DOP-C02 Monitoring and Logging Practice Question
A company wants to collect and analyze logs from on-premises servers and send them to AWS for centralized monitoring. Which combination of AWS services should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Agent on the on-premises servers to send logs to Amazon CloudWatch Logs.
CloudWatch Agent collects logs from on-prem servers and sends to CloudWatch Logs. Option B is wrong because Kinesis Agent is for streaming data to Kinesis, not CloudWatch Logs directly. Option C is wrong because the unified CloudWatch Agent is the recommended tool. Option D is wrong because SSM Agent does not collect logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon CloudWatch Agent on the on-premises servers to send logs to Amazon CloudWatch Logs.
Why this is correct
The Amazon CloudWatch Agent is the standard, fully supported solution for hybrid environments: it installs directly on on-premises servers, uses an IAM role or access key for authentication, and can simultaneously collect both system metrics and log files into Amazon CloudWatch Logs. Its unified configuration file lets you specify log paths, timestamp formats, and multi-line patterns, enabling out-of-the-box analysis with Logs Insights without any intermediary streaming service.
- ✗
Amazon Kinesis Agent on the on-premises servers to send logs to Amazon Kinesis Data Firehose, then to Amazon S3.
Why it's wrong here
While the Kinesis Agent can tail logs on an on-premises host and push them to Kinesis Data Firehose, that pipeline terminates at an Amazon S3 bucket (or similar destination) rather than CloudWatch Logs. This adds architectural complexity—another agent, a delivery stream, and S3 storage—and forfeits CloudWatch's native log-analysis features like metric filters, subscription filters, and Logs Insights. It is a valid data-lake pattern but not the direct, purpose-built answer for CloudWatch Logs analytics.
- ✗
Amazon CloudWatch Agent with the awslogs configuration to send logs to Amazon CloudWatch Logs.
Why it's wrong here
The CloudWatch Agent does support an awslogs-style configuration schema, but that schema is a legacy compatibility mode inherited from the older standalone CloudWatch Logs agent. This answer is functionally equivalent to the correct option yet less precise: it over-specifies an implementation detail and points to a deprecated configuration style rather than the modern, unified agent configuration. In a single-best-answer question, the broader, directly named solution—simply 'Amazon CloudWatch Agent'—is the more accurate and recommended choice.
- ✗
AWS Systems Manager Agent to collect logs and send to Amazon CloudWatch Logs.
Why it's wrong here
The AWS Systems Manager Agent (SSM Agent) is designed for management and automation tasks such as running commands, applying patches, collecting inventory, and configuring State Manager associations. It does not have a built-in capability to tail arbitrary log files and forward them to CloudWatch Logs; any log collection via SSM would require using Run Command to manually install and invoke the CloudWatch Agent. Thus it is an orchestration mechanism, not a log-collection agent itself—making it fundamentally unsuitable as the direct answer.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps engineer needs to centrally collect and analyze logs from multiple AWS accounts and on-premises servers. Which AWS service should be used to aggregate logs in a single dashboard?
easy- A.Amazon Athena.
- B.Amazon S3.
- ✓ C.Amazon CloudWatch Logs.
- D.Amazon Kinesis Data Firehose.
Why C: Amazon CloudWatch Logs is the correct service to centrally collect and analyze logs from multiple AWS accounts and on-premises servers in a single dashboard. It supports cross-account log aggregation via subscription filters and can visualize logs using CloudWatch Logs Insights. Option A (Amazon Athena) is a query service for S3 data, not a dashboard. Option B (Amazon S3) is an object storage service, not a dashboard. Option D (Amazon Kinesis Data Firehose) is a streaming data delivery service, not a dashboard.
Variation 2. Your company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running a web server. The web servers write access logs to a shared Amazon EFS filesystem. The operations team needs to monitor the web server logs in real-time to detect and alert on 5xx error spikes. Currently, the team manually SSHes into instances to tail logs, which is inefficient and doesn't provide real-time alerting. The team wants a centralized, near-real-time logging solution with minimal operational overhead. They have asked you to design a solution that ingests logs from the EFS filesystem into a centralized log analytics platform. Which solution would you recommend?
medium- A.Enable AWS CloudTrail data events for the EC2 instances to capture log file modifications.
- B.Configure an Amazon EventBridge scheduled rule to invoke an AWS Lambda function that reads new log lines from EFS and publishes them to Amazon CloudWatch Logs.
- C.Stream the log files to Amazon Kinesis Data Streams using a custom producer, then use a Lambda function to analyze and alert on 5xx errors.
- ✓ D.Install and configure the Amazon CloudWatch Logs agent on each EC2 instance to tail the log files from the EFS mount and send them to CloudWatch Logs. Create a metric filter and alarm for 5xx errors.
Why D: Installing the CloudWatch Logs agent on each EC2 instance allows it to tail the log files from the shared EFS mount point and stream them to CloudWatch Logs in near real-time. This provides centralized log ingestion with minimal operational overhead, and you can create a metric filter and alarm to detect and alert on 5xx error spikes without manual SSH access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.