Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 141Soru →

A SysOps Administrator is configuring monitoring for a containerized microservices application that writes logs to an Amazon CloudWatch Logs group in JSON format. A typical log event with a successful response looks like this:

{
"tenantId": "tenant-12",
"requestPath": "/checkout",
"responseCode": 200,
"executionTimeMs": 1250
}

For requests that fail due to an early gateway timeout, the `executionTimeMs` field is omitted from the JSON payload:

{
"tenantId": "tenant-12",
"requestPath": "/checkout",
"responseCode": 504
}

The Administrator needs to create a metric filter to track the latency of failed gateway requests (where `responseCode` is 502502 or 504504). The resulting metric must be named `GatewayLatency` in the custom namespace `AppMetrics`, with the dimension `Tenant` mapped to `tenantId` and the dimension `Path` mapped to `requestPath`. When the `executionTimeMs` field is missing, the metric must record a value of 15001500 milliseconds. Metric points should not be published for successful requests or other status codes.

Which configuration combination should the SysOps Administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Set the filter pattern to `{ .responseCode=502∣∣.responseCode = 502 || .responseCode = 504 }`. In the metric transformation, set the metric value to `.executionTimeMs‘andthedefaultvalueto.executionTimeMs` and the default value to 1500 .Configurethedimensions‘Tenant‘and‘Path‘tousetheJSONpaths‘. Configure the dimensions `Tenant` and `Path` to use the JSON paths `.tenantId` and `$.requestPath`, respectively.

Cevap

Set the filter pattern to `{ .responseCode=502∣∣.responseCode = 502 || .responseCode = 504 }`. In the metric transformation, set the metric value to `.executionTimeMs‘andthedefaultvalueto.executionTimeMs` and the default value to 1500 .Configurethedimensions‘Tenant‘and‘Path‘tousetheJSONpaths‘. Configure the dimensions `Tenant` and `Path` to use the JSON paths `.tenantId` and `$.requestPath`, respectively.
The correct configuration uses the filter pattern to select only the logs representing gateway errors (status codes 502502 or 504504). In the metric transformation, setting the metric value to the JSON path of the latency field and specifying a default value of 15001500 ensures that if the log event matches the filter pattern but lacks the latency field, CloudWatch still publishes the metric point with the value of 15001500 using the tenant and path dimensions.

Adım Adım Çözüm

1
Determine the correct CloudWatch Logs JSON filter pattern to select only the gateway timeout errors.
The correct pattern is `{ .responseCode=502∣∣.responseCode = 502 || .responseCode = 504 }`, which matches log events with either response status code.
We must isolate events that represent gateway failures before extracting execution time or applying default logic.
2
Identify the target metric extraction value and the required behavior for missing fields.
The metric value path is `.executionTimeMs‘.Topublish.executionTimeMs`. To publish 1500 whenthisfieldismissing, when this field is missing, 1500$ must be defined as the metric transformation's 'Default value'.
CloudWatch Logs metric filters use the default value only when the pattern matches the log event but the specified JSON path does not exist in that event.
3
Map the required dimensions using JSON paths.
Configure dimension key-value pairs: `Tenant` mapped to `.tenantId‘and‘Path‘mappedto‘.tenantId` and `Path` mapped to `.requestPath`.
This allows CloudWatch to publish the custom metric under the correct dimension categories extracted dynamically from the matching log events.
4
Evaluate the configuration logic to ensure missing field events are processed.
If the filter pattern does not check for field existence (i.e. does not use `EXISTS`), the log event matches, the dimensions are extracted, and the default value is successfully published.
Including `EXISTS` in the filter pattern would filter out the target logs before the metric transformation can apply the default value fallback.

Anahtar Kavram

CloudWatch Logs Metric Filters allow SysOps Administrators to extract metrics and custom dimensions from structured JSON logs. When log events match a filter pattern but lack the JSON field specified in the metric value, CloudWatch publishes the metric with the defined default value using the dimensions extracted from that log event.
Soru 142Soru →

A SysOps Administrator is configuring a new VPC Flow Log to send traffic data to an Amazon CloudWatch Logs group. To manage costs, the administrator wants to ensure that the flow logs are retained for exactly 90 days.

Which action must the administrator take to configure this retention period?

Cevabı ve açıklamayı göster

Cevap: Configure the retention setting directly on the target CloudWatch Logs group to 90 days.

Cevap

Configure the retention setting directly on the target CloudWatch Logs group to 90 days.
The correct answer is to configure the retention setting directly on the target CloudWatch Logs group. VPC Flow Logs do not store data or maintain retention settings on their own resource. They deliver logs to CloudWatch Logs or Amazon S3, and the retention or lifecycle rules must be configured on those destination resources.

Adım Adım Çözüm

1
Identify where VPC Flow Logs store data.
VPC Flow Logs are sent to a destination, in this case, an Amazon CloudWatch Logs group.
VPC Flow Logs do not store data directly; they deliver log events to the designated log group.
2
Determine how log retention is managed in CloudWatch.
Retention settings are configured at the Log Group level in CloudWatch Logs.
CloudWatch Logs groups allow you to define a retention period (e.g., 90 days) to automatically delete older log events.
3
Select the option that configures retention at the destination.
Changing the target CloudWatch Logs group's retention period to 90 days.
This is the native, cost-efficient, and direct way to manage the storage duration of flow logs.

Anahtar Kavram

VPC Flow Logs deliver traffic logs to Amazon CloudWatch Logs or Amazon S3. The retention period and lifecycle of the logs must be configured directly on the target destination (e.g., CloudWatch Log Group retention settings or S3 Lifecycle policies), as the VPC Flow Logs resource itself does not support retention configuration.
Soru 143Soru →

A SysOps Administrator is troubleshooting an Amazon CloudWatch alarm configured to monitor a custom application metric named `ProcessingErrors` across a fleet of Amazon EC2 instances. The application code publishes this metric to CloudWatch with two dimensions: `InstanceId` and `Environment`. The CloudWatch alarm is configured to monitor the `ProcessingErrors` metric filtering by the `Environment` dimension only, in order to alert on the total aggregate error count. However, the alarm remains in the `INSUFFICIENT_DATA` state. Which of the following actions should the SysOps Administrator take to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the application code to publish the metric using only the `Environment` dimension, omitting the `InstanceId` dimension.; Update the CloudWatch alarm to use a Metric Math expression with the `SEARCH` function to query and aggregate the metrics across all instances for the specified environment.

Cevap

To resolve the dimension mismatch and aggregate the metric, the SysOps Administrator must either modify the application code to publish the metric with only the `Environment` dimension, or update the CloudWatch alarm to use a Metric Math expression with the `SEARCH` function to aggregate the metrics across all instances.
CloudWatch treats metrics with different dimension sets as distinct metrics. Therefore, a metric published with both an instance ID and an environment cannot be retrieved using only the environment dimension. Modifying the application code to publish the metric without the instance ID dimension, or updating the alarm to use a Metric Math expression with the search function to dynamically sum the metrics resolves this issue.

Adım Adım Çözüm

1
Identify why the alarm is in the `INSUFFICIENT_DATA` state despite the metric being published.
Each unique dimension combination in CloudWatch is treated as a separate metric. The alarm queries the metric with only the `Environment` dimension, but it is only published with both `InstanceId` and `Environment` dimensions, meaning the queried metric does not exist.
Understanding CloudWatch's behavior with respect to dimensions is necessary to troubleshoot why the alarm cannot find the data.
2
Evaluate resolution strategies that allow aggregation of custom metrics.
To aggregate, either publish the metric with the specific target dimension combination (e.g., only `Environment`), or use CloudWatch Metric Math to search and aggregate the existing multi-dimensional metrics dynamically.
These two methods provide the correct and supported ways to sum or average metric values across multiple dimensions in CloudWatch.

Anahtar Kavram

CloudWatch Custom Metric Dimensions and Aggregation
Tahmini Süre:2m 0s
Soru 144Soru →

A SysOps Administrator is configuring automatic remediation for an AWS Config rule that checks if Amazon S3 buckets have server-side encryption enabled. The administrator wants to use an AWS Systems Manager (SSM) Automation document to automatically remediate non-compliant buckets. Which of the following configuration steps are required to set up this automated remediation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the AWS Config rule with the AWS-ConfigureS3BucketEncryption Systems Manager Automation document as the remediation target.; Specify an IAM execution role for the remediation, and grant the administrator the iam:PassRole permission for this role.

Cevap

Associate the AWS Config rule with the AWS-ConfigureS3BucketEncryption Systems Manager Automation document as the remediation target, and specify an IAM execution role for the remediation while granting the administrator the iam:PassRole permission for this role.
To set up automatic remediation in AWS Config, you must define the target Systems Manager Automation document (such as AWS-ConfigureS3BucketEncryption) and provide an IAM execution role that has permissions to remediate the resource. Crucially, the administrator configuring the rule must have the iam:PassRole permission to pass this execution role to AWS Config.

Adım Adım Çözüm

1
Select the correct AWS Systems Manager Automation document to perform the S3 encryption remediation.
The target remediation document is associated with the AWS Config rule.
AWS Config requires a target action, typically a pre-defined or custom SSM Automation document, to perform remediation.
2
Configure the remediation execution role and permissions.
An IAM role with S3 write permissions is designated, and the administrator is granted the iam:PassRole permission.
AWS Config must assume a role to execute the remediation actions on behalf of the user, requiring the administrator to pass the role explicitly.

Anahtar Kavram

AWS Config Remediation Configuration
Soru 145Soru →

A SysOps Administrator is configuring a monitoring solution for a fleet of web servers. The web servers write access logs to an Amazon CloudWatch Logs group in the Apache Common Log Format (CLF). The administrator needs to monitor for server-side errors and identify instances where response sizes exceed 10 KB10\text{ KB} (10,000 bytes10,000\text{ bytes}). Specifically, if there are more than 1515 occurrences of HTTP status codes in the 5xx5xx range combined with a response size greater than 10,000 bytes10,000\text{ bytes} within any 5-minute5\text{-minute} window, the administrator must receive an email notification. Additionally, to manage costs, the log group's retention period must be automatically adjusted to 3030 days if a peak event occurs, as it is currently set to never expire. Which TWO actions should the SysOps Administrator take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a metric filter on the log group using the pattern `[ip, id, user, timestamp, request, status_code = 5*, size > 10000]`. Create a CloudWatch alarm based on this metric with a threshold of 1515 within a 5-minute5\text{-minute} period, and configure an Amazon SNS action to send an email notification.; Create an Amazon EventBridge rule that triggers when the CloudWatch alarm transitions to the `ALARM` state, and configure the rule to target an AWS Systems Manager Automation document to update the log group's retention period to 3030 days.

Cevap

Create a metric filter with the pattern tracking status code 5* and size > 10000, setting up a CloudWatch alarm with SNS notifications, and create an EventBridge rule triggered by the alarm to run an SSM Automation document updating the log group retention to 30 days.
The correct options involve setting up a metric filter mapping the fields of the Apache CLF format to target status code 5* and response size > 10000. An alarm is configured on the resulting metric to trigger an SNS notification. To dynamically update the log retention, an EventBridge rule must be created to detect when the alarm enters the `ALARM` state, triggering an SSM Automation document that changes the log group retention configuration.

Adım Adım Çözüm

1
Parse the incoming log format and create a CloudWatch metric filter.
A metric filter with the pattern `[ip, id, user, timestamp, request, status_code = 5*, size > 10000]` is created, mapping to a custom metric.
Apache Common Log Format (CLF) maps variables positionally: client IP, client RFC 1413 identity, userid, timestamp, request string, status code, and size. Filtering status code with prefix 5* captures 5xx5xx errors, and size captures bytes.
2
Create a CloudWatch alarm on the generated custom metric.
An alarm is configured with a threshold of 1515 over a evaluation period of 5-minute5\text{-minute} and linked to an SNS topic for email alerts.
This evaluates the metric frequency within the required time window and notifies the administrator upon threshold breach.
3
Configure the automated remediation flow for log retention.
An EventBridge rule matches the alarm state transition to `ALARM` and invokes an SSM Automation document.
Alarms cannot execute administrative APIs like modifying log retention directly, so EventBridge must route the event to SSM Automation.

Anahtar Kavram

CloudWatch Logs Metric Filters and Event-Driven Remediation
Soru 146Soru →

An administrator wants to count database connection timeout errors in an application's logs using Amazon CloudWatch. The administrator sets up a metric filter on the log group to scan for the term 'Timeout' and configures a metric transformation to publish a value of 11 for each occurrence.

Which additional action is necessary to trigger a notification when the frequency of timeout errors exceeds a specific threshold?

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch alarm based on the new custom metric, and configure an Amazon SNS action to send the notification.

Cevap

Create a CloudWatch alarm based on the new custom metric, and configure an Amazon SNS action to send the notification.
The correct answer is to create a CloudWatch alarm based on the new custom metric, and configure an Amazon SNS action. Metric filters parse logs and output metrics, but do not possess alerting capabilities. A CloudWatch alarm must monitor the metric and trigger an SNS topic to notify administrators when thresholds are exceeded.

Adım Adım Çözüm

1
Verify that the metric filter is successfully scanning log events and outputting data to the custom metric.
The metric contains data points representing log occurrences.
Before an alarm can evaluate a metric, the metric must exist and receive data.
2
Create a CloudWatch alarm on the custom metric, setting the threshold and evaluation period.
An alarm is created to evaluate the metric over the specified time window.
An alarm is the only native CloudWatch mechanism that can evaluate thresholds and trigger state changes (OK, ALARM, INSUFFICIENT_DATA).
3
Configure an Amazon Simple Notification Service (SNS) action on the alarm state change to ALARM.
A notification is sent to the target topic subscribers when the metric exceeds the threshold.
Alarms must be associated with actions, such as Amazon SNS, to deliver external notifications to administrators.

Anahtar Kavram

CloudWatch metric filters define how log data is converted into metrics, while CloudWatch alarms monitor those metrics and initiate notifications or scaling actions.
Soru 147Soru →

To verify that CloudTrail logs have not been tampered with after delivery, an organization enables log file integrity validation. A SysOps administrator attempting to run the `aws cloudtrail validate-logs` command from the AWS CLI receives access denied errors when the command attempts to fetch the digest files from the Amazon S3 log bucket. The administrator has the necessary CloudTrail permissions, but the S3 bucket policy is highly restrictive. Which two modifications will resolve this access issue and allow log validation? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the `s3:GetObject` permission on the log and digest objects to the administrator's IAM identity in the S3 bucket policy.; Grant the `s3:ListBucket` permission on the bucket to the administrator's IAM identity in the S3 bucket policy.

Cevap

Granting `s3:GetObject` and `s3:ListBucket` permissions on the S3 bucket to the administrator's IAM identity.
To validate CloudTrail logs using the AWS CLI `validate-logs` command, the executing IAM identity must have read access to both the log files and the digest files in the Amazon S3 bucket. This requires the S3 bucket policy to permit the `s3:GetObject` action on the objects stored in the bucket and the `s3:ListBucket` action on the bucket itself so that the CLI can locate and retrieve the digest and log files.

Adım Adım Çözüm

1
Identify the resource access requirements for the `aws cloudtrail validate-logs` command.
The command requires read access (`s3:GetObject`) to both the logs and the digest files, as well as the ability to list objects (`s3:ListBucket`) in the S3 bucket.
The CLI needs to fetch digest files to reconstruct the cryptographic hash chain and verify the integrity of the log files.
2
Modify the S3 bucket policy in the target bucket.
Add statements that grant the administrator's IAM role both the `s3:GetObject` and `s3:ListBucket` permissions.
This resolves the client-side 'Access Denied' error by overriding the restrictive bucket policy for the validating user.

Anahtar Kavram

CloudTrail log file integrity validation relies on digest files stored in the S3 bucket, requiring the validating identity to have list and read permissions on those S3 resources.
Soru 148Soru →

A SysOps Administrator is setting up an AWS CloudTrail organization trail in the management account (account ID 111122223333) to log all API activity across all accounts in an AWS Organization (org ID o-exampleorg12). The administrator creates a centralized S3 bucket named org-audit-logs-bucket in the management account.

The S3 bucket policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailAclCheck",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::org-audit-logs-bucket"
},
{
"Sid": "AWSCloudTrailWrite",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::org-audit-logs-bucket/AWSLogs/111122223333/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}

After creating the organization trail, the administrator notices that logs from the management account are successfully delivered, but no logs are appearing for any of the member accounts in the organization. How should the SysOps Administrator modify the configuration to ensure logs from all member accounts are successfully delivered?

Cevabı ve açıklamayı göster

Cevap: Modify the S3 bucket policy's AWSCloudTrailWrite statement to include arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/* in the Resource element.

Cevap

Modify the S3 bucket policy's AWSCloudTrailWrite statement to include the organization ID log prefix (arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/*) in the Resource element.
For an AWS Organizations trail, AWS CloudTrail delivers log files for member accounts to a path prefixed with the organization ID (e.g., `AWSLogs/o-exampleorg12/`) rather than the individual management account ID. The S3 bucket policy must explicitly permit the `s3:PutObject` action for this path. Updating the `Resource` list in the `AWSCloudTrailWrite` statement to include `arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/*` allows CloudTrail to write the logs for all member accounts.

Adım Adım Çözüm

1
Analyze how CloudTrail writes logs for Organization trails.
Identify that CloudTrail delivers member account logs under the path prefix matching the Organization ID (o-orgId), whereas management account logs are delivered under the management account ID prefix.
To explain why only management account logs are successfully delivering while member logs are failing.
2
Examine the S3 bucket policy Resource element.
Locate the restriction where only the resource path 'arn:aws:s3:::org-audit-logs-bucket/AWSLogs/111122223333/*' is permitted for s3:PutObject.
To pinpoint the configuration mismatch causing the delivery failure for member accounts.
3
Update the Resource list in the S3 bucket policy.
Add 'arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/*' to the Resource list of the AWSCloudTrailWrite statement.
To authorize the CloudTrail service principal to write to the correct S3 path prefix used for member accounts.

Anahtar Kavram

CloudTrail Organization Trails S3 Bucket Policy Requirements
Soru 149Soru →

A SysOps Administrator is troubleshooting a CloudWatch alarm designed to initiate an automated remediation workflow when a custom application metric, `DatabaseQueryLatency`, exceeds 200 ms200\text{ ms}. The application runs on Amazon EC2 instances with standard monitoring enabled. The alarm is configured with a 1-minute evaluation period and is intended to trigger an AWS Systems Manager (SSM) Automation runbook. However, the administrator notices that the alarm remains in the `INSUFFICIENT_DATA` state even when latency is high, and the runbook is never executed.

Which TWO actions should the administrator take to resolve these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the CloudWatch alarm to specify the exact dimensions, such as `InstanceId` and `DatabaseName`, that are published with the custom metric.; Create an Amazon EventBridge rule that detects when the CloudWatch alarm transitions to the `ALARM` state, and configure it to target the Systems Manager Automation runbook.

Cevap

The correct actions are to configure the CloudWatch alarm with the exact dimensions published with the custom metric, and to create an Amazon EventBridge rule to route the alarm state change event to the Systems Manager Automation runbook.
The correct actions are configuring the alarm with the exact dimensions associated with the custom metric, which resolves the dimension mismatch causing the INSUFFICIENT_DATA state, and implementing an Amazon EventBridge rule to handle the alarm state change, which correctly connects the alarm to the Systems Manager Automation target.

Adım Adım Çözüm

1
Analyze why the CloudWatch alarm is in the INSUFFICIENT_DATA state.
Identify that CloudWatch custom metrics require exact matching dimensions to retrieve data points.
A custom metric published with dimensions like InstanceId and DatabaseName will not match an alarm configured without those exact dimensions, causing an INSUFFICIENT_DATA state.
2
Determine the correct integration pathway to invoke the Systems Manager Automation runbook from a CloudWatch alarm.
Create an Amazon EventBridge rule that triggers when the alarm state transitions to ALARM, with the SSM Automation runbook as the target.
CloudWatch alarms cannot directly target SSM Automation runbooks; an intermediate event routing mechanism is required.

Anahtar Kavram

CloudWatch custom metrics require matching dimensions to alarm properly, and automated remediation workflows using Systems Manager Automation runbooks must be triggered via Amazon EventBridge.
Soru 150Soru →

A SysOps Administrator is monitoring an application running on a fleet of Amazon EC2 instances. The application logs are streamed to an Amazon CloudWatch Logs log group named `/aws/app/production-backend` using the CloudWatch agent. The logs are structured in JSON format as follows:

{
"request_id": "req-9823f",
"path": "/checkout",
"latency_ms": 350,
"db_queries": 4
}

The administrator needs to monitor occurrences of high latency for the `/checkout` path. Specifically, they must trigger an AWS SNS notification if there are more than 55 requests to `/checkout` where `latencymslatency_ms` exceeds 500500 within any 11-minute window.

Which of the following configurations will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a metric filter with the pattern `{ .path = "/checkout" && .latency_ms > 500 }`, and set the metric value to `1`. Configure a CloudWatch alarm based on this metric using the `Sum` statistic and a period of 11 minute (6060 seconds).

Cevap

Create a metric filter with the pattern `{ .path = "/checkout" && .latency_ms > 500 }`, and set the metric value to `1`. Configure a CloudWatch alarm based on this metric using the `Sum` statistic and a period of 11 minute (6060 seconds).
The correct answer uses the proper JSON filter pattern syntax `{ .path = "/checkout" && .latency_ms > 500 }`. By setting the metric value to `1`, each matching log entry acts as a single count. Applying the `Sum` statistic over 11 minute (6060 seconds) with a threshold of >5> 5 matches the business requirements. Additionally, because CloudWatch Logs metric filters process logs on ingestion and publish data points at 11-minute intervals automatically, changing EC2 instance monitoring configurations is unnecessary.

Adım Adım Çözüm

1
Select the correct JSON filter pattern syntax.
`{ .path = "/checkout" && .latency_ms > 500 }`
Since the logs are in JSON format, JSON path matching syntax must be used instead of space-delimited syntax.
2
Define the metric value to represent occurrences rather than values.
Metric Value = `1`
Setting the metric value to `1` ensures that each matching log entry increments the custom metric by 1, which represents an occurrence.
3
Configure the CloudWatch alarm threshold and statistic.
`Sum` statistic over 11 minute (6060 seconds) with threshold >5> 5.
To detect if there are more than 55 occurrences within any 1-minute window, the `Sum` statistic must be aggregated over a 1-minute period.
4
Evaluate the need for EC2 Detailed Monitoring.
No configuration change needed on EC2 instances.
CloudWatch Logs metric filters process logs in real-time as they are sent to CloudWatch Logs, and publish metrics at 11-minute resolution by default.

Anahtar Kavram

CloudWatch Logs Metric Filters process log streams in real-time to generate metrics at 1-minute resolution, using JSON path expressions to match and extract fields from JSON logs.
Tahmini Süre:3m 0s
Soru 151Soru →

An e-commerce company operates an application on AWS where the frontend instances are managed by an Auto Scaling group (ASG). During scheduled flash sales, the company notices that CPU utilization spikes instantly on the active instances, causing the application to become temporarily unresponsive. However, the ASG fails to launch any new instances until exactly 55 minutes after the flash sale starts, despite a target tracking policy being active. The ASG's launch template does not have detailed monitoring enabled.

Which configuration adjustment will resolve the delay in the initial scale-out actions?

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring in the launch template of the Auto Scaling group so that metrics are sent to Amazon CloudWatch at 11-minute intervals.

Cevap

Enable detailed monitoring in the launch template of the Auto Scaling group so that metrics are sent to Amazon CloudWatch at 11-minute intervals.
Enabling detailed monitoring in the launch template sends EC2 metrics such as CPU utilization to CloudWatch at 11-minute intervals instead of the default 55 minutes. This reduces the latency of alarm evaluation, permitting target tracking policies to scale out the group much more rapidly during traffic spikes.

Adım Adım Çözüm

1
Analyze the observed delay pattern.
The delay is exactly 55 minutes, which matches the metric delivery interval of standard monitoring.
By default, basic or standard monitoring for EC2 instances posts metrics to CloudWatch at 55-minute intervals, delaying any scaling alarms built on these metrics.
2
Determine the scaling metric source configuration.
Standard monitoring is currently active because detailed monitoring is disabled in the launch template.
Auto Scaling groups inherit monitoring settings from their launch configurations or templates.
3
Select the appropriate resolution to reduce metric latency.
Enabling detailed monitoring on the launch template reduces the metric update interval to 11 minute.
This allows CloudWatch to receive metrics more frequently and evaluate the target tracking policy's threshold alarm within 11 minute of a load spike.

Anahtar Kavram

Standard vs. Detailed CloudWatch Monitoring for Auto Scaling Groups
Tahmini Süre:1m 30s
Soru 152Soru →

A SysOps Administrator enabled log file integrity validation on an AWS CloudTrail trail. The trail encrypts its logs at rest using a customer managed AWS KMS key and delivers them to an Amazon S3 bucket. An audit requires the administrator to verify the integrity of the logs using the AWS CLI. However, when running the `aws cloudtrail validate-logs` command, the validation fails. Which of the following configuration issues could cause this validation failure? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An S3 Lifecycle rule has transitioned the digest files under the prefix CloudTrail-Digest/ to the Amazon S3 Glacier Flexible Retrieval storage class.; The IAM identity executing the AWS CLI command lacks the kms:Decrypt permission for the customer managed KMS key.

Cevap

An S3 Lifecycle rule transitioning the digest files under the CloudTrail-Digest/ prefix to Amazon S3 Glacier Flexible Retrieval, and the IAM identity executing the command lacking the kms:Decrypt permission for the customer managed KMS key.
Log file integrity validation is a client-side function executed by the AWS CLI. The CLI downloads the digest files and log files from the S3 bucket and verifies the hashes. Therefore, the files must be immediately available (not transitioned to Glacier storage classes) and the administrator's IAM identity must have the necessary decryption rights via the KMS key policy.

Adım Adım Çözüm

1
Check the location and availability of the digest files in the S3 bucket.
Identify if the digest files are archived in a Glacier storage class, which requires restoration before validation can proceed.
The validate-logs command needs immediate read access to the digest files to perform integrity checks.
2
Verify the permissions of the IAM identity running the command.
Ensure the IAM identity has s3:GetObject and s3:ListBucket permissions on the S3 bucket, as well as kms:Decrypt permission on the KMS key used for encryption.
The validation process runs locally on the administrator's machine and must download and decrypt the log and digest files directly.

Anahtar Kavram

CloudTrail log file integrity validation relies on local CLI processing that fetches digest and log files directly from S3, requiring both immediate file availability (not archived in Glacier) and adequate read/decrypt permissions for the administrator's IAM identity.
Soru 153Soru →

An administrator is configuring a lifecycle hook (EC2_INSTANCE_TERMINATING) for an Amazon EC2 Auto Scaling group to back up application logs to an Amazon S3 bucket before instances are terminated. What is the correct chronological sequence of events starting from when the Auto Scaling group initiates the termination of an instance?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with the Auto Scaling group selecting the instance and transitioning it to the Terminating:Wait state. Next, Amazon EventBridge triggers a target function such as AWS Lambda. The target function performs the log backup to Amazon S3, and then calls the CompleteLifecycleAction API. Finally, the Auto Scaling group transitions the instance to the Terminating:Proceed state and terminates the instance.
The lifecycle hook flow requires that the Auto Scaling group first pauses termination (Terminating:Wait). This state change triggers EventBridge to invoke the cleanup script. Once the script backs up the logs to S3, it must call the CompleteLifecycleAction API with a CONTINUE result. The Auto Scaling group then changes the state to Terminating:Proceed and terminates the instance.

Adım Adım Çözüm

1
Select and pause the instance.
The instance goes into the Terminating:Wait state, which pauses the termination.
This state transition allows custom actions to run before the instance is shut down.
2
Detect transition and trigger automation.
Amazon EventBridge catches the event and invokes the target Lambda function.
EventBridge orchestrates the event-driven notification of the lifecycle transition.
3
Execute cleanup scripts.
Logs are transferred to the Amazon S3 bucket.
The task must occur while the instance is still fully operational in the wait state.
4
Signal lifecycle completion.
The CompleteLifecycleAction API is called with the CONTINUE result.
This informs the Auto Scaling group that the custom action is finished.
5
Terminate the instance.
The instance moves to Terminating:Proceed and is shut down.
The Auto Scaling group resumes the termination workflow after the signal is received.

Anahtar Kavram

Auto Scaling Lifecycle Hooks
Soru 154Soru →

A SysOps Administrator is monitoring a latency-sensitive application hosted on Amazon EC2 instances. The application publishes a custom metric named RequestLatency to Amazon CloudWatch. The administrator needs to design an automated remediation workflow that triggers within 30 seconds when average latency exceeds 500 milliseconds. Which TWO actions should the SysOps Administrator take to implement this monitoring and remediation capability? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the application to publish the RequestLatency metric with the StorageResolution parameter set to 1.; Create a CloudWatch alarm for RequestLatency with a Period of 10 seconds and Evaluation Periods set to 3.

Cevap

Configure the application to publish the RequestLatency metric with the StorageResolution parameter set to 1, and create a CloudWatch alarm for RequestLatency with a Period of 10 seconds and Evaluation Periods set to 3.
To detect latency issues and trigger a workflow within 30 seconds, a high-resolution alarm is necessary. CloudWatch supports high-resolution alarms with periods of 10 seconds or 30 seconds. To support this, the metric itself must be published as a high-resolution metric by specifying a storage resolution of 1 second (StorageResolution=1) during publication. An alarm period of 10 seconds with 3 evaluation periods provides a 30-second evaluation window to detect breaches.

Adım Adım Çözüm

1
Enable high-resolution custom metric publishing.
The application publishes the RequestLatency custom metric using the PutMetricData API with the StorageResolution parameter set to 1, which enables 1-second resolution storage in CloudWatch.
By default, custom metrics are stored at standard resolution (1-minute intervals). Monitoring and alarming at sub-minute intervals (like 10 seconds) requires the metric to be stored at high resolution.
2
Configure a high-resolution CloudWatch alarm.
Create a CloudWatch alarm on the RequestLatency metric with a Period of 10 seconds and Evaluation Periods set to 3.
This establishes a 30-second evaluation window (3 periods of 10 seconds) to satisfy the requirement of triggering the remediation workflow within 30 seconds.

Anahtar Kavram

CloudWatch High-Resolution Metrics and Alarms
Tahmini Süre:2m 30s
Soru 155Soru →

A company is hosting a file-sharing application on an Amazon EC2 instance that runs with standard monitoring enabled. To detect sudden spikes in outbound data transfer, a SysOps Administrator creates an Amazon CloudWatch alarm for the NetworkOut metric. The alarm is configured with a threshold of 500,000,000500,000,000 bytes, a period of 11 minute, and an evaluation period of 22. During a testing window, a large file transfer causes the NetworkOut metric to exceed the threshold for exactly 33 minutes, but the alarm remains in the OK state.

Which action will resolve this issue and ensure the alarm triggers during future traffic spikes?

Cevabı ve açıklamayı göster

Cevap: Activate detailed monitoring on the EC2 instance.

Cevap

Activate detailed monitoring on the EC2 instance.
The correct action is to activate detailed monitoring on the EC2 instance. Standard monitoring only publishes metrics to CloudWatch every 5 minutes. Because the alarm is configured with a 1-minute period and requires 2 consecutive breaching periods, it cannot trigger without detailed monitoring, which increases the reporting frequency to 1-minute intervals.

Adım Adım Çözüm

1
Analyze the reporting frequency under standard monitoring.
Standard monitoring for Amazon EC2 publishes metrics to CloudWatch at 5-minute intervals.
Understanding the default reporting frequency is necessary to identify why the alarm failed to evaluate consecutive 1-minute periods.
2
Evaluate the alarm configuration constraints.
The alarm has a 1-minute period and requires 2 consecutive breaching periods (2 minutes of data) to trigger.
This shows that the alarm needs metric data at 1-minute intervals to evaluate consecutive periods successfully.
3
Determine the solution to align reporting frequency with the alarm period.
Enabling detailed monitoring on the EC2 instance increases the metric reporting frequency to 1-minute intervals.
This allows CloudWatch to receive data every minute, enabling the alarm to evaluate consecutive 1-minute periods and trigger during a 3-minute spike.

Anahtar Kavram

CloudWatch Detailed Monitoring vs. Standard Monitoring for EC2 instances
Soru 156Soru →

A SysOps Administrator is monitoring a third-party payment processing helper utility that writes space-delimited transaction logs to Amazon CloudWatch Logs. The format of the log entries is:

`[timestamp, transaction_id, status_code, latency_ms, response_size]`

An example log entry is:

`2026-07-14T12:00:00Z tx-9988 502 350 1024`

The administrator wants to extract the `latency_ms` value into a custom metric for any transaction where the `status_code` is 500500 or higher.

Which TWO steps are required to correctly configure this monitoring solution? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the Filter Pattern to `[timestamp, transaction_id, status_code >= 500, latency_ms, response_size]`.; Set the Metric Value to `$latency_ms` in the metric transformation configuration.

Cevap

Setting the Filter Pattern to `[timestamp, transaction_id, status_code >= 500, latency_ms, response_size]` and setting the Metric Value to `$latency_ms` in the metric transformation configuration.
To extract latency data for server errors from a space-delimited log, the administrator must define the correct field mapping in the filter pattern and use a relational operator (`status_code >= 500`). The administrator must also configure the metric transformation to extract the specific value by referencing the field name with a dollar sign (`$latency_ms`).

Adım Adım Çözüm

1
Identify the correct space-delimited filter pattern syntax to filter log entries based on a specific field condition.
The pattern `[timestamp, transaction_id, status_code >= 500, latency_ms, response_size]` is constructed.
For space-delimited logs, fields are listed in brackets, and conditional expressions like `>= 500` are applied directly to the field name.
2
Specify the value to be extracted and recorded in the custom metric.
The metric value is set to `$latency_ms`.
Referencing a field value in a metric transformation requires prefixing the field name with a dollar sign (`$`).
3
Verify that the other options represent invalid or unrelated configurations.
Detailed monitoring, subscription filters to EventBridge, and log retention changes are discarded.
Detailed monitoring applies to EC2 instances, subscription filters do not target EventBridge directly, and log retention is for storage duration, not real-time log ingestion processing.

Anahtar Kavram

CloudWatch Logs Metric Filters allow SysOps administrators to search and filter log data, and extract values from space-delimited or JSON log entries to create custom metrics in real-time.
Soru 157Soru →

A SysOps Administrator is designing a centralized monitoring solution for an application distributed across two AWS accounts. Account A has Amazon Elastic Container Service (Amazon ECS) clusters running on AWS Fargate in the us-east-1 Region. Account B has ECS clusters running on AWS Fargate in the us-west-2 Region. The Administrator needs to create a single, consolidated Amazon CloudWatch dashboard in Account C (us-east-1) that displays container-level CPU and memory utilization metrics from both Account A and Account B clusters. The solution must minimize custom script development and operational overhead.

Which combination of actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable CloudWatch Container Insights on the ECS clusters in Account A and Account B by modifying the cluster settings to enable the containerInsights setting.; Configure CloudWatch cross-account observability by establishing a central sink in Account C and creating links to the sink in Account A and Account B, then select the appropriate source account and region when creating the dashboard widgets in Account C.

Cevap

To centralize container-level monitoring on ECS Fargate across multiple accounts and regions, the Administrator must modify the cluster settings to enable the containerInsights setting on the ECS clusters, and establish CloudWatch cross-account observability by configuring a central sink in the monitoring account and linking the source accounts to it.
The correct actions are enabling the containerInsights setting on the ECS clusters to natively gather Fargate performance metrics, and establishing CloudWatch cross-account observability with sinks and links to share the metrics with the centralized dashboard.

Adım Adım Çözüm

1
Enable Container Insights on the ECS clusters in Account A and Account B.
Performance metrics are natively collected and published to the ECS/ContainerInsights namespace in the respective accounts and regions.
ECS Fargate tasks do not support running the CloudWatch agent as a daemon service, but Container Insights natively reports metrics directly without agent deployment.
2
Configure a CloudWatch cross-account observability sink in Account C and links in Account A and Account B.
The source accounts (Account A and Account B) are authorized to share metric data with the monitoring account (Account C) without explicit STS assume-role requests at the dashboard widget layer.
This establishes the necessary cross-account trust boundaries using the modern, native observability configuration.
3
Construct the dashboard in Account C and add metric widgets querying the cross-account data sources.
The dashboard displays centralized container metrics from us-east-1 and us-west-2 directly within a single screen.
Dashboard widgets support cross-account and cross-region selections once native links are established.

Anahtar Kavram

Centralized cross-account and cross-region CloudWatch dashboarding using Container Insights for ECS Fargate.
Tahmini Süre:3m 0s
Soru 158Soru →

A SysOps Administrator is tasked with establishing a compliance baseline across all member accounts within an AWS Organization. The administrator wants to deploy a pre-defined package containing several AWS Config rules and their associated remediation actions as a single unit from the organization's management account.

Which of the following components or configurations are required to accomplish this deployment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An organization conformance pack deployed from the AWS Organizations management account or delegated administrator account.; An Amazon S3 bucket in the administration account to store the conformance pack template file.

Cevap

Deploying an organization conformance pack from the AWS Organizations management account or delegated administrator account, and utilizing an Amazon S3 bucket in the administration account to store the conformance pack template file.
Deploying an organization conformance pack from the management account automatically deploys the packaged set of AWS Config rules and remediations to all member accounts. The YAML template that describes the conformance pack must be stored in an Amazon S3 bucket within the administrator account so that AWS Config can reference it during the deployment process.

Adım Adım Çözüm

1
Determine the resource packaging method for AWS Config rules deployment across an organization.
Identify that Conformance Packs group Config rules and remediations as a single entity, and an Organization Conformance Pack allows deploying this group to all member accounts.
Deploying rules individually across hundreds of accounts increases operational overhead, whereas organization conformance packs automate this distribution from a centralized location.
2
Identify the storage dependency for deploying conformance pack templates.
Ensure an Amazon S3 bucket exists in the administration account to hold the YAML template body defining the conformance pack.
AWS Config requires the template defining the rules and remediation parameters to be stored in an accessible S3 bucket during deployment.

Anahtar Kavram

AWS Config Conformance Packs allow administrators to deploy a unified package of compliance rules and remediation actions across an AWS Organization, relying on a template stored in Amazon S3 for centralized rollout.
Soru 159Soru →

A SysOps Administrator is designing an automated remediation workflow for a web application running on an Amazon EC2 instance. The administrator needs to configure an Amazon CloudWatch alarm to monitor the EC2 instance's CPU utilization (CPUUtilizationCPUUtilization). The alarm must trigger an automated response if the CPU utilization exceeds 85%85\% for three consecutive 11-minute periods. The automated response must execute an AWS Systems Manager (SSM) Automation runbook. Which actions should the administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring on the EC2 instance to ensure CPU metric data is sent to CloudWatch at 11-minute intervals.; Create an Amazon EventBridge rule that detects when the CloudWatch alarm transitions to the ALARM state and targets the Systems Manager Automation runbook.

Cevap

Enable detailed monitoring on the EC2 instance to ensure CPU metric data is sent to CloudWatch at 1-minute intervals, and create an Amazon EventBridge rule that detects when the CloudWatch alarm transitions to the ALARM state and targets the Systems Manager Automation runbook.
To evaluate a CloudWatch alarm at 11-minute intervals for default EC2 metrics (like CPU utilization), detailed monitoring must be enabled on the EC2 instance. Without it, data is only published every 55 minutes. Additionally, CloudWatch alarms do not support direct invocation of Systems Manager Automation runbooks as an alarm action. An Amazon EventBridge rule must be created to detect the alarm state change event and target the runbook.

Adım Adım Çözüm

1
Determine metric resolution requirement
Identify that a 11-minute alarm period requires detailed monitoring (11-minute interval) rather than standard monitoring (55-minute interval) for EC2 instances.
Standard EC2 monitoring only sends metrics every 55 minutes, which is insufficient for a 11-minute period alarm.
2
Determine alarm target trigger flow
Select Amazon EventBridge as the event router since CloudWatch alarms cannot directly invoke Systems Manager Automation runbooks.
CloudWatch alarms natively support only SNS, EC2 actions, and Auto Scaling actions, making EventBridge necessary to route the state change event to Systems Manager.

Anahtar Kavram

Configuring CloudWatch alarms with detailed monitoring and routing alerts to AWS Systems Manager Automation via Amazon EventBridge.
Soru 160Soru →

A SysOps Administrator is configuring an automated remediation workflow for an application running on a standalone Amazon EC2 instance. The administrator wants to execute a custom AWS Systems Manager (SSM) Automation document to reboot the instance when the `CPUUtilization` metric exceeds 80%80\% for 33 consecutive 11-minute periods. Currently, default monitoring is enabled on the instance. During testing, the alarm remains in the `INSUFFICIENT_DATA` state and fails to trigger the remediation workflow.

Which of the following actions should the administrator take to resolve this issue and execute the remediation workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring on the EC2 instance.; Create an Amazon EventBridge rule that is triggered by the CloudWatch alarm state change to ALARM, and set the SSM Automation document as the target.

Cevap

To resolve the issues, the administrator must enable detailed monitoring on the EC2 instance to receive metric updates every minute, and construct an Amazon EventBridge rule that intercepts the CloudWatch alarm state change to trigger the Systems Manager Automation document.
To resolve the metric data issue, detailed monitoring must be enabled on the EC2 instance. Detailed monitoring changes the data aggregation frequency from 55 minutes to 11 minute, satisfying the alarm's requirement for consecutive 11-minute evaluation periods. To resolve the execution failure, an Amazon EventBridge rule must be created to intercept the CloudWatch alarm transition to the ALARM state and trigger the Systems Manager Automation document, as CloudWatch alarms cannot directly invoke Automation runbooks.

Adım Adım Çözüm

1
Analyze the metric collection frequency configuration.
Default (standard) EC2 monitoring collects metrics at 55-minute intervals. Because the alarm requires three consecutive 11-minute evaluation periods, it lacks sufficient datapoints and remains in the INSUFFICIENT_DATA state.
Detailed monitoring must be enabled on the EC2 instance to supply CloudWatch with metrics at the required 11-minute frequency.
2
Determine the correct target configuration for the remediation workflow.
CloudWatch alarms cannot natively invoke Systems Manager Automation documents directly as an alarm action.
An Amazon EventBridge rule must be created to detect the alarm state change and route the execution request to the Systems Manager Automation document target.

Anahtar Kavram

CloudWatch detailed monitoring configuration and EventBridge-based automated remediation.
ÖncekiSayfa 8 / 49Sonraki
Tüm alıştırma soruları — AWS Certified SysOps Administrator - Associate | Examkin