DOP-C02 Monitoring and Logging Practice Question
A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search and analyze logs from multiple EC2 instances in real time. Which TWO services can be used to achieve this? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon OpenSearch Service.
CloudWatch Logs can stream logs to Amazon OpenSearch Service for real-time search and analytics. Option E is correct because CloudWatch Logs Insights allows real-time querying of log groups directly within CloudWatch. Option B is incorrect: Amazon Athena is designed for querying data in S3, not for real-time log search from EC2 instances. Option C is incorrect: Amazon QuickSight is a business intelligence service for visualization, not real-time log search. Option D is incorrect: Amazon Kinesis Data Analytics is for analyzing streaming data, not directly searching CloudWatch Logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon OpenSearch Service.
Why this is correct
Amazon OpenSearch Service ingests CloudWatch Logs via a subscription filter and Lambda, indexing them for real-time full-text search, aggregations, and Kibana visualization. This makes it purpose-built for interactive log analytics and operational dashboards, directly querying the live stream without S3 export latency. It also scales to handle massive log volumes with open-source Elasticsearch-compatible APIs.
- ✗
Amazon Athena.
Why it's wrong here
Amazon Athena queries structured or semi-structured data residing in S3 using SQL, so logs must first be exported as objects, which adds significant storage and latency. It performs scheduled or ad-hoc analysis of historical log files, not real-time searches over the live CloudWatch Logs stream. Athena cannot ingest or index streaming data natively, making it unsuitable for immediate log troubleshooting.
- ✗
Amazon QuickSight.
Why it's wrong here
Amazon QuickSight is a cloud-scale business intelligence service for interactive dashboards and reports, powered by SPICE in-memory caching. While it can visualize query results from multiple sources, it lacks a log-specific query language and cannot subscribe to CloudWatch Logs in real time. QuickSight is the wrong tool for searching raw log entries because it expects aggregated datasets rather than exposing raw event search.
- ✗
Amazon Kinesis Data Analytics.
Why it's wrong here
Amazon Kinesis Data Analytics executes continuous SQL or Apache Flink on streaming data to detect patterns, aggregates, or time-series anomalies, but it does not index logs for search. Its output is a processed stream or table, not queryable log records, and interactive exploration in a console is not supported. Therefore, it is engineered for real-time computation, not real-time log retrieval, which distinctly separates it from a search service.
- ✓
CloudWatch Logs Insights.
Why this is correct
CloudWatch Logs Insights is the native query engine of CloudWatch, providing an interactive query interface that can search live log groups with a domain-specific language. It supports real-time point-in-time analysis without external infrastructure, making it a correct answer for immediate log investigation. However, it lacks the persistent indexing, text-analysis features, and visualization depth of OpenSearch, so it suits troubleshooting rather than long-term log analytics.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.