DOP-C02 Practice Question 16: Composite Alarm Suppression
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 2 · question 6 of 10
An application has 40 CloudWatch metric alarms, one per microservice, each sending to an on-call Amazon SNS topic. When a shared dependency fails, all 40 alarms fire and the on-call engineer gets 40 pages for one incident. During the nightly maintenance window, which an existing MaintenanceMode alarm already signals, the alarms page for expected errors. The team wants one page per incident and no pages while MaintenanceMode is in ALARM, without writing custom code.
What should the team configure?
Show answer and explanation
Answer:
A composite alarm evaluates a rule expression over other alarms' states, combining ALARM(), OK(), and INSUFFICIENT_DATA() with AND, OR, and NOT. With the child alarms no longer paging, an OR composite changes to ALARM once when the first child fires. Further children firing do not change its state, so the incident produces one page. Action suppression handles the maintenance window: any alarm can be named as a composite alarm's suppressor, and while the suppressor is in ALARM the composite alarm takes no actions. WaitPeriod and ExtensionPeriod absorb the timing gaps as the suppressor changes state. Everything is configuration, with no code.
Option A cuts short blips but not duplicates. A real outage is sustained, so all 40 alarms still fire and page, just slightly later, and nothing handles the maintenance window.
Option B changes *how* each threshold is set, not how many notifications one incident creates. Forty anomaly detection alarms still means 40 independent pages when a shared dependency fails.
Option D deals with the maintenance window only. Muting the alarms at night does nothing about the daytime flood, where each of the 40 alarms still has its own SNS action.
References: Create a composite alarm; Alarm suppression