DOP-C02 Monitoring and Logging Practice Question
A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The security team requires that logs be encrypted at rest using a customer-managed KMS key. Which configuration step should the engineer perform to meet this requirement?
⚠ Common exam trap
DOP-C02 often tests the misconception that creating a KMS key and granting permissions is enough — the actual required action is associating the key with the specific CloudWatch log group, which is the step candidates most often overlook.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate the KMS key with the CloudWatch log group using the console or CLI
CloudWatch Logs supports encryption at rest with a customer-managed KMS key by associating that key with the log group. This is done via the console or CLI (e.g., aws logs associate-kms-key), and once set, all log data in that group is encrypted with the specified CMK. This directly satisfies the security team's requirement for customer-managed key encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the CloudWatch agent to encrypt logs before sending
Why it's wrong here
Configuring the CloudWatch agent to encrypt logs before sending addresses only the transport path. The agent transmits log events over TLS/HTTPS to CloudWatch Logs, but it cannot apply server-side encryption at rest to the log group itself. CloudWatch Logs at-rest encryption is a service-owned feature that requires a KMS key associated with the log group; the agent simply forwards plaintext data to the service, and any client-side encryption would make the logs unreadable by CloudWatch Logs on arrival.
- ✗
Create a KMS key and attach a policy allowing CloudWatch Logs to use it
Why it's wrong here
Creating a KMS key and attaching a service policy that permits CloudWatch Logs to use the key is a prerequisite, but it does not by itself enable at-rest encryption. The key policy must include statements allowing the CloudWatch Logs service principal to perform kms:GenerateDataKey and kms:Decrypt operations; however, until you explicitly associate that key with the log group through the console or the associate-kms-key API, CloudWatch Logs continues to use its default AWS-managed encryption key. The policy enables but does not activate encryption for a specific log group.
- ✗
Enable default encryption on the S3 bucket that stores logs
Why it's wrong here
Enabling default encryption on an S3 bucket is irrelevant because CloudWatch Logs does not natively store log events in S3. Log data resides in the log group's storage layer, which is encrypted using a key associated with the log group, not an S3 bucket encryption setting. S3 is used only for optional exports or subscriptions, and default S3 encryption would apply to those exported objects, not to the live log streams that the question asks to secure at rest.
- ✓
Associate the KMS key with the CloudWatch log group using the console or CLI
Why this is correct
Associating the KMS key with the CloudWatch log group is the required and sufficient step to encrypt log data at rest. When you use the console or the associate-kms-key AWS CLI command, CloudWatch Logs begins encrypting all log events in that group with the specified key and uses the same key to decrypt them when you view or export them. This association applies to the log group's data, including all log streams inside it, and is the only way to apply customer-managed KMS encryption to CloudWatch Logs at rest.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.