Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is managing an application that writes JSON-formatted log events to an Amazon CloudWatch Logs group named `/aws/apps/auth-service`. A sample log event is shown below:

{
"timestamp": "2026-07-14T10:00:00Z",
"request_id": "req-98213",
"service": "auth-service",
"event": "LoginFailed",
"user_type": "premium",
"latency_ms": 350
}

The administrator needs to monitor the frequency of failed login events specifically for premium users. Additionally, the administrator must ensure that logs in this log group are kept for only 90 days to avoid indefinite storage costs.

Which two actions should the administrator take to meet these requirements? (Select TWO.)

  1. Create a metric filter on the /aws/apps/auth-service log group with the filter pattern { (.event = "LoginFailed") && (.user_type = "premium") }.Answer
  2. Modify the retention settings of the /aws/apps/auth-service log group and set the retention period to 90 days.Answer
  3. C
    Enable CloudWatch detailed monitoring on the EC2 instances hosting the application to automatically enforce a 90-day retention limit on application logs.
  4. D
    Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation runbook daily to delete log events older than 90 days from the log group.
  5. E
    Create an Amazon S3 lifecycle policy with a transition rule to expire objects after 90 days and apply it directly to the CloudWatch log group.

Answer

Create a metric filter on the /aws/apps/auth-service log group with the filter pattern { (.event = "LoginFailed") && (.user_type = "premium") } and modify the retention settings of the /aws/apps/auth-service log group to set the retention period to 90 days.
To monitor JSON logs, the metric filter pattern must use valid JSON syntax, where individual criteria are prefixed with $. and enclosed in parentheses, combined with logical operators like &&. To limit log storage costs, the SysOps Administrator must configure the retention settings directly on the CloudWatch log group, setting the expiration period to 90 days.

Step-by-Step Solution

1
Identify the correct JSON filter pattern syntax for CloudWatch Logs metric filters.
The pattern { (.event = "LoginFailed") && (.user_type = "premium") } matches JSON log events where the event field equals LoginFailed and the user_type field equals premium. Each logical condition must be enclosed in parentheses.
This isolates the specific log events of interest using valid AWS CloudWatch Logs JSON filter syntax.
2
Configure the retention settings for the CloudWatch log group to prevent indefinite storage costs.
Modifying the retention setting of the /aws/apps/auth-service log group to 90 days automatically expires logs older than that period.
This satisfies the requirement to keep logs for exactly 90 days to avoid ongoing costs.

Key Concept

CloudWatch Logs metric filter patterns for JSON log events and configuring log group retention periods.
Estimated Time:1m 30s
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic