AWS Management and Monitoring

Question 1

Which AWS service records API calls made to your AWS account—including the caller's identity, time, and source IP—and delivers log files to Amazon S3 for auditing and compliance?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail logs every API call made in your account (via the console, CLI, SDKs, or services) and delivers event history to S3. It answers 'who did what, when, and from where.' CloudWatch collects metrics and logs from applications, Config tracks resource configuration changes, and GuardDuty detects threats.

Question 2

A DevOps team wants to receive an alarm notification when average EC2 CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should they configure?

Accepted Answer

Amazon CloudWatch Alarms

Answer

Amazon CloudWatch Alarms monitor a specified metric over a defined period and trigger actions (SNS notification, Auto Scaling policy, EC2 action) when the metric breaches a threshold for a given number of consecutive periods. CloudTrail audits API calls, Config evaluates compliance, and Trusted Advisor provides general guidance.

Question 3

What does AWS Config primarily do?

Accepted Answer

Records AWS resource configuration history and evaluates configurations against desired rules

Answer

AWS Config continuously records the configuration state of your AWS resources and evaluates them against Config Rules (managed or custom). It answers 'what did my infrastructure look like at this point in time?' and 'is my configuration compliant?' It does not monitor performance (CloudWatch) or API calls (CloudTrail).

Question 4

Which Amazon CloudWatch feature allows you to collect, monitor, and store log files from EC2 instances, Lambda functions, and other AWS services in a centralized location?

Accepted Answer

CloudWatch Logs

Answer

CloudWatch Logs is a centralized log management service that ingests, stores, and queries log data from virtually any source (EC2 via the CloudWatch agent, Lambda automatically, and others). CloudWatch Metrics tracks numerical time-series data, Alarms monitor metrics, and Events (now EventBridge) routes event-based triggers.

Question 5

An operations team needs to run a shell script across 500 EC2 instances simultaneously without SSH access. Which AWS service enables this?

Accepted Answer

AWS Systems Manager Run Command

Answer

AWS Systems Manager Run Command lets you remotely and securely execute scripts or commands across a fleet of managed instances without opening inbound SSH/RDP ports. The SSM Agent on each instance communicates outbound to the Systems Manager endpoint, executing commands and returning output.

AWS Practice Test

AWS Practice Test

AWS Management and Monitoring