AWS DevOps Monitoring and Logging 3 — Questions and Answers
Question 1: When configuring a CloudWatch Alarm, what does setting the 'Treat missing data as' option to 'breaching' cause?
- The alarm ignores periods with no data and stays in its current state
- The alarm transitions to ALARM state when data is missing, treating absence as a failure (Correct answer)
- The alarm sends a notification but does not change state
- The alarm resets to OK state when data stops arriving
Correct answer: The alarm transitions to ALARM state when data is missing, treating absence as a failure
Setting missing data to 'breaching' means the alarm treats absent data points as if the threshold were exceeded, triggering an ALARM state.
Question 2: A Lambda function processes deployment events and writes structured JSON logs. Which CloudWatch feature lets the team count error events per minute without changing the function code?
- CloudWatch Embedded Metrics Format
- CloudWatch Metric Filters (Correct answer)
- CloudWatch Contributor Insights
- CloudWatch Log Anomaly Detection
Correct answer: CloudWatch Metric Filters
Metric Filters scan incoming log data for patterns and increment a custom metric each time a match is found, requiring no code changes.
Question 3: Which X-Ray concept represents the end-to-end journey of a single request as it passes through multiple services?
- Segment
- Subsegment
- Trace (Correct answer)
- Annotation
Correct answer: Trace
A Trace in X-Ray is the complete collection of segments and subsegments generated by a single request across all services it touches.
Question 4: A DevOps engineer needs to alert on-call staff when deployment error rates exceed 5% over a 5-minute window. The alerting must include a runbook link. Which SNS feature supports this?
- SNS message filtering
- SNS message attributes in the alarm description or action notification (Correct answer)
- SNS FIFO topic ordering
- SNS mobile push with deep links
Correct answer: SNS message attributes in the alarm description or action notification
CloudWatch Alarm descriptions and SNS message bodies can include runbook URLs, which are delivered to on-call staff via the SNS notification.
Question 5: Which CloudWatch Logs feature identifies which log sources (IP addresses, users, URLs) contribute most to log volume or error counts?
- Log Insights
- Metric Filters
- Contributor Insights (Correct answer)
- Subscription Filters
Correct answer: Contributor Insights
Contributor Insights analyzes log data to identify the top contributors (heavy hitters) to a metric, such as the IPs generating the most errors.
Question 6: A team runs canary deployments on ECS and wants to automatically roll back if the p99 latency of the new task version exceeds 2 seconds. Which service combination enables this?
- CodeDeploy deployment group with CloudWatch Alarm-based rollback triggers (Correct answer)
- CloudWatch Alarm + Lambda rollback function + SNS
- AWS Config + Systems Manager + CodeDeploy
- EventBridge Scheduler + CodePipeline manual approval
Correct answer: CodeDeploy deployment group with CloudWatch Alarm-based rollback triggers
CodeDeploy deployment groups support CloudWatch Alarm-based automatic rollback; if the alarm fires during deployment, CodeDeploy reverts to the previous version.
Question 7: What is the purpose of CloudWatch Embedded Metrics Format (EMF)?
- To embed CloudWatch dashboards inside third-party tools
- To allow applications to publish high-cardinality custom metrics as structured log events without a separate API call (Correct answer)
- To format CloudWatch Alarms as JSON for EventBridge
- To embed metric widgets inside CloudWatch Log Insights queries
Correct answer: To allow applications to publish high-cardinality custom metrics as structured log events without a separate API call
EMF lets applications write structured JSON log lines that CloudWatch automatically parses and converts into custom metrics asynchronously.
AWS DevOps Monitoring and Logging 3
When configuring a CloudWatch Alarm, what does setting the 'Treat missing data as' option to 'breaching' cause?