CLF-C02 Cloud Technology and Services Practice Question
A company runs multiple EC2 instances across several applications and wants to centralise all application log files in one place for searching, analysis, and long-term retention. Which AWS service provides centralised log storage and querying?
⚠ Common exam trap
It's easy for candidates to confuse CloudWatch Logs with CloudTrail, mistakenly thinking CloudTrail handles application logs, when in fact CloudTrail only records AWS API calls, not application-generated log data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Logs
Amazon CloudWatch Logs is the correct service because it is designed to centralize log storage from multiple sources, including EC2 instances, via the CloudWatch agent. It provides built-in querying with Logs Insights, supports real-time monitoring, and offers configurable retention policies for long-term storage, meeting all requirements for searching, analysis, and retention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is an object storage service that can store log files as static objects, but it lacks native agent-based log collection from EC2 instances, real-time log streaming, and built-in querying capabilities like CloudWatch Logs Insights. While CloudWatch Logs can export logs to S3 for long-term archival in compliance scenarios, S3 alone does not provide the centralised operational log aggregation, metric filters that turn log patterns into metrics, or alarm triggering that the scenario requires.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is specifically designed to capture API activity across your AWS account, recording who made a call, from which IP address, and when, for security auditing and governance. It does not ingest application-level logs that originate from operating systems or application processes on EC2 instances or Lambda functions, which are precisely the types of log entries CloudWatch Logs centralises with agent-based collection, metric filters, and Logs Insights. For this reason, while CloudTrail is itself an important audit trail, it cannot serve as the centralised log storage for operational logs.
- ✓
Amazon CloudWatch Logs
Why this is correct
Amazon CloudWatch Logs is the purpose-built service for centralised log storage and real-time analysis: the unified CloudWatch agent collects logs from EC2 instances, Lambda execution events are ingested natively, and on-premises servers can stream logs via the agent as well. Log events are organised into log groups and streams with configurable retention, and you can define metric filters to create CloudWatch metrics from matching log patterns, triggering alarms, or run interactive queries using CloudWatch Logs Insights. This makes it the correct choice when the need is unified operational logging with search, monitoring, and alerting.
- ✗
Amazon Kinesis Data Firehose
Why it's wrong here
Amazon Kinesis Data Firehose is a streaming ingestion service that can deliver records to destinations such as Amazon S3, Amazon Redshift, or Amazon OpenSearch Service, but it does not itself store or query logs. It would require you to build and manage the target storage and analysis solution separately, and it lacks the native log format parsing, metric filters, and log group organisation that CloudWatch Logs offers. Firehose is better suited to large-scale data stream delivery, not as a standalone centralised log storage service.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.