALARM state when network issues prevent data publication, the missing data treatment must be set to 'breaching'.

Adım Adım Çözüm

Determine the alarm evaluation period and datapoints.

Since the metric is published every 1 minute and the duration required is 15 minutes, we configure a Period of 1 minute and Evaluation Periods of 15.

This guarantees that 15 consecutive 1-minute data points must violate the threshold for the alarm to trigger.

Select the missing data behavior.

Configure the alarm to treat missing data as breaching.

This meets the requirement that if metrics are missing due to a network interruption, the alarm will transition to the ALARM state.

Anahtar Kavram

CloudWatch Alarm Evaluation and Missing Data Configuration

Soru 123Soru →

A SysOps Administrator is designing an automated remediation workflow for a batch-processing application running on Amazon EC2 instances. The application publishes a custom metric named `QueueBacklogDepth` to Amazon CloudWatch at 1-minute intervals. The administrator wants to automatically execute the `AWS-RestartEC2Instance` Systems Manager (SSM) Automation runbook if the backlog depth exceeds 1,000 messages for a duration of 15 minutes.

The administrator configures a CloudWatch alarm for the `QueueBacklogDepth` metric with a threshold of 1,000, a period of 5 minutes (300 seconds), and evaluation periods of 3. During testing, the queue backlog depth exceeds 1,000 for 20 minutes, and the alarm state successfully transitions to ALARM, but the SSM Automation runbook fails to run.

How should the administrator resolve this issue to ensure the remediation workflow executes successfully?

Create an Amazon EventBridge rule that triggers on a CloudWatch Alarm State Change event for this alarm to invoke the Systems Manager Automation runbook as the target.

Enable detailed monitoring on the EC2 instances hosting the application to allow CloudWatch to receive and evaluate the custom metric at the 1-minute resolution required by the evaluation period configuration.

Configure the Systems Manager Automation runbook as a subscription endpoint on an Amazon SNS topic, and update the CloudWatch alarm actions to publish to that SNS topic.

Reduce the Auto Scaling group cooldown period to be less than the 15-minute evaluation window to prevent the alarm actions from being suppressed.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon EventBridge rule that triggers on a CloudWatch Alarm State Change event for this alarm to invoke the Systems Manager Automation runbook as the target.

Cevap

Create an Amazon EventBridge rule that triggers on a CloudWatch Alarm State Change event for this alarm to invoke the Systems Manager Automation runbook as the target.

The correct answer is to create an Amazon EventBridge rule that triggers on a CloudWatch Alarm State Change event to invoke the Systems Manager Automation runbook. CloudWatch metric alarms cannot natively invoke Systems Manager Automation runbooks as a direct action. Because CloudWatch publishes state changes to EventBridge, using an EventBridge rule to match the specific alarm transitioning to the ALARM state and targeting the runbook is the standard, event-driven pattern for this scenario.

Adım Adım Çözüm

Analyze the native targets of Amazon CloudWatch alarm actions.

Identify that CloudWatch alarms can natively send notifications to SNS, execute Auto Scaling actions, or invoke EC2 actions (such as reboot, stop, terminate, or recover). They cannot directly target SSM Automation runbooks.

This establishes why the initial configuration failed to execute the runbook even though the alarm transitioned to the ALARM state.

Determine the proper integration path between CloudWatch alarms and SSM Automation.

Identify that CloudWatch Alarm State Change events are published to Amazon EventBridge. EventBridge can route these events directly to Systems Manager Automation as a target.

This creates the event-driven bridge required to execute the remediation workflow without modifying the application code.

Verify custom metric resolution requirements.

Confirm that custom metrics published via the PutMetricData API are separate from EC2 instance metrics, meaning EC2 detailed monitoring is not required for custom metrics evaluation.

This rules out standard vs. detailed monitoring configurations as the cause of the failure.

Anahtar Kavram

CloudWatch Alarm Actions and Event-Driven Remediation with EventBridge

Tahmini Süre:3m 0s

Soru 124Soru →

A SysOps Administrator is configuring a new Amazon EC2 instance. The administrator needs to monitor the CPU utilization of the instance at 1-minute intervals and trigger an alarm if the utilization exceeds 80%. Which steps must the administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable detailed monitoring for the Amazon EC2 instance.

Configure the Amazon CloudWatch alarm with a period of 60 seconds.

Configure the Amazon CloudWatch alarm with a period of 300 seconds.

Enable basic monitoring for the Amazon EC2 instance.

Configure the CloudWatch alarm to send notifications directly to an Amazon SQS queue.

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring for the Amazon EC2 instance.; Configure the Amazon CloudWatch alarm with a period of 60 seconds.

Cevap

To monitor the EC2 instance at 1-minute intervals and trigger the alarm, the administrator must enable detailed monitoring on the EC2 instance and configure the CloudWatch alarm with a period of 60 seconds.

To monitor EC2 metrics at a 1-minute resolution, detailed monitoring must be enabled on the EC2 instance. The CloudWatch alarm must then be configured with an evaluation period of 60 seconds to match the metric delivery frequency.

Adım Adım Çözüm

Enable detailed monitoring on the target EC2 instance.

The instance begins publishing CPU utilization and other default metrics to CloudWatch at 1-minute intervals instead of the default 5-minute intervals.

Standard monitoring only provides 5-minute granularity, which is insufficient for 1-minute monitoring.

Create and configure the CloudWatch alarm for CPUUtilization.

The alarm is configured with a period of 60 seconds (1 minute) and a threshold of 80%.

This aligns the alarm evaluation frequency with the 1-minute metric delivery frequency.

Anahtar Kavram

Configuring CloudWatch alarms with 1-minute granularity for EC2 metrics requires enabling detailed monitoring on the EC2 instances.

Soru 125Soru →

A SysOps Administrator is troubleshooting a CloudWatch alarm configured for a critical database client application running on Amazon EC2 instances. The application publishes a custom metric named `ConnectionFailures` under the namespace `DatabaseMonitor` with the dimension `DatabaseClusterId`. The alarm is configured to monitor `ConnectionFailures` over a $5$ -minute period, with a threshold of greater than $5$ , and is set to notify an Amazon SNS topic. During a recent database outage, users experienced dozens of connection failures, and the failures were visible as data points in the CloudWatch metric graph. However, the alarm remained in the `OK` state and did not trigger any notification. Which of the following configurations could explain why the alarm failed to transition to the `ALARM` state? (Select TWO.)

Geçerli olan tümünü seçin

The alarm is configured to use the `Average` statistic instead of the `Sum` statistic to evaluate the custom metric.

The alarm is configured with a dimension of `InstanceId` instead of `DatabaseClusterId`, and the alarm's `TreatMissingData` setting is set to `notBreaching`.

The custom metric is being published at

10

-second intervals, but the EC2 instances running the application do not have detailed monitoring enabled.

The SNS topic's access policy does not grant the Amazon EventBridge service principal (`events.amazonaws.com`) permission to publish messages.

The Auto Scaling Group's cooldown period is set to

300

seconds, which suspends all CloudWatch alarm evaluations during scaling activity.

Cevabı ve açıklamayı göster

Cevap: The alarm is configured to use the `Average` statistic instead of the `Sum` statistic to evaluate the custom metric.; The alarm is configured with a dimension of `InstanceId` instead of `DatabaseClusterId`, and the alarm's `TreatMissingData` setting is set to `notBreaching`.

Cevap

The correct options are: configuring the alarm to use the `Average` statistic instead of the `Sum` statistic, and configuring the alarm with the dimension `InstanceId` instead of `DatabaseClusterId` while having `TreatMissingData` set to `notBreaching`.

The alarm fails to trigger because of either a statistic mismatch or a dimension mismatch combined with the missing data treatment policy. First, when a metric represents a count of failures and is published with a value of

1

per occurrence, evaluating it using the `Average` statistic results in a value of

1

regardless of frequency, which fails to exceed the threshold of

5

. Second, CloudWatch metrics are uniquely identified by their dimensions. If the alarm specifies the dimension `InstanceId` but the metric is published with the dimension `DatabaseClusterId`, CloudWatch finds no data matching the alarm's query. If `TreatMissingData` is set to `notBreaching`, this lack of data is evaluated as non-breaching, keeping the alarm in the `OK` state.

Adım Adım Çözüm

Analyze the metric definition and how the application publishes the data.

The application publishes the metric `ConnectionFailures` with the dimension `DatabaseClusterId`. Each failure publishes a value of

1

This establishes the expected schema and reporting mechanism of the metric.

Evaluate the effect of using the `Average` statistic on count-based custom metrics.

If multiple failures occur and each publishes a value of

1

, the average value of these data points over

5

minutes is

1

. This is below the alarm threshold of

5

This explains why the alarm statistic selection prevents the alarm from transitioning to the `ALARM` state.

Evaluate the impact of a dimension mismatch combined with the `TreatMissingData` setting.

An alarm looking for the `InstanceId` dimension will find no data because the metric is published with the `DatabaseClusterId` dimension. With `TreatMissingData` set to `notBreaching`, the missing data is treated as OK, preventing the alarm from transitioning.

This explains the second configuration combination that causes the alarm to remain in the `OK` state.

Anahtar Kavram

CloudWatch alarms require exact metric namespace, name, and dimension matches. Furthermore, metric statistics must align with the logic of the metric payload to trigger alarms correctly.

Soru 126Soru →

A SysOps Administrator is setting up VPC Flow Logs to publish network traffic metadata to an Amazon CloudWatch Logs group. After configuring the flow log, the administrator notices that no log streams are being created in the target CloudWatch log group. What is the most likely cause of this issue?

The SysOps Administrator's IAM user policy is missing the iam:PassRole action, which is required in the trust policy of the role being assumed by the VPC Flow Logs service.

The IAM role associated with the flow log does not have a trust relationship allowing the vpc-flow-logs.amazonaws.com service principal to assume it.

The target CloudWatch Logs group is configured with an active 1-day log retention policy, which blocks new flow logs from being initially written.

The route table for the subnets being monitored is missing a route to an Internet Gateway, which prevents the flow logs from being sent to the CloudWatch service endpoint.

Cevabı ve açıklamayı göster

Cevap: The IAM role associated with the flow log does not have a trust relationship allowing the vpc-flow-logs.amazonaws.com service principal to assume it.

Cevap

The IAM role associated with the flow log does not have a trust relationship allowing the vpc-flow-logs.amazonaws.com service principal to assume it.

For VPC Flow Logs to successfully publish to CloudWatch Logs, the service must assume an IAM role. The role must contain a trust policy (trust relationship) that allows the service principal 'vpc-flow-logs.amazonaws.com' to perform the 'sts:AssumeRole' action. Without this trust relationship, delivery fails silently and no log streams are created in the target log group.

Adım Adım Çözüm

Verify that VPC Flow Logs are configured to publish to CloudWatch Logs.

Confirming the configuration target shows that logs are destined for CloudWatch Logs.

This establishes the scope of delivery permissions required.

Examine the IAM role's trust policy associated with the VPC Flow Log configuration.

Ensure that the trust policy grants 'sts:AssumeRole' permissions to the 'vpc-flow-logs.amazonaws.com' service principal.

The VPC Flow Logs service must be trusted to assume the delivery role in order to create log streams and put log events.

Ensure that the IAM role's permission policy allows creating log groups, log streams, and putting log events to CloudWatch.

The role will have full operational access to log delivery.

Both trust relationship and functional IAM permissions are required for successful flow log generation.

Anahtar Kavram

VPC Flow Logs require an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role, plus permission to publish logs to Amazon CloudWatch Logs.

Soru 127Soru →

An organization monitors an application's transaction rate using a custom Amazon CloudWatch metric. During off-peak hours, the application stops sending data to CloudWatch when there are no transactions. A SysOps Administrator needs to configure a CloudWatch alarm so that it remains in its current state during these periods without transitioning to another state. Which configuration option for treating missing data should the administrator select to achieve this?

Ignore (maintain the current alarm state)

Enable detailed monitoring for the custom metric to generate empty data points

Create an Amazon EventBridge rule to automatically publish a default value of zero when the alarm status changes

Increase the Auto Scaling group cooldown period to prevent the alarm from evaluation during off-peak hours

Cevabı ve açıklamayı göster

Cevap: Ignore (maintain the current alarm state)

Cevap

Configure the CloudWatch alarm to treat missing data as 'ignore' (maintain the current alarm state).

The correct option correctly identifies the 'ignore' setting (maintain the current alarm state) for handling missing data. This option ensures that CloudWatch does not change the alarm state or trigger actions when no new metric data points are received.

Adım Adım Çözüm

Identify that the problem is caused by the absence of custom metric data during periods of low activity.

The application does not publish metrics when there are no transactions.

When no data is sent, CloudWatch alarms default to transitioning into an INSUFFICIENT_DATA state.

Evaluate CloudWatch alarm settings for handling missing data points.

Identify 'ignore' as the option that prevents state transitions when data is missing.

Choosing 'ignore' ensures that the alarm maintains its last evaluated state during periods of missing data.

Select the 'ignore' option (maintain current alarm state) to prevent the alarm from transitioning to INSUFFICIENT_DATA or triggering false alarms.

The alarm is successfully configured to maintain its current state during periods of inactivity.

This configuration directly addresses the requirement without needing external scripts or modifying scaling parameters.

Anahtar Kavram

Treatment of missing data in CloudWatch Alarms

Soru 128Soru →

A SysOps Administrator needs to monitor an application log group in Amazon CloudWatch Logs. The administrator wants to receive an email notification whenever the keyword "Failed" appears in the logs. Which two configuration steps must the SysOps Administrator perform to set up this monitoring and notification? (Select TWO.)

Geçerli olan tümünü seçin

Create a metric filter on the log group with the filter pattern "Failed" to map log occurrences to a custom metric.

Create a CloudWatch alarm based on the custom metric and configure it to send a notification to an Amazon SNS topic.

Configure a subscription filter on the log group to stream the log events directly to an Amazon SNS topic.

Enable detailed monitoring on the EC2 instances hosting the application to increase the log parsing frequency to 1-minute intervals.

Modify the log retention policy of the log group to 1 day to trigger notifications on expired log streams.

Cevabı ve açıklamayı göster

Cevap: Create a metric filter on the log group with the filter pattern "Failed" to map log occurrences to a custom metric.; Create a CloudWatch alarm based on the custom metric and configure it to send a notification to an Amazon SNS topic.

Cevap

Create a metric filter on the log group with the filter pattern "Failed" to map log occurrences to a custom metric, and create a CloudWatch alarm based on the custom metric and configure it to send a notification to an Amazon SNS topic.

To alert on specific log events in CloudWatch Logs, you must first create a metric filter on the target log group. The filter matches the specified term (in this case, "Failed") and outputs a numeric metric. You then create a CloudWatch alarm that evaluates this custom metric and sends a notification to an Amazon SNS topic when the threshold is breached.

Adım Adım Çözüm

Define a Metric Filter on the CloudWatch Log Group.

A custom metric is created under a specific namespace that increments by 1 whenever the keyword "Failed" is matched in the incoming log events.

Metric filters parse log data in real-time to convert text patterns into numerical CloudWatch metrics.

Create a CloudWatch Alarm for the newly created custom metric.

An alarm is defined to monitor the custom metric, transitioning to the ALARM state when the count of "Failed" events exceeds the threshold.

Alarms are required to evaluate metric values over time and trigger actions when thresholds are crossed.

Configure the Alarm Action to send a notification.

An Amazon Simple Notification Service (SNS) topic is configured as the target, sending an email notification to the administrator.

SNS topics distribute notifications to subscribed endpoints when the alarm state transitions.

Anahtar Kavram

Using CloudWatch Logs Metric Filters and Alarms to detect and alert on log patterns.

Soru 129Soru →

A SysOps Administrator is configuring an AWS CloudTrail organization trail from the organization's management account to log all API activity across all member accounts. The trail is configured to deliver logs to a centralized Amazon S3 bucket. While logs from the management account are successfully appearing in the S3 bucket, no logs from the member accounts are being delivered. Which of the following is the most likely cause of this issue?

The S3 bucket policy restricts the s3:PutObject permission to the resource path prefix containing the management account ID instead of the AWS Organization ID.

The S3 bucket policy is missing the s3:GetBucketAcl permission for the cloudtrail.amazonaws.com service principal.

The IAM policy associated with the SysOps Administrator in the management account is missing the iam:PassRole permission to pass the CloudTrail service role to member accounts.

An Amazon EventBridge rule must be created in each member account to forward the CloudTrail log events to the central management account's S3 bucket.

Cevabı ve açıklamayı göster

Cevap: The S3 bucket policy restricts the s3:PutObject permission to the resource path prefix containing the management account ID instead of the AWS Organization ID.

Cevap

The S3 bucket policy restricts the s3:PutObject permission to the resource path prefix containing the management account ID instead of the AWS Organization ID.

The correct answer is that the S3 bucket policy restricts the s3:PutObject permission to the resource path prefix containing the management account ID instead of the AWS Organization ID. When an organization trail is created, CloudTrail writes log files from member accounts to the S3 bucket under the prefix 'AWSLogs/o-organizationId/'. If the S3 bucket policy only grants 's3:PutObject' access to the path prefix containing the management account ID, log delivery for all other member accounts will be blocked, while the management account's logs might still be delivered if a specific rule allowed them.

Adım Adım Çözüm

Analyze the log delivery path for an AWS CloudTrail organization trail.

For organization trails, the log files are delivered to the S3 bucket under the path format: 'arn:aws:s3:::bucket-name/AWSLogs/o-organizationId/accountID/'. For non-organization trails or the management account's own local trail, it is 'arn:aws:s3:::bucket-name/AWSLogs/management-accountId/'.

This determines the resource prefix matching rules in the S3 bucket policy.

Examine the S3 bucket policy permissions required for CloudTrail.

The bucket policy must allow the 'cloudtrail.amazonaws.com' service principal to perform 's3:PutObject'. The Resource array must cover the path used by all member accounts under the organization, which is 'arn:aws:s3:::bucket-name/AWSLogs/o-organizationId/*'.

If the policy only allows writes to 'arn:aws:s3:::bucket-name/AWSLogs/management-accountId/*', CloudTrail will fail to deliver logs for any of the member accounts.

Verify correct remediation action.

Updating the S3 bucket policy to allow 's3:PutObject' on 'arn:aws:s3:::bucket-name/AWSLogs/o-organizationId/*' resolves the log delivery issue for member accounts.

This correctly aligns S3 bucket access permissions with the path layout used by CloudTrail organization trails.

Anahtar Kavram

AWS CloudTrail Organization Trail S3 Bucket Policies

Soru 130Soru →

A SysOps Administrator is designing an automated remediation workflow to reboot an Amazon EC2 instance if a custom application health metric falls below a threshold. The custom metric is published to Amazon CloudWatch every 60 seconds. The reboot must be performed by an AWS Systems Manager (SSM) Automation document. Which configuration will meet these requirements with the least operational overhead?

Create a CloudWatch alarm to monitor the custom metric with an evaluation period of 1 minute. Configure an Amazon EventBridge rule that detects the CloudWatch alarm state change to ALARM and targets the Systems Manager Automation document.

Enable detailed monitoring on the EC2 instance to ensure the custom metric is evaluated at 1-minute intervals. Configure the CloudWatch alarm action to directly execute the Systems Manager Automation document.

Create a CloudWatch alarm to monitor the custom metric with an evaluation period of 5 minutes. Configure the CloudWatch alarm action to send the state change event to an Amazon Kinesis Data Firehose stream to trigger the Systems Manager Automation document.

Create a CloudWatch alarm to monitor the custom metric with an evaluation period of 5 minutes. Configure the CloudWatch alarm to send a message to an Amazon Simple Queue Service (Amazon SQS) queue, and configure the SQS queue to directly invoke the Systems Manager Automation document.

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch alarm to monitor the custom metric with an evaluation period of 1 minute. Configure an Amazon EventBridge rule that detects the CloudWatch alarm state change to ALARM and targets the Systems Manager Automation document.

Cevap

The correct configuration uses a CloudWatch alarm with a 1-minute evaluation period to match the custom metric's 60-second publication rate. Because CloudWatch alarms cannot directly invoke Systems Manager Automation, an Amazon EventBridge rule is configured to detect the alarm's state change to ALARM, which then targets the Systems Manager Automation document to perform the reboot.

Adım Adım Çözüm

Determine the metric type and publication frequency.

The metric is a custom metric published every 60 seconds (1 minute). This means the alarm's evaluation period should be configured for 1 minute to match the resolution of the data.

Aligning the evaluation period with the data publication frequency ensures timely and accurate alarm evaluations without unnecessary delay or missing data.

Identify the target action and valid integrations.

The target action is to execute an AWS Systems Manager Automation document. CloudWatch alarms cannot directly invoke Systems Manager Automation documents as an alarm action.

CloudWatch alarm actions are limited to EC2 actions, Auto Scaling, Systems Manager Incident Manager, and SNS notifications.

Determine the integration method to route the alarm trigger to Systems Manager.

Amazon EventBridge can capture CloudWatch alarm state change events and route them to targets. An EventBridge rule can target the SSM Automation document directly.

This provides a serverless, decoupled way to trigger automated remediation workflows on alarm state changes.

Anahtar Kavram

Integration of CloudWatch alarms with Systems Manager Automation using EventBridge for custom metric remediation.

Tahmini Süre:1m 30s

Soru 131Soru →

An administrator is troubleshooting a CloudWatch alarm configured to monitor the `DiskReadBytes` metric of an Amazon EC2 instance. The alarm has a period of $60$ seconds, an evaluation period of $1$ , and is set to transition to the `ALARM` state when disk read activity exceeds a specific threshold. The administrator notes that the alarm regularly transitions to the `INSUFFICIENT_DATA` state and fails to trigger during brief periods of high disk reads. The EC2 instance is currently using the default monitoring configuration.

Which action will resolve this issue while maintaining the $60\text{-second}$ alarm evaluation frequency?

Turn on detailed monitoring for the EC2 instance.

Increase the alarm period to

5

minutes to match the default metric publishing frequency.

Create an Amazon EventBridge rule that triggers an AWS Systems Manager Automation runbook to poll the disk metrics at

1\text{-minute}

intervals.

Configure an Auto Scaling group cooldown period of

60

seconds for the instance to force CloudWatch to collect metrics more frequently.

Cevabı ve açıklamayı göster

Cevap: Turn on detailed monitoring for the EC2 instance.

Cevap

Turn on detailed monitoring for the EC2 instance.

The correct option is to turn on detailed monitoring for the EC2 instance. By default, Amazon EC2 sends metric data (such as CPU, disk, and network) to CloudWatch at

5\text{-minute}

intervals (standard monitoring). To run an alarm with a

60\text{-second}

period without encountering missing data, detailed monitoring must be enabled to change the metric resolution to

1\text{-minute}

intervals.

Adım Adım Çözüm

Analyze the existing monitoring configuration and alarm settings.

The alarm is configured with a period of

60

seconds, but the EC2 instance is using default (standard) monitoring, which publishes metrics only every

5

minutes.

This mismatch causes the alarm to evaluate periods that contain no data, resulting in frequent transitions to the `INSUFFICIENT_DATA` state.

Identify the requirement to maintain a

60\text{-second}

evaluation frequency.

Changing the alarm period to

5

minutes is ruled out because the administrator wants to keep the

60\text{-second}

detection window.

1\text{-minute}

metric resolution is required to support a

60\text{-second}

alarm period.

Select the configuration change that enables

1\text{-minute}

metric resolution.

Enabling detailed monitoring on the EC2 instance publishes metric data to CloudWatch every minute.

This provides the required data points for the

60\text{-second}

alarm period, preventing the alarm from entering the `INSUFFICIENT_DATA` state.

Anahtar Kavram

CloudWatch Standard vs. Detailed Monitoring for EC2 Instances

Soru 132Soru →

A company runs a critical application on a fleet of Amazon EC2 instances. A SysOps Administrator is configuring a CloudWatch alarm to monitor the aggregate CPU utilization of the fleet. The alarm must transition to the ALARM state and send an Amazon SNS notification if the average CPU utilization exceeds $85\%$ for $2$ consecutive evaluation periods of $1$ minute. The EC2 instances are currently configured with standard monitoring.

Which combination of actions must the SysOps Administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable detailed monitoring on the EC2 instances in the fleet.

Configure the CloudWatch alarm with a metric period of

1

minute and set both the Evaluation Periods and Datapoints to Alarm to

2

Keep standard monitoring enabled and configure the CloudWatch alarm with a metric period of

1

minute, relying on CloudWatch to interpolate the

5

-minute metrics.

Create an Amazon EventBridge rule that directly monitors the raw EC2 CPUUtilization metric stream at

1

-minute intervals to trigger the SNS notification.

Increase the Auto Scaling group cooldown period to

120

seconds to prevent CloudWatch from evaluating metrics during instance scaling activities.

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring on the EC2 instances in the fleet.; Configure the CloudWatch alarm with a metric period of $1$ minute and set both the Evaluation Periods and Datapoints to Alarm to $2$ .

Cevap

To achieve this configuration, detailed monitoring must be enabled on the EC2 instances, and the CloudWatch alarm must be configured with a metric period of

1

minute while setting both the Evaluation Periods and Datapoints to Alarm to

2

To evaluate a metric at

1

-minute intervals, the EC2 instances must be configured with detailed monitoring, as standard monitoring only reports metrics at

5

-minute intervals. Additionally, the CloudWatch alarm must be configured with a period of

1

minute, and both the Evaluation Periods and Datapoints to Alarm must be set to

2

to ensure that the alarm only triggers when the CPU utilization threshold of

85\%

is exceeded for

2

consecutive

1

-minute periods.

Adım Adım Çözüm

Ensure the underlying metrics are published at the required frequency.

Detailed monitoring is enabled on the fleet's EC2 instances, switching the CPU utilization reporting interval from

5

minutes to

1

minute.

Standard monitoring does not provide the

1

-minute data points required for the alarm's evaluation period.

Configure the threshold evaluation window on the CloudWatch alarm.

The alarm is configured with a period of

1

minute, Evaluation Periods of

2

, and Datapoints to Alarm (M out of N) of

2

This configuration requires

2

out of

2

consecutive data points to exceed the

85\%

threshold before triggering the alarm.

Anahtar Kavram

CloudWatch detailed monitoring configuration and multi-period alarm evaluation.

Soru 133Soru →

An application running on an Amazon EC2 instance in a private subnet is unable to connect to an external database. To determine if outbound network connection attempts are being blocked, a SysOps Administrator decides to enable VPC Flow Logs for the subnet and publish the logs to a new Amazon CloudWatch Logs group.

Which of the following actions must the administrator perform to implement this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role.

Set the traffic filter setting on the flow log to REJECT.

Associate an IAM policy with the CloudWatch Logs group that grants iam:PassRole permissions to the SysOps Administrator.

Configure a log retention policy of zero days on the destination CloudWatch Logs group to enable real-time log delivery.

Create an Amazon EventBridge rule that detects subnet traffic activity and routes it to the CloudWatch Logs group.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role.; Set the traffic filter setting on the flow log to REJECT.

Cevap

Create an IAM role with a trust policy that allows the VPC Flow Logs service principal to assume the role, and set the traffic filter on the flow log to REJECT.

The correct actions are to create an IAM role that trusts the VPC Flow Logs service principal to assume the role, and to set the flow log filter to REJECT. To publish flow logs to Amazon CloudWatch Logs, the VPC Flow Logs service requires permissions to create log streams and publish log events to the target log group, which is achieved by assuming a configured IAM role. Furthermore, because the administrator is specifically troubleshooting blocked outbound connection attempts, setting the filter to REJECT isolates the relevant traffic records.

Adım Adım Çözüm

Select the appropriate traffic filter for the troubleshooting scenario.

Filter set to REJECT.

Since the administrator is investigating blocked outbound packets, only rejected traffic records need to be captured to find the issue.

Establish the necessary IAM permissions to deliver logs to CloudWatch Logs.

An IAM role created with a trust policy that lists vpc-flow-logs.amazonaws.com in the Principal block.

VPC Flow Logs requires permission to write to CloudWatch Logs on behalf of the account owner, which is authorized by the service assuming this role.

Anahtar Kavram

VPC Flow Logs destination delivery to CloudWatch Logs requires a service trust relationship (AssumeRole) to write logs, and filtering can be customized to capture only accepted, rejected, or all traffic.

Soru 134Soru →

A SysOps Administrator is monitoring a critical processing application running on a fleet of Amazon EC2 instances. The application publishes a custom CloudWatch metric named `QueueProcessingLatency` at 5-minute intervals. The administrator configures a CloudWatch alarm for this metric with a threshold of $200$ milliseconds, a period of $1$ minute, and `EvaluationPeriods` set to $3$ . The alarm is configured to treat missing data as `nonBreaching`.

During a peak traffic event, the latency increases to $450$ milliseconds and remains high for an hour, but the alarm never transitions to the `ALARM` state.

Which of the following is the reason for this behavior, and how should it be resolved?

Enable detailed monitoring on the EC2 instances hosting the application. This will force all custom metrics published from the instances to report at 1-minute intervals, allowing the alarm to evaluate complete data.

Configure an Amazon EventBridge rule that detects when the custom metric is published, and route the raw metric data directly to an Auto Scaling scaling policy, bypassing the CloudWatch alarm evaluation.

Change the alarm period to 5 minutes to align with the metric's publication frequency, or modify the application code to publish the metric at 1-minute intervals so that there is no missing data.

Decrease the Auto Scaling group's cooldown period to 60 seconds to match the 1-minute alarm evaluation period, allowing the instances to report metrics faster.

Cevabı ve açıklamayı göster

Cevap: Change the alarm period to 5 minutes to align with the metric's publication frequency, or modify the application code to publish the metric at 1-minute intervals so that there is no missing data.

Cevap

Change the alarm period to 5 minutes to align with the metric's publication frequency, or modify the application code to publish the metric at 1-minute intervals.

The correct option is to align the alarm period with the metric frequency (5 minutes) or modify the application to publish at 1-minute intervals. Because the custom metric is only published every 5 minutes, a 1-minute alarm period means at least two out of the three evaluation periods will contain no data. Since missing data is treated as non-breaching, the alarm will never see three consecutive breaching periods to trigger.

Adım Adım Çözüm

Analyze the custom metric's publication frequency.

The metric is published every 5 minutes.

This determines how often actual data points are available in CloudWatch.

Analyze the alarm's evaluation parameters.

The alarm has a period of 1 minute and evaluates 3 periods.

This means the alarm looks for 3 consecutive 1-minute windows.

Determine the impact of the missing data policy.

In any 3-minute window, at most 1 minute has data, and the other 2 are missing. Since missing data is treated as non-breaching, the alarm will never register 3 out of 3 breaching data points.

This explains why the alarm remains in OK/INSUFFICIENT_DATA despite high latency.

Identify the resolution.

Align the alarm period with the metric frequency (5 minutes) or increase the metric publication rate (1 minute).

This ensures the alarm has sufficient data points to evaluate the threshold.

Anahtar Kavram

CloudWatch Alarm Evaluation and Metric Resolution Alignment

Soru 135Soru →

A SysOps Administrator is monitoring an e-commerce application log group named /aws/app/ecommerce in Amazon CloudWatch Logs. The application publishes database timeout event logs in the following JSON format:

`{ "requestId": "req-123", "service": "InventoryService", "event": "DB_TIMEOUT", "details": { "duration_ms": 1500, "retryCount": 3 } }`

The administrator needs to monitor the average timeout duration, count the occurrences, and trigger an alert if the average duration exceeds 2000 ms over a 5-minute period.

Which combination of actions must the SysOps Administrator perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a metric filter on the /aws/app/ecommerce log group with the filter pattern {

.event = "DB_TIMEOUT" }, and publish a custom metric where the metric value is set to

.details.duration_ms.

Create a CloudWatch alarm based on the custom metric, using the Average statistic, a period of 5 minutes, a threshold greater than 2000, and an Amazon SNS topic as the action.

Enable detailed monitoring on the EC2 instances hosting the application to ensure that the log group metric filter can publish metrics at 1-minute resolution instead of the default 5-minute resolution.

Modify the /aws/app/ecommerce log group retention setting to "Never Expire" to prevent metric filters from losing historical data when computing the 5-minute average.

Configure an AWS Config rule to evaluate the custom metric value, and associate the rule with a Systems Manager Automation document to publish a notification message to the SNS topic.

Cevabı ve açıklamayı göster

Cevap: Create a metric filter on the /aws/app/ecommerce log group with the filter pattern { $.event = "DB_TIMEOUT" }, and publish a custom metric where the metric value is set to$ .details.duration_ms.; Create a CloudWatch alarm based on the custom metric, using the Average statistic, a period of 5 minutes, a threshold greater than 2000, and an Amazon SNS topic as the action.

Cevap

To configure the monitoring and alerting system, create a metric filter with the filter pattern that matches the JSON path for the timeout event and extracts the duration value. Then, configure a CloudWatch alarm that tracks the Average statistic of this custom metric over a 5-minute period and notifies an SNS topic if it exceeds 2000.

To process the JSON log events, a CloudWatch metric filter needs to select the relevant JSON key and extract the corresponding value. The pattern `{

.event = "DB_TIMEOUT" }` correctly targets the database timeout logs, and the value is mapped to `

.details.duration_ms` to populate the custom metric. To alert on this data, a CloudWatch alarm must evaluate the metric using the Average statistic, a period of 5 minutes, and a threshold of 2000, triggering an SNS notification upon threshold breach.

Adım Adım Çözüm

Analyze the JSON log structure and create a metric filter to target the database timeout events.

A metric filter is defined with the pattern `{ $.event = "DB_TIMEOUT" }`.

This filters the log streams to target only database timeout entries.

Configure the metric value extraction for the filter.

The metric value is set to `$.details.duration_ms`.

This extracts the numerical latency value of each timeout event so that statistical operations can be performed on the metric.

Create a CloudWatch alarm on the newly created custom metric.

The alarm is configured with the Average statistic, a period of 300 seconds (5 minutes), and a threshold of 2000.

This monitors the average latency over the 5-minute window as specified in the requirements.

Define the alarm action to trigger notification routing.

The alarm state triggers a notification to an Amazon SNS topic when transitioning to the ALARM state.

This ensures support teams receive an email or message whenever the average database timeout exceeds the threshold.

Anahtar Kavram

Extracting custom numerical metric data from JSON logs using CloudWatch metric filters and configuring standard CloudWatch alarms to monitor statistical averages over a defined period.

Soru 136Soru →

A SysOps Administrator is setting up an organization trail in AWS CloudTrail to aggregate API activity logs from all member accounts into a centralized Amazon S3 bucket named company-audit-logs in the organization's management account (account ID 111122223333). The administrator creates the S3 bucket and configures the following bucket policy statement to authorize log delivery:

{
"Sid": "AWSCloudTrailWrite",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::company-audit-logs/AWSLogs/111122223333/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}

After enabling the organization trail, the administrator discovers that log files are successfully delivered for the management account, but log delivery fails for all member accounts with an access denied error. What action should the administrator take to resolve this issue?

Modify the S3 bucket policy's Resource parameter to target arn:aws:s3:::company-audit-logs/AWSLogs/o-organizationid/*, replacing o-organizationid with the ID of the organization.

Add a condition block to the existing S3 bucket policy statement that checks for "StringEquals": {"aws:PrincipalOrgID": "o-organizationid"} while maintaining the original Resource path.

Create a cross-account IAM role in each member account that allows s3:PutObject permissions to the bucket, and configure the organization trail to assume this role for log delivery.

Create separate statements in the S3 bucket policy for each member account, specifying arn:aws:s3:::company-audit-logs/AWSLogs/member-account-id/* as the Resource for each member account.

Cevabı ve açıklamayı göster

Cevap: Modify the S3 bucket policy's Resource parameter to target arn:aws:s3:::company-audit-logs/AWSLogs/o-organizationid/*, replacing o-organizationid with the ID of the organization.

Cevap

Modify the S3 bucket policy's Resource parameter to target arn:aws:s3:::company-audit-logs/AWSLogs/o-organizationid/*, replacing o-organizationid with the ID of the organization.

Updating the S3 bucket policy's Resource path to include the organization ID format matches the prefix CloudTrail uses for organization trails. This ensures that CloudTrail can successfully write logs for all accounts within the organization structure.

Adım Adım Çözüm

Determine the S3 bucket path structure used by AWS CloudTrail for organization trails.

CloudTrail writes organization trail logs using the path structure AWSLogs/o-orgid/account-id/ instead of AWSLogs/account-id/.

This path separation prevents conflict and organizes logs by organization ID before member account ID.

Evaluate the current S3 bucket policy's Resource element against the target delivery path.

The current Resource element allows writes only to AWSLogs/111122223333/*, which fails to match the required path containing the organization ID prefix for member accounts.

S3 evaluates policies strictly; if the write request's path prefix does not match the allowed Resource ARN, the request is denied.

Update the Resource ARN in the S3 bucket policy to allow writing to the organization-specific prefix path.

The Resource parameter is updated to include the wildcard organization path: arn:aws:s3:::company-audit-logs/AWSLogs/o-organizationid/*.

This ensures that CloudTrail has permissions to write logs for all accounts under the organization, resolving the delivery failure.

Anahtar Kavram

AWS CloudTrail organization trails store logs in S3 using an organization ID prefix (AWSLogs/o-orgid/), requiring the S3 bucket policy to grant write permissions explicitly to that path structure.

Soru 137Soru →

A SysOps Administrator is monitoring an application log group in Amazon CloudWatch Logs. The administrator has created a metric filter to match the term 'AccessDenied' and configured it to increment a custom metric named 'AccessDeniedCount'. The administrator now needs to ensure that the security team receives an email notification whenever this error occurs.

What is the next step the administrator must take to send an email notification when the error occurs?

Create a CloudWatch alarm based on the custom metric 'AccessDeniedCount' and configure it to send a notification to an Amazon SNS topic subscribed to the security team's email.

Enable Detailed Monitoring on the log group to trigger an email alert through the standard CloudWatch logging daemon.

Configure a log retention policy on the log group to forward matching events directly to the security team's email address.

Create an Amazon EventBridge rule that monitors the log group directly and uses a Systems Manager Automation runbook to email the team.

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch alarm based on the custom metric 'AccessDeniedCount' and configure it to send a notification to an Amazon SNS topic subscribed to the security team's email.

Cevap

Create a CloudWatch alarm based on the custom metric 'AccessDeniedCount' and configure it to send a notification to an Amazon SNS topic subscribed to the security team's email.

To send alerts based on log events, you must follow the CloudWatch log monitoring pattern: Metric Filter -> Custom Metric -> CloudWatch Alarm -> SNS Topic. The correct answer successfully describes this chain by configuring the alarm on the custom metric to notify an SNS topic that has the security team's email as a subscriber.

Adım Adım Çözüm

Use the custom metric generated by the CloudWatch Logs metric filter.

The numerical metric 'AccessDeniedCount' represents the volume of matching events.

Metric filters extract numerical metrics from log files but cannot send notifications directly.

Create a CloudWatch alarm on the custom metric with a threshold >= 1.

The alarm shifts into the ALARM state when the 'AccessDenied' pattern is matched in the logs.

Alarms evaluate metric values against defined limits to trigger automated actions.

Configure the alarm's action to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Amazon SNS sends an email to subscribed addresses when the alarm transitions to ALARM.

Amazon SNS is the standard mechanism to deliver email notifications from CloudWatch Alarms.

Anahtar Kavram

Integrating CloudWatch metric filters with alarms and SNS notifications for alerting

Tahmini Süre:1m 0s

Soru 138Soru →

A SysOps Administrator is configuring a new AWS CloudTrail trail to deliver log files to an Amazon S3 bucket. The trail is configured to encrypt the log files using a customer managed key in AWS Key Management Service (AWS KMS). However, the administrator notices that log files are not appearing in the S3 bucket, and CloudTrail reports delivery errors.

Which of the following actions must the administrator take to allow CloudTrail to successfully deliver the encrypted log files? (Select two.)

Geçerli olan tümünü seçin

Configure the Amazon S3 bucket policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject permission for the target log prefix.

Configure the KMS key policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the kms:GenerateDataKey* and kms:DescribeKey permissions.

Add a policy statement to the KMS key policy that allows the Amazon S3 service principal (s3.amazonaws.com) to perform kms:GenerateDataKey* and kms:Decrypt actions.

Attach an IAM policy to the administrator's IAM identity granting the iam:PassRole permission to pass the KMS key to the CloudTrail service.

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon S3 bucket policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject permission for the target log prefix.; Configure the KMS key policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the kms:GenerateDataKey* and kms:DescribeKey permissions.

Cevap

To resolve the delivery issues, the SysOps Administrator must configure the Amazon S3 bucket policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject permission, and configure the KMS key policy to grant the AWS CloudTrail service principal the kms:GenerateDataKey* and kms:DescribeKey permissions.

To successfully deliver encrypted logs, CloudTrail must have permissions on both the destination S3 bucket and the custom KMS key. The S3 bucket policy must allow the CloudTrail service principal to upload logs via the s3:PutObject action. Simultaneously, since CloudTrail encrypts the logs before delivery, the KMS key policy must grant the CloudTrail service principal the kms:GenerateDataKey* and kms:DescribeKey permissions.

Adım Adım Çözüm

Analyze the resource dependencies for AWS CloudTrail log delivery using KMS encryption.

Identify that CloudTrail writes log files directly to the destination Amazon S3 bucket and encrypts them using the specified KMS key before delivery.

Understanding the components involved in the write and encryption path identifies which policies need correction.

Verify S3 bucket policy permissions for CloudTrail log delivery.

Determine that the S3 bucket policy must explicitly permit the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.

Without this permission, S3 will reject write requests from CloudTrail, preventing logs from being delivered.

Verify KMS key policy permissions for CloudTrail log encryption.

Determine that the customer managed KMS key policy must explicitly permit the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* and kms:DescribeKey actions.

Because CloudTrail performs client-side encryption of logs before uploading them to S3, it must have permission to generate data keys using the specified customer managed key.

Anahtar Kavram

AWS CloudTrail log delivery relies on resource-based policies (S3 bucket policy and KMS key policy) to grant the CloudTrail service principal the necessary permissions to write to S3 and encrypt logs using customer managed KMS keys.

Soru 139Soru →

A SysOps Administrator is monitoring an Amazon EC2 instance that hosts a legacy transaction processing application. To detect transient CPU utilization spikes as quickly as possible, the administrator configures an Amazon CloudWatch alarm with a period of 60 seconds (1 minute) and an evaluation period of 1. However, the alarm remains in the INSUFFICIENT_DATA state, and CPU utilization spikes are not triggering the alarm. Which of the following actions will resolve this issue?

Enable detailed monitoring on the EC2 instance so that metric data is published to CloudWatch at 1-minute intervals.

Modify the alarm configuration to use a period of 5 minutes, as standard monitoring publishes EC2 metrics to CloudWatch at 1-minute intervals but aggregates them every 5 minutes.

Configure an Amazon EventBridge rule to trigger an AWS Systems Manager Automation document that periodically pulls the CPUUtilization metric from the instance OS.

Reduce the Auto Scaling group cooldown period to 60 seconds to force the EC2 instance to report its metric data at a faster rate.

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring on the EC2 instance so that metric data is published to CloudWatch at 1-minute intervals.

Cevap

Enable detailed monitoring on the EC2 instance so that metric data is published to CloudWatch at 1-minute intervals.

The correct answer is to enable detailed monitoring on the EC2 instance. By default, Amazon EC2 uses standard monitoring, which reports metrics (like CPUUtilization) to CloudWatch at 5-minute intervals. When an alarm is configured with a 60-second period, it expects data points at least every minute. Without detailed monitoring enabled, the lack of data points causes the alarm to enter the INSUFFICIENT_DATA state. Enabling detailed monitoring changes the reporting interval to 1 minute, resolving the issue while maintaining the fast detection period.

Adım Adım Çözüm

Analyze the alarm configuration and the current metric state.

The CloudWatch alarm is configured with a 1-minute period (60 seconds), but the alarm is in the INSUFFICIENT_DATA state.

By default, Amazon EC2 instances use standard monitoring, which sends metrics to CloudWatch at 5-minute intervals. An alarm with a 1-minute period will not have data points for every evaluation window, resulting in an insufficient data state.

Evaluate the requirement for rapid detection.

The requirement is to detect transient CPU utilization spikes as quickly as possible.

Keeping the alarm period at 1 minute is necessary to meet this requirement. Increasing the alarm period to 5 minutes would reduce the detection speed.

Select the correct mechanism to increase metric frequency.

Enabling detailed monitoring on the EC2 instance is the standard way to increase the frequency of EC2 hypervisor metrics (such as CPUUtilization) from 5-minute intervals to 1-minute intervals.

This provides the required 1-minute data points, allowing the 1-minute alarm to function properly and trigger quickly on spikes.

Anahtar Kavram

CloudWatch Standard vs. Detailed Monitoring for EC2 Instances

Tahmini Süre:1m 30s

Soru 140Soru →

A SysOps Administrator is troubleshooting an issue where an automated remediation workflow fails to run. The application publishes a custom metric named `DatabaseConnections` to CloudWatch at ` $1\text{-minute}$ ` intervals. The administrator configured a CloudWatch alarm to trigger a Systems Manager (SSM) Automation runbook to reboot the database instance if `DatabaseConnections` exceeds ` $100$ ` for ` $3$ ` consecutive periods of ` $1\text{-minute}$ `. However, during periods of high load, the alarm remains in the `INSUFFICIENT_DATA` state, and the runbook is never executed.

Which two configuration changes should the SysOps Administrator make to resolve this issue and successfully execute the remediation workflow? (Select TWO.)

Geçerli olan tümünü seçin

Update the CloudWatch alarm configuration to include the exact dimensions specified by the application when publishing the metric.

Create an Amazon EventBridge rule that monitors for the CloudWatch alarm state transition to ALARM and targets the Systems Manager Automation runbook.

Enable Detailed Monitoring on the EC2 instances to decrease the publishing interval of the custom metric from `

5

` minutes to `

1

` minute.

Configure the CloudWatch alarm's ALARM action to directly target the Systems Manager Automation runbook.

Decrease the Auto Scaling group cooldown period to ensure the reboot action is not blocked during metric evaluation.

Cevabı ve açıklamayı göster

Cevap: Update the CloudWatch alarm configuration to include the exact dimensions specified by the application when publishing the metric.; Create an Amazon EventBridge rule that monitors for the CloudWatch alarm state transition to ALARM and targets the Systems Manager Automation runbook.

Cevap

To resolve the issue, the SysOps Administrator must update the CloudWatch alarm configuration to include the exact dimensions specified by the application when publishing the metric, and create an Amazon EventBridge rule that monitors for the CloudWatch alarm state transition to ALARM and targets the Systems Manager Automation runbook.

To resolve the `INSUFFICIENT_DATA` state, the CloudWatch alarm must align with the exact dimensions defined by the application when publishing the metric. Additionally, because CloudWatch Alarms cannot directly invoke Systems Manager Automation runbooks, an Amazon EventBridge rule must be created to detect the alarm state transition to `ALARM` and route the execution to the runbook.

Adım Adım Çözüm

Analyze why the CloudWatch alarm remains in the `INSUFFICIENT_DATA` state despite metrics being published.

Identify that CloudWatch custom metrics require exact matching of dimensions, namespace, and metric name to retrieve data. If dimensions are missing or mismatched on the alarm, no data is found.

Resolves the metric retrieval issue causing the `INSUFFICIENT_DATA` state.

Analyze the pathway to trigger the remediation runbook.

Identify that CloudWatch Alarms do not support direct execution of Systems Manager Automation runbooks as alarm actions.

Requires an EventBridge rule to intercept the alarm state change and target the SSM Automation runbook.

Anahtar Kavram

Integrating CloudWatch Alarms with EventBridge for Automated SSM Remediation and Aligning Custom Metric Dimensions

ÖncekiSayfa 7 / 49Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram