DOP-C02 Incident and Event Response Practice Question
A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The DevOps team needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which combination of services should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudWatch Logs Insights and CloudWatch Dashboards
CloudWatch Logs Insights allows real-time querying of CloudWatch Logs, and CloudWatch Dashboards can display the results as a real-time dashboard showing the count of ERROR-level log entries across all instances. Option A is incorrect because Amazon Athena is designed for querying data stored in S3, not real-time log streams. Option B is incorrect because while Kinesis Data Analytics and Elasticsearch Service could be used, they add unnecessary complexity and cost compared to the native CloudWatch integration. Option C is incorrect because Amazon S3 and QuickSight are not suitable for real-time monitoring; QuickSight is for business intelligence and batch analytics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Athena and Amazon QuickSight
Why it's wrong here
Amazon Athena can only query data stored in Amazon S3, so CloudWatch Logs would first need to be exported from log groups to S3 via an export task or subscription filter—creating near-real-time latency and extra infrastructure. QuickSight is a business intelligence service for ad hoc analytics and interactive visualization, not a live operational dashboard engine; it requires scheduled data refreshes and lacks native CloudWatch integration. Thus, this combination adds unnecessary delay and complexity for a simple log-count query.
- ✗
Amazon Kinesis Data Analytics and Amazon Elasticsearch Service
Why it's wrong here
Amazon Kinesis Data Analytics (now Managed Service for Apache Flink) is for complex stream processing with SQL or Apache Flink, which is far heavier than needed for a simple count of log entries. Amazon OpenSearch Service requires a separate ingestion pipeline (e.g., Kinesis Data Firehose or Lambda) to index logs, and visualization typically needs additional Kibana dashboards, adding cost and operational overhead. CloudWatch Logs Insights already provides the query capability natively, making this architecture overengineered and less real-time.
- ✗
Amazon S3 and Amazon QuickSight
Why it's wrong here
This option requires moving entire log throughput to Amazon S3, either through scheduled exports or a Firehose subscription, which is batch-oriented and delayed relative to live log streaming. QuickSight queries data via SPICE in-memory caching or direct SQL, but it is not a real-time monitoring tool—it refreshes on a schedule and is meant for business intelligence dashboards. Consequently, you lose live log visibility and add significant setup effort just to achieve a simple count.
- ✓
CloudWatch Logs Insights and CloudWatch Dashboards
Why this is correct
CloudWatch Logs Insights runs SQL-like queries directly against live CloudWatch Logs data, allowing you to count matching log entries with a query such as 'stats count(*) by status' in real time. CloudWatch Dashboards can embed these query results as graph or numeric widgets, which automatically refresh (on up to a 60-second interval) to provide a live operational view. This is the native, serverless, and lowest-latency solution designed specifically for this use case.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.