SOA-C02 Monitoring, Logging, and Remediation Practice Question
A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The marketing team wants to know how many users visit the website each day, including the geographic distribution. Which solution requires the LEAST operational overhead?
⚠ Common exam trap
Test-takers frequently confuse CloudWatch metrics (which show request counts but lack geographic detail) with access logs (which provide the raw data needed for geographic analysis), or overcomplicate the solution by choosing real-time streaming when batch analysis is sufficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CloudFront access logs and use Amazon Athena to query the logs in S3.
Enabling CloudFront access logs and querying them with Amazon Athena provides detailed user visit counts and geographic distribution with minimal operational overhead. Access logs contain client IP addresses and request details, which Athena can analyze using SQL without managing servers or complex pipelines. This approach is serverless and cost-effective for periodic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use CloudWatch metrics for CloudFront to view request counts and enable detailed metrics.
Why it's wrong here
CloudFront publishes standard and detailed metrics to CloudWatch, including RequestCount and BytesDownloaded, but these metrics are aggregated at the distribution or cache-behavior level and do not include a country or geographic dimension. Enabling detailed metrics only increases data granularity to one-minute intervals for existing metric types; it still cannot break down requests by viewer location. You therefore cannot use CloudWatch alone to answer 'how many requests per country per day'.
- ✓
Enable CloudFront access logs and use Amazon Athena to query the logs in S3.
Why this is correct
CloudFront access logs are delivered to an S3 bucket and capture each viewer request with fields like date, time, client-IP-derived country, URI, and edge response status. With Amazon Athena, you can define a table over those S3 objects with a serde (or partition projection on the log date) and run serverless SQL queries to aggregate request counts by day and country. This approach matches the requirement with minimal operational overhead and no streaming infrastructure.
- ✗
Enable AWS CloudTrail for CloudFront and query the event history.
Why it's wrong here
AWS CloudTrail records control-plane API calls made to CloudFront, such as CreateDistribution, UpdateDistribution, or DeleteDistribution, and delivers those events to an S3 bucket. It does not capture the data-plane viewer requests that your website receives—those are never represented as CloudTrail events. Therefore, querying CloudTrail event history would yield management activity, not the per-viewer request records needed for country-based daily counts.
- ✗
Enable CloudFront real-time logs and send them to Amazon Kinesis Data Analytics for analysis.
Why it's wrong here
CloudFront real-time log streams do include the same per-request fields as standard access logs, but they require a Kinesis Data Stream and Kinesis Data Analytics application to parse, aggregate, and sink the data. Standing up that streaming architecture for a simple daily request-count-by-country report adds significant cost and operational complexity, and you still must write a SQL or Flink job to perform the aggregation. Standard access logs queried with Athena give the same analysis in a simpler, fully serverless way.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.