AWS Certified SysOps Administrator – Associate — All Questions

An administrator needs per-minute CPU metrics from EC2 instances instead of the default interval. What should they enable?

• a.The CloudWatch agent for CPU
• b.A custom metric filter
• c.Detailed monitoring on the instances✓
• d.AWS CloudTrail data events

Enabling detailed monitoring reports EC2 metrics every one minute instead of the default five-minute basic monitoring. The CloudWatch agent is needed for memory and disk metrics, not CPU frequency, metric filters extract metrics from logs, and CloudTrail records API activity.

Memory utilization is not appearing among an instance's default CloudWatch metrics. Why, and what is the fix?

• a.Memory is not collected by the hypervisor by default; install the CloudWatch agent to publish it✓
• b.Memory metrics require enabling CloudTrail
• c.Memory is only visible in Cost Explorer
• d.Detailed monitoring adds memory metrics automatically

The hypervisor cannot see guest OS memory, so CloudWatch does not collect it by default; the CloudWatch agent running inside the instance publishes memory and disk metrics. CloudTrail and Cost Explorer are unrelated, and detailed monitoring only increases the frequency of existing metrics.

Which service should an administrator use to determine which IAM principal deleted a security group last week?

• a.Amazon CloudWatch metrics
• b.AWS Config only
• c.VPC Flow Logs
• d.AWS CloudTrail✓

CloudTrail records management API calls including who made them and when, so it identifies the principal that deleted the security group. CloudWatch tracks operational metrics, Config tracks configuration state changes over time, and VPC Flow Logs capture network traffic, not API identity.

An administrator wants to automatically run a remediation Lambda whenever an EC2 instance enters the stopped state. Which service triggers this?

• a.AWS Config rules
• b.Amazon EventBridge✓
• c.Amazon SQS
• d.AWS Trusted Advisor

EventBridge rules match events such as an EC2 state-change and invoke targets like Lambda or Systems Manager Automation for remediation. Config evaluates configuration compliance, SQS is a message queue, and Trusted Advisor gives best-practice recommendations, not real-time event triggering.

How can an administrator turn a recurring error string in application logs into something they can alarm on?

• a.Export logs to S3 nightly
• b.Enable detailed monitoring
• c.Create a CloudWatch Logs metric filter that counts the pattern, then alarm on the metric✓
• d.Increase log retention

A metric filter scans a log group for a pattern and publishes a numeric CloudWatch metric that an alarm can watch. Exporting to S3 or extending retention stores logs but does not create alarms, and detailed monitoring only affects metric frequency.