DOP-C02 Monitoring and Logging Practice Question
A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The security team requires that logs be encrypted at rest using a customer-managed KMS key. Which configuration step should the engineer perform to meet this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate the KMS key with the CloudWatch log group using the console or CLI
CloudWatch Logs can be encrypted at rest using a customer-managed KMS key, and the key must be associated with the log group. Option A is incorrect because the CloudWatch agent does not handle encryption at rest; encryption is applied server-side by CloudWatch Logs. Option B is incorrect because while a KMS key policy is necessary to grant CloudWatch Logs permissions, the key must also be explicitly associated with the log group. Option C is incorrect because CloudWatch Logs does not store logs in an S3 bucket by default; encryption is applied at the log group level, not via S3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the CloudWatch agent to encrypt logs before sending
Why it's wrong here
Configuring the CloudWatch agent to encrypt logs before sending addresses only the transport path. The agent transmits log events over TLS/HTTPS to CloudWatch Logs, but it cannot apply server-side encryption at rest to the log group itself. CloudWatch Logs at-rest encryption is a service-owned feature that requires a KMS key associated with the log group; the agent simply forwards plaintext data to the service, and any client-side encryption would make the logs unreadable by CloudWatch Logs on arrival.
- ✗
Create a KMS key and attach a policy allowing CloudWatch Logs to use it
Why it's wrong here
Creating a KMS key and attaching a service policy that permits CloudWatch Logs to use the key is a prerequisite, but it does not by itself enable at-rest encryption. The key policy must include statements allowing the CloudWatch Logs service principal to perform kms:GenerateDataKey and kms:Decrypt operations; however, until you explicitly associate that key with the log group through the console or the associate-kms-key API, CloudWatch Logs continues to use its default AWS-managed encryption key. The policy enables but does not activate encryption for a specific log group.
- ✗
Enable default encryption on the S3 bucket that stores logs
Why it's wrong here
Enabling default encryption on an S3 bucket is irrelevant because CloudWatch Logs does not natively store log events in S3. Log data resides in the log group's storage layer, which is encrypted using a key associated with the log group, not an S3 bucket encryption setting. S3 is used only for optional exports or subscriptions, and default S3 encryption would apply to those exported objects, not to the live log streams that the question asks to secure at rest.
- ✓
Associate the KMS key with the CloudWatch log group using the console or CLI
Why this is correct
Associating the KMS key with the CloudWatch log group is the required and sufficient step to encrypt log data at rest. When you use the console or the associate-kms-key AWS CLI command, CloudWatch Logs begins encrypting all log events in that group with the specified key and uses the same key to decrypt them when you view or export them. This association applies to the log group's data, including all log streams inside it, and is the only way to apply customer-managed KMS encryption to CloudWatch Logs at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,339 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.