CS Techie
Comments
courseAWS

AWS certification-style practice questions from Cloud Monitoring Service

Easy (foundational)

  1. You want to collect application-level latency metrics from your EC2-hosted web service and visualize them in CloudWatch. Which approach is recommended?
    A. Use CloudTrail to publish latency data.
    B. Push custom metrics via PutMetricData or the CloudWatch agent.
    C. Send metrics to X‑Ray only and rely on its UI.
    D. Store metrics in S3 and import them into CloudWatch manually.
    Correct: B
    Explanation: PutMetricData or the CloudWatch agent is the standard way to publish custom application metrics to CloudWatch for dashboards and alarms.

  2. Which CloudWatch feature lets you run interactive queries over log data with a serverless, SQL‑like language?
    A. CloudTrail Insights
    B. CloudWatch Logs Insights
    C. CloudWatch Metric Math
    D. CloudWatch Synthetics
    Correct: B
    Explanation: CloudWatch Logs Insights provides a query language and interactive console for analyzing log data.

  3. You need an alarm that only fires when a metric breaches a threshold for 3 out of 5 consecutive 1‑minute periods. Which alarm setting controls this behavior?
    A. TreatMissingData
    B. DatapointsToAlarm and EvaluationPeriods
    C. Period only
    D. ComparisonOperator
    Correct: B
    Explanation: EvaluationPeriods defines the number of periods to evaluate; DatapointsToAlarm determines how many of those periods must be breaching to change state.

  4. Which service records AWS API calls for auditing and compliance and can be configured to deliver logs to S3 or CloudWatch Logs?
    A. CloudWatch Events
    B. CloudTrail
    C. GuardDuty
    D. X‑Ray
    Correct: B
    Explanation: AWS CloudTrail logs API calls and can deliver logs to S3 and optionally to CloudWatch Logs.

  5. You have a highly variable baseline metric (diurnal traffic). Which CloudWatch alarm type helps detect anomalous deviations from expected behavior without a fixed static threshold?
    A. Composite alarm
    B. Metric alarm with DatapointsToAlarm=1
    C. Anomaly detection alarm
    D. SNS alarm
    Correct: C
    Explanation: Anomaly detection uses a machine learning model trained on historical data to create dynamic thresholds.

  6. Which CloudWatch Logs feature can forward a real‑time stream of log events to a Lambda function for processing?
    A. Metric filters
    B. Subscription filters
    C. Log retention policies
    D. Cross-account log exports
    Correct: B
    Explanation: Subscription filters send log events in near real time to Lambda, Kinesis, or Firehose.

Medium (design & integration)

  1. You want to trace a user request across microservices (API Gateway → Lambda → downstream services) to find latency hotspots. Which AWS service is best suited?
    A. CloudTrail
    B. CloudWatch Alarms
    C. X‑Ray
    D. GuardDuty
    Correct: C
    Explanation: AWS X‑Ray provides distributed tracing and a service map to analyze latency and errors across services.

  2. Which CloudWatch metric retention statement is correct for high‑resolution (1‑second) metrics?
    A. High‑resolution metrics are retained at 1‑second granularity for 3 hours.
    B. High‑resolution metrics are retained forever at 1‑second granularity.
    C. High‑resolution metrics are retained for 15 days only.
    D. High‑resolution metrics are not supported by CloudWatch.
    Correct: A
    Explanation: High‑resolution (1s) data is retained at 1‑second granularity for a limited time (commonly 3 hours) before being aggregated.

  3. You need a durable archive of events from a critical business event bus for later replay and debugging. Which EventBridge feature should you use?
    A. EventBridge Pipes
    B. EventBridge archive & replay
    C. CloudWatch Logs Insights
    D. Kinesis Data Streams only
    Correct: B
    Explanation: EventBridge archive & replay lets you store events and replay them to recreate state or reprocess events.

  4. Which of the following is the best way to reduce noisy alerts from brief spikes when creating CloudWatch alarms?
    A. Use 1‑second period with EvaluationPeriods=1
    B. Increase Period and use DatapointsToAlarm to require sustained breaches
    C. Set TreatMissingData=breaching
    D. Create more separate alarms for the same metric
    Correct: B
    Explanation: Increasing the period and requiring multiple datapoints to breach reduces false positives from transient spikes.

  5. You want to centralize Prometheus metrics at scale for EKS and query them with Grafana. Which AWS managed service is built for this purpose?
    A. Amazon Managed Grafana (data store)
    B. Amazon Managed Service for Prometheus (AMP)
    C. CloudWatch Logs Insights
    D. CloudTrail
    Correct: B
    Explanation: AMP is a managed Prometheus-compatible service for scraping, storing, and querying Prometheus metrics; it integrates with Grafana.

  6. For a synthetic monitoring check of your public API endpoint with scripted browser interactions, which CloudWatch feature should you use?
    A. CloudWatch RUM
    B. CloudWatch Synthetics canaries
    C. CloudWatch Logs Insights
    D. CloudWatch Alarms only
    Correct: B
    Explanation: CloudWatch Synthetics (canaries) run scripted checks and can perform browser-like interactions to monitor endpoints.

Hard (scenario & troubleshooting)

  1. A critical metric occasionally shows INSUFFICIENT_DATA and the alarm does not evaluate. You confirm the application is publishing metrics. Which setting is the best first check to influence INSUFFICIENT_DATA behavior?
    A. Change TreatMissingData to 'notBreaching' or 'ignore' as appropriate
    B. Increase AlarmName length
    C. Disable CloudTrail
    D. Delete and recreate the log group
    Correct: A
    Explanation: TreatMissingData determines how missing samples affect alarm state; adjusting it resolves INSUFFICIENT_DATA behavior in many cases.

  2. You must monitor end‑user experience from real browsers globally. Which two CloudWatch features combined give client-side telemetry and scripted synthetic checks?
    A. X‑Ray + CloudTrail
    B. CloudWatch RUM + CloudWatch Synthetics
    C. CloudWatch Logs + AMP
    D. GuardDuty + Detective
    Correct: B
    Explanation: RUM collects real user monitoring data from browsers; Synthetics runs scripted (synthetic) checks — use both for full visibility.

  3. Your X‑Ray traces show high downstream latency for an external HTTP call. You want to alert automatically when average downstream segment duration exceeds 300ms for 5 minutes. Which pattern is best?
    A. Create a CloudWatch metric (custom or X‑Ray integration) for downstream segment duration and alarm on it.
    B. Use CloudTrail to detect slow calls.
    C. Put an alarm on CPUUtilization of the instance only.
    D. Rely solely on manual inspection of X‑Ray traces.
    Correct: A
    Explanation: Derive a metric for the downstream segment (via X‑Ray or custom metric) and create a CloudWatch alarm to automate detection and notification.

  4. You run a multi‑account environment and want centralized monitoring of CloudTrail events across accounts with automated response for suspicious API calls. Which combination fits best?
    A. Export CloudTrail to S3 + Athena only
    B. Use CloudWatch Logs + GuardDuty + Detective + EventBridge rules to centralize and automate responses
    C. Use X‑Ray in each account only
    D. Use CloudWatch RUM for API security detection
    Correct: B
    Explanation: CloudTrail logs can be sent to CloudWatch Logs; GuardDuty detects threats; Detective helps investigate; EventBridge rules can trigger automated responses across accounts.

  5. An application emits high-cardinality label values, and you plan to create many CloudWatch custom metrics derived from logs. What is the risk and best mitigation?
    A. No risk — create unlimited metrics.
    B. Metric explosion leading to cost and management issues; mitigate by aggregating labels, reducing cardinality, and extracting only necessary fields.
    C. CloudWatch will auto-aggregate and reduce cost.
    D. Use CloudTrail instead of metrics.
    Correct: B
    Explanation: High-cardinality metrics cause explosion of metric time series and costs; reduce cardinality and only create necessary derived metrics.

  6. Your CloudWatch Logs subscription to a Kinesis Data Stream fails intermittently and you see "ThrottlingException". What is the most appropriate mitigation?
    A. Increase retention on the log group
    B. Increase Kinesis stream capacity (shards) or use batching/backoff on the consumer side
    C. Delete the log group and recreate it
    D. Switch to CloudTrail for logs
    Correct: B
    Explanation: Throttling indicates insufficient throughput on the Kinesis stream; increase shards or improve batching to handle the log event rate.

  7. You need to detect compromised EC2 instances and anomalous AWS API behavior in your account. Which managed service should you enable to continuously analyze logs and produce security findings?
    A. CloudWatch Synthetics
    B. Amazon GuardDuty
    C. CloudWatch RUM
    D. CloudTrail Insights only
    Correct: B
    Explanation: GuardDuty analyzes VPC Flow Logs, CloudTrail, and DNS logs to detect threats and compromised instances.

  8. You created a composite alarm that combines multiple metric alarms. However, it rarely enters ALARM even when individual alarms fire. Which is a likely cause?
    A. Composite alarms only work with CloudTrail metrics.
    B. The composite rule logic (AND/OR/NOT) might be configured such that the combination rarely evaluates true; review the Boolean expression and the individual alarm states and their EvaluationPeriods.
    C. Composite alarms ignore DatapointsToAlarm settings.
    D. Composite alarms cannot trigger SNS.
    Correct: B
    Explanation: Composite alarms evaluate a Boolean rule over other alarms; incorrect boolean logic or timing mismatches (evaluation windows) can prevent the composite from becoming ALARM.