DOP-C02 Monitoring and Logging Practice Question
A company wants to detect and alert on unusual patterns in a CloudWatch Logs log group, such as a sudden spike in error messages, without writing complex queries. The team wants CloudWatch to learn normal patterns and notify when behavior deviates. Which feature should the DevOps engineer use?
⚠ Common exam trap
The trap here is treating a metric filter alarm as equivalent to anomaly detection, when the filter alarm still needs a manually chosen static threshold.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudWatch Logs anomaly detection on a metric filter, which trains a model on the metric's historical behavior and alarms on deviations.
CloudWatch anomaly detection learns a metric's normal pattern and alarms when values deviate from the expected band, removing the need to pick static thresholds. Applied to a metric filter on the log group, it can detect spikes in error messages. Static-threshold filters, Logs Insights queries, and Contributor Insights do not provide the same adaptive learning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CloudWatch Logs anomaly detection on a metric filter, which trains a model on the metric's historical behavior and alarms on deviations.
Why this is correct
CloudWatch anomaly detection builds a model from up to two weeks of metric data and creates a band of expected values, alarming when the metric falls outside it. Applying it to a metric filter derived from the log group lets CloudWatch learn normal error patterns and notify on spikes without manual thresholds, matching the requirement.
- ✗
CloudWatch Logs Insights saved queries scheduled with an anomaly detection alarm.
Why it's wrong here
Logs Insights queries are powerful for ad hoc and scheduled analysis, but they return results rather than automatically learning baselines. Pairing them with anomaly detection still requires publishing a metric first. This approach is manual and query-centric, not a built-in pattern-learning alerting feature for the log group.
- ✗
CloudWatch Contributor Insights rules on the log group with a static alarm on the top contributor.
Why it's wrong here
Contributor Insights identifies top contributors such as noisiest IP addresses, which is useful for cardinality analysis, but it does not learn expected baselines or detect deviations automatically. Alarming on a top contributor still uses a static threshold and does not adapt to changing normal behavior, so it misses the core requirement.
- ✗
CloudWatch Logs metric filters with a static threshold alarm.
Why it's wrong here
Metric filters turn log patterns into numeric metrics, and alarms can threshold them, but the threshold is static and must be chosen manually. This does not learn normal patterns or adapt to seasonal variation, so it does not satisfy the anomaly detection requirement even though it is a common logging alerting technique.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.