SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company uses Amazon CloudWatch Logs to collect application logs. The operations team wants to be notified when a specific error message appears in the logs. What is the SIMPLEST way to achieve this?
⚠ Common exam trap
SAP-C02 often tests whether candidates choose the simplest native AWS service rather than a custom Lambda or manual query approach, so candidates who over-engineer the solution pick Lambda or Logs Insights instead of metric filters plus alarms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a metric filter on the log group for the error message and set up a CloudWatch alarm on the metric.
A CloudWatch metric filter scans a log group for a specified pattern (such as an error string) and increments a custom metric each time the pattern matches; attaching a CloudWatch alarm to that metric then triggers notifications via SNS when the threshold is breached. This is the native, lowest-effort mechanism for alerting on log content and requires no custom code. It directly satisfies the 'simplest way' requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure S3 event notifications on the log file destination to send an alert.
Why it's wrong here
S3 event notifications fire on object creation, not on log content, and CloudWatch Logs does not write to S3 by default, so the specific error message would never trigger an alert. S3 events suit reacting to uploaded objects, not pattern matching inside log streams.
- ✗
Subscribe a Lambda function to the log group and have it check for the error message.
Why it's wrong here
Subscribing a Lambda function to a log group requires writing and maintaining custom code to parse log events, which adds operational overhead and violates the "simplest" requirement. This approach is tempting because Lambda can indeed process log streams for arbitrary pattern matching, and would be correct if the team needed to transform logs or trigger complex remediation logic beyond simple notification. However, CloudWatch Logs already provides a native metric filter that can directly trigger an alarm without any custom code.
- ✓
Create a metric filter on the log group for the error message and set up a CloudWatch alarm on the metric.
Why this is correct
A metric filter scans incoming log events for the error pattern and increments a custom CloudWatch metric, which an alarm then evaluates against a threshold. This satisfies the stem's notification requirement natively within CloudWatch Logs, avoiding custom Lambda parsing or third-party tooling.
- ✗
Use CloudWatch Logs Insights to run a query periodically and send results via email.
Why it's wrong here
Logs Insights queries are run on demand or via scheduled rules, but they do not natively email results; you must wire the query to a destination yourself. It is intended for interactive log investigation and ad-hoc analysis, not for the simplest automated notification on a matching error message.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.