DOP-C02 Monitoring and Logging Practice Question
A DevOps team is implementing a comprehensive logging strategy for a microservices architecture running on Amazon EKS. They need to collect logs from all containers and send them to a centralized log analytics platform. The solution must be agentless and support multi-line log events. Which approach should the team use?
⚠ Common exam trap
Many candidates confuse 'agentless' with 'no software at all,' but in Kubernetes, agentless means no sidecar injection per pod; a DaemonSet is considered agentless because it runs as a cluster-level service, not as part of the application deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a Fluent Bit DaemonSet on the EKS cluster and configure it to send logs to Amazon CloudWatch Logs.
Fluent Bit is a lightweight, CNCF-graduated log processor that can be deployed as a DaemonSet on EKS to collect logs from all nodes without requiring sidecar containers. It supports multi-line log events natively via its multiline filter plugin, and it can output directly to Amazon CloudWatch Logs using the cloudwatch_logs output plugin, meeting the agentless requirement since it runs as a Kubernetes DaemonSet rather than as a per-pod sidecar.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a Fluent Bit DaemonSet on the EKS cluster and configure it to send logs to Amazon CloudWatch Logs.
Why this is correct
Fluent Bit is a lightweight, high-throughput log processor that runs as a DaemonSet, placing one pod on every cluster node. It automatically discovers and collects container stdout/stderr logs without requiring application-side changes, making it effectively agentless for application teams. It supports multi-line log parsing and its native CloudWatch Logs output plugin streams logs directly to CloudWatch Logs for real-time aggregation. This is the recommended pattern for comprehensive logging on EKS.
- ✗
Use the Amazon CloudWatch agent as a sidecar container in each pod to forward logs to CloudWatch Logs.
Why it's wrong here
The CloudWatch agent sidecar pattern requires modifying every pod to include an additional container, which breaks the 'agentless' model and adds memory/CPU overhead per pod. It also complicates lifecycle management because sidecars must be defined in each workload's pod spec, and they do not automatically capture logs from all containers in a multi-container pod without manual file tailing. A DaemonSet approach is the standard for cluster-wide log collection because it scales with nodes rather than pods and requires no changes to application manifests.
- ✗
Install the Amazon Kinesis Agent on each EC2 instance and configure it to stream logs to Amazon Kinesis Data Firehose.
Why it's wrong here
Amazon Kinesis Agent is a host-based Java agent that tails log files on EC2 instances and writes to Kinesis Data Streams or Data Firehose. It is not designed for containerized environments like EKS because it cannot discover or parse logs from the container runtime, and it would require manual installation and management on each worker node as a static daemon, which defeats the 'agentless' objective. Furthermore, it does not natively handle multi-line container logs or Kubernetes metadata enrichment, making it unsuitable for a comprehensive EKS logging strategy.
- ✗
Deploy a Fluentd DaemonSet on the EKS cluster and configure it to send logs to Amazon S3.
Why it's wrong here
Fluentd is a feature-rich log collector, but it is noticeably heavier in resource consumption than Fluent Bit, and it is fundamentally a logging agent, not an agentless solution. Directing logs to S3 also fails the real-time operational logging requirement because S3 is an archival object store with no native querying; logs would need to be buffered and ingested into an analytics service for meaningful monitoring. A better architecture would use Fluent Bit to stream to CloudWatch Logs, with S3 as a destination only for long-term retention via CloudWatch Logs export or Firehose.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.