SOA-C02 Monitoring, Logging, and Remediation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable AWS CloudTrail and store logs in an S3 bucket.

  Why it's wrong here

  AWS CloudTrail is an API-gateway audit service that records management events such as RunInstances, TerminateInstances, and console sign-ins, storing them in S3 for governance and compliance. It does not capture application-level output, stderr/stdout, or web server access logs generated by the operating system or application inside the EC2 instance. Therefore, CloudTrail cannot be used to search for application errors, debug runtime behavior, or monitor live application performance — it only traces calls to the AWS control plane.

• ✗

  Use Amazon Kinesis Data Firehose to send logs directly from each instance to Amazon Redshift.

  Why it's wrong here

  Amazon Kinesis Data Firehose is a streaming ingestion service that can deliver data to Amazon Redshift, but Redshift is a petabyte-scale columnar data warehouse optimized for complex analytical queries over structured data, not for low-latency interactive log search. Loading into Redshift requires a COPY command via an intermediate S3 bucket, which introduces significant delivery latency and operational overhead (e.g., managing schemas, compression, and error handling). It also lacks native full-text search, live tailing, or metric-filtering capabilities that are essential for real-time troubleshooting, making it inappropriate for this use case.

• ✓

  Install the CloudWatch Logs agent on each EC2 instance and stream logs to Amazon CloudWatch Logs.

  Why this is correct

  Installing the CloudWatch Logs agent on each EC2 instance enables near-real-time streaming of application and system log files to Amazon CloudWatch Logs, providing a centralized, scalable, and searchable log store. With CloudWatch Logs you can create metric filters to trigger CloudWatch alarms, use Logs Insights to run queries across log groups, and perform live tailing to watch logs as they arrive. The agent also handles log rotation, multi-line log records, and timestamp parsing automatically, which simplifies log management and removes the need for manual log harvesting or extra infrastructure.

• ✗

  Store logs locally on each instance and periodically copy them to Amazon S3.

  Why it's wrong here

  Storing logs locally on each EC2 instance and periodically copying them to Amazon S3 offers durable and cost-effective archival, but it does not give you real-time visibility into application behavior because you must wait for the copy interval to elapse. S3 has no native search functionality for log contents, so to analyze the data you would need to run additional services such as Amazon Athena or an Elasticsearch cluster, adding complexity and latency to any investigation. Meanwhile, in an active incident you might be unable to access an instance's local logs if the instance is down or unreachable, making this approach both slow and operationally fragile compared to centralized streaming to CloudWatch Logs.

Go deeper

Related to this question