Free SOA-C03 flashcards

Why do EC2 memory utilisation and free disk space not appear in Amazon CloudWatch by default, and how are they collected?

CloudWatch receives EC2 metrics from the hypervisor, which sees CPU, network and EBS activity but cannot look inside the guest operating system. Memory used and free disk are in-guest values, so the CloudWatch agent must read those system counters (such as mem_used_percent and disk_free) and publish them as custom metrics before any alarm can evaluate them.

Enabling EC2 detailed monitoring will start publishing memory and disk metrics to Amazon CloudWatch.

Detailed monitoring only raises the publishing frequency of the existing hypervisor metrics to one minute. It never adds in-guest memory or disk usage, so those signals are still missing. The CloudWatch agent is required to collect them.

Which EC2 Auto Scaling policy holds a metric like average CPU near a chosen set point with the least manual threshold tuning?

A target tracking scaling policy. You name a metric and a target value, and EC2 Auto Scaling creates and manages the underlying Amazon CloudWatch alarms, computing the capacity changes needed to keep the metric near the target. This works like a thermostat and avoids the per-band alarm design that simple and step scaling require.

A simple scaling policy that adds a fixed number of instances on a CPU alarm, then waits a cooldown, is the lowest-effort way to hold CPU at a set point.

Simple scaling reacts to a single alarm with a fixed capacity change and a blocking cooldown, so it cannot hold a continuous set point and forces the team to hand-tune the threshold and step size. Target tracking holds a metric near a target value while managing the CloudWatch alarms for you.

Which AWS service builds a hardened golden AMI automatically on a schedule, running build and test steps on a temporary instance and leaving nothing running between cycles?

EC2 Image Builder runs a pipeline that launches a transient build instance from a chosen base image, applies ordered build and test components, validates the result, registers a new versioned AMI, then terminates the build and test instances. Because the pipeline can trigger on a schedule or on a source-image change, the hardened image is rebuilt hands-off with no instance kept alive between runs.

A Systems Manager State Manager association on a long-running builder instance can produce a fresh hardened golden AMI whenever patches are released.

State Manager enforces configuration on a running instance and never outputs an AMI. It keeps a builder alive between rebuilds and produces no new image, so it cannot deliver a scheduled golden-image rebuild. EC2 Image Builder is the service that registers a versioned AMI and tears the build instance down.

How can instances in a private subnet download OS patches from the public internet while staying unreachable from outside?

Place a NAT gateway in a public subnet and route the private subnet's internet-bound traffic to it. The NAT gateway performs source network address translation so instances can initiate outbound connections through the internet gateway, but it never accepts connections initiated from the internet, so the instances remain unaddressable from outside.

Adding a route from a private subnet directly to an internet gateway is a safe way to give those instances outbound internet access.

Routing a private subnet straight to an internet gateway makes those instances publicly addressable and reachable from the internet, breaking the requirement that they stay unreachable from outside. Use a NAT gateway in a public subnet for outbound-only access.