CloudWatch Composite Alarms

5 minutes 5 Questions

CloudWatch Composite Alarms allow you to combine multiple alarms to create a more sophisticated and accurate alerting system. Composite alarms are designed to reduce false positives and increase the reliability of your alarm configuration by only triggering an alarming state when multiple conditions are met across various metrics. Essentially, a composite alarm is a boolean expression that combines multiple CloudWatch alarms using AND, OR, and NOT operators. This enables you to create alarm behavior based on more complex conditions, catering to specific business requirements or unique performance patterns in your infrastructure. For example, you can set up a composite alarm that triggers only when there is high CPU usage, high memory utilization, and an increase in the error rate, giving you a more comprehensive view of potential issues in your infrastructure.

Guide: AWS CloudWatch Composite Alarms

What is CloudWatch Composite Alarms:
AWS CloudWatch Composite Alarms is a unique feature of AWS CloudWatch, which allows you to combine multiple alarms into a single alarm. It allows you to handle alarm state changes more efficiently and reduces the necessity of human intervention.

Why it is important:
Composite alarms are crucial in reducing unnecessary noise from individual metric alarms and providing a holistic overview of your cloud environment's health. They allow you to set more complex conditions for alarming, involving combinations of multiple metric alarms

How it works:
You can create a composite alarm using the AWS Management Console, the AWS Command Line Interface (CLI), or an SDK or Command Line Tool that supports the composite alarm operations in the CloudWatch API. When you create a composite alarm, you specify a boolean expression that uses arithmetic and logical operators on your existing metric alarms. When the conditions in your expression are met, the composite alarm becomes activated.

Exam Tips: Answering Questions on CloudWatch Composite Alarms:
Understanding the working process of Composite Alarms is important for any exam. Here are some tips:
1. Understand how to create and configure a composite alarm in AWS CloudWatch.
2. You should be able to explain what happens when a composite alarm changes state.
3. Be prepared to answer questions on managing alarm state transitions and identifying false positives/negatives.
4. Familiarize yourself with using composite alarms to reduce alarm noise.
5. Practice the boolean operators and alarm metric math involved in composite alarms.

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

Question 1

A media company wants to ensure high-quality streaming for viewers. They need to set up a composite alarm in AWS CloudWatch that triggers when the average number of active TCP connections exceeds 3000 and the number of playback errors is above 500. Which configuration should you use?

tcp_connections_alarm or playback_errors_alarm tcp_connections_alarm not playback_errors_alarm tcp_connections_alarm and playback_errors_alarm tcp_connections_alarm xor playback_errors_alarm

Correct Answer: tcp_connections_alarm and playback_errors_alarm

The correct answer is to use the 'and' configuration between the two alarms. This will ensure that when both thresholds for active TCP connections and playback errors are exceeded at the same time, the composite alarm is triggered. Other configurations wouldn't consider both conditions being met simultaneously, which is what the company requires for its monitoring.

Question 2

A company maintaining an online marketplace wants to set up a composite alarm in AWS CloudWatch. The alarm should trigger if the number of 4xx errors exceeds 500, and the number of 5xx errors doesn't exceed 100 within the same time period. Which configuration should you use?

errors_4xx_alarm not errors_5xx_alarm errors_4xx_alarm and not errors_5xx_alarm errors_4xx_alarm xor errors_5xx_alarm errors_4xx_alarm or not errors_5xx_alarm

Correct Answer: errors_4xx_alarm and not errors_5xx_alarm

The correct answer is to use the 'and' configuration with the 'not' operator for the errors_5xx_alarm. The composite alarm should be configured to trigger only if 4xx errors exceed 500, and 5xx errors don't exceed 100. Using other configurations wouldn't consider both conditions being met simultaneously, as required by the question.

Question 3

Your organization wants to set up an AWS CloudWatch composite alarm that only triggers when the average latency is over 300ms, and either the network input rate is higher than 5 MB/s or the network output rate is higher than 5MB/s. What is the correct composite alarm configuration?

latency_alarm or (network_input_alarm and network_output_alarm) latency_alarm xor (network_input_alarm and network_output_alarm) latency_alarm and (network_input_alarm or network_output_alarm) latency_alarm not (network_input_alarm or network_output_alarm)

Correct Answer: latency_alarm and (network_input_alarm or network_output_alarm)

The correct answer is to use the 'and' operator for the latency_alarm with the 'or' operator for the network_input_alarm and network_output_alarm. This will trigger the composite alarm based on the required conditions, where average latency must exceed 300ms and at the same time, either input or output rate must exceed 5 MB/s. Any other configuration would not meet these specific criteria.

Go Premium

AWS Certified Solutions Architect - Associate Preparation Package (2025)

More CloudWatch Composite Alarms questions

4 questions (total)