A company moved to a hybrid environment that includes on-premises instances and Amazon EC2 instances. The company wants to use Amazon CloudWatch Logs to track the instance logs for the on-premises…

The correct answer is B. Install and configure the CloudWatch agent on all the instances. Attach an IAM role to the EC2. Option B is correct because the CloudWatch agent must be installed on every instance - both on-premises and EC2 - to collect and stream logs to CloudWatch Logs. For EC2 instances, AWS best practice is to attach an IAM role (instance profile), which provides temporary…

Submitted by alyssa_d· Mar 30, 2026Monitoring, Logging, and Remediation

Question

A company moved to a hybrid environment that includes on-premises instances and Amazon EC2 instances. The company wants to use Amazon CloudWatch Logs to track the instance logs for the on-premises instances and the EC2 instances. What should a SysOps administrator do to meet these requirements in compliance with AWS best practices?

Options

AConfigure CloudWatch from the AWS Management Console for all the instances. Wait for AWS to
BInstall and configure the CloudWatch agent on all the instances. Attach an IAM role to the EC2
CInstall and configure the CloudWatch agent on all the instances. Configure IAM user credentials
DInstall and configure the CloudWatch agent on all the instances. Attach the necessary security

How the community answered

(42 responses)

A
12% (5)
B
76% (32)
C
5% (2)
D
7% (3)

Explanation

Option B is correct because the CloudWatch agent must be installed on every instance - both on-premises and EC2 - to collect and stream logs to CloudWatch Logs. For EC2 instances, AWS best practice is to attach an IAM role (instance profile), which provides temporary, automatically rotated credentials without storing long-term secrets on the machine. For on-premises servers, IAM roles cannot be attached, so IAM user credentials stored in a credentials file are the appropriate alternative - and the full text of B captures this distinction.

Why the distractors are wrong:

A is wrong because there is no "configure from console and wait" mechanism - CloudWatch Logs requires the agent to actively run on each instance.
C is wrong because it applies IAM user credentials to all instances, including EC2, which violates best practices by storing long-term static credentials on EC2 (use roles instead).
D is wrong because security groups control network-level traffic, not authentication - they don't grant an instance permission to send logs to CloudWatch.

Memory tip: Think "Roles for cloud, credentials for ground." EC2 lives in the cloud and gets IAM roles (ephemeral, no stored keys). On-premises servers are on the ground and must use IAM user credentials since AWS has no way to "inject" a role into your datacenter hardware.

Topics

#CloudWatch Logs#CloudWatch Agent#IAM Roles#Hybrid Cloud Logging

Community Discussion

No community discussion yet for this question.

Full SOA-C02 Practice