PAS-C01 CloudWatch Logs Insights Practice Question
Exhibit
Refer to the exhibit. CloudWatch Logs Insights query: fields @timestamp, @message | filter @message like /ERROR/ | stats count() by @logStream | sort count() desc | limit 10
An SAP administrator runs the above CloudWatch Logs Insights query on an application log group. The query returns no results even though the administrator knows there are ERROR messages in the logs. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The log events are not in plain text; they are in JSON format and the ERROR string is within a JSON field.
CloudWatch Logs Insights allows filtering log events using the @message field. When logs are in JSON format, the ERROR string may be embedded within a JSON field rather than appearing as plain text in @message. A simple pattern match like /ERROR/ on @message will not match if the @message contains the entire JSON object. To search JSON logs, parse the JSON fields and filter on the parsed fields. Option A is incorrect because CloudWatch Logs Insights supports regex patterns with the '/pattern/' syntax. Option B is incorrect because the correct filter syntax uses '/pattern/', not 'like' (which is not an operator in CloudWatch Logs Insights). Option C is incorrect because while the time range could exclude errors, the most likely cause given that errors are known to exist is the JSON structure. Therefore, Option D is the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The query uses a regex pattern that is not supported by CloudWatch Logs Insights.
Why it's wrong here
CloudWatch Logs Insights supports regex.
- ✗
The query syntax is incorrect; the filter should use 'like' instead of '/.../'.
Why it's wrong here
The syntax is valid; filter with /.../ is regex.
- ✗
The time range is set to a period when no ERROR messages were logged.
Why it's wrong here
The administrator knows errors exist, so the time range should include them.
- ✓
The log events are not in plain text; they are in JSON format and the ERROR string is within a JSON field.
Why this is correct
If logs are JSON, @message contains the entire JSON string; the filter may need to target a specific field.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.