AWS Solutions Architect Associate - Monitoring, Security, and DR

You have an RDS DB instance configured to push its database logs to CloudWatch. You want to create a CloudWatch alarm if an Error is found in the logs. How would you do that?

• Create a scheduled CloudWatch Event that triggers an AWS Lambda every 1 hour, scans the logs, and notifies you through an SNS topic

• Create a CloudWatch Logs Metric Filter that filters the logs for the keyword Error, then create a CloudWatch Alarm based on that Metric Filter

• Create an AWS Config Rule that monitors Error in your database logs and notifies you through an SNS topic

You have an application hosted on a fleet of EC2 instances managed by an Auto Scaling Group that you configured its minimum capacity to 2. Also, you have created a CloudWatch Alarm that is configured to scale in your ASG when CPU Utilization is below 60%. Currently, your application runs on 2 EC2 instances and has low traffic and the CloudWatch Alarm is in the ALARM state. What will happen?

• One EC2 instance will be terminated and the ASG desired and minimum capacity will go to 1

• The CloudWatch Alarm will remain in the ALARM state but never decrease the number of EC2 instances in the ASG

• The CloudWatch Alarm will be detached from my ASG

• The CloudWatch Alarm will go to the OK state

Answer explanation

The number of EC2 instances in an ASG can not go below the minimum capacity, even if the CloudWatch alarm would in theory trigger an EC2 instance termination.

How would you monitor your EC2 instance memory usage in CloudWatch?

• Enable EC2 Detailed Monitoring

• By default, the EC2 instance pushes memory usage to CloudWatch

• Use the Unified CloudWatch Agent to push memory usage as a custom metric to CloudWatch

You have made a configuration change and would like to evaluate how it impacts the performance of your application. Which AWS service should you use?

• Amazon CloudWatch

• AWS CloudTrail

Answer explanation

Amazon CloudWatch is a monitoring service that allows you to monitor your applications, respond to system-wide performance changes, optimize resource utilization, and get a unified view of operational health. It is used to monitor your applications' performance and metrics.

Amazon CloudTrail will not allow you to evaluate performance as it does not provide performance metrics.

Someone has terminated an EC2 instance in your AWS account last week, which was hosting a critical database that contains sensitive data. Which AWS service helps you find who did that and when?

• CloudWatch Metrics

• CloudWatch Alarms

• CloudWatch Events

• AWS CloudTrail

Answer explanation

AWS CloudTrail allows you to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. It provides the event history of your AWS account activity, audit API calls made through the AWS Management Console, AWS SDKs, AWS CLI. So, the EC2 instance termination API call will appear here. You can use CloudTrail to detect unusual activity in your AWS accounts.

You have CloudTrail enabled for your AWS Account in all AWS Regions. What should you use to detect unusual activity in your AWS Account?

• CloudTrail Data Events

• CloudTrail Insights

• CloudTrail Management Events

One of your teammates terminated an EC2 instance 4 months ago which has critical data. You don't know who made this so you are going to review all API calls within this period using CloudTrail. You already have CloudTrail set up and configured to send logs to the S3 bucket. What should you do to find out who made this?

• Use CloudTrail Event History in CloudTrail Console

• Analyze CloudTrail logs in an S3 bucket using Amazon Athena

Answer explanation

You can use the CloudTrail Console to view the last 90 days of recorded API activity. For events older than 90 days, use Athena to analyze CloudTrail logs stored in S3.

You are running a website on a fleet of EC2 instances with OS with a known vulnerability on port 84. You want to continuously monitor your EC2 instances if they have port 84 exposed. How should you do this?

• • Setup CloudWatch Metrics

• • Setup CloudTrail Trails

• • Setup Config Rules

• • Schedule a CloudWatch Event to trigger a Lambda function to scan your EC2 instances

You would like to evaluate the compliance of your resource's configurations over time. Which AWS service will you choose?

• AWS Config

• Amazon CloudWatch

• AWS CloudTrail

Someone changed the configuration of a resource and made it non-compliant. Which AWS service is responsible for logging who made modifications to resources?

• Amazon CloudWatch

• AWS CloudTrail

• AWS Config