A development team stores application logs in Amazon CloudWatch Logs and has enabled detailed EC2 monitoring on every instance. Auditors require the logs to be retained for 90 days, but the operations team only needs the last 7 days to remain searchable in CloudWatch. Which two actions should they take to reduce monitoring cost? Select two.

Set the CloudWatch Logs retention period to 90 days so everything stays searchable in CloudWatch.

This meets the retention requirement but keeps all logs in the more expensive searchable store. The scenario says only 7 days must remain searchable in CloudWatch, so retaining 90 days there is unnecessary spend.

Send logs to DynamoDB because it is cheaper for long-term retention.

DynamoDB is not a log archive service and is not a good fit for time-based log retention. It does not provide the right cost model or retrieval pattern for archived logs.

Enable detailed monitoring only during peak business hours on every instance.

Time-based toggling adds operational complexity and still leaves the team paying for detailed monitoring during many periods when it is unnecessary. The cleaner cost reduction is to use basic monitoring by default and archive logs outside CloudWatch.

What does this SAA-C03 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Set the CloudWatch Logs retention period to 7 days and export or archive older logs in Amazon S3 or S3 Glacier for the remaining retention period. — The cost-optimized approach is to keep only the recent 7 days of logs in CloudWatch and archive older logs elsewhere to meet the 90-day retention requirement. In parallel, the team should disable detailed EC2 monitoring unless one-minute metrics are actually needed. These two actions reduce both log storage spend and per-instance monitoring charges. Keeping 90 days searchable in CloudWatch is more expensive than necessary. DynamoDB is not a sensible log retention platform. Enabling detailed monitoring only by business hours adds complexity without addressing the main storage cost issue. The best solution separates short-term searchable logs from long-term archived logs and removes unneeded metric granularity.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.