AWS 4: Monitoring and Logging: 127 practice questions

12 of the 127 4: Monitoring and Logging questions in the Certsqill AWS bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AWS? Take the free 5-min readiness check →

1. Centralize logs in CloudWatch Logs for 14 days: Which design best satisfies these requirements?

1. Create a cross-account OpenSearch domain, grant developers read access, and retain indexed records for seven years.

   OpenSearch supports searching but requires cluster operations and its index retention and access controls do not by themselves provide immutable compliance retention.
2. Centralize logs in CloudWatch Logs, set 14-day retention, and restrict log-group deletion to the platform team.

   This provides search and access control but does not provide immutable or tamper-resistant retention because an authorized administrator can still delete records or log groups.
3. Send logs to a security-owned S3 bucket with versioning and use CloudWatch Logs Insights only when investigators need searches.

   Versioning supports recovery from some overwrites or deletions but does not establish immutable retention, and S3 alone does not provide the required convenient 14-day log search experience.
4. Centralize logs in CloudWatch Logs for 14 days, and deliver a copy to a security-owned S3 bucket using Object Lock in compliance mode with the required retention period. ✓

   CloudWatch Logs provides managed short-term search and preserves centralized source context. A security-owned S3 bucket with Object Lock in compliance mode provides protected retention that application teams cannot shorten or delete.

Use centralized CloudWatch Logs for 14-day search and a security-owned S3 Object Lock archive for immutable retention.

2. Create a metric filter matching rejected-shipment events: Which design should the DevOps engineer implement?

1. Create a metric filter matching rejected-shipment events and alarm on Average greater than 20.

   Average measures the mean published value, not the total rejected events across instances during the evaluation period.
2. Create a metric filter matching rejected-shipment events, publish value 1, use zero default, and alarm on Sum. ✓

   A metric filter counts future matching events, and Sum over five minutes detects the aggregate rejection threshold across instances.
3. Create a Logs Insights query over the log group and attach a metric alarm directly to query results.

   A metric alarm requires a metric or metric expression; a scheduled Logs Insights query is not directly its metric input.
4. Create a CloudWatch dashboard using the rejected-shipment search pattern and configure an alarm on the dashboard.

   Dashboards display metrics or logs but cannot create alarms from an unmaterialized search pattern.

A metric filter publishes one count per matching future event; Sum with a zero default detects aggregate five-minute rejections.

3. Create a CloudWatch metric stream to Amazon Data Firehose: Which design is most appropriate?

1. Create CloudWatch Logs subscription filters for metric namespaces and send matching events to Amazon S3.

   CloudWatch metric data is not CloudWatch Logs data, so log subscriptions cannot capture ordinary published metrics.
2. Schedule Lambda functions to call CloudWatch GetMetricData and write returned values directly into Amazon S3.

   Polling requires custom scheduling, pagination, checkpointing, and retry logic, increasing operational work and delivery gaps.
3. Add every metric to a CloudWatch dashboard and export dashboard images into Amazon S3.

   Dashboard exports are visual snapshots and do not provide continuous raw metric delivery for analytics.
4. Create a CloudWatch metric stream to Amazon Data Firehose, then deliver the stream to Amazon S3. ✓

   Metric streams continuously deliver selected CloudWatch metrics to Firehose, which buffers and delivers them to S3 without polling.

CloudWatch metric streams continuously deliver selected metrics to Firehose, which buffers and writes them to S3.

4. Emit Embedded Metric Format records containing billing: Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

1. Create a CloudWatch dashboard containing invoice log searches and use its widgets as custom metrics.

   Dashboard widgets visualize data but do not publish application or host measurements as CloudWatch metrics.
2. Use an Amazon EC2 Auto Scaling alarm on instance CPU to represent billing latency and payment failures.

   CPU is unrelated to the requested application measurements and cannot represent latency or failed-payment counts.
3. Create a CloudWatch Logs subscription filter that forwards billing events to Amazon S3 for automatic metric creation.

   A subscription delivers matching logs, but Amazon S3 storage does not automatically turn those records into CloudWatch metrics.
4. Emit Embedded Metric Format records containing billing latency and failure counts with service and environment dimensions. ✓

   EMF extracts application metrics from log events into CloudWatch metrics, supporting dimensions and subsequent alarm evaluation.
5. Configure the CloudWatch agent to collect instance disk and memory metrics and publish them to CloudWatch. ✓

   The CloudWatch agent collects configured guest operating-system metrics that standard instance metrics do not automatically provide.

Use the CloudWatch agent for host measurements and EMF for dimensional application metrics that alarms can consume.

5. Keep operational logs in CloudWatch for 30 days: Which design best meets the lifecycle requirements?

1. Set one-day CloudWatch retention and run scheduled scripts that copy audit logs to the security bucket for seven years.

   Scheduled scripts are executable but introduce avoidable delivery and completeness gaps and shorten operational searchability below 30 days.
2. Keep operational logs in CloudWatch for 30 days and deliver audit logs through Firehose to the centralized S3 bucket. ✓

   CloudWatch retention limits operational storage, while Firehose delivers audit logs to the security-owned bucket for S3 lifecycle management and separate control.
3. Keep both log classes in CloudWatch Logs for seven years and search them there from the application account.

   This retains data but causes unnecessary CloudWatch storage and leaves audit records under the application account's control.
4. Export all logs immediately to S3 Glacier Deep Archive and search archived objects during every incident.

   Immediate deep archival can satisfy retention, but it does not provide convenient recent CloudWatch searchability for operations.

Retain operational logs in CloudWatch for 30 days and stream audit logs to centralized S3.

6. Use account-level CloudWatch Logs subscription filters: Which design should be used?

1. Configure each application host to publish logs directly to the central Kinesis stream.

   Direct publishing bypasses CloudWatch Logs retention and local querying and increases application coupling.
2. Use account-level CloudWatch Logs subscription filters to stream regional log events to the central Kinesis destination. ✓

   Account-level subscription filters continuously stream matching events while leaving the source log groups available for local queries.
3. Use scheduled Athena queries to send periodic query results to the central Kinesis stream.

   Athena queries are batch-oriented and do not provide near-real-time delivery of every event.
4. Create regional CloudWatch metric streams and forward their records to the central Kinesis stream.

   Metric streams deliver metrics, not the application log events required by the processor.

Use account-level CloudWatch Logs subscriptions to stream events continuously.

7. Use CloudWatch Logs Insights with fields: Which approach is most suitable?

1. Create dashboard widgets for each service, compare their metric values, and correlate IDs separately.

   Dashboards can display metrics or queries, but this approach does not efficiently produce the requested combined request-level results.
2. Create service-specific metric filters, graph the resulting metrics, and inspect the series.

   Metric filters create numerical metrics and do not conveniently return representative request IDs from historical records.
3. Use CloudWatch Logs Insights with fields, filter, stats, sort, and limit. ✓

   Logs Insights interactively queries existing events, filters failures and latency, aggregates by service, and returns representative IDs.
4. Export the groups to Amazon S3, catalog the files, and query them with Athena.

   This is executable, but export, cataloging, and batch querying add unnecessary steps for an interactive one-time investigation.

Use CloudWatch Logs Insights for the one-time analysis.

8. Associate the customer managed KMS key with each: Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

1. Give application roles kms:PutKeyPolicy so they can configure log-group encryption independently.

   Application roles do not need key-administration permissions, and granting PutKeyPolicy violates administrative separation.
2. Use an IAM policy allowing developers to decrypt all log groups without considering the KMS key policy.

   KMS authorization requires compatible IAM and key-policy permissions, and unrestricted developer decryption violates the stated control.
3. Associate the customer managed KMS key with each CloudWatch log group requiring encrypted storage. ✓

   CloudWatch Logs supports associating customer managed KMS keys with log groups for encryption at rest.
4. Grant the CloudWatch Logs service principal required KMS permissions through the key policy and restrict key administration separately. ✓

   The key policy must permit CloudWatch Logs to use the key while excluding workload teams from administrative key actions.
5. Encrypt only the Firehose destination and leave the CloudWatch log groups using their default encryption.

   Encrypting Firehose does not satisfy the requirement that stored CloudWatch log-group data use the customer managed key.

Associate the customer managed key with log groups and authorize CloudWatch Logs in the key policy while separating administration.

9. Use cross-account CloudWatch dashboards for operations: Which design is most appropriate?

1. Use CloudTrail organization events as the source for utilization dashboards and alarms.

   CloudTrail records API activity, not application latency or resource-utilization metrics for CloudWatch alarms.
2. Use cross-account CloudWatch dashboards for operations and QuickSight for CloudWatch and S3 reporting. ✓

   Cross-account CloudWatch dashboards centralize operational metrics and alarms, while QuickSight supports broader analytical visualizations using CloudWatch and S3 data.
3. Keep dashboards in each workload account and have analysts switch accounts during incidents.

   This is supported but duplicates dashboard maintenance and does not provide the requested centralized view.
4. Use QuickSight dashboards for operational alarms and combine them with CloudWatch metrics and S3 business datasets.

   QuickSight supports analytical reporting but does not replace CloudWatch alarm evaluation and operational alerting.

Use cross-account CloudWatch for operations and QuickSight for combined business analytics.

10. Alarm on both dimensions with Sum: Which configuration should be implemented?

1. Alarm on the metric name without dimensions, using Average over one ten-minute period, SNS notification, and not-breaching treatment for missing data.

   Omitting dimensions can fail to identify the published series, and the statistic and evaluation window do not match the requirement.
2. Create a composite alarm from an underlying CheckoutErrors alarm, use the composite for SNS notification, and leave the metric alarm at its defaults.

   A composite alarm can notify SNS, but the underlying metric alarm still must specify the exact dimensions, statistic, period, threshold, and missing-data behavior.
3. Alarm on both dimensions with Sum, two five-minute periods, threshold 50, SNS, and missing data not breaching. ✓

   This selects the exact dimensional time series and applies the required statistic, period, evaluation count, threshold, action, and missing-data treatment.
4. Create a scheduled Logs Insights alarm for records containing CheckoutErrors, aggregate two ten-minute query runs, and send the result to SNS.

   Log alarms are supported, but this substitutes log searching and different timing for the already published dimensional metric.

Alarm on both dimensions with Sum, two five-minute periods, threshold 50, SNS, and missing data not breaching.

11. Enable native X-Ray tracing for API Gateway and Lambda: Which deployment design satisfies these requirements?

1. Install the CloudWatch agent on ECS tasks, forward API Gateway and Lambda logs to a central group, and grant developers Logs Insights access.

   Logs and agent telemetry are executable monitoring choices but do not provide correlated distributed traces through all three request layers.
2. Enable native X-Ray tracing for API Gateway and Lambda, run ADOT for ECS, and give the ECS task role administrator access for telemetry troubleshooting.

   The tracing design is appropriate, but administrator access violates the stated least-privilege requirement; the collector needs only the required telemetry actions.
3. Enable X-Ray for Lambda, use CloudTrail organization trails for API Gateway and ECS, and grant developers read access to CloudTrail events.

   CloudTrail records API activity rather than correlated request segments, so it does not provide request-path visibility through API Gateway, Lambda, and ECS.
4. Enable native X-Ray tracing for API Gateway and Lambda, run an ADOT collector for the instrumented ECS tasks, and grant the collector only trace-ingest actions while granting developers read-only trace access. ✓

   Native integrations cover API Gateway and Lambda. Supported OpenTelemetry instrumentation with ADOT covers ECS, and separate narrowly scoped ingestion and read roles address telemetry least privilege without requiring business-logic changes.

Use native X-Ray integrations for API Gateway and Lambda, ADOT for ECS, and separate least-privilege telemetry roles.

12. Use Kinesis Data Streams partition keys derived: Select TWO implementation choices that satisfy these requirem

Select two. More than one option is correct — every correct one is ticked below.

1. Use Kinesis Data Streams partition keys derived from tenant identifiers and process records with independent consumer applications. ✓

   Tenant-based partitioning preserves ordering per tenant while allowing multiple consumers and retained records for replay.
2. Schedule CloudWatch Logs Insights queries every hour and export their results to Amazon S3 for consumer processing.

   Scheduled queries introduce polling delays and do not provide the required near-real-time stream for authentication detection.
3. Send all log events to an Amazon SNS topic and use email subscriptions for tenant-specific authentication alerts.

   SNS can notify subscribers, but email delivery is unsuitable for replayable processing and structured tenant stream consumption.
4. Create a CloudWatch Logs subscription filter that sends matching log events to an Amazon Kinesis Data Stream. ✓

   Subscription filters deliver matching logs continuously to Kinesis, preserving near-real-time processing and replayable stream records.
5. Configure CloudWatch Logs to deliver directly to Amazon OpenSearch Service without an intermediate durable stream.

   Direct delivery can support search, but it lacks the required independent replay buffer when the downstream service is unavailable.

Use CloudWatch Logs subscriptions into Kinesis, then partition and consume records by tenant for real-time processing and replay.

Other AWS domains

• 1: SDLC Automation — 187 questions →
• 2: Configuration Management and IaC — 144 questions →
• 6: Security and Compliance — 144 questions →
• 3: Resilient Cloud Solutions — 128 questions →
• 5: Incident and Event Response — 119 questions →
• All 849 AWS questions →
• AWS certification: requirements, cost and exam format →