DOP-C02 Monitoring and Logging Practice Question
A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?
⚠ Common exam trap
DOP-C02 often tests the misconception that a log group resource policy or an account-wide setting can enable KMS encryption, when in fact you need both a properly permissioned customer-managed key AND a per-log-group association.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the CloudWatch Logs console or API to associate the KMS key with the log group
Option E is correct because CloudWatch Logs encryption at rest with a customer-managed key requires first creating a customer-managed KMS key in KMS and attaching a key policy that grants the CloudWatch Logs service principal (logs.<region>.amazonaws.com) the necessary kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:Describe* permissions. Option A is correct because, once the key exists, you must explicitly associate it with the specific log group using the CloudWatch Logs console, the AWS CLI (aws logs associate-kms-key --log-group-name <name> --kms-key-id <key-arn>), or the AssociateKmsKey API; encryption is applied at the log group level. Option B is not correct because CloudWatch Logs has no account-level 'default encryption' toggle; encryption must be set per log group. Option C is not correct because a log group resource policy controls access to log data, not KMS encryption, and does not enable encryption at rest. Option D is not correct because KMS keys are associated with log groups, not individual log streams, so per-stream association is neither possible nor required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the CloudWatch Logs console or API to associate the KMS key with the log group
Why this is correct
The correct action is to explicitly associate your customer-managed AWS KMS key with the CloudWatch Logs log group, either through the console or by calling the `AssociateKmsKey` API. This association defines the encryption boundary at the log group level and applies to all existing and future log streams within that group. The key-policy prerequisites must already be in place, but the actual enabling step is this association.
- ✗
Enable default encryption for CloudWatch Logs in the AWS account settings
Why it's wrong here
CloudWatch Logs does not offer any 'default encryption' setting at the AWS account level for KMS keys. Encryption for CloudWatch Logs is always configured per log group, not via a global account setting. Enabling EBS or S3 default encryption, for example, has no effect on CloudWatch Logs, so this option is not a valid solution.
- ✗
Update the log group's resource policy to reference the KMS key
Why it's wrong here
A log group's resource policy is used to control access for delivery destinations (such as cross-account subscription filters or S3 exports) and does not govern KMS encryption. The KMS key association is a log group attribute, not a resource policy statement. To permit CloudWatch Logs to use your KMS key, you must update the key policy on the KMS key itself, granting the `logs.amazonaws.com` service principal the required crypto permissions.
- ✗
Associate the KMS key with each log stream individually
Why it's wrong here
KMS encryption for CloudWatch Logs is applied at the log group level, not at the individual log stream level. Log streams inherit the encryption configuration of their parent log group, and the `AssociateKmsKey` API takes a `logGroupName` parameter only. There is no API to attach a KMS key to a single log stream, so this approach is incorrect.
- ✓
Create a customer-managed KMS key with appropriate key policy that allows CloudWatch Logs to use the key
Why this is correct
Before you can associate a KMS key with a log group, you must create a customer-managed key (not the default `aws/logs` key) and configure its key policy to allow the CloudWatch Logs service principal to perform the needed operations (`kms:Encrypt`, `kms:Decrypt`, `kms:ReEncrypt`, `kms:GenerateDataKey`). This is a necessary prerequisite, and without it the association attempt will fail with access denied. However, creating the key alone does not enable encryption; you still must perform the log group association described in the other correct option.
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon CloudWatch Logs to store application logs. The DevOps engineer needs to ensure that log data is encrypted at rest using a customer-managed KMS key. What step must be taken?
hard- A.Use AWS CloudTrail to encrypt the log data before it is sent to CloudWatch Logs.
- B.Create a KMS key and apply it to the IAM role used by the application.
- ✓ C.Create a new KMS customer-managed key and associate it with the CloudWatch Logs log group.
- D.Enable server-side encryption on the log group using the default CloudWatch Logs key.
Why C: CloudWatch Logs supports encryption at rest using a customer-managed KMS key, which must be explicitly associated with the log group. When you create or update a log group, you can specify a KMS key ID (via the AWS CLI, SDK, or console) to encrypt all log data stored in that group. This ensures that the log data is encrypted using a key you control, not the default AWS-managed key.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.