A company's application runs on Amazon EC2 instances. The application writes to a log file that records the username, date, time, and source IP address of the login. The log is published to a log…

Question

Options

• ACreate a CloudWatch Logs metric filter on the log group. Use a filter pattern that matches the
• BCreate a CloudWatch Logs subscription on the log group. Use a filter pattern that matches the
• CCreate a CloudWatch Logs Insights query that uses an aggregation function to count the number
• DCreate a CloudWatch dashboard. Add a number widget that has a filter pattern that counts the

• A
  2% (1)
• B
  10% (4)
• C
  83% (34)
• D
  5% (2)

Explanation

Explanation

Option C is correct because CloudWatch Logs Insights is specifically designed for interactive querying and analysis of log data, allowing you to write queries using aggregation functions (like count()) filtered by specific fields (such as username) over a custom time range up to the past 7 days - making it the perfect tool for this root cause analysis scenario.

Option A is incorrect because CloudWatch Logs metric filters track future incoming log events and emit metrics going forward; they cannot retroactively count logins from the past 7 days of existing log data.

Option B is incorrect because CloudWatch Logs subscriptions are used to stream log data in near real-time to destinations like Lambda, Kinesis, or OpenSearch - they are not designed for querying historical log records.

Option D is incorrect because CloudWatch dashboards display metrics and visualizations, but they cannot directly query raw log data with filter patterns to perform ad hoc aggregation counts on historical log entries.

Memory Tip

Think of Logs Insights = Investigation Tool - any time an exam question mentions querying, analyzing, counting, or root cause analysis on existing CloudWatch log data, CloudWatch Logs Insights is almost always the answer. The word "Insights" itself hints at deep analytical capability.

No community discussion yet for this question.