Practice CloudWatch Questions Now

Start a timed practice session focusing on Amazon CloudWatch topics from the SOA-C03 question bank.

SOA-C03 CloudWatch Question Bank (88 Questions)

Browse all 88 practice questions covering Amazon CloudWatch for the SOA-C03 certification exam. Answers are intentionally hidden on this page so you can self-test first before checking results in quiz mode.

Question 1Select All That ApplyMonitoring, Logging & Remediation
A company operates 6 AWS accounts within an Organization. The central operations team needs to view CloudWatch metrics, dashboards, and alarms from all member accounts in a single monitoring account without deploying additional infrastructure in each member account. Which approach achieves this? (Select TWO.)
AConfigure CloudWatch cross-account observability by setting the monitoring account as a sink and each member account as a source using organization-level linking.
BCreate a CloudWatch Metric Stream in each member account to Kinesis Data Firehose, which delivers data to the monitoring account's S3 bucket for Athena queries.
CUse the monitoring account's CloudWatch console to switch roles into each member account and view dashboards individually.
DEnable organization-level sharing links so that member accounts automatically share metrics, logs, and traces with the designated monitoring account.
EDeploy a CloudWatch Agent in the monitoring account that polls each member account using cross-account IAM roles.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 2Monitoring, Logging & Remediation
A company uses CloudWatch anomaly detection on the CPUUtilization metric for a fleet of EC2 instances. The team observes that each Monday morning the anomaly detection band does not account for the weekly traffic spike and raises false alarms. What should the administrator do to resolve this?
AIncrease the anomaly detection band width threshold to 3 standard deviations
BExclude Monday data from the anomaly detection model by specifying an exclusion period
CDelete the anomaly detection model and recreate it after collecting at least 14 days of data
DCreate a separate anomaly detection model that only evaluates Monday metrics
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 3Monitoring, Logging & Remediation
An application writes custom business metrics to Amazon CloudWatch using the `PutMetricData` API. The operations team wants to create a dashboard that shows the p99 latency of these custom metrics at 1-second granularity. The team discovers the data is only available at 1-minute resolution. What should the team do to achieve 1-second granularity?
APublish the metrics using the `StorageResolution` parameter set to 1 (high-resolution metrics).
BEnable detailed monitoring on the EC2 instances running the application.
CChange the CloudWatch agent collection interval to 1 second.
DUse CloudWatch Metric Streams to send data to a Kinesis Data Firehose at 1-second intervals.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 4Select All That ApplyMonitoring, Logging & Remediation
An organization has multiple AWS accounts under AWS Organizations. The central operations team needs a single CloudWatch dashboard in the management account that displays EC2 CPU utilization metrics from five workload accounts. What must the administrator configure? (Select TWO)
AEnable CloudWatch cross-account observability by creating a monitoring account link in each source account
BCreate an IAM role in each workload account that trusts the management account and allows `cloudwatch:GetMetricData`
CIn the management account, configure the CloudWatch console to add the source accounts as linked accounts
DReplicate all metrics to the management account using Kinesis Data Firehose
EEnable sharing of CloudWatch data in each source account through the CloudWatch settings for cross-account
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 5Select All That ApplyMonitoring, Logging & Remediation
A company operates workloads in three AWS Regions (us-east-1, eu-west-1, ap-southeast-1) across four accounts. The operations team needs a single CloudWatch dashboard in the monitoring account that displays EC2 and RDS metrics from all accounts and all Regions on one page. Which configuration achieves this? (Select TWO.)
AConfigure CloudWatch cross-account observability by designating the monitoring account as a sink and linking each source account in each Region.
BIn the monitoring account dashboard, add cross-account cross-Region widgets that reference the source account IDs and Region names.
CCreate a Kinesis Data Firehose stream in each Region to replicate metrics to the monitoring account's S3 bucket, then query with Athena.
DDeploy a CloudWatch Agent in the monitoring account that uses AssumeRole to pull metrics from remote accounts.
EUse CloudWatch Metric Streams in each account/Region to push metrics to the monitoring account's Amazon Managed Service for Prometheus endpoint.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 6Select All That ApplyMonitoring, Logging & Remediation
A multinational corporation operates workloads across four AWS accounts. The central operations team in the management account needs real-time visibility into CloudWatch metrics and dashboards from all member accounts without deploying agents in each account. (Select TWO.)
AEnable CloudWatch cross-account observability by configuring the management account as a monitoring account and the other accounts as source accounts
BCreate an IAM role in each source account that grants cloudwatch:GetMetricData to the monitoring account
CUse CloudWatch metric streams to send metrics from each account to a central Amazon S3 bucket, then query with Athena
DConfigure CloudWatch cross-account observability sharing for metrics, logs, and traces from each source account using the observability access manager
EInstall the CloudWatch unified agent on all instances with a cross-account IAM role for PutMetricData
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 7Monitoring, Logging & Remediation
A company has configured a CloudWatch anomaly detection model on the `NetworkIn` metric for a group of EC2 instances. After a planned migration increased average traffic by 40%, the anomaly detection band is consistently flagging normal traffic as anomalous. What is the BEST approach to resolve this quickly?
ADelete the existing anomaly detection model and create a new one; it will automatically retrain on the new traffic pattern within 3 hours
BIncrease the number of standard deviations in the anomaly detection band to accommodate the higher traffic
CWait for the anomaly detection model to retrain automatically; the model adapts continuously and will adjust within 1-2 weeks
DCreate an exclusion window covering the migration period so the model ignores the old baseline for that timeframe
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 8Monitoring, Logging, and Remediation
A SysOps administrator wants to monitor the CPU utilization of all EC2 instances across multiple regions from a single dashboard. Which CloudWatch feature enables cross-region metrics aggregation?
ACloudWatch cross-account observability
BCloudWatch cross-region dashboards
CCloudWatch Contributor Insights
DAWS Health Dashboard
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 9Monitoring, Logging & Remediation
A company uses Amazon CloudWatch Logs to store application logs from several EC2 instances. The operations team needs to create a metric that counts the number of `ERROR` log entries per minute and triggers an alarm when the count exceeds 50. Which approach should the team use?
ACreate a CloudWatch Logs metric filter that matches the pattern `ERROR`, publish it as a custom metric, and create a CloudWatch alarm on that metric.
BUse CloudWatch Logs Insights to run a scheduled query every minute that counts ERROR entries and sends the results to an SNS topic.
CConfigure the CloudWatch agent to parse ERROR entries and publish them as EMF (Embedded Metric Format) logs, then create an alarm on the extracted metric.
DEnable CloudWatch Logs anomaly detection on the log group and set the anomaly threshold to 50.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 10Monitoring, Logging & Remediation
A SysOps Administrator needs to create a CloudWatch alarm that triggers when the ratio of HTTP 5xx errors to total requests exceeds 5% on an Application Load Balancer. The ALB publishes `HTTPCode_Target_5XX_Count` and `RequestCount` as separate metrics. Which approach should the administrator use to build this alarm?
ACreate two separate CloudWatch alarms (one for 5xx count and one for request count) and combine them using a Composite Alarm.
BCreate a single CloudWatch alarm using a Metric Math expression that divides `HTTPCode_Target_5XX_Count` by `RequestCount` and sets a threshold of 0.05.
CCreate a CloudWatch Logs Insights query that calculates the error ratio and configure it to trigger an SNS notification.
DEnable ALB access logging to S3 and use Amazon Athena to query the error ratio on a schedule.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 11Monitoring, Logging & Remediation
A SysOps Administrator needs a CloudWatch alarm that fires when the combined CPU utilization across all instances in an Auto Scaling group exceeds 80% AND the ALB `TargetResponseTime` metric exceeds 2 seconds, at the same time. Creating two separate alarms would cause too many false positives. Which CloudWatch feature should be used?
AA single CloudWatch alarm using Metric Math to multiply the two metrics together.
BA CloudWatch Composite Alarm that combines the two individual alarms using AND logic.
CCloudWatch Anomaly Detection applied to both metrics simultaneously.
DA CloudWatch Synthetics canary that monitors both conditions.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 12Monitoring, Logging & Remediation
A CloudWatch alarm on an EC2 instance's `StatusCheckFailed_System` metric has been in the `INSUFFICIENT_DATA` state since creation. The instance is running and healthy. What is the MOST likely cause?
AThe alarm evaluation period is longer than the metric's reporting interval, causing gaps.
BThe IAM role attached to the instance does not have permission to publish CloudWatch metrics.
CThe alarm was created with an incorrect namespace or dimension, so CloudWatch cannot find matching data points.
DDetailed monitoring is not enabled, so the metric is only published every 5 minutes.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 13Monitoring, Logging & Remediation
A SysOps Administrator observes that a CloudWatch alarm transitions from `OK` to `ALARM` state, but the metric value appears to return to normal within one evaluation period. However, the alarm stays in `ALARM` state for several more periods. What is the MOST likely explanation?
AThe alarm uses a math expression that introduces a delayed evaluation window.
BThe alarm is configured with multiple datapoints-to-alarm (e.g., 3 out of 5) and still has breaching data points within the evaluation window.
CCloudWatch alarm state changes have a mandatory cool-down period of 5 minutes before returning to OK.
DThe SNS notification is queued, creating the appearance that the alarm is still active.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 14Monitoring, Logging & Remediation
A SysOps Administrator configures a CloudWatch alarm that monitors the `CPUUtilization` metric for an EC2 instance. The alarm fires unexpectedly during a brief spike that lasts only 1 minute, even though the intended threshold is a sustained high-CPU condition. The alarm uses a Period of 60 seconds and an Evaluation Period of 1 datapoint. Which change will ensure the alarm only fires during sustained CPU spikes?
AChange the statistic from Average to Maximum.
BIncrease the Evaluation Periods to 5 and set Datapoints to Alarm to 3 of 5.
CChange the Period to 300 seconds while keeping Evaluation Periods at 1.
DAdd an anomaly detection band instead of a static threshold.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 15Monitoring, Logging & Remediation
A SysOps Administrator configures a CloudWatch alarm that publishes to an SNS topic when the RDS `FreeStorageSpace` metric crosses a threshold. The team requires that the same alarm notification is sent simultaneously to an email distribution list, a PagerDuty HTTPS endpoint, and an AWS Lambda function that runs automated remediation. Which SNS configuration achieves this?
ACreate three separate SNS topics, each with one subscription type (email, HTTPS, Lambda), and configure the CloudWatch alarm to publish to all three topics.
BUse a single SNS topic with three subscriptions: one email subscription for the distribution list, one HTTPS subscription for PagerDuty, and one Lambda subscription for the remediation function.
CCreate one SNS topic with an email subscription and use EventBridge to route the alarm state-change event to PagerDuty and Lambda separately.
DCreate one SQS queue subscribed to the SNS topic and have PagerDuty and Lambda poll the queue.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 16Monitoring, Logging & Remediation
A company runs a multi-tier application across three AWS accounts. Each account has a CloudWatch alarm that monitors a critical metric. The operations team wants a single alarm that enters ALARM state only when ALL three individual alarms are in the ALARM state simultaneously. Which solution meets this requirement?
ACreate a CloudWatch composite alarm in the monitoring account that combines the three underlying alarms using an AND rule, with cross-account observability enabled to share alarm states.
BCreate an EventBridge rule in each account that forwards alarm state-change events to a central account, then use a Lambda function to evaluate the combined state.
CUse CloudWatch Contributor Insights to aggregate the three alarm states.
DSet up a CloudWatch Anomaly Detection model across accounts.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 17Monitoring, Logging & Remediation
A SysOps Administrator configures a CloudWatch alarm to automatically recover an EC2 instance when the `StatusCheckFailed_System` metric triggers. The instance is backed by an EBS volume. After a system status check failure, the alarm transitions to ALARM but the instance does not recover. What is the MOST LIKELY reason?
AThe alarm action was set to `Stop` instead of `Recover`.
BThe instance uses instance-store volumes, and the recover action only works with EBS-backed instances.
CThe IAM role attached to the instance does not include the `ec2:RecoverInstances` permission.
DThe alarm evaluation period is too long and the instance auto-healed before the action executed.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 18Select All That ApplyMonitoring, Logging & Remediation
A company has a CloudWatch alarm configured for an RDS instance's `FreeStorageSpace` metric. The alarm should notify the DBA team via email AND automatically execute an SSM Automation document that increases the allocated storage. Which configuration supports BOTH actions from a single alarm? (Select TWO.)
AAdd an alarm action that publishes to an SNS topic subscribed by the DBA team's email addresses.
BAdd an alarm action that triggers the SSM Automation document `AWS-ResizeRDSInstance` directly.
CCreate an EventBridge rule that matches the CloudWatch alarm state change to ALARM and targets the SSM Automation document.
DConfigure the alarm to invoke a Lambda function that sends the email and runs the Automation document.
EAdd a second alarm action pointing to a second SNS topic that triggers an SSM Automation execution via an EventBridge rule.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 19Monitoring, Logging & Remediation
A SysOps Administrator wants to monitor the number of objects in an S3 bucket over time. The `NumberOfObjects` metric for S3 is reported once per day. The administrator creates a CloudWatch alarm but notices the alarm stays in `INSUFFICIENT_DATA` state for hours. What is the MOST LIKELY cause?
AThe S3 bucket does not have request metrics enabled in the S3 console.
BThe alarm evaluation period is shorter than the metric reporting frequency; S3 storage metrics are published once every 24 hours, so the alarm needs a period of at least 86400 seconds.
CThe CloudWatch Agent is not installed on the instances accessing the S3 bucket.
DThe S3 bucket policy does not allow CloudWatch to read bucket metadata.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 20Select All That ApplyMonitoring, Logging & Remediation
An application running on Amazon EC2 is experiencing intermittent memory pressure. The SysOps administrator wants to create a CloudWatch alarm that triggers when available memory drops below 10% for 5 consecutive minutes. The default CloudWatch metrics do not show memory utilization. What must the administrator do? (Select TWO)
AInstall and configure the CloudWatch agent on the EC2 instance
BEnable detailed monitoring on the EC2 instance
CCreate a custom metric filter from VPC Flow Logs
DConfigure the CloudWatch agent to publish `mem_used_percent` metrics
EEnable Enhanced Monitoring on the EC2 instance
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 21Monitoring, Logging & Remediation
A SysOps administrator configures an Amazon CloudWatch composite alarm that combines three child alarms monitoring CPU, memory, and disk utilization. The composite alarm should only trigger when ALL three child alarms are in the ALARM state simultaneously. Which alarm rule expression should the administrator use?
A`ALARM(CPUAlarm) OR ALARM(MemoryAlarm) OR ALARM(DiskAlarm)`
B`ALARM(CPUAlarm) AND ALARM(MemoryAlarm) AND ALARM(DiskAlarm)`
C`NOT(OK(CPUAlarm)) AND NOT(OK(MemoryAlarm)) AND NOT(OK(DiskAlarm))`
D`ALARM(CPUAlarm) + ALARM(MemoryAlarm) + ALARM(DiskAlarm) >= 3`
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 22Monitoring, Logging & Remediation
A SysOps administrator has set up a CloudWatch alarm to monitor the `ApproximateNumberOfMessagesVisible` metric for an Amazon SQS queue. The alarm should trigger when the queue depth exceeds 10,000 messages for 3 consecutive evaluation periods of 5 minutes each. The administrator notices the alarm never triggers even though the queue regularly exceeds 10,000 messages briefly. What is the MOST LIKELY reason?
ASQS metrics are only published to CloudWatch every 15 minutes
BThe queue depth exceeds the threshold for less than 15 consecutive minutes
CThe CloudWatch alarm is configured with the wrong statistic type
DSQS metrics require detailed monitoring to be enabled
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 23Monitoring, Logging & Remediation
An administrator needs to create a CloudWatch alarm that triggers when the total number of errors across three Lambda functions exceeds 100 in a 5-minute period. The metric name is `Errors` under the `AWS/Lambda` namespace, one per function. What is the most efficient approach?
ACreate three separate alarms and use a CloudWatch composite alarm with an OR condition
BUse metric math to create an expression `SUM(METRICS("m"))` referencing all three function Errors metrics, then alarm on the expression
CPublish a custom metric that aggregates errors from all three functions using a Lambda function, then alarm on the custom metric
DUse CloudWatch Contributor Insights to aggregate the error counts and create an alarm on the insight rule
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 24Monitoring, Logging & Remediation
A company uses CloudWatch metric math to calculate the percentage of HTTP 5xx errors relative to total requests for an Application Load Balancer. The expression is defined as `m1 / m2 * 100`, where m1 is `HTTPCode_Target_5XX_Count` and m2 is `RequestCount`. During a period of zero requests, the alarm enters INSUFFICIENT_DATA. How should the administrator handle this to avoid unnecessary alert noise?
AAdd `FILL(m2, 1)` to avoid division by zero and set the alarm to treat missing data as `notBreaching`
BChange the expression to `IF(m2 > 0, m1/m2*100, 0)` and configure the alarm to treat missing data as `notBreaching`
CSet the alarm evaluation period to a longer interval to smooth out zero-request windows
DUse `METRICS("m1") / METRICS("m2") * 100` with `REMOVE_EMPTY` to suppress zero-request periods
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 25Monitoring, Logging & Remediation
An operations team wants to create a CloudWatch alarm that triggers when the ratio of HTTP 5xx errors to total requests exceeds 5% for an Application Load Balancer. The team wants to use existing ALB CloudWatch metrics without publishing custom metrics. Which approach should they use?
ACreate a CloudWatch composite alarm that combines separate 5xx and RequestCount alarms
BCreate a CloudWatch alarm based on a metric math expression dividing HTTPCode_ELB_5XX_Count by RequestCount
CCreate a CloudWatch anomaly detection alarm on the HTTPCode_ELB_5XX_Count metric
DCreate a CloudWatch Logs metric filter to calculate the ratio from ALB access logs
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 26Monitoring, Logging & Remediation
An operations team has configured CloudWatch alarms using metric math expressions. An alarm evaluates `METRICS("m1")/METRICS("m2") * 100` where m1 is error count and m2 is invocation count for a Lambda function. The alarm frequently enters INSUFFICIENT_DATA state even during normal operation. What is the most likely cause?
AMetric math expressions are not supported in CloudWatch alarms
BOne or both of the underlying metrics have periods with no data points, and the alarm treat-missing-data setting is configured as "missing"
CThe Lambda function has not been invoked frequently enough to generate high-resolution metrics
DThe IAM role for CloudWatch does not have permission to perform metric math calculations
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 27Monitoring, Logging, and Remediation
A SysOps administrator receives a CloudWatch alarm notification. They want to see which metric caused the alarm and view the last 24 hours of data. Where do they look?
ACloudTrail event history
BCloudWatch alarm history and the associated metric graph in the CloudWatch console
CAWS Config resource timeline
DSystems Manager OpsCenter
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 28Monitoring, Logging, and Remediation
A SysOps administrator configures a CloudWatch alarm for an S3 bucket's NumberOfObjects metric. The alarm is never triggered even when the bucket is empty. Why?
AS3 NumberOfObjects metric is only available with S3 Storage Lens
BS3 bucket metrics are only published once per day; the alarm evaluates daily data, not real-time
CS3 bucket metrics require the CloudWatch agent
DS3 metrics are only visible in us-east-1
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 29Select All That ApplyMonitoring, Logging & Remediation
A SysOps administrator is troubleshooting an issue where an EC2 instance's custom memory and disk metrics are not appearing in CloudWatch. The CloudWatch agent is installed and running on the instance. (Select TWO.)
AThe EC2 instance's IAM role is missing the `cloudwatch:PutMetricData` permission.
BThe CloudWatch agent configuration file does not include the `metrics` section for memory and disk.
CDetailed monitoring has not been enabled on the EC2 instance.
DThe CloudWatch agent is configured to send metrics to a different AWS Region than the one being viewed.
EThe EC2 instance does not have the `AmazonSSMManagedInstanceCore` policy attached.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 30Monitoring, Logging & Remediation
A development team deploys a microservices application that emits structured JSON logs from AWS Lambda functions. They want these logs to automatically generate CloudWatch metrics for business KPIs (e.g., order count, payment failures) without deploying additional infrastructure. Which approach should the administrator recommend?
ACreate CloudWatch metric filters on each Lambda log group with pattern matching for each KPI
BUse CloudWatch embedded metric format (EMF) in the Lambda function code to emit metrics within structured log entries
CStream Lambda logs via Kinesis Data Firehose to S3, then use Athena for KPI reporting
DDeploy a CloudWatch agent on a dedicated EC2 instance to parse Lambda logs and publish custom metrics
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 31Monitoring, Logging & Remediation
A SysOps administrator needs to identify all EC2 instances across five accounts that have not sent metrics to CloudWatch in the last 24 hours, indicating potentially stopped or unhealthy agents. Which approach is MOST operationally efficient?
AWrite a Lambda function in each account that queries EC2 and CloudWatch APIs, then aggregates results in a central S3 bucket
BUse Systems Manager Explorer to view managed instance compliance and filter for instances missing CloudWatch agent inventory
CUse CloudWatch cross-account search to query EC2 metrics and identify instances with no recent data points
DCreate AWS Config rules in each account that check for the CloudWatch agent running and aggregate with a Config Aggregator
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 32Monitoring, Logging & Remediation
A company runs a containerized application on Amazon ECS with the Fargate launch type. The operations team needs to monitor CPU utilization, memory utilization, and network throughput at the task and service level without installing any agents. Which CloudWatch feature provides these container-level metrics?
ACloudWatch Application Insights with ECS integration.
BCloudWatch Container Insights, which automatically collects task-level and service-level metrics for ECS on Fargate.
CCloudWatch custom metrics published by the application container using the PutMetricData API.
DCloudWatch Logs Insights queries against ECS task logs.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 33Monitoring, Logging & Remediation
A SysOps Administrator creates a CloudWatch dashboard to monitor production workloads and wants to share it in real time with a non-AWS stakeholder who does not have an AWS account. The dashboard must automatically refresh and be accessible via a web browser. Which approach should the administrator use?
AExport the dashboard as a JSON file and host it on an internal web server with a cron job that refreshes it hourly.
BEnable CloudWatch dashboard sharing, which generates a shareable link protected by a third-party single sign-on (SSO) provider or by username and password via Amazon Cognito.
CCreate a read-only IAM user with `CloudWatchReadOnlyAccess` and provide the credentials to the stakeholder.
DTake periodic screenshots of the dashboard and email them to the stakeholder using Amazon SES.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 34Select All That ApplyMonitoring, Logging & Remediation
A SysOps Administrator is troubleshooting why a CloudWatch Agent on an EC2 instance is not publishing custom metrics. The agent process is running, and the instance has internet connectivity. Which two items should the administrator verify FIRST? (Select TWO.)
AThe IAM instance profile attached to the EC2 instance includes the `CloudWatchAgentServerPolicy` managed policy.
BThe CloudWatch Agent configuration file specifies the correct metrics namespace and collection interval.
CThe EC2 instance has detailed monitoring enabled in the console.
DThe security group allows outbound traffic on port 443 to the CloudWatch API endpoint.
EThe instance is launched in a public subnet with an Internet Gateway.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 35Monitoring, Logging & Remediation
A development team deploys an AWS Lambda function that processes orders. The team wants the function to emit custom business metrics (e.g., `OrderValue`, `ProcessingTime`) to CloudWatch without making explicit `PutMetricData` API calls, to avoid the overhead and additional IAM permissions. Which approach should the SysOps Administrator recommend?
AWrite the metrics to the function's standard output as structured JSON using the CloudWatch Embedded Metric Format (EMF) specification, which CloudWatch Logs automatically extracts as custom metrics.
BUse the AWS SDK to call `PutMetricData` asynchronously after each invocation, which avoids blocking the main function logic.
CPublish the metrics to an SNS topic, and configure a CloudWatch Logs subscription filter to parse and create metrics.
DEnable Lambda Insights, which automatically captures custom business metrics alongside performance metrics.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 36Monitoring, Logging & Remediation
A SysOps Administrator notices that a CloudWatch Logs subscription filter sending data to a Kinesis Data Stream is throttled. The CloudWatch Logs metric `ForwardedLogEvents` is lower than expected and `ThrottledLogEvents` is non-zero. What is the MOST likely cause of the throttling?
AThe subscription filter pattern is too broad and matches too many log events.
BThe Kinesis Data Stream does not have enough shards to handle the incoming log volume from the subscription filter.
CThe CloudWatch Logs log group has a retention policy that is deleting events before they can be forwarded.
DThe IAM role used by the subscription filter lacks `kinesis:DescribeStream` permission.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 37Cost & Performance Optimization
A company uses a fleet of T3 burstable EC2 instances for a development environment. The SysOps Administrator notices that several instances are running in `unlimited` mode and are incurring unexpected charges for surplus CPU credits. The team wants to monitor credit usage proactively. Which CloudWatch metric should the administrator monitor, and what action should be taken when credits are low?
AMonitor the `CPUCreditBalance` metric. When the balance approaches zero, the instance will use surplus credits in unlimited mode, incurring charges. The administrator should set a CloudWatch alarm on `CPUSurplusCreditsCharged` to detect when surplus charges begin accumulating, and consider right-sizing to a fixed-performance instance type.
BMonitor `CPUUtilization` only and scale out additional T3 instances when utilization is high.
CMonitor `NetworkIn` and `NetworkOut` to detect overutilization.
DSwitch all instances to `standard` mode, which eliminates any CPU credit monitoring needs.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 38Select All That ApplyMonitoring, Logging & Remediation
A company runs a high-frequency trading application on EC2 instances and needs CloudWatch metrics at 1-second granularity so the team can detect CPU spikes within seconds. The default CloudWatch metrics report at 5-minute intervals. Which steps must the administrator take? (Select TWO.)
AInstall and configure the unified CloudWatch Agent on the EC2 instances with the `metrics_collection_interval` set to 1 second for the desired metrics.
BEnable detailed monitoring on the EC2 instances to switch from 5-minute to 1-minute resolution.
CPublish custom metrics to CloudWatch using the `PutMetricData` API with a `StorageResolution` of 1 (high-resolution).
DChange the EC2 instance type to a compute-optimized instance, which automatically publishes high-resolution metrics.
EUpgrade the AWS account to the CloudWatch Premium plan to unlock sub-minute metric resolution.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 39Select All That ApplyMonitoring, Logging & Remediation
An application team wants to set up a CloudWatch dashboard that automatically refreshes and shows the P99 latency for their Application Load Balancer alongside the `Invocations` count of a Lambda function. They also want to overlay deployment markers. Which CloudWatch dashboard features support this? (Select TWO.)
AUse a CloudWatch Metrics widget with the ALB `TargetResponseTime` metric and select the `p99` statistic.
BUse a CloudWatch Logs Insights widget to calculate P99 latency from ALB access logs.
CAdd vertical annotations to the dashboard at deployment timestamps to create deployment markers.
DUse a CloudWatch Contributor Insights widget to calculate P99 latency.
EEmbed an external Grafana iframe in the CloudWatch dashboard for deployment markers.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 40Monitoring, Logging & Remediation
A SysOps administrator notices that an Amazon EC2 instance's `StatusCheckFailed_System` metric is showing a value of 1 in CloudWatch. The instance is running a stateless web application behind an Application Load Balancer. What should the administrator do to resolve this with MINIMAL effort?
AStop and start the instance to migrate it to a new host
BReboot the instance from the EC2 console
CCreate a CloudWatch alarm that triggers an EC2 `recover` action on the metric
DTerminate the instance and launch a new one manually
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 41Monitoring, Logging & Remediation
A SysOps administrator is troubleshooting an application that writes to Amazon DynamoDB. The application occasionally receives `ProvisionedThroughputExceededException` errors. The DynamoDB table uses provisioned capacity mode. Which CloudWatch metric should the administrator examine FIRST to identify the root cause?
A`ConsumedReadCapacityUnits`
B`ThrottledRequests`
C`ConsumedWriteCapacityUnits`
D`WriteThrottleEvents`
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 42Monitoring, Logging & Remediation
A SysOps team needs to write a CloudWatch Logs Insights query that returns the top 10 most frequently occurring error messages from an application log group over the past 24 hours. Which query accomplishes this?
A`fields @message | filter @message like /ERROR/ | stats count(*) as errorCount by @message | sort errorCount desc | limit 10`
B`fields @message | filter @message = "ERROR" | count(@message) | top 10`
C`parse @message "ERROR: *" as errorMsg | stats sum(errorMsg) by errorMsg | sort desc | limit 10`
D`filter @message like /ERROR/ | display @message | dedup @message | limit 10`
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 43Monitoring, Logging & Remediation
A company's operations team configured CloudWatch cross-account observability. The monitoring account can view metrics from source accounts but cannot view log groups. What is the most likely cause?
AThe source accounts did not include `AWS::Logs::LogGroup` in their observability access manager sink policy
BThe monitoring account's IAM role does not have `logs:GetLogEvents` permission on the source accounts
CCloudWatch Logs sharing requires the unified CloudWatch agent to be installed in the source accounts
DThe source accounts need to enable CloudWatch Logs resource policies allowing cross-account access
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 44Monitoring, Logging & Remediation
A SysOps administrator is analyzing VPC Flow Logs stored in CloudWatch Logs. The administrator needs to identify the top 5 source IP addresses generating rejected traffic on port 443 in the last 6 hours. Which CloudWatch Logs Insights query is correct?
A`filter action = "REJECT" and dstPort = 443 | stats count(*) as rejectCount by srcAddr | sort rejectCount desc | limit 5`
B`fields srcAddr | filter action like "REJECT" | filter dstPort > 440 and dstPort < 444 | group by srcAddr | limit 5`
C`parse @message "* * * * * * * * REJECT * * * *" as f1,f2,srcAddr,f4,f5,f6,dstPort,f8,f9,f10,f11,f12 | filter dstPort = "443" | stats count() by srcAddr | sort count() desc | limit 5`
D`filter @message like /REJECT/ and @message like /443/ | stats count(*) by @message | sort count(*) desc | limit 5`
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 45Monitoring, Logging & Remediation
A company wants to stream real-time CloudWatch metrics from multiple AWS accounts into an Amazon S3 data lake for long-term analytics. The metrics should arrive in near real-time with minimal transformation. What is the MOST operationally efficient solution?
ACreate a CloudWatch Logs subscription filter in each account that sends metric data to a centralized Kinesis Data Stream, then use a Lambda consumer to write to S3
BConfigure CloudWatch metric streams in each account to send metrics in OpenTelemetry format to an Amazon Kinesis Data Firehose delivery stream that writes to S3
CDeploy a CloudWatch agent on every instance configured to write metrics directly to S3 using an S3 output plugin
DUse the CloudWatch GetMetricData API with a scheduled Lambda function in each account to poll metrics and write to S3 every minute
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 46Monitoring, Logging & Remediation
A development team uses a containerized application running on Amazon ECS with Fargate. They emit application metrics inside their code using `console.log()` in a structured JSON format. The team wants these metrics to appear as custom CloudWatch metrics without deploying a sidecar container or modifying the task definition. Which approach should the administrator recommend?
AEnable ECS Container Insights and configure it to parse JSON logs for custom metrics
BAdopt the CloudWatch embedded metric format (EMF) in the application's structured log output so CloudWatch automatically extracts dimensions and metrics from the logs
CConfigure a CloudWatch Logs subscription filter with a metric filter pattern to extract numeric values from the JSON logs
DDeploy the CloudWatch agent as a daemon service on the ECS cluster to scrape custom metrics from the container logs
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 47Monitoring, Logging & Remediation
A company uses Lambda functions to process financial transactions. During peak hours, cold starts cause latency spikes that breach SLA requirements. The administrator enabled provisioned concurrency, but now wants to monitor whether the provisioned concurrency is being fully utilized or if additional capacity is needed. Which CloudWatch metric should the administrator monitor?
A`ConcurrentExecutions` divided by `UnreservedConcurrentExecutions`
B`ProvisionedConcurrencySpilloverInvocations` — which counts invocations that exceeded provisioned concurrency and used on-demand capacity
C`ProvisionedConcurrencyUtilization` — which represents the fraction of allocated provisioned concurrency in use
D`Throttles` — which indicates requests that were rejected due to concurrency limits
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 48Select All That ApplyMonitoring, Logging & Remediation
A SysOps administrator configures CloudWatch metric streams to export EC2 metrics to a third-party monitoring platform via a Kinesis Data Firehose HTTP endpoint. After enabling the stream, no data appears at the destination. Which TWO actions should the administrator verify? (Select TWO.)
AThe metric stream IAM role has the `firehose:PutRecord` and `firehose:PutRecordBatch` permissions
BThe Kinesis Data Firehose delivery stream has the correct HTTP endpoint URL and an access key configured for the third-party platform
CCloudWatch metric streams require the CloudWatch agent to be installed on all source EC2 instances
DThe VPC endpoint for Kinesis Data Firehose has been provisioned in the same VPC as the EC2 instances
EThe metric stream has an include or exclude filter that may be inadvertently filtering out the EC2 namespace
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 49Monitoring, Logging & Remediation
A SysOps administrator needs to trace requests across multiple AWS services for a microservices application. The application uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The administrator wants a unified view that correlates traces, logs, and metrics in a single pane of glass within CloudWatch. Which feature should the administrator enable?
ACloudWatch Contributor Insights
BCloudWatch ServiceLens
CCloudWatch Application Insights
DCloudWatch Synthetics
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 50Select All That ApplyMonitoring, Logging & Remediation
A SysOps administrator is troubleshooting missing CloudWatch metric data for a custom application metric that was published 20 days ago. The metric was published with a storage resolution of 1 second (high-resolution). The administrator can still see the metric name but the granularity no longer matches the original 1-second data points. What explains this behavior? (Select TWO.)
AHigh-resolution data points are automatically deleted after 3 hours
BHigh-resolution data points with a period of less than 60 seconds are available for 3 hours
CAfter 15 days, data points with a period of 300 seconds are no longer available
DAfter 15 days, the data points are aggregated and available at a 1-hour resolution
EData points with a period of 60 seconds are available for 15 days
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 51Monitoring, Logging & Remediation
An administrator publishes a custom CloudWatch metric every 10 seconds using high-resolution with `StorageResolution` set to 1. After 60 days, the administrator queries the metric. What is the finest granularity of data available?
A1-second periods
B1-minute periods
C5-minute periods
D1-hour periods
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 52Monitoring, Logging & Remediation
A SysOps administrator needs to monitor the memory utilization of EC2 instances. The default CloudWatch metrics do not include memory. After installing and configuring the CloudWatch agent, the administrator still does not see memory metrics in the CloudWatch console. What should the administrator check FIRST?
AThe CloudWatch agent configuration file does not include the mem_used_percent metric
BThe EC2 instance does not have an IAM role with the CloudWatchAgentServerPolicy attached
CThe CloudWatch agent is running but publishing metrics to a different AWS Region
DThe instance type does not support detailed monitoring
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 53Monitoring, Logging, and Remediation
A SysOps administrator wants to create a metric from application logs showing the count of '5xx' errors per minute. Which CloudWatch feature creates this metric?
ACloudWatch Logs Insights
BCloudWatch metric filter on the log group
CCloudWatch composite alarm
DCloudWatch embedded metric format
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 54Monitoring, Logging, and Remediation
A SysOps administrator needs to collect custom application metrics (e.g., queue depth) from EC2 instances. Which tool ships these metrics to CloudWatch?
ACloudWatch built-in EC2 agent
BCloudWatch agent (amazon-cloudwatch-agent) with custom metrics configuration
CAWS X-Ray daemon
DAmazon Inspector agent
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 55Monitoring, Logging, and Remediation
A SysOps administrator wants to alert on anomalous EC2 network traffic patterns rather than static thresholds. Which CloudWatch feature supports anomaly detection?
ACloudWatch composite alarms
BCloudWatch anomaly detection — creates dynamic bands using ML
CCloudWatch Contributor Insights
DAWS GuardDuty
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 56Monitoring, Logging, and Remediation
A SysOps administrator wants to query CloudWatch Logs across all log groups in an account without switching between groups. Which CloudWatch Logs Insights feature enables this?
ACloudWatch Logs Insights cross-log-group queries (select multiple log groups in one query)
BCloudWatch Logs subscription filter
CCloudWatch Logs metric filter
DCloudWatch Logs Insights does not support multi-group queries
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 57Monitoring, Logging, and Remediation
A SysOps administrator wants to measure the p99 latency of API calls across multiple Lambda functions. Which CloudWatch feature computes percentile statistics from metric data?
ACloudWatch metric math
BCloudWatch percentile statistics (p99) on metric data
CCloudWatch Contributor Insights
DX-Ray service map
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 58Monitoring, Logging, and Remediation
A SysOps administrator needs to monitor memory utilization of EC2 instances. The CloudWatch console does not show memory metrics. Why?
AMemory metrics require a paid CloudWatch subscription
BEC2 hypervisor does not have access to guest OS memory; the CloudWatch agent must be installed on the instance
CMemory metrics are only available for Windows instances
DCloudWatch metrics for memory are delayed by 24 hours
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 59Monitoring, Logging, and Remediation
A SysOps administrator sets up a CloudWatch dashboard shared with an external stakeholder who does not have an AWS account. What sharing option allows this?
ACloudWatch dashboards cannot be shared with non-AWS users
BShare the dashboard publicly (with or without password) or embed it in an internal website
CExport the dashboard to PDF and email it
DGrant the stakeholder read-only IAM access
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 60Monitoring, Logging, and Remediation
A SysOps administrator needs to monitor DynamoDB consumed read and write capacity units. The application is throttling requests. Which CloudWatch metric indicates this?
ADynamoDB SuccessfulRequestLatency
BDynamoDB ConsumedReadCapacityUnits and ConsumedWriteCapacityUnits compared to ProvisionedReadCapacityUnits
CDynamoDB SystemErrors
DDynamoDB ReturnedItemCount
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 61Monitoring, Logging, and Remediation
A SysOps administrator wants to monitor the number of 4xx errors returned by an API Gateway. How is this metric published to CloudWatch?
ACloudWatch agent on API Gateway servers
BAPI Gateway automatically publishes 4xxError and 5xxError metrics to CloudWatch without any configuration
CEnable API Gateway access logs and create a metric filter
DUse X-Ray traces to count 4xx errors
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 62Monitoring, Logging, and Remediation
A SysOps administrator wants to monitor the bytes read/written per second for EBS volumes. Which CloudWatch metrics are used?
AEBS VolumeReadOps and VolumeWriteOps
BEBS VolumeReadBytes and VolumeWriteBytes
CEBS BurstBalance
DEBS Throughput
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 63Monitoring, Logging, and Remediation
A SysOps administrator uses CloudWatch Container Insights for ECS. Which metrics does it collect?
AOnly cluster-level CPU and memory
BTask-level and service-level CPU, memory, network I/O, storage I/O, and container insights data
COnly CloudTrail events for ECS
DECS does not support CloudWatch Container Insights
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 64Monitoring, Logging, and Remediation
A SysOps administrator wants to monitor custom business metrics (e.g., order count per minute) alongside infrastructure metrics. Which CloudWatch approach is MOST efficient?
ACloudWatch standard metrics for both business and infrastructure
BPublish custom metrics via the PutMetricData API or CloudWatch agent with embedded metric format
CStore metrics in DynamoDB and create CloudWatch alarms on DynamoDB
DUse Amazon Timestream for business metrics
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 65Monitoring, Logging, and Remediation
A SysOps administrator notices that a CloudWatch Logs Insights query is timing out for large log groups. What optimization reduces query time?
AIncrease CloudWatch Logs storage class
BNarrow the time range and add specific filter conditions to reduce the data scanned
CExport logs to S3 and use Athena
DCloudWatch Logs Insights cannot be optimized
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 66Monitoring, Logging, and Remediation
A SysOps administrator wants to troubleshoot an application issue by correlating CloudWatch metrics, logs, and X-Ray traces in a single view. Which CloudWatch feature provides this?
ACloudWatch Dashboards
BCloudWatch ServiceLens
CCloudWatch Application Insights
DAWS Systems Manager Explorer
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 67Cost and Performance Optimization
A SysOps administrator uses Amazon CloudWatch and has many custom metrics. CloudWatch costs are high. Which practices reduce CloudWatch metric costs?
AReduce metric resolution (use standard resolution instead of high resolution where precision is not critical)
BUse CloudWatch Logs metric filters instead of publishing individual PutMetricData calls for each event
CBoth A and B reduce CloudWatch costs
DCustom metrics cannot be optimized for cost
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 68Monitoring, Logging & Remediation
A SysOps administrator needs to create a CloudWatch alarm that triggers when the ratio of `5XXError` to total `RequestCount` on an ALB exceeds 5% for three consecutive evaluation periods of 5 minutes. How should the administrator configure this alarm?
ACreate two separate alarms for `5XXError` and `RequestCount`, then combine them using a CloudWatch composite alarm
BCreate a single alarm using a metric math expression: `m1/m2 * 100` where m1 is `5XXError` and m2 is `RequestCount`, with threshold > 5
CUse CloudWatch Anomaly Detection on the `5XXError` metric and set the anomaly band to 5%
DPublish a custom metric from a Lambda function that calculates the error rate, then alarm on that custom metric
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 69Monitoring, Logging & Remediation
A SysOps administrator has configured an SNS topic to receive all CloudWatch alarms. The team is overwhelmed with notifications and wants to route only `ALARM` state alarms for production resources to a PagerDuty integration, while `OK` and `INSUFFICIENT_DATA` go to a low-priority email. Which configuration achieves this?
ACreate two separate SNS topics—one for PagerDuty and one for email—and configure each alarm to send to the appropriate topic
BUse a single SNS topic with SNS subscription filter policies that filter on alarm state and resource tags
CConfigure CloudWatch alarm actions to send `ALARM` state to the PagerDuty SNS topic and `OK`/`INSUFFICIENT_DATA` states to the email SNS topic
DCreate an EventBridge rule that matches CloudWatch alarm state change events, filters by state and tags, and routes to the appropriate target
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 70Monitoring, Logging & Remediation
A security team needs to count the number of REJECT actions per source IP address per hour in their VPC Flow Logs, and trigger an alarm when any single IP exceeds 1,000 rejected connections in an hour. The flow logs are sent to a CloudWatch Logs log group. Which approach is MOST operationally efficient?
ACreate a CloudWatch Logs metric filter that matches `REJECT` in the flow log pattern, extracting the source IP as a dimension, then set a CloudWatch alarm on the resulting metric.
BExport VPC Flow Logs to S3 hourly and query with Amazon Athena to count rejects per source IP.
CStream VPC Flow Logs to a Kinesis Data Stream and process with a Lambda function that publishes custom metrics per source IP.
DEnable VPC Traffic Mirroring and analyze the mirrored packets using a third-party IDS.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 71Monitoring, Logging & Remediation
A company wants to automate incident response for critical production alerts. When a CloudWatch alarm fires, the system should automatically create an incident, notify on-call responders, track the timeline of actions, and provide a post-incident analysis. Which AWS service provides this integrated incident management capability?
AAmazon SNS with a Lambda function that creates Jira tickets and pages the on-call team.
BAWS Systems Manager Incident Manager, which integrates with CloudWatch alarms to create incidents, manage response plans, and track incident timelines.
CAWS Systems Manager OpsCenter, which creates OpsItems from CloudWatch alarms.
DAmazon EventBridge with AWS Step Functions to orchestrate the incident response workflow.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 72Deployment, Provisioning & Automation
A SysOps Administrator wants to automatically roll back a CloudFormation stack update if a specific CloudWatch alarm enters the `ALARM` state within 5 minutes of the update completing. The alarm monitors the application's HTTP 5xx error rate. Which CloudFormation feature provides this?
AEnable stack termination protection to prevent accidental rollbacks.
BConfigure rollback triggers on the stack, specifying the CloudWatch alarm ARN and a monitoring period of 5 minutes.
CAdd a `DeletionPolicy: Retain` to all resources so they survive a rollback.
DCreate a CloudWatch Events rule that detects the `UPDATE_COMPLETE` stack event and triggers a Lambda function to initiate rollback if the alarm is active.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 73Reliability & Business Continuity
A SysOps Administrator configures Route 53 health checks for a multi-region active-passive failover setup. The primary region runs an ALB, and the secondary is an S3 static website. The administrator needs a health check that evaluates the primary ALB and fails over to S3 only when both the ALB endpoint AND a CloudWatch alarm for backend health are in a failure state. Which Route 53 health check type should be used?
AAn HTTP health check against the ALB endpoint.
BA TCP health check against the ALB on port 443.
CA calculated health check that combines an HTTP health check for the ALB and a CloudWatch alarm health check, treating the endpoint as unhealthy only when both child checks fail.
DA CloudWatch alarm health check only, which monitors the ALB's `HealthyHostCount` metric.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 74Monitoring, Logging & Remediation
A company hosts a public-facing REST API behind Amazon API Gateway. The operations team needs to verify that the API returns HTTP 200 responses and that response latency stays below 3 seconds from multiple geographic locations every 5 minutes — even when no real users are active. If the check fails, a CloudWatch alarm must fire. Which solution meets these requirements with the LEAST operational overhead?
ADeploy AWS Lambda functions in multiple regions on an EventBridge 5-minute schedule, each calling the API and publishing a custom CloudWatch metric.
BCreate a CloudWatch Synthetics canary using the API canary blueprint, configure it to run every 5 minutes, and set a CloudWatch alarm on the `SuccessPercent` metric.
CEnable API Gateway execution logging, create a CloudWatch Logs metric filter for non-200 status codes, and alarm on the extracted metric.
DUse Route 53 health checks configured against the API endpoint URL with latency monitoring enabled.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 75Monitoring, Logging & Remediation
A SysOps Administrator receives frequent CloudWatch alarms from SSM OpsCenter about patch compliance failures across 50 EC2 instances. The team wants OpsCenter to automatically run a remediation runbook that re-applies the missing patches whenever an OpsItem is created for this alarm. Which configuration achieves this?
ACreate an EventBridge rule that matches OpsItem creation events with the source `aws.ssm` and target an SSM Automation document `AWS-RunPatchBaseline`.
BConfigure the OpsItem to include an associated SSM Automation runbook. When an operator approves the OpsItem, OpsCenter executes the runbook automatically.
CUse AWS Config auto-remediation with the `AWS-RunPatchBaseline` Automation document triggered by the `ec2-managedinstance-patch-compliance-status-check` Config rule.
DCreate a CloudWatch alarm action that directly invokes an SSM Run Command to apply patches.
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 76Monitoring, Logging & Remediation
A SysOps administrator has separate CloudWatch alarms for CPU utilization, memory utilization, and disk I/O on a fleet of production EC2 instances. The team wants a single alarm that enters ALARM state only when both the CPU alarm and the memory alarm are in ALARM state, regardless of the disk I/O alarm. Which approach should the administrator take?
ACreate a metric math expression that adds the CPU and memory metrics together, then alarm on the combined metric
BCreate a CloudWatch composite alarm with an alarm rule expression using AND logic for the CPU and memory alarms
CUse an EventBridge rule to capture both alarm state changes and trigger a Lambda function that evaluates the combined state
DConfigure a CloudWatch anomaly detection model that monitors both metrics simultaneously
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 77Monitoring, Logging & Remediation
A SysOps administrator has configured a composite alarm that combines three child alarms using the rule `ALARM(CPUAlarm) AND (ALARM(MemoryAlarm) OR ALARM(DiskAlarm))`. The current states are: CPUAlarm = ALARM, MemoryAlarm = OK, DiskAlarm = INSUFFICIENT_DATA. What is the state of the composite alarm if the missing data treatment for the composite alarm is set to `missing` → treat as "missing"?
AALARM, because one side of the OR is INSUFFICIENT_DATA which is treated as ALARM
BOK, because the OR condition evaluates to FALSE when one is OK and the other is INSUFFICIENT_DATA
CINSUFFICIENT_DATA, because one of the child alarms has INSUFFICIENT_DATA and the composite alarm treats missing as missing
DALARM, because AND with ALARM and OR with missing defaults to TRUE
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 78Monitoring, Logging, and Remediation
A SysOps administrator wants CloudWatch to automatically recover an EC2 instance when a system status check fails. Which action should be configured on the alarm?
ASNS notification to trigger a Lambda remediation function
BEC2 auto-recovery action (recover) on the alarm
CAuto Scaling terminate and replace
DAWS Systems Manager Automation runbook
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 79Monitoring, Logging, and Remediation
A SysOps administrator creates a CloudWatch alarm. The alarm state shows INSUFFICIENT_DATA. What does this mean?
AThe metric value exceeded the threshold
BThe metric has not received data within the evaluation period
CThe alarm has been disabled
DCloudWatch could not evaluate the metric due to a service error
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 80Monitoring, Logging, and Remediation
A SysOps administrator uses Amazon EventBridge to automate responses to CloudWatch alarms. An alarm triggers but the EventBridge target (Lambda) is not invoked. What should they check?
AThe Lambda function's VPC configuration
BThe EventBridge rule's event pattern matches the CloudWatch alarm state change event, and the Lambda resource policy allows EventBridge to invoke it
CCloudTrail data events for Lambda
DThe CloudWatch alarm's SNS subscription
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 81Monitoring, Logging, and Remediation
A SysOps administrator needs to create a CloudWatch alarm that fires only if BOTH network in AND CPU utilization are high simultaneously. Which feature enables this?
ATwo separate alarms with SNS
BCloudWatch composite alarm combining two child alarms with AND logic
CCloudWatch metric math combining both metrics
DEventBridge pattern matching both metrics
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 82Monitoring, Logging, and Remediation
A SysOps administrator needs a centralized operational view showing all CloudWatch alarms, Config findings, and SSM OpsItems across multiple accounts. Which service provides this?
AAWS CloudTrail
BAWS Systems Manager Explorer
CAWS Security Hub
DAmazon CloudWatch Application Insights
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 83Monitoring, Logging, and Remediation
A SysOps administrator wants to send a notification to a Slack channel when a CloudWatch alarm enters ALARM state. What is the simplest architecture?
ACloudWatch alarm → SNS → Lambda → Slack webhook
BCloudWatch alarm → EventBridge → Lambda → Slack webhook
CCloudWatch alarm → SNS → email → manual Slack post
DBoth A and B are equally simple
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 84Monitoring, Logging, and Remediation
A SysOps administrator configures CloudWatch alarms but is concerned about alarm fatigue from too many notifications. Which strategy reduces alarm fatigue?
ADelete low-priority alarms
BUse composite alarms to consolidate related alarms; implement tiered severity with different SNS topics
CIncrease alarm thresholds
DDisable CloudWatch alarms during off-hours
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 85Monitoring, Logging, and Remediation
A SysOps administrator wants to automatically create a ticket in Jira when a CloudWatch alarm fires. Which architecture achieves this?
ACloudWatch alarm → SNS → Lambda → Jira API
BCloudWatch alarm → EventBridge → Lambda → Jira API
CCloudWatch alarm → SQS → Lambda → Jira API
DBoth A and B work
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 86Monitoring, Logging, and Remediation
A SysOps administrator wants to see a unified operational view of all CloudWatch alarms, Config rule violations, and Security Hub findings for an account. Which tool provides this?
AAWS Health Dashboard
BAWS Systems Manager Explorer
CAWS Security Hub
DAmazon DevOps Guru
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 87Monitoring, Logging, and Remediation
A SysOps administrator receives a CloudWatch alarm indicating an RDS instance has less than 1 GB of free storage. What automated remediation can be configured?
AEnable RDS Storage Auto Scaling and set the maximum storage threshold
BCloudWatch alarm → SNS → Lambda → rds:ModifyDBInstance to increase storage
CBoth A and B
DCreate a larger RDS instance and migrate data
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz
Question 88Reliability and Business Continuity
A SysOps administrator uses CloudWatch alarms to detect failures. An alarm requires 3 consecutive evaluation periods of 1 minute each before firing. What is the impact of this configuration?
AThe alarm fires faster — 3 evaluations mean it's more sensitive
BThe alarm requires 3 minutes of sustained failure before firing, reducing false positives from transient issues
CThe alarm only fires during the third evaluation period
DUsing 3 periods increases alarm costs
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start SOA-C03 Quiz

Key CloudWatch Concepts for SOA-C03

cloudwatchmetricalarmdashboardlogs insightsmetric filteranomaly detectioncomposite alarm

SOA-C03 CloudWatch Exam Tips

Amazon CloudWatch questions in SOA-C03 are typically scenario-based. Focus on operations, observability, incident response, and automated remediation. Priority concepts: cloudwatch, metric, alarm, dashboard, logs insights, metric filter.

What SOA-C03 Expects

Anchor your answer in prioritize operational visibility and repeatable runbook-ready automation.
CloudWatch scenarios for SOA-C03 are frequently mapped to Domain 1 (22%), so read the objective carefully before picking controls or architecture.
Expect multi-topic scenarios where CloudWatch interacts with IAM, networking, storage, or observability patterns rather than appearing as an isolated question.
When two options are both technically valid, prefer the choice that best aligns with the exam's operational scope (Associate) and vendor best practices.

High-Value CloudWatch Concepts

Know the core CloudWatch building blocks cold: cloudwatch, metric, alarm, dashboard.
Review the edge-case features and limits for logs insights, metric filter; these details are commonly used to differentiate answer choices.
Practice service-integration reasoning: how CloudWatch pairs with CloudTrail, EventBridge, Systems Manager, Observability in real deployment patterns.
For SOA-C03, explain why the chosen CloudWatch design meets reliability, security, and cost expectations better than the alternatives.

Common SOA-C03 Traps

Watch for answers that deploy quickly but are hard to monitor or recover.
Questions in Monitoring, Logging, Analysis, Remediation, and Performance Optimization often include distractors that look correct for CloudWatch but violate least-privilege, durability, or availability requirements.
Avoid picking options purely by feature name; validate data path, failure handling, and governance impact before answering.
If the prompt hints at automation or repeatability, eliminate manual-only operational answers first.

Fast Review Checklist

Can you compare at least two CloudWatch implementation paths and justify which one best fits the scenario?
Can you map the chosen answer back to Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%) outcomes for SOA-C03?
Can you explain security and access boundaries for CloudWatch without relying on default-open assumptions?
Can you describe how CloudWatch integrates with CloudTrail and EventBridge during failure, scaling, and monitoring events?

Exam Domains Covering CloudWatch

Domain 1Monitoring, Logging, Analysis, Remediation, and Performance Optimization22%

Related Resources

🎯 Free SOA-C03 Mock Exam CloudTrail Questions EventBridge Questions Systems Manager Questions Observability Questions

More SOA-C03 Study Resources

← SOA-C03 Study Hub 30-Day Study Plan Full Practice Exam

📊 Amazon CloudWatch - SOA-C03 Practice Questions