I85PREP
⌘ K
AWS CloudOps Engineer (SOA-C03) study materials
AWS CloudOps Engineer (SOA-C03) study resources

AWS CloudOps Engineer (SOA-C03) practice questions

One question at a time. Build your AWS CloudOps Engineer (SOA-C03) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Monitoring, Logging, and Remediation

A company wants a single dashboard that shows CPU utilization for all EC2 instances tagged Environment=Prod. Which CloudWatch feature should be used to group the metrics automatically?

  1. CloudWatch Logs Insights queries
  2. CloudWatch dimension-based filtering on the tag key Correct answer.
  3. CloudWatch metric math functions
  4. AWS CloudTrail event selectors

Explanation

EC2 publishes metrics with a dimension for each tag key, so dashboards and alarms can filter by tag dimensions such as Environment=Prod. Metric math operates on existing time series rather than selecting instances.

Question 2Monitoring, Logging, and Remediation

An engineer needs to be notified when the average CPU utilization of an Auto Scaling group exceeds 80% for two consecutive 5-minute periods. Which combination of resources accomplishes this?

  1. A CloudWatch alarm with period 300 and EvaluationPeriods 2 Correct answer.
  2. A CloudWatch dashboard widget
  3. An AWS Config conformance pack
  4. A CloudWatch Logs metric filter

Explanation

A CloudWatch alarm evaluates a metric against a threshold using Period and EvaluationPeriods; two consecutive 300-second periods require EvaluationPeriods=2. Dashboards only visualize data and do not send notifications.

Question 3Monitoring, Logging, and Remediation

Which CloudWatch alarm state indicates that the metric data is insufficient to determine whether the threshold is breached?

  1. ALARM
  2. INSUFFICIENT_DATA Correct answer.
  3. OK
  4. MISSING

Explanation

CloudWatch alarms have three states: OK, ALARM, and INSUFFICIENT_DATA. The last occurs when the alarm has not received enough data points to evaluate the rule.

Question 4Monitoring, Logging, and Remediation

An application writes structured JSON logs to CloudWatch Logs. An engineer wants to count how many requests returned HTTP status 500. Which approach is most appropriate?

  1. Create a CloudWatch composite alarm
  2. Stream the logs to Amazon S3 and query with Athena
  3. Enable detailed monitoring on the instances
  4. Create a metric filter with a filter pattern matching the status field and a metric value of 1 Correct answer.

Explanation

Metric filters scan log events for a pattern and increment a custom metric, which can then be alarmed on. Detailed monitoring affects EC2 metrics, not log content.

Question 5Monitoring, Logging, and Remediation

Which AWS service records API calls made in an account for auditing and can deliver events to CloudWatch Logs?

  1. Amazon Inspector
  2. AWS CloudTrail Correct answer.
  3. AWS Trusted Advisor
  4. Amazon GuardDuty

Explanation

CloudTrail records management and data events for API activity and can be configured to send them to CloudWatch Logs for metric filters and alarms. The other services perform assessment or threat detection rather than API auditing.

Question 6Monitoring, Logging, and Remediation

A team wants EC2 instance metrics at one-minute granularity. What must be enabled?

  1. Detailed monitoring Correct answer.
  2. Basic monitoring
  3. Enhanced networking
  4. CloudWatch agent with the procstat plugin

Explanation

Detailed monitoring publishes EC2 metrics every minute, whereas basic monitoring publishes every five minutes. Enhanced networking and the CloudWatch agent relate to other capabilities.

Question 7Monitoring, Logging, and Remediation

Which feature lets an engineer run a query across multiple log groups in CloudWatch Logs to find the slowest Lambda invocations?

  1. AWS X-Ray analytics
  2. CloudWatch Logs Insights Correct answer.
  3. CloudWatch Synthetics
  4. CloudWatch ServiceLens

Explanation

Logs Insights is a query language for searching and analyzing log events across one or more log groups. The other options provide canaries, tracing, or combined views rather than ad hoc log queries.

Question 8Monitoring, Logging, and Remediation

An alarm must trigger an automated action that stops an EC2 instance when a custom metric exceeds a threshold. Which alarm configuration element defines that action?

  1. The treat missing data setting
  2. The alarm actions Correct answer.
  3. The metric math expression
  4. The statistic

Explanation

Alarm actions specify what happens when the alarm changes state, such as sending to an SNS topic or invoking an EC2 action. The statistic and metric math affect evaluation, not remediation.

Question 9Monitoring, Logging, and Remediation

A company needs to retain application logs for seven years at low cost and occasionally query them with SQL. Which destination is most appropriate for long-term storage?

  1. CloudWatch Logs with a 30-day retention
  2. CloudWatch Logs with no retention limit
  3. Amazon S3 with a lifecycle policy to Glacier Correct answer.
  4. Amazon Kinesis Data Streams

Explanation

Exporting logs to Amazon S3 allows lifecycle transitions to lower-cost storage classes such as Glacier for long-term retention, and services like Athena can query them. CloudWatch Logs retention is not designed for multi-year archival economics.

Question 10Monitoring, Logging, and Remediation

An engineer configures an alarm with TreatMissingData set to notBreaching. What is the effect when no data points arrive during an evaluation period?

  1. The alarm is evaluated as if the metric were within the threshold Correct answer.
  2. The alarm transitions to INSUFFICIENT_DATA
  3. The alarm is deleted after the evaluation period
  4. The alarm transitions to ALARM

Explanation

TreatMissingData controls how missing points are treated; notBreaching treats them as within the threshold so the alarm stays OK. The default behavior treats missing data as insufficient.

Question 11Monitoring, Logging, and Remediation

A Solutions Architect wants to reduce alarm noise by combining several underlying alarms so that a notification fires only when multiple conditions are true at once. Which feature should be used?

  1. Anomaly detection bands
  2. Metric filters
  3. CloudWatch dashboards
  4. Composite alarms Correct answer.

Explanation

Composite alarms combine the states of multiple alarms using AND/OR logic, reducing alert noise. Anomaly detection builds a model of normal behavior but does not combine alarms.

Question 12Monitoring, Logging, and Remediation

An application's traffic has a weekly pattern, and static thresholds cause false alarms during low-traffic nights. Which CloudWatch capability best addresses this?

  1. Disabling the alarm during nights
  2. Switching the statistic to Sum
  3. Increasing the alarm period to one hour
  4. Using anomaly detection on the metric Correct answer.

Explanation

Anomaly detection learns the metric's normal pattern, including daily and weekly seasonality, and alarms on deviations from the band. Static thresholds and manual disabling do not adapt to patterns.

Question 13Monitoring, Logging, and Remediation

A CloudWatch Logs metric filter is created with the default settings. How does CloudWatch publish the resulting custom metric?

  1. As a built-in metric in the AWS/Logs namespace
  2. As a custom metric in the same Region as the log group Correct answer.
  3. Only when an alarm references it
  4. Only after the log group is exported to S3

Explanation

Metric filters publish custom metrics into the Region where the log group resides, and they appear once matching log events are processed. They do not require an alarm to exist.

Question 14Monitoring, Logging, and Remediation

An operations team wants to receive an email when an alarm fires. Which sequence of resources achieves this with the least custom code?

  1. Alarm action to an EventBridge rule targeting Lambda
  2. Alarm action to an SQS queue polled by a script
  3. Alarm action to an SSM Automation document
  4. Alarm action to an SNS topic with an email subscription Correct answer.

Explanation

SNS supports email subscriptions directly, so an alarm action that publishes to an SNS topic delivers the notification without custom code. The other options require additional processing.

Question 15Monitoring, Logging, and Remediation

Which CloudWatch Logs feature automatically extracts fields from JSON log events so they can be referenced in metric filters and Insights queries?

  1. Log group tags
  2. Metric filters with JSON patterns Correct answer.
  3. Log stream sharding
  4. Subscription filters

Explanation

Metric filter patterns can reference JSON fields by name, allowing selective matching on structured events. Subscription filters stream logs elsewhere and do not parse fields for metrics.

Question 16Monitoring, Logging, and Remediation

An engineer needs to detect when an IAM policy change occurs and trigger a remediation function. Which CloudWatch Logs metric filter pattern on a CloudTrail log group is most appropriate?

  1. A pattern matching the request latency
  2. A pattern matching the source IP address
  3. A pattern matching the log level ERROR
  4. A pattern matching the eventName for policy change API calls Correct answer.

Explanation

CloudTrail events include an eventName field, so a metric filter matching relevant API names (for example, PutUserPolicy) can drive an alarm and remediation. Log level and latency fields are not present in CloudTrail events.

Question 17Monitoring, Logging, and Remediation

An alarm is configured with a period of 60 seconds and a statistic of Average. Which statement about the evaluated data is accurate?

  1. The alarm requires at least 60 data points to evaluate
  2. Each evaluation uses the average of all data points in the preceding 60 seconds Correct answer.
  3. The alarm ignores data points older than one day
  4. The alarm evaluates the maximum data point over 60 minutes

Explanation

The period defines the length of each evaluation window, and the statistic aggregates the data points within that window. A 60-second period with Average uses the mean of the samples in that minute.

Question 18Monitoring, Logging, and Remediation

A team wants CloudWatch to stop an idle EC2 instance automatically when CPU stays below 5% for 30 minutes. Which configuration best meets the requirement?

  1. A CloudWatch dashboard with a CPU widget
  2. A metric filter on system logs and an SNS topic
  3. An AWS Config rule that flags idle instances
  4. An alarm with period 300, EvaluationPeriods 6, and an EC2 stop action Correct answer.

Explanation

Six consecutive 300-second periods equal 30 minutes, and the alarm action can stop the instance directly. Config rules evaluate compliance but do not perform automatic stop actions.

Question 19Monitoring, Logging, and Remediation

Which statement describes the difference between CloudWatch Logs subscription filters and metric filters?

  1. Metric filters stream log events; subscription filters increment metrics
  2. Both create custom metrics from log events
  3. Subscription filters stream log events to a destination; metric filters increment metrics Correct answer.
  4. Both stream log events to Lambda

Explanation

Subscription filters deliver matching log events in near real time to services such as Kinesis or Lambda. Metric filters convert matches into numeric metrics for alarms and dashboards.

Question 20Monitoring, Logging, and Remediation

An engineer must ensure that an alarm on a metric with sparse data does not stay in ALARM indefinitely after data stops arriving. Which setting controls this behavior?

  1. The alarm description
  2. The metric namespace
  3. The treat missing data setting Correct answer.
  4. The comparison operator

Explanation

Treat missing data determines how gaps are handled, including whether an alarm can transition out of ALARM when data stops. The comparison operator defines the threshold logic but not missing-data handling.

Question 21Monitoring, Logging, and Remediation

A company needs to aggregate the same custom metric from many instances and alarm only on the fleet total. Which feature should be used?

  1. A single alarm per instance
  2. CloudWatch metric math with SUM across the metrics Correct answer.
  3. CloudWatch Logs Insights
  4. AWS Health Dashboard

Explanation

Metric math can combine multiple time series, such as summing per-instance metrics into a fleet total for a single alarm. Per-instance alarms would not evaluate the aggregate.

Question 22Monitoring, Logging, and Remediation

An engineer wants to detect unusual API activity in CloudTrail logs and route matching events to a Lambda function for automatic key deactivation. Which combination achieves this?

  1. A CloudWatch Logs subscription filter to Lambda Correct answer.
  2. A CloudWatch dashboard widget
  3. A CloudWatch alarm with an SNS email subscription
  4. An AWS Config remediation action

Explanation

Subscription filters can stream matching CloudTrail log events to Lambda in near real time, enabling automated remediation. SNS email notifications require manual action, and dashboards do not trigger functions.

Question 23Monitoring, Logging, and Remediation

An alarm uses a custom metric published every 5 minutes but is configured with a 1-minute period. What is the most likely result?

  1. The alarm evaluates more frequently with interpolated values
  2. The alarm automatically changes the period to 5 minutes
  3. The alarm frequently enters INSUFFICIENT_DATA because periods lack data Correct answer.
  4. The alarm publishes additional data points to fill gaps

Explanation

When the alarm period is shorter than the metric's resolution, many evaluation windows contain no data, which by default yields INSUFFICIENT_DATA. CloudWatch does not interpolate or auto-adjust the period.

Question 24Monitoring, Logging, and Remediation

A team needs a cross-account view where alarms in a central account evaluate metrics published by workloads in many member accounts. Which approach is valid?

  1. Publish metrics from member accounts to a central account using cross-account metric sharing and create alarms there Correct answer.
  2. Create identical alarms in each account and rely on email
  3. Use CloudTrail organization trails to aggregate metrics
  4. Enable detailed monitoring in each account

Explanation

CloudWatch supports cross-account observability, allowing a monitoring account to view and alarm on metrics from source accounts. Identical per-account alarms do not provide a unified evaluation.

Question 25Monitoring, Logging, and Remediation

An alarm on a metric filter for a critical error pattern must trigger remediation quickly but avoid repeated triggers for the same persistent condition. Which configuration best balances these goals?

  1. A metric filter with a 30-day retention
  2. A low period with EvaluationPeriods of 1 and an alarm action that is idempotent Correct answer.
  3. A composite alarm with no underlying alarms
  4. A high period with EvaluationPeriods of 1 and no actions

Explanation

A short period with a single evaluation detects the condition quickly, and an idempotent remediation action ensures repeated state changes do not cause harm. Longer periods or missing actions delay or prevent remediation.

Question 26Monitoring, Logging, and Remediation

A CloudWatch alarm monitors a metric and is configured with three evaluation periods and a threshold of 80. The metric breaches the threshold in two consecutive periods and then returns to normal. What is the alarm state after the third period?

  1. INSUFFICIENT_DATA, because the evaluation was interrupted by a normal period.
  2. OK, because the alarm requires three consecutive breaching periods to enter ALARM. Correct answer.
  3. ALARM, because any single breaching period latches the alarm until manually reset.
  4. OK, because the alarm state is based only on the most recent period.

Explanation

An alarm transitions to ALARM only when the number of breaching data points meets or exceeds the evaluation periods within the most recent periods. Two breaches out of three are below the configured threshold of three, so the alarm remains OK. The state does not latch and is not based solely on the last period.

Question 27Monitoring, Logging, and Remediation

A CloudWatch Logs log group receives application logs. An engineer wants to archive all log events to Amazon S3 in near real time for long-term storage. Which CloudWatch Logs feature should be used?

  1. Log insights queries
  2. Metric filters
  3. Contributor Insights
  4. Subscription filters Correct answer.

Explanation

Subscription filters deliver log events to destinations such as Kinesis Data Streams, Lambda, or Firehose, which can then write to S3. Metric filters only create metrics, and Logs Insights and Contributor Insights are for querying and analysis, not continuous export.

Question 28Monitoring, Logging, and Remediation

An engineer wants to create a CloudWatch alarm that sends a notification to an Amazon SNS topic when the estimated charges for an AWS account exceed a defined budget. Which metric should the alarm monitor?

  1. The AWS/Usage ResourceCount metric in the account's default Region
  2. The AWS/Billing EstimatedCharges metric in the us-east-1 Region Correct answer.
  3. The AWS/Billing EstimatedCharges metric in every Region
  4. The AWS/CloudTrail event count metric in each Region

Explanation

Billing metrics are published only in the us-east-1 Region under the AWS/Billing namespace. Alarms for estimated charges must therefore be created in us-east-1, and the account must have billing alerts enabled. Other namespaces and Regions do not provide the billing metric.

Question 29Monitoring, Logging, and Remediation

A CloudWatch Logs log group contains sensitive data. An engineer must ensure that log events are encrypted at rest using a customer managed AWS KMS key. What is the correct approach?

  1. Enable encryption on the log group by associating the KMS key with the log group. Correct answer.
  2. Encrypt the underlying CloudWatch Logs service-linked role with the KMS key.
  3. Enable AWS KMS encryption on the CloudWatch agent configuration.
  4. Use an S3 bucket with default encryption as the log destination.

Explanation

CloudWatch Logs supports associating a customer managed KMS key with a log group, which encrypts log data at rest. The key policy must allow the logs service principal to use the key. Encrypting roles, destinations, or agents does not encrypt the log group itself.

Question 30Monitoring, Logging, and Remediation

A company wants to detect when an IAM user's access key is used from an unusual geographic location. The company already delivers CloudTrail events to CloudWatch Logs. Which CloudWatch Logs feature should be used to identify the source IP addresses associated with the API calls?

  1. Metric filters that count all API calls
  2. Subscription filters that forward events to S3
  3. Logs Insights queries that parse the sourceIPAddress field Correct answer.
  4. Alarm on the IncomingLogEvents metric

Explanation

CloudWatch Logs Insights can query and parse structured fields such as sourceIPAddress in CloudTrail log events. This allows analysis of geographic patterns. Metric filters count patterns but do not provide field-level querying, and the other options do not inspect event content.

Question 31Monitoring, Logging, and Remediation

An engineer needs to view a graph of a custom metric alongside the logs that were generated during the same time period. Which CloudWatch feature allows correlating metric data with log data in a single view?

  1. CloudWatch dashboards with metric and log widgets Correct answer.
  2. CloudWatch ServiceLens
  3. CloudWatch Contributor Insights
  4. CloudWatch Synthetics

Explanation

CloudWatch dashboards support widgets that display both metrics and Logs Insights query results, enabling correlation in a single view. ServiceLens combines traces and metrics but not arbitrary log correlation; Contributor Insights and Synthetics serve different purposes.

Question 32Monitoring, Logging, and Remediation

A CloudWatch alarm is configured to stop an EC2 instance when CPU utilization exceeds 90% for five minutes. The alarm action must be executed only once per alarm state transition. Which alarm configuration ensures this?

  1. Set the alarm to trigger the action only when the state changes to ALARM. Correct answer.
  2. Use an SNS topic with a Lambda function that stops the instance.
  3. Configure the alarm with a single evaluation period.
  4. Set the alarm action to trigger on both ALARM and OK states.

Explanation

Alarm actions are invoked when the alarm transitions into the specified state. Configuring the action for the ALARM state only ensures the stop action runs once when the threshold is first breached, not repeatedly while the alarm remains in ALARM. Actions on OK would run again on recovery.

Question 33Monitoring, Logging, and Remediation

A CloudWatch Logs metric filter is defined with a filter pattern that matches the term "ERROR". What does CloudWatch do when a log event containing "ERROR" is ingested?

  1. It sends the log event to an SNS topic automatically.
  2. It increments the metric value by 1 for that period. Correct answer.
  3. It stores the matching log event in a separate log stream.
  4. It creates a new log group for error events.

Explanation

A metric filter counts matching events by publishing a numeric value to a custom metric each time a matching event is found. It does not route, store, or notify on the events themselves; those actions require subscription filters or alarms.

Question 34Monitoring, Logging, and Remediation

A company uses AWS Systems Manager to manage a fleet of EC2 instances. An engineer wants to automatically remediate instances that fail a compliance check by running a remediation runbook. Which Systems Manager feature should be used?

  1. State Manager associations
  2. Patch Manager baselines
  3. Session Manager port forwarding
  4. Compliance remediation Correct answer.

Explanation

AWS Systems Manager Compliance allows remediation actions to be configured for noncompliant resources, including running automation runbooks. State Manager applies desired state but does not directly remediate compliance findings; Patch Manager and Session Manager serve different purposes.

Question 35Monitoring, Logging, and Remediation

An engineer wants to receive a notification when the number of running EC2 instances in an Auto Scaling group exceeds a specified count. Which CloudWatch metric should be used for the alarm?

  1. GroupMaxSize
  2. GroupInServiceInstances Correct answer.
  3. GroupTotalInstances
  4. GroupDesiredCapacity

Explanation

The GroupInServiceInstances metric reports the number of instances that are running and in service in the Auto Scaling group. GroupDesiredCapacity is the target count, GroupTotalInstances includes instances not yet in service, and GroupMaxSize is a configuration limit.

Question 36Monitoring, Logging, and Remediation

A CloudWatch alarm on a custom metric is configured with a period of 300 seconds and a statistic of Sum. The metric is published once every 60 seconds with a value of 1. What value does the alarm evaluate for each 300-second period?

  1. 1
  2. 5 Correct answer.
  3. 60
  4. 300

Explanation

With a 300-second period and data published every 60 seconds, five data points are aggregated per period. The Sum statistic adds those values, yielding 5. The period length and publication frequency determine the number of data points.

Question 37Monitoring, Logging, and Remediation

A CloudWatch alarm is configured with TreatMissingData set to breaching. What is the effect when the metric has no data points for an evaluation period?

  1. The alarm ignores the period and evaluates only periods with data.
  2. The missing data is treated as a breaching value and can cause the alarm to enter ALARM. Correct answer.
  3. The alarm transitions to OK because no breach was observed.
  4. The alarm transitions to INSUFFICIENT_DATA and remains there until data arrives.

Explanation

The breaching setting treats missing data points as if they breached the threshold, which can drive the alarm into ALARM. This is useful when absence of data itself indicates a problem. The other settings (notBreaching, ignore, missing) behave differently.

Question 38Monitoring, Logging, and Remediation

A company wants to monitor the health of an application by using CloudWatch Synthetics. Which type of canary should be used to verify that a web page loads and contains expected text?

  1. API canary
  2. Visual monitoring canary
  3. Broken link checker canary
  4. Heartbeat canary Correct answer.

Explanation

A heartbeat canary loads a web page and can check for expected content, verifying availability and correctness. API canaries test endpoints, broken link checkers scan links, and visual monitoring compares screenshots.

Question 39Monitoring, Logging, and Remediation

An engineer needs to analyze VPC flow logs to identify the top source IP addresses by number of rejected connections. The flow logs are delivered to CloudWatch Logs. Which approach provides this information with the least operational effort?

  1. Use CloudWatch Logs Insights to query and aggregate the source IP addresses. Correct answer.
  2. Enable VPC Flow Logs with a maximum aggregation interval.
  3. Create a metric filter for each possible source IP address.
  4. Export the logs to Amazon S3 and run an Amazon EMR job.

Explanation

CloudWatch Logs Insights can query flow log fields, filter for rejected connections, and aggregate by source IP address. This requires no additional infrastructure. Metric filters for each IP are impractical, and EMR adds significant operational overhead.

Question 40Monitoring, Logging, and Remediation

A CloudWatch alarm monitors a metric that is published only when an error occurs. The engineer wants the alarm to remain in OK when no errors are reported. Which TreatMissingData setting should be used?

  1. notBreaching Correct answer.
  2. breaching
  3. ignore
  4. missing

Explanation

The notBreaching setting treats missing data as within the threshold, keeping the alarm in OK when no error metric is published. This is appropriate for sparse metrics where absence of data indicates normal operation.

Question 41Monitoring, Logging, and Remediation

An engineer must ensure that a CloudWatch alarm on an EC2 instance's CPUUtilization metric does not trigger during a known maintenance window when the instance is intentionally stopped. Which approach is most appropriate?

  1. Configure the alarm to treat missing data as notBreaching.
  2. Disable the alarm during the maintenance window. Correct answer.
  3. Increase the alarm's evaluation periods.
  4. Change the alarm statistic to Maximum.

Explanation

Disabling the alarm actions during the maintenance window prevents notifications while the instance is intentionally stopped. Treating missing data as notBreaching may not help if the instance still publishes zero or low values, and other changes do not address the planned outage.

Question 42Monitoring, Logging, and Remediation

A company uses CloudWatch Logs and wants to identify the most frequently occurring error messages across a large volume of logs. Which feature should be used to find the top contributors?

  1. CloudWatch metric filters
  2. CloudWatch Contributor Insights Correct answer.
  3. CloudWatch Logs Insights
  4. CloudWatch Logs subscription filters

Explanation

CloudWatch Contributor Insights analyzes log data to identify top contributors, such as the most frequent error messages or IP addresses. Logs Insights can query but not rank top contributors as directly; metric filters count patterns, and subscription filters route data.

Question 43Monitoring, Logging, and Remediation

An engineer needs to configure a CloudWatch alarm that evaluates a metric with a period of 1 minute and requires three consecutive breaching data points before entering ALARM. Which combination of settings achieves this?

  1. Period = 60 seconds, Evaluation periods = 1, Datapoints to alarm = 3
  2. Period = 60 seconds, Evaluation periods = 3, Datapoints to alarm = 1
  3. Period = 180 seconds, Evaluation periods = 3, Datapoints to alarm = 1
  4. Period = 60 seconds, Evaluation periods = 3, Datapoints to alarm = 3 Correct answer.

Explanation

The alarm must evaluate three 1-minute periods and require all three to be breaching. Setting evaluation periods to 3 and datapoints to alarm to 3 achieves this. Other combinations either evaluate fewer periods or trigger on fewer breaches.

Question 44Monitoring, Logging, and Remediation

A CloudWatch alarm is configured to monitor a custom metric and is in the ALARM state. An engineer wants to test a new remediation action without changing the alarm definition. Which action is appropriate?

  1. Set the alarm state to OK manually.
  2. Change the alarm threshold temporarily.
  3. Delete and recreate the alarm with the new action.
  4. Disable the alarm actions, then manually invoke the remediation. Correct answer.

Explanation

Disabling alarm actions prevents the existing actions from firing while allowing manual testing of the new remediation. Changing the threshold or recreating the alarm alters the alarm definition, and manually setting state does not test the action.

Question 45Reliability and Business Continuity

A company wants its EC2-backed application to keep running in a second AWS Region if the primary Region fails. Which combination best provides this capability?

  1. Cross-Region read replicas and a Route 53 failover routing policy Correct answer.
  2. An Application Load Balancer spanning multiple Availability Zones in one Region
  3. A single Availability Zone with larger instance types
  4. EBS snapshots copied to a second Region only

Explanation

Regional disaster recovery requires resources and data in the second Region plus a mechanism to shift traffic, such as Route 53 failover routing with replicated data. Multi-AZ designs protect against AZ failure but not Region failure. Snapshots alone provide data durability, not running capacity.

Question 46Reliability and Business Continuity

Which AWS service provides a managed, highly available relational database that automatically fails over to a standby in another Availability Zone?

  1. Amazon Redshift with a single node
  2. Amazon RDS with a Multi-AZ deployment Correct answer.
  3. Amazon DynamoDB with on-demand capacity
  4. Amazon RDS with a read replica in the same AZ

Explanation

RDS Multi-AZ maintains a synchronous standby in a different AZ and automatically fails over during an outage. Read replicas are asynchronous and do not provide automatic failover of the primary. DynamoDB and Redshift single-node do not match the described relational failover behavior.

Question 47Reliability and Business Continuity

An application stores session state in memory on each EC2 instance behind an ALB. Users are logged out when an instance is replaced. What change most directly improves reliability across instance loss?

  1. Attach an Elastic IP to each instance
  2. Increase the instance root volume size
  3. Move session state to ElastiCache or DynamoDB Correct answer.
  4. Enable detailed monitoring on the instances

Explanation

Externalizing session state to a shared, durable store decouples it from individual instances so any instance can serve any user. Larger disks, monitoring, and Elastic IPs do not make in-memory state survive instance replacement.

Question 48Reliability and Business Continuity

Which Route 53 routing policy sends traffic to a primary endpoint and automatically shifts to a secondary when health checks fail?

  1. Latency routing
  2. Failover routing Correct answer.
  3. Geolocation routing
  4. Weighted routing

Explanation

Failover routing associates a primary and secondary record and uses health checks to move traffic to the secondary. Weighted, latency, and geolocation policies distribute traffic by proportion, latency, or location rather than by health-based failover.

Question 49Reliability and Business Continuity

What is the primary purpose of an AWS Backup vault lock?

  1. To replicate backups to another account
  2. To enforce retention compliance by preventing deletion of recovery points Correct answer.
  3. To encrypt backups with a customer managed key
  4. To reduce backup storage cost

Explanation

Vault Lock applies a write-once governance or compliance mode that prevents recovery points from being deleted before retention ends. Encryption, cross-account copy, and cost optimization are separate concerns.

Question 50Reliability and Business Continuity

Which Auto Scaling group configuration helps an application survive the loss of an Availability Zone?

  1. Set the desired capacity to one
  2. Specify multiple subnets in different Availability Zones Correct answer.
  3. Disable health check replacement
  4. Use a single subnet with a larger instance type

Explanation

An Auto Scaling group that spans multiple AZ subnets can relaunch capacity in a surviving AZ when one becomes unavailable. A single subnet or minimal capacity concentrates risk, and disabling health checks prevents replacement of unhealthy instances.