Q1 — CloudWatch vs CloudTrail

A security engineer needs to determine which IAM user deleted an S3 bucket at 2:47 AM last Tuesday. Which service provides this information?

• A. Amazon CloudWatch Logs
• B. AWS CloudTrail
• C. Amazon Inspector
• D. AWS Config
• Correct answer:

Q2 — EC2 memory metrics

A CloudWatch alarm should trigger when EC2 memory utilization exceeds 80%. A team attempts to find a memory metric in CloudWatch but it does not exist. Why, and what is the solution?

• A. Memory metrics require Detailed Monitoring to be enabled on the instance
• B. EC2 does not expose memory utilization by default; install and configure the CloudWatch Agent to collect it
• C. Memory metrics are in CloudTrail, not CloudWatch
• D. Enable VPC Flow Logs and filter for memory-related events
• Correct answer:

Q3 — CloudWatch alarm actions

An Auto Scaling group should add EC2 instances when the average CPU utilization exceeds 70% for 5 consecutive minutes. What configuration achieves this?

• A. A CloudTrail rule that detects high CPU events
• B. A CloudWatch alarm on the CPUUtilization metric that triggers a scale-out Auto Scaling policy