SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Network Topology

A Lambda function logs are being retained for 30 days. The company wants to reduce costs by deleting logs older than 7 days. What should they do?

⚠ Common exam trap

SAP-C02 often tests whether candidates know that CloudWatch Logs retention is set per log group via put-retention-policy, and distracts with S3 lifecycle policies — candidates who assume CloudWatch logs live in S3 pick the wrong option.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use the put-retention-policy command to set retentionInDays to 7.

CloudWatch Logs retention is controlled per log group via the PutRetentionPolicy API (aws logs put-retention-policy), which sets retentionInDays to a value such as 7. This automatically deletes log events older than the specified period, directly reducing storage costs without changing the logging pipeline. It is the native, lowest-effort solution.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Export the logs to S3 and delete the log group.
Why it's wrong here
Exporting to S3 and deleting the log group removes all logs, including the last 7 days the company wants to keep, and breaks future ingestion. It is tempting because S3 storage is cheaper, and this would suit long-term archival where no CloudWatch retention is required.
✓
Use the put-retention-policy command to set retentionInDays to 7.
Why this is correct
Setting a CloudWatch Logs retention policy of 7 days via `put-retention-policy` directly satisfies the stem's cost constraint, since CloudWatch automatically deletes log events once they exceed the configured `retentionInDays` value. This is the native, serverless mechanism for lifecycle management, requiring no custom deletion code or scheduled Lambda invocations.
✗
Configure an S3 Lifecycle policy on the log group's underlying storage.
Why it's wrong here
S3 Lifecycle policies apply to S3 buckets, not CloudWatch Logs log groups, which have no underlying S3 storage to expire. It is tempting because lifecycle rules are the standard expiry mechanism, and this would be correct if the logs were stored in an S3 bucket instead.
✗
Create a CloudTrail trail to capture log events and expire them after 7 days.
Why it's wrong here
CloudTrail records API activity, not Lambda execution logs, so it cannot expire the existing log data. It is tempting because trails are a familiar logging control, and this would be right for auditing API calls rather than managing CloudWatch Logs retention.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question