Monitoring, Logging, and Remediation
Free AWS Certified SysOps Administrator - Associate practice — 6 questions on Monitoring, Logging, and Remediation, with explanations. No sign-up. Full 12-question mixed test →
A SysOps administrator wants to create a CloudWatch alarm that automatically adapts to the normal traffic pattern of an application and triggers only when metric values fall outside an expected range that accounts for time-of-day and day-of-week seasonality. Which alarm configuration should the administrator use?
ANOMALY_DETECTION_BAND(m1, stdev) is a CloudWatch metric math function that builds a machine-learning-derived expected range accounting for hourly, daily, and weekly seasonality; the alarm is then configured to trigger when the metric value is outside that band.
An organization must ensure the CloudWatch agent is installed and running with a specific configuration on every EC2 instance in a large fleet, including instances launched in the future, with compliance checked and enforced every 30 minutes without any manual intervention. Which Systems Manager capability should be used?
State Manager associations are purpose-built for continuous, fleet-wide state enforcement: they target instances by tag (so newly launched matching instances are automatically included), run on a defined schedule such as rate(30 minutes), and re-apply the desired configuration without manual steps.
A SysOps administrator configures an AWS Config rule named s3-bucket-versioning-enabled to detect S3 buckets without versioning enabled. Non-compliant buckets must be automatically remediated using the AWS-ConfigureS3BucketVersioning SSM Automation document, with up to 3 attempts spaced 60 seconds apart if an attempt fails. Which remediation configuration satisfies this requirement?
AWS Config remediation configurations natively support Automatic remediation with the parameters MaximumAutomaticAttempts (number of retry attempts) and RetryAttemptSeconds (delay between attempts), fully satisfying the requirement without extra custom logic.
An application writes structured JSON log entries to CloudWatch Logs containing fields @timestamp, statusCode, and latencyMs. A SysOps administrator needs a CloudWatch Logs Insights query that counts requests grouped by statusCode, only for requests where latencyMs is greater than 1000, sorted by count in descending order. Which query accomplishes this?
Logs Insights syntax applies filter before aggregation, then uses stats count(*) by <field> to group counts, followed by sort <function> desc to order results — exactly matching the requirement to filter by latency, group by statusCode, and sort by count descending.
A monitoring team manages an application with two CloudWatch alarms: one for high CPU utilization and one for high application error rate. Both alarms trigger frequently during expected traffic spikes even though the application remains healthy, causing alarm fatigue. The team wants a single alarm that enters ALARM state only when BOTH the CPU and error-rate conditions are true at the same time. What should they implement?
Composite alarms use a boolean AlarmRule expression that references the states of other alarms (ALARM(), OK(), INSUFFICIENT_DATA()); combining two alarms with AND logic means the composite alarm only enters ALARM state when both underlying conditions are true simultaneously, directly addressing the noise-reduction goal.
A company wants to automatically remediate EC2 instances that transition to a 'stopped' state unexpectedly (excluding scheduled maintenance stops on instances tagged Maintenance=true) by invoking a Lambda function that restarts the instance and sends a notification. Which EventBridge-based approach correctly identifies only the unexpected stop events?
EC2 Instance State-change Notification events do not include resource tag data in the event detail, so tag-based filtering cannot be done through EventBridge pattern matching alone. The Lambda function must call the EC2 API (e.g., DescribeTags) at invocation time to check for the Maintenance tag and decide whether to act — this is the standard and correct pattern.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
undefined $34.99 with code 89CE4ED79F19FA855B6D — valid through Sep 23.
Get my $34.99 deal →