Free SOA-C03 flashcards

How do you alarm when more than fifty matching log lines appear in a CloudWatch Logs log group within five minutes, using the least infrastructure?

CloudWatch alarms watch metrics, never raw log groups. Create a CloudWatch Logs metric filter that matches the pattern and publishes a count metric, then set an alarm on the five-minute sum of that metric to fire above fifty. This uses only native CloudWatch features with no extra compute.

Why do EC2 memory utilisation and free disk space not appear in Amazon CloudWatch by default, and how are they collected?

CloudWatch receives EC2 metrics from the hypervisor, which sees CPU, network and EBS activity but cannot look inside the guest operating system. Memory used and free disk are in-guest values, so the CloudWatch agent must read those system counters (such as mem_used_percent and disk_free) and publish them as custom metrics before any alarm can evaluate them.

Common misconceptionThat turning on detailed monitoring adds memory and disk metrics. It only raises the publishing rate of the existing hypervisor metrics to one minute.

Which EC2 Auto Scaling policy holds a metric like average CPU near a chosen set point with the least manual threshold tuning?

A target tracking scaling policy. You name a metric and a target value, and EC2 Auto Scaling creates and manages the underlying Amazon CloudWatch alarms, computing the capacity changes needed to keep the metric near the target. This works like a thermostat and avoids the per-band alarm design that simple and step scaling require.

What configuration object must an EC2 Auto Scaling group reference to use a mixed instances policy spanning instance types and both On-Demand and Spot capacity?

A launch template. Launch templates are versioned and are the only configuration object that supports a mixed instances policy, letting one group draw from a list of instance types and split capacity between On-Demand and Spot. They support multiple numbered versions, so configuration can evolve over time.

Common misconceptionThat a launch configuration can mix instance types and Spot capacity. It is immutable, carries a single instance type, and cannot express a mixed instances policy at all.

Which AWS service builds a hardened golden AMI automatically on a schedule, running build and test steps on a temporary instance and leaving nothing running between cycles?

EC2 Image Builder runs a pipeline that launches a transient build instance from a chosen base image, applies ordered build and test components, validates the result, registers a new versioned AMI, then terminates the build and test instances. Because the pipeline can trigger on a schedule or on a source-image change, the hardened image is rebuilt hands-off with no instance kept alive between runs.

Which Amazon ECR scanning configuration continuously reports both OS and language package vulnerabilities and rescans existing images automatically as new CVEs are disclosed?

Enhanced scanning, powered by Amazon Inspector, covers both operating system and programming language packages and automatically rescans images already in the repository whenever Inspector learns of a new vulnerability. Basic scanning runs only on push or on demand and covers OS packages only, so it cannot provide the language coverage or automatic refresh.

Common misconceptionThat basic ECR scanning keeps images under continuous watch. It runs only on push or on demand and reports operating system packages alone.

Which VPC control allows inbound HTTPS plus automatic return traffic with the fewest rules to maintain, and why?

A security group is stateful, so an inbound allow on port 443 implicitly permits the matching outbound response without a separate return rule. This expresses the requirement with a single rule, unlike a stateless network ACL which needs explicit inbound and outbound rules covering ephemeral ports.

How can instances in a private subnet download OS patches from the public internet while staying unreachable from outside?

Place a NAT gateway in a public subnet and route the private subnet's internet-bound traffic to it. The NAT gateway performs source network address translation so instances can initiate outbound connections through the internet gateway, but it never accepts connections initiated from the internet, so the instances remain unaddressable from outside.

Common misconceptionThat a route to an internet gateway gives a private subnet outbound-only access. It works in both directions, so those instances become reachable from the internet.