Courseiva
← MLS-C01
Full test
Exploratory Data Analysis →mediumMultiple ChoiceObjective-mapped

MLS-C01 Exploratory Data Analysis Practice Question

Exhibit

Refer to the exhibit.

```
2019-09-01 12:00:01 ERROR 500 Server Error: /api/v1/users
2019-09-01 12:00:02 INFO 200 OK: /api/v1/users
2019-09-01 12:00:03 ERROR 500 Server Error: /api/v1/users
```

A data scientist is analyzing server logs stored in Amazon CloudWatch Logs. The above snippet shows three log entries. They want to count the number of 500 errors per minute using CloudWatch Logs Insights. Which query should they use?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

fields @timestamp, @message | filter @message like /500/ | stats count() by bin(1m)

The correct query is D. It reads the @timestamp and @message fields, filters log entries containing '500' in the message, and then counts the number of such entries per minute using stats count() by bin(1m). This directly matches the requirement to count 500 errors per minute. Option A attempts to filter on a 'status' field, but the logs shown do not have a separate status field; the status code is embedded in the message. Option B filters for 'ERROR', but the logs use numeric status codes, not the word 'ERROR'. Option C sorts the results instead of aggregating, so it does not provide the count per minute.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    fields @timestamp, status | filter status = 500 | stats count() by bin(1m)

    Why it's wrong here

    Status field may not be parsed automatically.

  • ✗

    fields @timestamp, @message | filter @message like /ERROR/ | stats count() by bin(1m)

    Why it's wrong here

    Filters error messages, not status code 500.

  • ✗

    fields @timestamp, @message | filter @message like /500/ | sort @timestamp desc

    Why it's wrong here

    Sorts but does not count.

  • ✓

    fields @timestamp, @message | filter @message like /500/ | stats count() by bin(1m)

    Why this is correct

    Correctly filters for 500 status code and counts per minute.

About these practice questions

One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.