Management and Governance

A data engineering team needs near-real-time delivery of CloudWatch metrics to a third-party observability platform. Which feature is the best fit?

CloudWatch Metric Streams

A company wants to send selected CloudWatch metrics to a monitoring partner through a delivery pipeline. Which destination is supported by Metric Streams in the course material?

Kinesis Data Firehose

An analyst needs to query application log events interactively. Which CloudWatch capability should be used?

CloudWatch Logs Insights

A team exports CloudWatch Logs to S3 for archival, but the newest events are not available immediately. What explains this?

S3 export is not near real time and can take up to 12 hours

An EC2 instance writes application logs to local files, but the files do not appear in CloudWatch Logs. What should the engineer do?

Install/configure the CloudWatch agent and provide required IAM permissions

A fleet needs CPU, memory, disk, swap, and network statistics from its instances, with centralized agent configuration. Which agent is the best match?

CloudWatch Unified Agent

An administrator needs to interpret CloudWatch alarm states. Which state means there is insufficient information to determine whether the metric is breaching?

INSUFFICIENT_DATA

A CloudWatch alarm evaluates a metric every defined interval. What does the alarm period represent?

The time in seconds over which the metric is evaluated

A team wants an alarm to notify an operations team when a threshold is breached. Which target is appropriate?

Amazon SNS

An engineer wants to test an alarm's notification path without waiting for the metric to breach. Which CLI command can set the alarm state for testing?

AWS cloudwatch set-alarm-state

A security auditor needs to identify which identity called an API to delete a resource. Which service should be checked first?

AWS CloudTrail

A company needs object-level records for S3 GetObject and PutObject operations. What must be configured?

CloudTrail data events

A team wants to track IAM policy changes and subnet creation. Which CloudTrail event category captures these actions?

Management events

A security team wants CloudTrail to detect unusual spikes in write API activity compared with normal behavior. Which feature should it enable?

CloudTrail Insights

An investigator needs to review recent account activity in CloudTrail Event history. What is the retention period described in the course material?

90 days

A company wants a managed data lake for CloudTrail events, SQL analysis, and retention of up to seven years. Which option fits?

CloudTrail Lake

A CloudTrail Lake query scans too much data and costs more than expected. What should the analyst do?

Add a filter on eventTime

A company wants to determine whether an S3 bucket was public last month and review how its configuration changed. Which service is designed for this?

AWS Config

A security team creates a Config rule for unrestricted SSH. What should it understand about Config rules?

They evaluate compliance but do not inherently prevent the action

A resource remains noncompliant after a Config evaluation. The company wants an automated remediation workflow. What is a suitable approach?

Use a Systems Manager Automation document

A Config remediation runs but the resource remains noncompliant. What behavior may be configured?

Retry Remedation

A company wants to aggregate AWS Config data across multiple accounts and Regions. Which statement is correct?

Config supports aggregation across accounts and Regions

A team wants to notify stakeholders when a Config resource becomes noncompliant. Which eventing path is appropriate?

EventBridge rule and notification target such as SNS

A load balancer has increased incoming connections and error rates. The team also needs to know who changed its security group and whether its configuration complies with policy. Which service mapping is correct?

CloudWatch for metrics, CloudTrail for API actor, Config for configuration/compliance

A team wants to define infrastructure once and repeatedly provision the same architecture in test and production. Which service is the best fit?

AWS CloudFormation

A deployment team wants infrastructure changes reviewed as code and deployed consistently across accounts and Regions. What is the strongest benefit of CloudFormation?

It enables repeatable, consistent infrastructure deployment from templates

A developer wants to define a security group, EC2 instances, S3 bucket, and load balancer in one declarative file. Which concept is being used?

Infrastructure as Code

An application needs a centralized place to store configuration values and secrets, with version tracking and IAM access control. Which service should be considered?

Systems Manager Parameter Store

According to the supplied course slides, what is the per-account, per-Region parameter quota for standard parameters?

10,000

According to the supplied course slides, what is the per-account, per-Region parameter quota for advanced parameters?

100,000

A sensitive parameter must automatically expire after a defined period. Which advanced parameter policy is appropriate?

Expiration

A team wants an event notification before an advanced parameter expires. Which policy should it use?

ExpirationNotification

A security team wants to be notified when a parameter has not been updated for a specified period. Which policy fits?

NoChangeNotification

An architecture review team wants to evaluate a workload against AWS best practices across six pillars. Which tool should it use?

AWS Well-Architected Tool

Which list contains the six Well-Architected pillars?

1.Operational Excellence

2. Security

3.Reliability

4.Performance Efficiency

5.Cost Optimization

6.Sustainability

A team wants to stop guessing capacity needs, test at production scale, automate experimentation, and use game days. These are examples of what?

Well-architected guiding principles

A company wants a managed Grafana environment and needs users to authenticate through its enterprise identity provider. Which identity options are described in the course material?

IAM Identity Center and/or SAML

A monitoring team wants to build Grafana dashboards using AWS metrics and analytics sources. Which set contains supported AWS data sources from the slides?

CloudWatch, OpenSearch, Timestream, Athena, Redshift, X-Ray

A log-processing system needs log events delivered continuously to a downstream consumer. Which CloudWatch Logs feature is a better fit than S3 export?

Subscription filter

A team wants to send CloudWatch Logs from one AWS account to a Kinesis stream in another account. Which capability supports this?

Cross-account log subscription

OK

Not Triggered

Alarm

A THRESHOLD BREACH AND NOTIFICATIONS WILL BE SENT

A data engineering team is organizing metrics collected from multiple AWS services. They want to group related metrics under a common identifier. What CloudWatch concept should they use?

Namespace

An engineer monitors EC2 CPU utilization and wants to distinguish metrics associated with different EC2 instances and environments. What CloudWatch feature provides these identifying attributes?

Dimensions

According to your course material, what is the maximum number of dimensions that can be associated with a CloudWatch metric?

30

A company wants to retain application logs in CloudWatch for a specific period. Some logs need to be retained indefinitely, while others should expire. Which statement is correct according to your slides?

CloudWatch Logs supports retention from 1 day to 10 years, or never expire.

A data engineering team needs to deliver CloudWatch Logs to downstream services for processing and analysis. Which list contains supported destinations from your course material?

Amazon S3, Kinesis Data Streams, Kinesis Data Firehose, Lambda, and OpenSearch

A security engineer asks whether CloudWatch Logs data is encrypted by default and whether AWS KMS can be used. Which statement matches your slides?

Logs are encrypted by default, and KMS is available as an option.

A data engineer suspects an EC2 instance is experiencing memory pressure. They need to inspect free, used, cached, and total RAM. Which CloudWatch Unified Agent metric category should they examine?

RAM

An engineer is troubleshooting slow storage operations and needs to examine disk reads, writes, bytes, and IOPS. Which Unified Agent metric category is most relevant?

Disk I/O

An administrator needs to investigate TCP and UDP connections, packets, and bytes transferred by an EC2 instance. Which Unified Agent metric category should they examine?

Netstat

An administrator wants to monitor the number of running, sleeping, blocked, idle, and dead processes on an instance. Which Unified Agent metric category provides this information?

Processes

A data engineering team publishes high-resolution custom CloudWatch metrics and needs to configure an alarm with a shorter evaluation period. Which periods are supported according to your slides?

10 seconds, 30 seconds, or multiples of 60 seconds

An EC2 instance experiences a performance issue, and the company wants CloudWatch to automatically take action when an alarm enters the ALARM state. Which actions are supported?

Stop, terminate, reboot, or recover the EC2 instance

A company wants to capture API activity across every AWS Region in its account using one CloudTrail trail. Which configuration should it select?

Multi-Region trail

A compliance team wants CloudTrail logs delivered to long-term storage and also wants to monitor those logs through CloudWatch. Which destinations should it configure?

Amazon S3 and CloudWatch Logs

A security team enables CloudTrail Insights to identify unusual bursts of write-management API activity. How does CloudTrail Insights identify these anomalies?

It establishes a baseline from normal management events and analyzes write activity for unusual behavior.

A CloudTrail Insights finding is generated. Which mechanisms can surface the finding according to your course material?

CloudTrail console, S3, and an EventBridge event

An auditor wants to review how resource compliance changed over time, how resource configurations changed, and the API calls associated with those changes. Which service provides these historical views?

AWS Config

A company wants to receive notifications when AWS Config detects resource configuration changes or compliance-state changes. Which approach is appropriate?

Send Config events to EventBridge and route notifications to SNS.

A company uses Parameter Store to manage application configuration values. It wants to track changes to parameter values and restrict which users and applications can access them. Which capabilities support these requirements?

Version tracking and IAM access control

An application stores sensitive configuration values in Systems Manager Parameter Store. The company wants these values encrypted using AWS Key Management Service. Which capability supports this?

KMS integration

A data engineering team wants Parameter Store changes to participate in event-driven workflows and infrastructure deployments. Which integrations were identified in your slides?

EventBridge notifications and CloudFormation integration

A company wants to visualize metrics and logs from multiple AWS and third-party sources using Amazon Managed Grafana. Which statement is correct?

It supports AWS and third-party data sources, including CloudWatch, Athena, Redshift, MySQL, and Redis.

A company uses Amazon Managed Grafana and requires encryption at rest and in transit. It also wants to use AWS KMS. Which statement matches your slides?

Managed Grafana supports encryption at rest and in transit and can use KMS.

A monitoring team wants Grafana to scale with its workload without manually managing the underlying Grafana servers. Which Managed Grafana characteristic supports this?

Fully managed service with automatic scaling

A company operates a data-processing pipeline that is experiencing delays. The data engineering team needs to monitor processing-delay metrics, investigate application log events, and identify who made an API change. Which combination of services is most appropriate?

CloudWatch metrics and alarms, CloudWatch Logs Insights, and CloudTrail