A company has a web application that is hosted on Amazon EC2 instances. The EC2 instances are configured to stream logs to Amazon CloudWatch Logs. The company needs to receive an Amazon Simple Notific

Question

Options

• ARewrite the application code to stream application logs to Amazon SNS. Configure an SNS topic
• BConfigure a subscription filter on the CloudWatch Logs log group. Configure the filter to send an
• CInstall and configure the Amazon Inspector agent on the EC2 instances to monitor for errors.
• DCreate a CloudWatch metric filter to match the application error pattern in the log data. Set up a

• A
  5% (1)
• C
  11% (2)
• D
  84% (16)

Explanation

Option D is correct because the proper AWS-native pattern for threshold-based log alerting is: CloudWatch Metric Filter → CloudWatch Alarm → SNS notification. A metric filter extracts error patterns from log data and converts them into a numeric metric; a CloudWatch Alarm then watches that metric and fires an SNS notification when the count exceeds your threshold within the specified 5-minute evaluation period - exactly what the question requires.

Option A is wrong because rewriting application code to push directly to SNS bypasses the existing CloudWatch Logs infrastructure entirely and adds unnecessary complexity - SNS is a notification bus, not a log aggregation or threshold-evaluation service.

Option B is a near-miss - subscription filters stream log events to destinations like Lambda or Kinesis Data Firehose for real-time processing, but they don't evaluate thresholds or trigger SNS directly; they're a data routing mechanism, not an alerting mechanism.

Option C is wrong because Amazon Inspector is a security vulnerability assessment tool that scans for software CVEs and network exposures - it has no role in monitoring application error rates in log files.

Memory tip: Think of it as a pipeline - Filter → Metric → Alarm → SNS. Whenever a question involves "count something in logs and alert when it crosses a threshold," the answer always goes through a CloudWatch Metric Filter first, because raw logs can't be alarmed on directly.

No community discussion yet for this question.