DOP-C02 Monitoring and Logging Practice Question
A company runs a web application behind an Application Load Balancer (ALB) in a production AWS account. The DevOps team needs to analyze HTTP request patterns and identify the top IP addresses generating errors. They want to store the data cost-effectively for querying with SQL. Which solution meets these requirements?
⚠ Common exam trap
A common mix-up: candidates confuse CloudWatch Logs (which for ALB only contain error logs, not full request details) with ALB access logs (which are stored in S3 and contain all request data), leading them to choose Option B instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable ALB access logs and store them in Amazon S3, then use Amazon Athena to query the logs with SQL.
ALB access logs provide detailed HTTP request data (including source IP, request URI, response code, etc.) and are stored in Amazon S3, which is cost-effective for long-term storage. Amazon Athena allows querying these logs directly with standard SQL without needing to load data into a database, meeting the requirement for SQL-based analysis of top IP addresses generating errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use CloudWatch Metrics to monitor error rates and top IPs via custom metrics.
Why it's wrong here
Custom CloudWatch Metrics for error rates and top IPs would not capture full access-log detail unless you instrument the application and publish metrics programmatically, which requires code changes and ongoing maintenance. Even then, CloudWatch Metrics stores only aggregated time-series data at fixed resolutions and does not support arbitrary SQL-style joins or row-level filtering, so you cannot perform the deep, flexible historical analysis that the application requires. This approach is unsuitable because it is neither turnkey nor cost-effective for rich log analytics.
- ✗
Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query the logs.
Why it's wrong here
Enabling CloudWatch Logs for the ALB and using Logs Insights is not the right fit because Insights uses a purpose-built query language that is SQL-like but not standard SQL, so you cannot run all standard SQL constructs against the logs. Moreover, CloudWatch Logs pricing charges for ingestion and for each query's scanned data, which becomes cost-prohibitive for high-volume, long-term logs compared with storing raw access logs in S3 and querying them on demand with Athena. Because the requirement explicitly wants SQL-based analysis, this option is functionally inferior and more expensive.
- ✗
Stream the ALB logs to Amazon Kinesis Data Analytics and use SQL applications.
Why it's wrong here
Streaming ALB logs to Kinesis Data Analytics and using SQL applications targets real-time, continuous processing rather than ad-hoc historical analysis, so it does not match the stated requirement to query stored logs. You would need to maintain a live log stream, and the per-hour Kinesis processing unit costs plus the complexity of schema inference make it a heavy, costly option for occasional queries over retained data. Although Kinesis Data Analytics can filter and aggregate streams with SQL-like syntax, it is designed for ongoing streaming use cases, not cost-effective one-off investigations.
- ✓
Enable ALB access logs and store them in Amazon S3, then use Amazon Athena to query the logs with SQL.
Why this is correct
Enabling ALB access logs to be delivered to Amazon S3 creates immutable, row-based log files that are ideal for large-scale retrospective analysis. Amazon Athena lets you run standard SQL directly on that S3 data using a serverless engine that charges only for the bytes scanned, and you can further optimize costs and performance by partitioning S3 objects by date or using compression. This combination is the industry-standard cost-effective approach when the goal is to perform flexible SQL queries over historical ALB logs without pre-provisioning infrastructure or paying for continuous ingestion.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps engineer needs to collect and analyze logs from multiple AWS services, including EC2, Lambda, and API Gateway. The logs must be stored in a central location for long-term retention and analyzed using SQL queries. Which TWO services should be combined to achieve this? (Choose TWO.)
easy- A.AWS CloudTrail
- ✓ B.Amazon CloudWatch Logs
- C.Amazon Kinesis Data Firehose
- D.Amazon SQS
- ✓ E.Amazon Athena
Why B: Correct options: B and E. Option B: CloudWatch Logs can collect logs from many AWS services. Option E: Exporting logs to S3 and using Athena allows SQL-based analysis. Option A is wrong because CloudTrail is for API logs, not all service logs. Option C is wrong because Kinesis Data Firehose is for real-time streaming, not for ad-hoc SQL queries. Option D is wrong because SQS is a message queue, not a log store.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.