AWS Certification CloudOps Engineer Associate (SysOps) 2025 past questions and answers

1. Install and configure the Amazon CloudWatch agent to publish memory metrics, then create a CloudWatch alarm on the selected metric.
2. Enable detailed monitoring for the EC2 instances; this adds memory metrics at one-minute intervals.
3. Create a CloudTrail trail that records EC2 management events and use it as the memory metric source.
4. Enable VPC Flow Logs and create an alarm on the volume of network traffic.

Answer: A. Install and configure the Amazon CloudWatch agent to publish memory metrics, then create a CloudWatch alarm on the selected metric.

The CloudWatch agent can collect guest operating system metrics such as memory and publish them to CloudWatch for alarming. EC2 detailed monitoring increases the frequency of supported instance metrics but does not add memory metrics.

1. Enable CloudTrail management event logging and query the API history in the CloudTrail console.
2. Enable ALB access logs in Amazon S3 and use Amazon Athena to query the request-level records.
3. Enable VPC Flow Logs for the ALB subnets and query packet-flow records in Athena.
4. Enable Amazon Inspector and review its vulnerability findings for the target instances.

Answer: B. Enable ALB access logs in Amazon S3 and use Amazon Athena to query the request-level records.

ALB access logs include request-level details such as the target, request URI, and response status, and Athena can query the S3 log files without server management. CloudTrail records AWS API activity, while VPC Flow Logs do not contain HTTP request paths.

1. Keep every log event in the CloudWatch Logs default retention setting and export files manually when needed.
2. Send all log events to an Amazon OpenSearch Service cluster sized for continuous, low-latency searches.
3. Create a CloudWatch Logs subscription filter that delivers the logs through Amazon Data Firehose to Amazon S3, and use S3 lifecycle policies for retention and storage transitions.
4. Write the logs to an EC2 instance's root volume and create a daily EBS snapshot.

Answer: C. Create a CloudWatch Logs subscription filter that delivers the logs through Amazon Data Firehose to Amazon S3, and use S3 lifecycle policies for retention and storage transitions.

A CloudWatch Logs subscription can stream matching log events to Data Firehose, which can deliver them to durable, lower-cost S3 storage; S3 lifecycle policies can manage long retention. OpenSearch is more appropriate for frequently queried data and adds ongoing cluster costs and operations.

1. Create an AWS Config rule that checks whether the security group has any ingress rules.
2. Schedule an AWS Lambda function to poll the EC2 API every 15 minutes.
3. Create a CloudWatch metric filter on the EC2 CPU utilization metric.
4. Create an Amazon EventBridge rule matching the CloudTrail AuthorizeSecurityGroupIngress API event and send it to an SNS topic.

Answer: D. Create an Amazon EventBridge rule matching the CloudTrail AuthorizeSecurityGroupIngress API event and send it to an SNS topic.

CloudTrail management events are available to EventBridge, where a rule can match the security group ingress API call and deliver it to SNS. Periodic polling adds delay and custom operations, while the other choices do not detect the requested API event.

1. Modify the DB instance to use a Multi-AZ deployment.
2. Create a read replica in the same Availability Zone and direct writes to it.
3. Export automated backups to Amazon S3 and restore them after an outage.
4. Place the DB instance in a public subnet and associate an Elastic IP address.

Answer: A. Modify the DB instance to use a Multi-AZ deployment.

An RDS Multi-AZ deployment maintains a standby in another Availability Zone and provides managed failover while retaining the DB endpoint. A read replica is primarily a scaling and replication option, not the equivalent of automatic Multi-AZ failover.