SOA-C03 practice question: Automated remediation with Systems Manager (1 of 2)

Monitoring, Logging, Analysis, Remediation, and Performance Optimization A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A dental chain's appointment API runs on EC2 instances.

About once a week the API process hangs, and a custom CloudWatch alarm on its health-check metric goes into ALARM. The fix is always to restart the service with a custom Systems Manager Automation runbook the team already wrote.

Rebooting the instance is not acceptable, because the cache takes 10 minutes to warm. The team wants the fix to run automatically within a minute of the alarm.

What should a CloudOps engineer do?

Choose one answer.

A. Add an EC2 reboot action to the alarm so that the instance restarts automatically whenever the health-check alarm enters ALARM.
B. Create a State Manager association that runs the runbook on all instances every 30 minutes, whether or not the alarm has fired.
C. Create an EventBridge rule that matches the alarm's state change to ALARM and starts the Automation runbook through an IAM role allowed to start it.
D. Write a Lambda function that runs every minute, checks the alarm state with the CloudWatch API, and calls Run Command to restart the service.

Show the answer and explanation

Answer: C

A. Wrong: The EC2 reboot alarm action restarts the whole instance. That clears the hang but also empties the cache, which the team ruled out. Learn more: Create alarms that stop, terminate, reboot, or recover an instance (opens in a new tab)
B. Wrong: State Manager applies a configuration on a schedule. Restarts would happen only on the schedule, up to 30 minutes after the hang, and would also restart healthy services needlessly. Learn more: AWS Systems Manager State Manager (opens in a new tab)
C. Right: Correct. CloudWatch sends alarm state changes to EventBridge, and a rule can start an Automation runbook directly as its target. The restart runs within seconds and touches only the service, not the instance. Learn more: Alarm events and EventBridge (opens in a new tab)
D. Wrong: This works, but it adds custom polling code to maintain and runs every minute even when nothing is wrong. An event-driven rule gives the same result with less to build. Learn more: AWS Systems Manager Run Command (opens in a new tab)

Explanation

Automatic remediation in AWS usually chains an alarm to an action through EventBridge. The alarm's state change event matches a rule, and the rule starts a Systems Manager Automation runbook that performs the precise fix. EC2 alarm actions are coarser, scheduled associations are slower, and polling code adds overhead.

The alarm's state change is the trigger, and the runbook does only the precise fix, so the cache stays warm.

SOA-C03 practice question: Automated remediation with Systems Manager (1 of 2)

Explanation

Study

Keep practicing