DOP-C02 Monitoring and Logging Practice Question
A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the CloudWatch Logs console or API to associate the KMS key with the log group
Options A and E are correct. To encrypt CloudWatch Logs with a customer-managed KMS key, you must first create a customer-managed KMS key with a key policy that grants CloudWatch Logs permission to use the key (option E). Then, you associate the key with the log group using the CloudWatch Logs console or API (option A). Option B is wrong because CloudWatch Logs does not support default encryption at the account level. Option C is wrong because you do not update the log group's resource policy; the key policy is set on the KMS key itself. Option D is wrong because encryption is at the log group level, not per log stream.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the CloudWatch Logs console or API to associate the KMS key with the log group
Why this is correct
The correct action is to explicitly associate your customer-managed AWS KMS key with the CloudWatch Logs log group, either through the console or by calling the `AssociateKmsKey` API. This association defines the encryption boundary at the log group level and applies to all existing and future log streams within that group. The key-policy prerequisites must already be in place, but the actual enabling step is this association.
- ✗
Enable default encryption for CloudWatch Logs in the AWS account settings
Why it's wrong here
CloudWatch Logs does not offer any 'default encryption' setting at the AWS account level for KMS keys. Encryption for CloudWatch Logs is always configured per log group, not via a global account setting. Enabling EBS or S3 default encryption, for example, has no effect on CloudWatch Logs, so this option is not a valid solution.
- ✗
Update the log group's resource policy to reference the KMS key
Why it's wrong here
A log group's resource policy is used to control access for delivery destinations (such as cross-account subscription filters or S3 exports) and does not govern KMS encryption. The KMS key association is a log group attribute, not a resource policy statement. To permit CloudWatch Logs to use your KMS key, you must update the key policy on the KMS key itself, granting the `logs.amazonaws.com` service principal the required crypto permissions.
- ✗
Associate the KMS key with each log stream individually
Why it's wrong here
KMS encryption for CloudWatch Logs is applied at the log group level, not at the individual log stream level. Log streams inherit the encryption configuration of their parent log group, and the `AssociateKmsKey` API takes a `logGroupName` parameter only. There is no API to attach a KMS key to a single log stream, so this approach is incorrect.
- ✓
Create a customer-managed KMS key with appropriate key policy that allows CloudWatch Logs to use the key
Why this is correct
Before you can associate a KMS key with a log group, you must create a customer-managed key (not the default `aws/logs` key) and configure its key policy to allow the CloudWatch Logs service principal to perform the needed operations (`kms:Encrypt`, `kms:Decrypt`, `kms:ReEncrypt`, `kms:GenerateDataKey`). This is a necessary prerequisite, and without it the association attempt will fail with access denied. However, creating the key alone does not enable encryption; you still must perform the log group association described in the other correct option.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon CloudWatch Logs to store application logs. The DevOps engineer needs to ensure that log data is encrypted at rest using a customer-managed KMS key. What step must be taken?
hard- A.Use AWS CloudTrail to encrypt the log data before it is sent to CloudWatch Logs.
- B.Create a KMS key and apply it to the IAM role used by the application.
- ✓ C.Create a new KMS customer-managed key and associate it with the CloudWatch Logs log group.
- D.Enable server-side encryption on the log group using the default CloudWatch Logs key.
Why C: CloudWatch Logs supports encryption at rest using a customer-managed KMS key, which must be explicitly associated with the log group. When you create or update a log group, you can specify a KMS key ID (via the AWS CLI, SDK, or console) to encrypt all log data stored in that group. This ensures that the log data is encrypted using a key you control, not the default AWS-managed key.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.