Log collection, retention, encryption and subscriptions: DOP-C02 study notes and practice questions
What to know about Log collection, retention, encryption and subscriptions for the DOP-C02 exam, from the Monitoring and Logging domain (15% of the exam guide), then 3 free questions to test it. Part of the DOP-C02 study guide.
These questions ask how to collect, protect, keep and centralize logs from many accounts.
Basics
Log groups hold log streams; set retention per group (default is never expire, which costs money).
Encryption with a customer managed KMS key associated with the log group; the key policy must allow the CloudWatch Logs service.
Log classes: Standard, or Infrequent Access at lower cost with fewer features.
Data protection policies detect and mask sensitive data (such as card numbers) when viewed, with audit findings.
Getting logs out
Method
Use
Subscription filters
Near real-time stream of matching events to Lambda, Kinesis Data Streams, Firehose or OpenSearch
Account-level subscription filters
One filter for all log groups in an account
Export to S3
Batch export task; not real-time
Firehose to S3
Continuous archive, convertible to Parquet
Centralizing across accounts
Cross-account subscriptions: each source log group sends to a destination in the central account, which forwards to Kinesis or Firehose. The destination’s access policy lists the source accounts.
CloudWatch cross-account observability links source accounts to a monitoring account to view logs, metrics and traces centrally without copying.
A video streaming service sends application logs from its playback servers to CloudWatch Logs. Engineers search the last 90 days of logs during incidents, and the compliance team needs logs kept for seven years at the lowest storage cost.
Security requires that every log group be encrypted with a customer managed KMS key, and the seven-year copies must be stored in a bucket that is not used for any other purpose.
The team wants the archive to fill itself with no nightly job to run or maintain.
Which configuration meets these requirements?
Choose one answer.
AA. Keep all logs in CloudWatch Logs with retention set to never expire, encrypted with the default AWS managed key, and check the storage cost each quarter to decide when to delete data.
BB. Copy each log stream to S3 with a Lambda function that runs every minute, writing each event as its own object, and set the log groups to expire after 90 days.
CC. Run a daily CreateExportTask job for each log group, exporting the previous day's logs to S3, and keep the log groups at the default retention so that the export has time to finish.
DD. Associate a customer managed KMS key with each log group, set retention to 90 days, and add a subscription filter that sends events to Amazon Data Firehose, which writes to a dedicated S3 bucket.
A customer managed KMS key on each log group meets the encryption rule, and a 90-day retention keeps the recent logs searchable in CloudWatch. A subscription filter sends events continuously to Amazon Data Firehose, which writes to a dedicated S3 bucket where lifecycle rules manage the seven-year archive. Export tasks, custom copy functions and unlimited retention each miss one requirement.
An insurance firm runs 40 AWS accounts for its business lines. Application logs in each account are written to CloudWatch Logs, and the security operations center in a separate central account runs its SIEM from an Amazon Data Firehose stream.
The SOC needs authentication-failure events from every account within a few seconds of their creation. Only those events should be sent, and the source accounts must keep ownership of their log groups.
The solution must not depend on a scheduled job or a polling process that the team would have to maintain.
Which solution meets these requirements?
Choose one answer.
AA. In each source account, create a subscription filter with a pattern for authentication failures that sends matching events to a CloudWatch Logs destination in the central account, which forwards them to Firehose.
BB. Run a daily CreateExportTask in each account to export the authentication logs to an S3 bucket in the central account, and have the SOC load them into the SIEM each morning.
CC. Give the central account read access to every source log group, and run a scheduled Logs Insights query there every minute that searches for authentication failures and sends the results to the SIEM.
DD. Enable AWS CloudTrail data events in every account and send the trail to the central account, where the SIEM filters the records for authentication failures.
D. Wrong: CloudTrail records API activity, not application log lines, so authentication-failure events from the applications would not appear there. Data events are also not the stream the SOC needs. Learn more: Logging data events (opens in a new tab)
Explanation
Cross-account subscription filters send only matching events from each source log group to a destination in the central account, which forwards them to Firehose in near real time. The source accounts keep ownership of their logs, and nothing needs to poll. Export tasks run in batches, scheduled queries poll, and CloudTrail data events do not carry the application's log lines.
An airline's booking service writes request logs to a CloudWatch Logs log group. The logs sometimes include passenger names and partial payment card numbers, which the service writes by mistake in a few code paths.
The security team requires that the log group be encrypted with a customer managed KMS key. Engineers should still be able to search the logs, but the sensitive values must be masked in what they see, and any appearance of such values must be recorded for the audit team.
The team does not want to change the booking service's code before the next release.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Turn on server-side encryption for the log group's S3 export bucket with an AWS managed key, and set the log group to forward a copy of its events to that bucket.
BB. Associate the customer managed KMS key with the log group, so that every event stored in that log group is encrypted with the key.
CC. Delete the log lines that contain passenger data with a scheduled Lambda function that runs each hour, so that the sensitive values never remain in the log group for long.
DD. Create a metric filter that counts the log lines containing card-like numbers, and alarm when the count rises, so that the security team learns about each leak.
EE. Add a data protection policy to the log group that audits and masks passenger names and card numbers in its events, so that the values are masked when engineers view them while the audit findings are recorded.
C. Wrong: Deleting lines removes evidence the audit team needs, and an hourly job leaves the values visible until it runs. It also adds a function the team must maintain.
A customer managed KMS key associated with the log group encrypts its events, and a data protection policy masks sensitive identifiers when engineers view them while recording findings for audit. Neither needs a code change. Encrypting an unrelated export bucket, deleting log lines and counting leaks with a metric filter each miss part of the requirement.
Want more on Log collection, retention, encryption and subscriptions? The 5 full-length practice sets have 13 more Log collection, retention, encryption and subscriptions questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Log collection, retention, encryption and subscriptions