Monitoring and Logging

127. Application log lines containing a specific error pattern must become a metric that an alarm can evaluate. Which solution meets these requirements?

1. A Create a CloudWatch Logs subscription filter that delivers matching lines to Amazon S3.
2. B Create a CloudWatch Logs metric filter matching the pattern and create an alarm on the resulting metric.
3. C Create a saved CloudWatch Logs Insights query and add it to a dashboard.
4. D Create an EventBridge rule that matches the log group.

128. CloudWatch metrics must be delivered continuously to a third-party analytics platform in near real time. Which solution meets these requirements?

1. A Create a CloudWatch metric stream delivering to Amazon Data Firehose with the platform as the destination.
2. B Export the metrics to Amazon S3 once each day for the platform to collect.
3. C Create a CloudWatch dashboard and grant the platform read access to it.
4. D Query the metrics with the GetMetricData API on a scheduled Lambda function.

129. Memory and disk utilization must be collected from EC2 instances into CloudWatch. Which solution meets these requirements?

1. A Enable enhanced networking on the instances so additional metrics are collected.
2. B Create a CloudWatch dashboard displaying the memory and disk metrics.
3. C Install and configure the CloudWatch agent on the instances to publish the guest metrics.
4. D Enable detailed monitoring so metrics are reported every minute.

130. Log data must be retained for ninety days in CloudWatch Logs and for seven years at lower cost. Which solution meets these requirements?

1. A Set the log group retention to seven years so all data is available in one place.
2. B Set the log group retention to never expire and delete old streams manually.
3. C Set the log group retention to ninety days and export or subscribe the data to Amazon S3 with a lifecycle policy for long-term retention.
4. D Set the log group retention to ninety days and accept that older data is lost.

131. Log events must be processed in near real time by a Lambda function as they arrive. Which solution meets these requirements?

1. A Create a metric filter and invoke the function from an alarm on the resulting metric.
2. B Create a CloudWatch Logs subscription filter with the Lambda function as the destination.
3. C Create a scheduled Lambda function that queries the log group every minute.
4. D Export the log group to Amazon S3 hourly and process the exported objects.

132. Log data written to CloudWatch Logs must be encrypted with a key the security team controls. Which solution meets these requirements?

1. A Restrict which IAM principals may read the log group.
2. B Enable default encryption on the account so all log groups are encrypted.
3. C Associate a customer managed AWS KMS key with the log group and grant CloudWatch Logs permission to use it in the key policy.
4. D Export the log data to an encrypted Amazon S3 bucket and delete the log group.

133. An engineer must find every occurrence of a correlation identifier across several log groups over a two-day window. Which solution meets these requirements?

1. A Create a metric filter for the identifier and review the resulting metric.
2. B Run a CloudWatch Logs Insights query filtering on the identifier across the log groups and time range.
3. C Export the log groups to Amazon S3 and search the objects manually.
4. D Download the log streams and search them with a local tool.

134. An application must publish a custom business metric at high volume without a synchronous API call per event. Which solution meets these requirements?

1. A Write the metric as a structured log entry in the CloudWatch embedded metric format and let CloudWatch extract it.
2. B Create an alarm on an existing built-in metric that approximates the value.
3. C Call PutMetricData once per event with the metric dimensions.
4. D Publish the metric values to an Amazon SNS topic for a consumer to record.

135. An on-call rotation receives many alerts that require no action, and the team must reduce them without losing genuine signals. Which approach is appropriate?

1. A Increase every alarm's evaluation period so fewer alerts are generated.
2. B Reduce the number of alarms by deleting those that fired most often.
3. C Route all alerts to a shared mailbox instead of paging the on-call engineer.
4. D Review the alerts that required no action, and for each either remove it, convert it to a ticket, or raise its threshold to reflect a real problem.

136. Alarms with consistent thresholds and actions must be created automatically for every new service deployed by any team. Which solution meets these requirements?

1. A Define the alarms in the service's infrastructure as code template so they are created with the service itself.
2. B Run a weekly script that finds services without alarms and creates them.
3. C Maintain a runbook instructing each team to create the alarms after deploying a service.
4. D Create the alarms manually in the console when a team requests monitoring.

137. A request traversing API Gateway, Lambda, and DynamoDB must be traced end to end. Which combination of steps meets these requirements? (Select TWO.)

1. A Increase the CloudWatch log retention period for the function.
2. B Instrument the AWS SDK calls with the X-Ray SDK so downstream subsegments appear.
3. C Enable CloudTrail data events for the DynamoDB table.
4. D Enable active tracing on the API and the Lambda function.
5. E Enable VPC Flow Logs on the Lambda subnets.

138. Security findings from several AWS services must be aggregated and evaluated against a standard across an organization. Which solution meets these requirements?

1. A Export each service's findings to Amazon S3 and query them with Amazon Athena.
2. B Enable AWS Security Hub with a delegated administrator and turn on the security standards.
3. C Enable Amazon Detective with a delegated administrator and review the behaviour graph.
4. D Create an AWS Config aggregator collecting compliance data from the accounts.

139. Configuration changes across the estate must be evaluated continuously against defined rules, with non-compliant resources reported. Which solution meets these requirements?

1. A Enable AWS Config with the relevant rules and review the compliance status of each resource.
2. B Enable VPC Flow Logs and analyse the traffic to the affected resources.
3. C Enable Amazon Inspector and review its findings for the affected resources.
4. D Enable AWS CloudTrail and review the management events for configuration changes.

140. A specific error pattern in application logs must automatically restart a service across hundreds of instances. Which solution meets these requirements?

1. A Connect to each instance with Session Manager and restart the service when the error is reported.
2. B Create an S3 event notification on the log archive bucket that invokes a restart function.
3. C Schedule a Run Command document that restarts the service every hour.
4. D Create a metric filter and alarm on the pattern, and invoke a Systems Manager Automation runbook from the alarm.

141. An EC2 instance failing its system status check must be recovered automatically while preserving its instance identity and attached volumes. Which solution meets these requirements?

1. A Create a Systems Manager maintenance window that reboots the instance weekly.
2. B Place the instance in an Auto Scaling group with a desired capacity of one.
3. C Create a CloudWatch alarm on the system status check metric and notify the on-call engineer.
4. D Create a CloudWatch alarm on the system status check metric and configure the EC2 recover action.

142. An event processing workflow must handle bursts far larger than its downstream system can absorb, without losing events. Which solution meets these requirements?

1. A Increase the downstream system's capacity to match the largest expected burst.
2. B Increase the processor's concurrency so the whole burst is handled immediately.
3. C Place an Amazon SQS queue between the event source and the processor so the burst is buffered and consumed at a sustainable rate.
4. D Configure the event source to retry delivery until the processor accepts each event.

143. An AWS Config rule detects a security group allowing unrestricted inbound access, and the rule must revert the change automatically. Which solution meets these requirements?

1. A Create an SCP denying the security group modification actions in the account.
2. B Create a CloudWatch alarm on the Config rule's compliance status and notify the security team.
3. C Review the Config compliance dashboard each morning and revoke offending rules manually.
4. D Attach a Systems Manager Automation remediation action to the Config rule so the offending rule is revoked.

144. An Application Load Balancer must stop sending traffic to targets whose application has crashed while the operating system remains reachable. Which solution meets these requirements?

1. A Reduce the target group's health check interval so failures are detected sooner.
2. B Configure the target group health check against the instance's system status check.
3. C Increase the target group's deregistration delay so connections drain fully.
4. D Configure the target group health check against an application endpoint that reflects the application's real state.

145. An object landing in Amazon S3 must trigger a processing workflow without polling. Which solution meets these requirements?

1. A Create a Systems Manager State Manager association that checks the bucket on a schedule.
2. B Configure an S3 event notification, or an EventBridge rule on the bucket, that starts the workflow.
3. C Create a Lambda function that lists the bucket every minute and starts the workflow for new objects.
4. D Create a CloudWatch alarm on the bucket's object count metric.

146. An Amazon DynamoDB table's provisioned capacity must follow demand without manual adjustment. Which solution meets these requirements?

1. A Provision capacity for the average traffic and accept throttling at peak.
2. B Create a CloudWatch alarm on throttled requests and adjust capacity manually.
3. C Enable auto scaling on the table's read and write capacity with a target utilization.
4. D Provision capacity for the highest observed traffic and leave it fixed.

147. Log data from many accounts must be centralized for correlation while each account retains local access. Which approach is appropriate?

1. A Replicate each account's log storage bucket to the central account.
2. B Ask each account to export its logs to the central account weekly.
3. C Grant the central team read access to each account's log groups.
4. D Stream the logs to a central account through a subscription or delivery destination while leaving local log groups in place.

148. Metrics must be published from an application at a resolution finer than one minute. Which configuration is required?

1. A Enable detailed monitoring on the underlying EC2 instances.
2. B Enable metric streams to a downstream destination.
3. C Increase the CloudWatch agent's collection interval.
4. D Publish the metric as a high-resolution custom metric with a one-second storage resolution.

149. An architect must control the cost of log storage without losing the ability to investigate incidents from the past year. Which approach is appropriate?

1. A Delete logs after 30 days and rely on metrics for older investigations.
2. B Reduce the application's log verbosity so less data is produced.
3. C Set the queryable store's retention to one year.
4. D Keep a short retention in the queryable store and deliver the logs to object storage with a lifecycle policy for the year.

150. An application's logs must be searchable by a structured field rather than by free-text matching. Which approach is appropriate?

1. A Emit the logs as structured JSON so queries can filter on named fields.
2. B Increase the log group's retention so more data is available to search.
3. C Emit the logs with a consistent prefix so filtering is easier.
4. D Emit the logs as formatted text and search with a pattern.

151. Logs must be encrypted with a key the security team controls and remain queryable by the operations team. Which approach is appropriate?

1. A Store the logs unencrypted and restrict who may read the log group.
2. B Encrypt the logs client-side before sending them and share the key with operations.
3. C Associate a customer managed key with the log group and grant the operations team's roles permission to use it for decryption.
4. D Encrypt the log group with the service default key.

152. An alarm must fire when a metric that is normally reported stops being reported at all. Which configuration is required?

1. A Configure the alarm with a lower threshold.
2. B Configure the alarm to treat missing data as breaching.
3. C Configure the alarm with a longer evaluation period.
4. D Configure the alarm to treat missing data as not breaching.

153. An investigation must establish the sequence of events across several services during an incident. Which approach is appropriate?

1. A Review each service's dashboard for the incident window.
2. B Query the aggregated logs across services for the incident window, correlating on a shared request identifier.
3. C Review the Auto Scaling activity history for the period.
4. D Review the CloudTrail management events for the period.

154. An architect must detect a gradual increase in application latency that stays within the existing alarm threshold. Which approach is appropriate?

1. A Increase the alarm's evaluation period so the trend is averaged.
2. B Review the latency dashboard each morning.
3. C Lower the static threshold until the increase breaches it.
4. D Alarm on an anomaly detection band so deviation from the established pattern is detected regardless of the absolute value.

155. A trace must show which downstream call caused a request's latency to exceed its target. Which approach is appropriate?

1. A Sample a higher percentage of requests for tracing.
2. B Record the number of downstream calls per request.
3. C Record the total request duration for each request.
4. D Instrument the downstream calls as subsegments so each appears separately in the trace.

156. An automated remediation must not run when the condition is already being handled by an in-progress deployment. Which approach is appropriate?

1. A Check the deployment state in the remediation and exit without acting when a deployment is in progress.
2. B Run the remediation and accept that it may conflict with the deployment.
3. C Disable the alarm during every deployment and re-enable it afterwards.
4. D Increase the alarm's evaluation period to cover the deployment duration.

157. An EventBridge rule must invoke a target in a different account. Which configuration is required?

1. A Create the rule in the source account with the target's ARN and no further configuration.
2. B Replicate the events to the target account through Amazon S3.
3. C Create an event bus in the target account with a resource policy permitting the source account, and target that bus from the rule.
4. D Create an IAM user in the target account and use its credentials in the rule.

158. Alarms must be created automatically for every new resource a team deploys, without the team remembering to add them. Which approach is appropriate?

1. A Run a weekly job that finds resources without alarms and creates them.
2. B Create the alarms centrally when a team requests monitoring.
3. C Define the alarms in the same infrastructure as code template as the resource so they are created together.
4. D Publish a standard requiring teams to create alarms.

159. A health check must detect that an application is serving stale data even though it responds successfully. Which approach is appropriate?

1. A Check that the application returns an HTTP 200 response.
2. B Check that the application's process is running.
3. C Have the health endpoint verify a freshness condition and report unhealthy when it is not met.
4. D Reduce the health check interval so failures are detected sooner.

160. A CloudWatch agent must collect logs from a fleet with a consistent configuration. Which approach is appropriate?

1. A Store the agent configuration in Systems Manager Parameter Store and have the agent fetch it, so a change propagates to the fleet.
2. B Configure each instance's agent through the console.
3. C Bake the configuration into the machine image and rebuild on change.
4. D Edit the configuration file on each instance.

161. Logs must be delivered to a destination in another account in near real time. Which mechanism is appropriate?

1. A A scheduled export task to Amazon S3.
2. B A Lambda function polling the log group.
3. C A CloudWatch Logs subscription filter targeting a destination in the other account.
4. D A manual download and upload.

162. A metric must be available at one-second resolution for a short-lived spike. Which configuration is required?

1. A Create a metric filter on the application logs.
2. B Publish the metric as a high-resolution custom metric with a storage resolution of one second.
3. C Enable detailed monitoring on the instances.
4. D Reduce the CloudWatch agent's collection interval to one minute.

163. Trace data must be retained beyond the service's default retention for later analysis. Which approach is appropriate?

1. A Export the trace data to a durable store such as Amazon S3 before it expires.
2. B Create a CloudWatch alarm on the trace count.
3. C Reduce the number of instrumented services.
4. D Increase the sampling rate so more traces are captured.

164. An alarm must evaluate a percentage derived from two metrics. Which capability is appropriate?

1. A A composite alarm combining two threshold alarms.
2. B Two separate alarms on each metric.
3. C A metric math expression combining the two metrics, with the alarm evaluating the expression.
4. D A dashboard showing both metrics.

165. A dashboard must show the same view of a workload across several accounts. Which capability is appropriate?

1. A Exporting metrics to a spreadsheet each day.
2. B CloudWatch cross-account observability, which lets a monitoring account view metrics and logs from source accounts.
3. C A separate dashboard in each account.
4. D Granting each team access to every account.

166. An investigation must determine whether a configuration change preceded an incident. Which source is appropriate?

1. A The Auto Scaling activity history.
2. B The AWS Config configuration timeline for the affected resources over the incident window.
3. C The application's error logs.
4. D The load balancer's access logs.

167. An EventBridge rule must invoke a target only for events matching a specific field value. Which configuration is appropriate?

1. A Reduce the event source's publishing rate.
2. B Define an event pattern matching that field and value so only matching events invoke the target.
3. C Invoke the target for all events and filter inside the target.
4. D Create a separate event bus for the matching events.

168. A scheduled automation must run at a precise time with timezone awareness and no drift. Which capability is appropriate?

1. A A cron job on an EC2 instance.
2. B A Lambda function that sleeps until the target time.
3. C An EventBridge Scheduler schedule, which supports timezones and one-time or recurring invocations.
4. D A CloudWatch alarm on a time-based metric.

169. An operational event must create a tracked item that responders work through to resolution. Which capability is appropriate?

1. A A log entry recording the event.
2. B An SNS notification to the on-call engineer.
3. C A CloudWatch alarm in the ALARM state.
4. D Systems Manager Incident Manager, which creates an incident record with responders, runbooks, and a timeline.

170. An automated remediation must be prevented from running repeatedly for the same ongoing condition. Which approach is appropriate?

1. A Reduce the alarm's evaluation period.
2. B Disable the alarm after the first remediation.
3. C Increase the remediation's timeout.
4. D Record that remediation is in progress for the affected resource and exit without acting when a subsequent event arrives.

171. A CloudWatch agent must collect a custom application metric alongside system metrics. Which approach is appropriate?

1. A Configure the agent to collect the application's StatsD or collectd output alongside its system metric configuration.
2. B Install a second agent for the custom metric.
3. C Publish the metric with a separate API call from the application.
4. D Write the metric to the application log and create a metric filter.

172. Log data must be retained in a queryable form for compliance while controlling cost. Which approach is appropriate?

1. A Keep all logs in Amazon S3 with no queryable copy.
2. B Keep recent logs in CloudWatch Logs for investigation and deliver a copy to Amazon S3 with a lifecycle policy for the retention period.
3. C Reduce the application's log verbosity to control cost.
4. D Keep all logs in CloudWatch Logs for the full retention period.

173. An organization must collect logs from on-premises servers into CloudWatch Logs. Which approach is appropriate?

1. A Forward the logs by email to an operations mailbox.
2. B Query the servers' logs remotely when needed.
3. C Copy the log files to Amazon S3 nightly.
4. D Install the CloudWatch agent on the servers with credentials from an IAM role assumed through IAM Roles Anywhere or a hybrid activation.

174. Metrics must be retained beyond CloudWatch's standard retention for long-term trend analysis. Which approach is appropriate?

1. A Stream the metrics to a durable store such as Amazon S3 where they can be retained and queried indefinitely.
2. B Create a dashboard showing the metrics over a long period.
3. C Export the metrics manually each month.
4. D Increase the CloudWatch metric retention setting.

175. An organization must ensure log data cannot be modified after delivery. Which approach is appropriate?

1. A Restrict write permissions on the bucket.
2. B Deliver logs to a bucket with Object Lock in compliance mode for the retention period.
3. C Encrypt the logs with a customer managed key.
4. D Enable versioning on the bucket.

176. Trace sampling must capture more traces for a specific high-value request path. Which approach is appropriate?

1. A Increase the default sampling rate for all requests.
2. B Define a sampling rule matching that path with a higher rate than the default rule.
3. C Increase the trace retention period.
4. D Disable sampling so every request is traced.

177. An organization must aggregate metrics from several accounts into one monitoring view. Which approach is appropriate?

1. A Grant the monitoring team access to each account's console.
2. B Configure CloudWatch cross-account observability with the monitoring account linked to the source accounts.
3. C Create identical dashboards in each account.
4. D Export each account's metrics to a spreadsheet.

178. An alarm must be suppressed while a related upstream alarm is already firing, to avoid duplicate paging. Which approach is appropriate?

1. A Increase the downstream alarm's evaluation period.
2. B Create a composite alarm expressing the dependency so the downstream alarm does not page when the upstream one is in alarm.
3. C Delete the downstream alarm.
4. D Route both alarms to the same notification topic.

179. An operator must find which requests contributed to a latency increase across a distributed application. Which approach is appropriate?

1. A Review the application's error rate.
2. B Review the aggregate latency metric for the period.
3. C Query the trace data for the period filtered by latency and examine the slowest traces' segment breakdown.
4. D Review each service's log volume.

180. An audit must determine whether a configuration was compliant at a specific date in the past. Which source is appropriate?

1. A The resource's current configuration.
2. B CloudTrail events for the resource.
3. C The AWS Config configuration timeline for the resource, which records its state over time.
4. D The resource's tags.

181. An organization must detect when a security finding remains unresolved beyond an agreed period. Which approach is appropriate?

1. A Archive findings older than the threshold.
2. B Track finding age in the aggregated findings store and alert when a finding exceeds the agreed threshold.
3. C Review the findings console weekly.
4. D Alert on every new finding.

182. An automated response must run in a different account from the one where the event occurred. Which approach is appropriate?

1. A Grant the source account permission to invoke the automation directly.
2. B Replicate the automation into every account.
3. C Poll each account's events from the response account.
4. D Forward the event to an event bus in the response account and invoke the automation there with a role in the source account.

183. An operational event must trigger different actions depending on the affected resource's environment tag. Which approach is appropriate?

1. A Apply the same action regardless of environment.
2. B Ask an operator to decide the action when the event fires.
3. C Create a separate rule for each environment with identical patterns.
4. D Route the event to a workflow that branches on the resource's tag and performs the appropriate action.

184. An automated remediation must be tested before it is enabled in production. Which approach is appropriate?

1. A Run the remediation against a representative non-production resource and verify both the outcome and its execution record.
2. B Review the remediation document without executing it.
3. C Enable it in production and monitor the first execution.
4. D Enable it in production during a low-traffic period.

185. A monitoring system must detect that a scheduled job did not run at all. Which approach is appropriate?

1. A Have the job emit a heartbeat metric on success and alarm when the metric is absent within the expected window.
2. B Increase the job's timeout.
3. C Alarm on the job's error rate.
4. D Review the job's execution history each morning.

186. An organization must ensure an automated remediation does not act on a resource an operator is already investigating. Which approach is appropriate?

1. A Notify operators after the remediation has run.
2. B Have operators apply a suppression tag that the remediation checks before acting.
3. C Disable the remediation whenever an investigation begins.
4. D Run the remediation only outside business hours.

187. An operational dashboard must show the health of a service rather than the health of its individual components. Which approach is appropriate?

1. A Display the number of alarms currently firing.
2. B Define a service-level indicator from the metrics that reflect user experience and display that.
3. C Display the count of running instances.
4. D Display every component's CPU and memory metrics.