Domain 1: Monitoring and Logging

Question 1

A company runs a legacy application on a fleet of Amazon EC2 instances in an Auto Scaling group. The operations team can already see default Amazon EC2 metrics such as CPUUtilization, but they also need near-real-time visibility into memory utilization, disk usage, and application log files stored on each instance. The team wants to search these logs centrally in Amazon CloudWatch Logs and avoid building a custom metrics pipeline.

Which solution best meets these requirements by using AWS-native services?

A. Install and configure the CloudWatch agent on each instance, attach an IAM instance profile that allows publishing metrics and logs to Amazon CloudWatch, and send OS-level metrics and application logs to CloudWatch and CloudWatch Logs.

B. Rely on default Amazon EC2 instance metrics for memory and disk visibility, and use AWS CloudTrail to capture the application log files for centralized search.

C. Configure the instances to copy application logs to Amazon S3 every hour and review them manually, while using default Amazon EC2 metrics for all host-level monitoring.

D. Enable VPC Flow Logs for the subnets containing the instances to collect memory utilization, disk usage, and application logs for analysis in Amazon CloudWatch.

Question 2

An organization runs microservices on both Amazon EKS and Amazon ECS. The CloudOps team needs container-level CPU, memory, and performance telemetry, plus centralized observability to troubleshoot service degradation. The team wants an AWS-managed approach integrated with Amazon CloudWatch for dashboards and alarms rather than maintaining a custom telemetry pipeline.

Select any two options that meet these requirements.

A. Enable CloudWatch Container Insights for the Amazon EKS clusters and Amazon ECS workloads to collect container, task, pod, and cluster performance metrics.

B. Use CloudWatch Application Signals, where supported, to provide application- and service-level observability integrated with Amazon CloudWatch dashboards and alarms.

C. Use AWS CloudTrail as the primary source for container CPU and memory metrics because it records service activity across the environment.

D. Monitor only the underlying Amazon EC2 node metrics because node-level telemetry is sufficient to diagnose container-specific performance issues.

E. Stream logs to Amazon S3 and query them manually instead of using Amazon CloudWatch managed observability features.

F. Use only Amazon Managed Service for Prometheus because the requirement explicitly prefers CloudWatch-managed monitoring and alerting.

Question 3

A security team needs to be notified whenever a specific IAM policy change occurs, such as an AttachRolePolicy or PutRolePolicy API call. The team wants to detect the event from API activity logs and trigger an alert automatically without manually reviewing records.

Which design best meets this requirement?

A. Configure AWS CloudTrail to deliver management events to Amazon CloudWatch Logs, create a CloudWatch Logs metric filter that matches the target API event pattern, create a CloudWatch alarm on the custom metric, and ...