AWS Management and Monitoring — Questions and Answers
Question 1: Which AWS service records API calls made to your AWS account—including the caller's identity, time, and source IP—and delivers log files to Amazon S3 for auditing and compliance?
- Amazon CloudWatch Logs
- AWS CloudTrail (Correct answer)
- AWS Config
- Amazon GuardDuty
Correct answer: AWS CloudTrail
AWS CloudTrail logs every API call made in your account (via the console, CLI, SDKs, or services) and delivers event history to S3. It answers 'who did what, when, and from where.' CloudWatch collects metrics and logs from applications, Config tracks resource configuration changes, and GuardDuty detects threats.
Question 2: A DevOps team wants to receive an alarm notification when average EC2 CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should they configure?
- AWS CloudTrail
- Amazon CloudWatch Alarms (Correct answer)
- AWS Config Rules
- AWS Trusted Advisor
Correct answer: Amazon CloudWatch Alarms
Amazon CloudWatch Alarms monitor a specified metric over a defined period and trigger actions (SNS notification, Auto Scaling policy, EC2 action) when the metric breaches a threshold for a given number of consecutive periods. CloudTrail audits API calls, Config evaluates compliance, and Trusted Advisor provides general guidance.
Question 3: What does AWS Config primarily do?
- Monitors application performance metrics and logs in real time
- Records AWS resource configuration history and evaluates configurations against desired rules (Correct answer)
- Provides API call logging for all AWS services
- Automatically remediates security vulnerabilities in EC2 instances
Correct answer: Records AWS resource configuration history and evaluates configurations against desired rules
AWS Config continuously records the configuration state of your AWS resources and evaluates them against Config Rules (managed or custom). It answers 'what did my infrastructure look like at this point in time?' and 'is my configuration compliant?' It does not monitor performance (CloudWatch) or API calls (CloudTrail).
Question 4: Which Amazon CloudWatch feature allows you to collect, monitor, and store log files from EC2 instances, Lambda functions, and other AWS services in a centralized location?
- CloudWatch Metrics
- CloudWatch Alarms
- CloudWatch Logs (Correct answer)
- CloudWatch Events
Correct answer: CloudWatch Logs
CloudWatch Logs is a centralized log management service that ingests, stores, and queries log data from virtually any source (EC2 via the CloudWatch agent, Lambda automatically, and others). CloudWatch Metrics tracks numerical time-series data, Alarms monitor metrics, and Events (now EventBridge) routes event-based triggers.
Question 5: An operations team needs to run a shell script across 500 EC2 instances simultaneously without SSH access. Which AWS service enables this?
- AWS CloudFormation
- AWS OpsWorks
- AWS Systems Manager Run Command (Correct answer)
- AWS Elastic Beanstalk
Correct answer: AWS Systems Manager Run Command
AWS Systems Manager Run Command lets you remotely and securely execute scripts or commands across a fleet of managed instances without opening inbound SSH/RDP ports. The SSM Agent on each instance communicates outbound to the Systems Manager endpoint, executing commands and returning output.
Question 6: Which AWS service provides a unified view of operational data from multiple AWS services and automates operational tasks across AWS resources, helping with patch management, inventory, and parameter storage?
- AWS CloudFormation
- AWS Systems Manager (Correct answer)
- Amazon CloudWatch
- AWS Control Tower
Correct answer: AWS Systems Manager
AWS Systems Manager is a broad operations management service that consolidates tools for resource grouping, patch management (Patch Manager), secure parameter storage (Parameter Store), remote command execution (Run Command), session management (Session Manager), and more—all without requiring open inbound ports.
AWS Management and Monitoring
Which AWS service records API calls made to your AWS account—including the caller's identity, time, and source IP—and delivers log files to Amazon S3 for auditing and compliance?