DOP-C02 CloudWatch Logs retention policy Practice Question
A company uses Amazon CloudWatch Logs to store application logs. They have a requirement to retain logs for 90 days for operational analysis and then archive them to Amazon S3 for compliance purposes for an additional 5 years. Which of the following steps are necessary to meet this requirement? (Select TWO.)
⚠ Common exam trap
Don't confuse CloudWatch Logs retention policies with S3 lifecycle policies. Retention only controls deletion from CloudWatch, not export to S3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the CloudWatch Logs retention policy on the log group to 90 days.
Setting the CloudWatch Logs retention policy on the log group to 90 days ensures logs are retained for operational analysis and then automatically expire (deleted) after 90 days. Option E is correct because to archive logs to Amazon S3 for compliance, you must use a CloudWatch Logs export task to export logs to S3 before the retention period expires. Option B is incorrect because an S3 lifecycle policy applies to objects already in S3, not to logs in CloudWatch. Option C is incorrect because subscription filters can stream logs in real time to destinations like Lambda or Kinesis, but not directly to S3 for archival. Option D is incorrect because CloudWatch Logs does not have a lifecycle policy to transition logs directly to S3; export is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the CloudWatch Logs retention policy on the log group to 90 days.
Why this is correct
Setting a CloudWatch Logs retention policy on the log group to 90 days automatically expires and permanently deletes log events after that period, with no additional infrastructure or cost. This is the direct method to enforce the 90-day storage requirement because the retention setting applies to all log streams within the group and overrides any default. It also eliminates the need for separate S3 export or lifecycle configurations if long-term archiving is not required.
- ✗
Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.
Why it's wrong here
An S3 lifecycle policy only governs objects already residing in an Amazon S3 bucket—it has no effect on log data that is still stored natively in CloudWatch Logs. Even if logs were exported or streamed to S3, this policy would only handle transition to Glacier after 90 days, but it would not delete the CloudWatch log group or free up CloudWatch Logs storage. Thus, this option fails to address the actual requirement of limiting retention in CloudWatch Logs.
- ✗
Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.
Why it's wrong here
CloudWatch Logs subscription filters can stream log events in real time to Amazon Kinesis Data Streams, Kinesis Data Firehose, Lambda, or Amazon OpenSearch Service—they do not deliver data directly to S3. To land logs in S3, you would have to configure a Kinesis Data Firehose delivery stream as the subscription destination, which adds complexity and still leaves the original logs in CloudWatch Logs. This approach is for continuous streaming analytics or replication, not for enforcing a 90-day retention boundary.
- ✗
Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.
Why it's wrong here
CloudWatch Logs does not offer a built-in 'lifecycle policy' that automatically transitions log groups to Amazon S3 after a specified number of days. The only native mechanisms are the log group retention policy (which deletes data) and manual/automated export tasks via the ExportTask API. Therefore, this option describes a non-existent feature and cannot be implemented to meet the requirement.
- ✓
Create a CloudWatch Logs export task to export logs to Amazon S3 before the retention period expires.
Why this is correct
Creating a CloudWatch Logs export task copies log data to an Amazon S3 bucket, which is useful when you need to archive logs beyond the retention period or move them to lower-cost storage. However, an export task is a one-time or scheduled operation—it does not automatically remove the logs from CloudWatch Logs, and you must still set a retention policy on the log group to delete them after 90 days. When used correctly, it complements the retention policy to satisfy both long-term archival and the 90-day CloudWatch storage requirement.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,339 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.