SOA-C03 - Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22% of the exam) - Section 1.4

Automate issue remediation driven by metrics using Amazon EventBridge, AWS Lambda, AWS Systems Manager Automation runbooks and auto scaling.

Design event-driven remediation pipelines that trigger AWS Lambda functions or Systems Manager Automation runbooks from Amazon EventBridge rules and CloudWatch alarm actions. Choose between Lambda for custom logic and Automation runbooks for predefined operational playbooks.

Amazon EventBridgeAWS LambdaSystems Manager Automation runbooksEvent-driven remediation

Practice question for this objective

Free sampleMonitoring, Logging, Analysis, Remediation, and Performance Optimizationmedium

An application publishes a custom metric named QueueAge to Amazon CloudWatch that records how long the oldest message has waited in a processing queue. When QueueAge stays above a threshold for several minutes, operations want an existing AWS Systems Manager Automation runbook to run on its own and drain the backlog, with no servers polling the metric and no custom bridging code to maintain. Which two components, working together, should connect the metric breach to the runbook? (Select TWO.)

AA CloudWatch alarm on the QueueAge metric that changes to the ALARM state once the threshold is breached for the configured period. Correct
BAn Amazon EventBridge rule matching the alarm state change to ALARM, with the Systems Manager Automation runbook configured as the rule target. Correct
CAn AWS Config rule evaluating QueueAge that marks the resource noncompliant and starts the Automation runbook as its remediation action.
DA Systems Manager Run Command document pushed to the fleet on a schedule to read QueueAge and decide whether to drain the queue.
EA Lambda function on a fixed EventBridge Scheduler timetable that queries QueueAge each minute and starts the runbook when the value is high.

A CloudWatch alarm detects a custom metric breach and an EventBridge rule on the alarm state change invokes a Systems Manager Automation runbook for hands-off remediation. Metric-driven remediation pairs a detector with a router. The CloudWatch alarm watches the custom QueueAge metric and emits an ALARM state change when the threshold holds; an EventBridge rule matches that state change and targets the Automation runbook directly, so the runbook runs without polling or glue code. AWS Config inspects configuration not metrics, Run Command needs scheduled polling, and a scheduled Lambda is exactly the custom polling code the team wants to avoid.

Why A is correct: The alarm evaluates the custom metric and produces the ALARM state change that signals the breach, which is the trigger the remediation reacts to.

Why B is correct: The rule routes the alarm state-change event directly to the runbook target, invoking the remediation event-driven with no polling and no custom code.

Why C is wrong: AWS Config evaluates resource configuration compliance, not CloudWatch metric thresholds, so it cannot detect a QueueAge breach and is the wrong detector here.

Why D is wrong: Run Command runs commands on managed nodes on demand, but scheduling it to poll the metric reintroduces the polling the team wants to avoid and is not event-driven.

Why E is wrong: A scheduled function is custom polling code on a timer, which adds maintenance and latency and contradicts the requirement for no polling and no bridging code.

See more SOA-C03 practice questions, answers explained.

Exam traps in Monitoring, Logging, Analysis, Remediation, and Performance Optimization

Answers that look right on this material and are not. Each one is a distractor from a different question in the SOA-C03 bank for this domain.

Configure a recurring EventBridge Scheduler job that queries the alarm state every minute and starts the remediation whenever it observes the ALARM value.
Why it is wrong: A scheduled poll adds a recurring job and reacts only at each interval, which is exactly the polling pattern the team asked to avoid and is slower than reacting to the state change.
Point the alarm action at an Amazon SNS topic and subscribe a polling worker that reads the message and calls StartAutomationExecution on the runbook.
Why it is wrong: SNS with a polling worker reacts to the alarm, but it reintroduces custom compute and code that the requirement explicitly wants to avoid for the bridge.
Issue a Systems Manager Run Command that sends the cache-clear shell commands to the instance and reports back whether each line of the script succeeded.
Why it is wrong: Run Command executes ad hoc commands on instances but does not model conditional branching or orchestrate verify-then-restart-then-ticket steps, so it cannot hold the reusable workflow on its own.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.