Backup retention and observability costs: SAP-C03 study notes and practice questions
What to know about Backup retention and observability costs for the SAP-C03 exam, from the Cost-Optimized Architecture Design domain (15% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks you to keep compliance and recovery goals while cutting the cost of backups, logs and metrics. The scenario usually says “retain for 7 years”, “recovery within hours” or “log bill grew 5x after adding debug logging”.
Backup retention
AWS Backup plans set frequency, retention and a lifecycle to cold storage for supported resources (such as EBS, EFS, DynamoDB with advanced features, and VMware or Timestream backups). Backups moved to cold storage must stay there at least 90 days, so the retention period must be at least 90 days longer than the time before transition.
Keep short retention for frequent backups (daily for 35 days) and long retention for a few (monthly for 7 years), not every daily backup for 7 years.
Cross-Region and cross-account copies add storage in the destination plus inter-Region transfer. Copy only the recovery points DR or compliance actually needs, often with shorter retention in the copy.
Amazon Data Lifecycle Manager (DLM) automates EBS snapshot and EBS-backed AMI creation and deletion by tag, including cross-Region copy and deprecating old AMIs.
EBS Snapshots Archive stores rarely needed full snapshots at a much lower price, with a 90-day minimum and a restore time of up to 72 hours. It suits month-end or compliance snapshots, not operational restores.
Incremental EBS snapshots charge only for changed blocks; deleting old snapshots frees only blocks no other snapshot references.
Point-in-time recovery features (DynamoDB PITR, RDS automated backups) cover short windows cheaply; long-term retention goes in AWS Backup.
Observability costs
Lever
Effect
Log group retention
CloudWatch Logs keep data forever by default; set a retention period on every log group
Infrequent Access log class
Lower ingestion price for logs you rarely query (fewer features, such as no live tail or metric filters)
Filter at the source
Drop debug logs, sample high-volume access logs, set log levels per environment
Export or subscribe to S3
Keep long-term archives in S3 with lifecycle rules to Glacier classes, query with Athena
Metric aggregation
Publish fewer, aggregated custom metrics; avoid high-cardinality dimensions such as user ID, which create a new metric each
Embedded Metric Format
Generate metrics from structured logs without separate API calls
Trace sampling
Sample traces with ADOT or X-Ray instead of tracing every request
Vended logs to S3
Send VPC Flow Logs and similar logs straight to S3 when you only query them occasionally
Centralizing logs in one account helps governance, but cross-Region or high-volume subscriptions add transfer and processing; aggregate within each Region where possible. See log aggregation.
How to choose
Scenario wording
Pick
“Keep monthly backups 7 years at lowest cost”
AWS Backup plan with lifecycle to cold storage
“EBS snapshots by tag, delete after 14 days”
Data Lifecycle Manager
“Year-end snapshots kept 10 years, restore time not critical”
EBS Snapshots Archive
“Audit logs rarely queried, must keep 1 year”
Infrequent Access log class or S3 archive with lifecycle
A retailer's order service writes verbose debug logs to Amazon CloudWatch Logs, and log ingestion is now its largest observability charge. Engineers search the last two weeks of logs during incidents, and the compliance team requires that application logs be kept for one year. The order service writes about one gigabyte of logs an hour.
The compliance team accepts that older logs may take longer to retrieve, and the engineers do not need the debug level in production at all.
Which solution meets these requirements at the LOWEST cost?
Choose one answer.
AA. Keep every log group on never-expire retention, so that every log from the past year stays searchable in CloudWatch Logs without any export step.
BB. Turn off debug logging in production, keep the logs in CloudWatch Logs for 14 days, and export older logs to an S3 bucket whose lifecycle rule moves them to an archive storage class.
CC. Take a daily AWS Backup snapshot of the log group's storage, and keep every snapshot in the default warm storage for one year.
DD. Send all logs to a third-party log platform through a subscription filter, and set every log group to the shortest retention so that the platform's pricing and search tools apply instead.
Show the answer and explanation
Answer: B
A. Wrong: Never-expire retention keeps all logs in CloudWatch Logs at its storage rate for the whole year. The verbose debug output would still be ingested and stored at full cost.
B. Right: Correct. Turning off debug output cuts ingestion at the source, and 14-day retention keeps incident searches fast. The exports to S3 with a lifecycle rule meet the one-year requirement at archive rates.
C. Wrong: AWS Backup protects data stores such as volumes and databases and is not the way to keep log events searchable. Warm storage for a year of daily copies costs more than exporting the logs once.
D. Wrong: The logs are still ingested into CloudWatch Logs before the subscription filter sends them on, so the ingestion charge for the debug output remains. The option also adds a vendor dependency the requirements did not ask for.
Explanation
Turning off debug output cuts ingestion, short CloudWatch retention keeps incident searches fast, and exports to an S3 archive tier meet the one-year rule at lower cost. Never-expire retention, daily snapshots and moving the cost to another vendor each keep the cost high or miss the point.
Want more on Backup retention and observability costs? The 5 full-length practice sets have 6 more Backup retention and observability costs questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →