A company recently moved its server infrastructure to Amazon EC2 instances. The company wants to use Amazon CloudWatch Logs to track the instance logs. What should a SysOps administrator do to meet…

Question

Options

• AConfigure CloudWatch from the AWS Management Console for the instances. Wait for AWS to
• BInstall and configure the CloudWatch agent on the instances. Attach an IAM role to allow the
• CInstall and configure the CloudWatch agent on the instances. Attach an IAM user to allow the
• DInstall and configure the CloudWatch agent on the instances. Attach the necessary security

• A
  4% (1)
• B
  92% (24)
• C
  4% (1)

Explanation

Option B is correct because collecting logs from EC2 instances requires the CloudWatch agent to be installed and running on the instance - AWS cannot remotely access instance-level logs without it. The agent must also have permission to send logs to CloudWatch, which is granted via an IAM role attached to the EC2 instance (not a user), following the AWS best practice of using roles for service-to-service authentication.

Why the distractors are wrong:

• A is wrong because you cannot configure CloudWatch to pull instance logs purely from the console - AWS has no built-in mechanism to reach inside an EC2 instance and collect logs without an agent.
• C is wrong because attaching an IAM user to an EC2 instance is not a valid AWS construct and violates best practices; roles (not users) are the correct way to grant permissions to EC2 instances.
• D is wrong because security groups control network traffic, not API permissions - they cannot grant an instance the right to publish logs to CloudWatch.

Memory tip: Think of it as three requirements - Agent (software to collect logs), Role (not a user) to authorize, and CloudWatch Logs as the destination. The mnemonic "A-R-C" (Agent → Role → CloudWatch) captures the correct answer pattern for any question about getting EC2 data into AWS monitoring services.

No community discussion yet for this question.