SCS-C02 Security Logging and Monitoring Practice Question
A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?
⚠ Common exam trap
The trap here is that candidates may incorrectly assume CloudWatch Logs can directly transition logs to Glacier via lifecycle policies, but CloudWatch Logs does not support lifecycle transitions to S3 storage classes; logs must first be exported to S3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.
Exporting logs from CloudWatch Logs to Amazon S3 and using S3 Lifecycle policies to transition them to S3 Glacier Deep Archive after 90 days is the most cost-effective solution. CloudWatch Logs storage costs are higher than S3, and Glacier Deep Archive offers the lowest storage cost for infrequently accessed data that must be retained for 7 years. This approach meets the retention requirement while minimizing costs for logs that are rarely accessed after the initial 90-day period.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.
Why this is correct
Exporting log data from CloudWatch Logs to S3 via the CreateExportTask API is the native, recommended path for long-term archival. Once in S3, a lifecycle rule can transition objects from S3 Standard to S3 Glacier Deep Archive after 90 days, minimizing storage costs for data that is rarely, if ever, accessed while meeting the 7-year compliance requirement. This approach also lets you set a short retention on the original log group to avoid ongoing CloudWatch Logs storage fees after export completes.
- ✗
Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.
Why it's wrong here
Streaming logs from CloudWatch Logs to S3 using Amazon Kinesis Data Firehose is a valid real-time delivery mechanism, but transitioning those objects to S3 Standard-IA after 90 days is not cost-optimal for 7-year archival that only needs occasional access. Standard-IA carries a per-GB retrieval fee and is designed for infrequent but immediate access, whereas S3 Glacier Deep Archive provides the lowest storage cost at the expense of hours-long retrieval. The Kinesis pipeline also introduces per-GB ingestion costs and additional operational overhead compared to a straightforward export task.
- ✗
Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.
Why it's wrong here
Keeping a 7-year retention policy directly on the CloudWatch Logs log group means paying CloudWatch Logs storage rates (per GB per month) for the entire duration, which is an order of magnitude more expensive than moving data to S3 Glacier Deep Archive. CloudWatch Logs Insights is an interactive query engine intended for real-time troubleshooting on recent logs, not a cost-effective archival or analytics solution, and it bills additional query costs. For compliance-grade data that is rarely accessed, storing everything in CloudWatch Logs for 7 years is financially impractical.
- ✗
Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.
Why it's wrong here
This option incorrectly assumes CloudWatch Logs has a native lifecycle policy that can transition log events directly to Amazon S3 Glacier. In reality, CloudWatch Logs only supports exporting data to an S3 bucket via export tasks or log subscriptions; there is no built-in S3 lifecycle integration within CloudWatch Logs itself. To ultimately archive in Glacier, you must first export the log data to S3 and then configure an S3 lifecycle rule — the retention policy on the log group only controls deletion in CloudWatch Logs, not movement to another service.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.