A team runs an EC2-based service and ships logs to Amazon CloudWatch Logs. They enabled long log retention and turned on detailed monitoring to improve troubleshooting. Their monthly CloudWatch costs have grown unexpectedly. Compliance requires that the logs remain available in CloudWatch Logs (for querying and audits) for 90 days, and alerts/alarms do not require detailed EC2 monitoring. What change best reduces cost while meeting requirements?

Keep the current long retention and detailed monitoring; reduce the log volume by sampling 10% of events

Sampling reduces ingest/storage, but it also changes which events are retained. This conflicts with compliance requirements that the full log data must remain available in CloudWatch Logs for 90 days.

Move all logs to S3 immediately and delete the CloudWatch log groups to reduce costs

Deleting the CloudWatch log groups would remove the logs from CloudWatch Logs before the required 90-day audit window. Even if data is exported to S3, this does not satisfy the stated compliance requirement that logs remain available in CloudWatch Logs for 90 days.

Increase CloudWatch alarm thresholds to reduce the number of metric datapoints

Alarm thresholds affect when alarms trigger, not how CloudWatch metrics are collected or billed for monitoring. It typically does not reduce the metric ingestion/monitoring cost drivers enough to address the unexpected cost increase.

What does this SAA-C03 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Set the CloudWatch Logs retention to 90 days and disable detailed EC2 monitoring (use standard monitoring) for the instances — CloudWatch costs are primarily driven by CloudWatch Logs retention duration and the amount of data retained, plus the monitoring mode used for EC2 metrics. Because compliance explicitly requires logs to remain in CloudWatch Logs for 90 days, the most direct cost optimization is to set CloudWatch Logs retention to 90 days. Additionally, detailed EC2 monitoring increases the volume and granularity of billed metrics; since alarms do not require detailed monitoring, switching to standard monitoring reduces metric cost while still supporting existing alerting. Sampling may reduce ingestion/storage but can violate the compliance requirement to keep the full log data in CloudWatch Logs for 90 days. Deleting log groups breaks the compliance requirement to keep logs available in CloudWatch Logs. Raising alarm thresholds can change when notifications occur, but it generally does not reduce metric collection and billing, so it’s unlikely to be the best cost lever here.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.