Monitoring, Logging, Analysis, Remediation, and Performance Optimization practice questions

Answer: A) A CloudWatch dashboard containing metric widgets for each of the three metrics

CloudWatch dashboards give a single, shareable view of selected metrics from multiple services and Regions. Composite alarms, Logs Insights, and Contributor Insights serve alerting and log-analysis needs instead.

• ACorrect. A CloudWatch dashboard is a customizable single view of selected metrics and alarms. It can graph metrics from different services, and even different Regions, together, and team members can share it during operational events.
• BIncorrect. A composite alarm evaluates a rule expression over the states of other alarms (ALARM, OK, INSUFFICIENT_DATA) and triggers actions. It produces one alarm state, not a graphical view of the underlying metrics.
• CIncorrect. CloudWatch Logs Insights searches and analyzes log data in CloudWatch Logs. It does not graph service metrics such as CPUUtilization or DatabaseConnections.
• DIncorrect. Contributor Insights analyzes high-cardinality data, mainly log data, to find top-N contributors such as the heaviest IP addresses. It is not used to put service metrics side by side on one screen.

Answer: A) A Compute Savings Plan

Compute Savings Plans are the most flexible commitment. They apply automatically to EC2 usage regardless of instance family or Region, and to Fargate and Lambda usage. EC2 Instance Savings Plans and Reserved Instances cover EC2 only.

• ACorrect. Compute Savings Plans apply to EC2 instance usage in any instance family, size, Region, OS or tenancy. They also apply to Fargate and Lambda usage.
• BIncorrect. An EC2 Instance Savings Plan is a commitment to one instance family in one Region. It doesn't apply to Lambda or Fargate usage.
• CIncorrect. Standard Reserved Instances discount matching EC2 instance usage only. They don't apply to Lambda or Fargate.
• DIncorrect. Convertible Reserved Instances can be exchanged for other EC2 instance configurations, but they still cover only EC2 instances, not Lambda or Fargate.

Answer: A) Reserved concurrency on the function, set to a value the database can safely support

Reserved concurrency sets a per-function upper limit on concurrent executions. This protects downstream resources with limited capacity, such as a database. Provisioned concurrency only pre-warms execution environments and does not cap scaling.

• ACorrect. Reserved concurrency sets both the minimum and the maximum concurrency for the function. Lambda throttles invocations above that value, which stops the function from overwhelming downstream resources such as database connections. Reserved concurrency has no additional charge.
• BIncorrect. Provisioned concurrency pre-initializes execution environments to reduce cold-start latency, and it has an additional charge. It does not cap the function's concurrency, so the function can still scale above it.
• CIncorrect. Raising the account concurrency quota lets functions scale higher, which would make the connection exhaustion worse. It also applies to the whole account, not to one function.
• DIncorrect. The memory setting changes the CPU and memory given to each execution environment. It does not limit how many environments run at once or how many connections the code opens.

Answer: A) Run one CloudWatch Logs Insights query with all three log groups selected, filtering on the error pattern and sorting by @timestamp

CloudWatch Logs Insights can query several log groups at once, so events from different services can be correlated in one sorted result set. FilterLogEvents works on only one log group per call, and metric filters produce metrics rather than log entries.

• ACorrect. A single CloudWatch Logs Insights query can cover several selected log groups (and, with cross-account observability, log groups in linked source accounts). The engineer can filter, sort by @timestamp, and see the combined events in one result set.
• BIncorrect. FilterLogEvents searches one log group per request: you supply either logGroupName or logGroupIdentifier, not a list. You would need three calls and would have to merge the results yourself.
• CIncorrect. Metric filters turn matching log events into numeric metric data points. A dashboard would show counts over time, not the actual log entries the engineer needs to correlate.
• DIncorrect. CloudTrail Insights detects unusual AWS API call volume or error rates in CloudTrail management events. It doesn't search application log groups in CloudWatch Logs.

Answer: A) An Amazon EventBridge rule that matches AWS Health events, with an Amazon SNS topic as its target

AWS Health events about a customer's own account are sent to Amazon EventBridge. A rule that sends them to an SNS topic gives automatic notification without anyone checking the AWS Health Dashboard.

• ACorrect. AWS Health sends account-specific events to Amazon EventBridge for all customers at no extra cost. A rule that matches these events can send them to an SNS topic, and the topic emails the team.
• BIncorrect. CloudTrail records API activity in the account. AWS scheduled maintenance and service issues are AWS Health events, not API calls, so a trail wouldn't capture them.
• CIncorrect. Trusted Advisor reviews resources against best practices for cost, security, fault tolerance and limits. It doesn't report scheduled maintenance or service events, and a weekly summary isn't timely.
• DIncorrect. A status check alarm only reacts after an instance fails its checks. It doesn't warn about scheduled maintenance or service issues that AWS reports through AWS Health.

Answer: A) Supply the tag key for each deployment through the conformance pack input parameters

Conformance pack templates can declare parameters, and ConformancePackInputParameters supplies their values at deployment. This lets one template be deployed with different rule settings, such as a required tag key.

• ACorrect. Conformance pack templates can declare parameters, and ConformancePackInputParameters supplies values for them at deployment time. The same template can therefore be deployed with different rule inputs without editing it.
• BIncorrect. A remediation action fixes resources the rule finds noncompliant. It does not change which tag key the rule evaluates.
• CIncorrect. An aggregator collects configuration and compliance data from multiple accounts and Regions. It does not set the inputs a rule uses when it evaluates resources.
• DIncorrect. Recording frequency controls how often configuration changes are recorded. It has no effect on which tag key a rule checks.

Answer: A) Create an Amazon CloudWatch RUM app monitor and add its code snippet to the application's pages

CloudWatch RUM collects real user, client-side performance data such as page load times and errors, broken down by browser and device. Synthetics measures simulated traffic, and X-Ray and ALB metrics show backend behavior.

• ACorrect. CloudWatch RUM collects client-side data from real user sessions, such as page load times, client-side errors, and user behavior. It can break this data down by device type, operating system, and browser.
• BIncorrect. Canaries are scheduled scripts that simulate a customer's actions. They measure availability and latency from the canary's own synthetic run, not from real visitors' browsers and devices.
• CIncorrect. X-Ray traces requests as they move through the backend services. On its own, it does not collect page load times or JavaScript errors from real users' browsers. RUM can optionally send client requests to X-Ray, but RUM is what collects the client-side data.
• DIncorrect. TargetResponseTime is a server-side metric. It measures how long targets take to respond to the load balancer, so it cannot show browser rendering time or client-side errors.

Answer: A) Create a CloudWatch alarm on the StatusCheckFailed_Instance metric and add an EC2 action to reboot the instance

CloudWatch alarms can reboot an EC2 instance directly, and AWS recommends the reboot action for instance status check failures. Custom Lambda code adds overhead, and the recover action is only for system status check failures.

• ACorrect. CloudWatch alarms can stop, terminate, reboot or recover an EC2 instance directly. AWS recommends the reboot action for instance status check failures. No custom code or runbook is needed, so this has the least overhead.
• BIncorrect. The recover action can be used only with StatusCheckFailed_System, not StatusCheckFailed_Instance. Recovery is meant for problems with the underlying host, not an operating system issue inside the instance.
• CIncorrect. This would work, but it adds a Lambda function, an SNS topic and IAM permissions that you must build and maintain. The alarm's built-in EC2 reboot action does the same job with less overhead.
• DIncorrect. A schedule restarts the instance whether or not it is impaired, which causes needless outages. It does not respond to the status check failure.

Answer: A) The instance used up its accrued CPU credits, so it dropped to its baseline utilization and can't burst until it earns more credits

A burstable instance in Standard mode spends accrued CPU credits to run above baseline. When those credits are gone, it drops back to baseline (30% for a t3.large) until it earns more. Unlimited mode would instead keep bursting and bill for surplus credits.

• ACorrect. In Standard mode, an instance uses accrued credits to burst above baseline. When no accrued credits remain, it gradually comes down to baseline and can't burst again until it accrues more credits. The baseline for a t3.large is 30%, which matches the observed plateau.
• BIncorrect. Surplus credits are used only in Unlimited mode, where the instance can keep bursting and is billed a flat additional rate per vCPU-hour. A Standard-mode instance doesn't spend surplus credits at all.
• CIncorrect. Launch credits apply only to T2 instances in Standard mode. T3 instances don't earn launch credits.
• DIncorrect. Hitting the accrual limit only means new earned credits are discarded while the balance is full. A full balance gives the instance the most room to burst, so it doesn't explain the throttling.

Answer: A) A metric filter on the log group with a filter pattern for ERROR, a metric value of 1, and the MyApp namespace

CloudWatch Logs metric filters turn matching log events into numeric CloudWatch metrics in a namespace you choose. These metrics can be graphed and used in metric alarms. Metric filters only count events that arrive after the filter is created.

• AMetric filters match terms and patterns in log events as they arrive and publish numeric CloudWatch metrics to the namespace and metric name you choose. You can graph these metrics or set alarms on them. A metric value of 1 counts each match.
• BSubscription filters stream matching log events to destinations such as Firehose, Kinesis, or Lambda. They do not publish a CloudWatch metric.
• CA saved query only stores the query text so it can be run again. It does not continuously publish an ErrorCount metric to a CloudWatch namespace.
• DAn export task copies log data to S3 in a batch for archiving or offline analysis. It does not create a CloudWatch metric that can be graphed or used in an alarm.