SAP-C03 practice question: Backup retention and observability costs
Cost-Optimized Architecture Design A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retailer's order service writes verbose debug logs to Amazon CloudWatch Logs, and log ingestion is now its largest observability charge. Engineers search the last two weeks of logs during incidents, and the compliance team requires that application logs be kept for one year. The order service writes about one gigabyte of logs an hour.
The compliance team accepts that older logs may take longer to retrieve, and the engineers do not need the debug level in production at all.
Which solution meets these requirements at the LOWEST cost?
Choose one answer.
AA. Keep every log group on never-expire retention, so that every log from the past year stays searchable in CloudWatch Logs without any export step.
BB. Turn off debug logging in production, keep the logs in CloudWatch Logs for 14 days, and export older logs to an S3 bucket whose lifecycle rule moves them to an archive storage class.
CC. Take a daily AWS Backup snapshot of the log group's storage, and keep every snapshot in the default warm storage for one year.
DD. Send all logs to a third-party log platform through a subscription filter, and set every log group to the shortest retention so that the platform's pricing and search tools apply instead.
Show the answer and explanation
Answer: B
A. Wrong: Never-expire retention keeps all logs in CloudWatch Logs at its storage rate for the whole year. The verbose debug output would still be ingested and stored at full cost.
B. Right: Correct. Turning off debug output cuts ingestion at the source, and 14-day retention keeps incident searches fast. The exports to S3 with a lifecycle rule meet the one-year requirement at archive rates.
C. Wrong: AWS Backup protects data stores such as volumes and databases and is not the way to keep log events searchable. Warm storage for a year of daily copies costs more than exporting the logs once.
D. Wrong: The logs are still ingested into CloudWatch Logs before the subscription filter sends them on, so the ingestion charge for the debug output remains. The option also adds a vendor dependency the requirements did not ask for.
Explanation
Turning off debug output cuts ingestion, short CloudWatch retention keeps incident searches fast, and exports to an S3 archive tier meet the one-year rule at lower cost. Never-expire retention, daily snapshots and moving the cost to another vendor each keep the cost high or miss the point.
Want more on Backup retention and observability costs? The 5 full-length practice sets have 6 more Backup retention and observability costs questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →