AWS DevOps Monitoring and Logging 4 — Questions and Answers
Question 1: An organization needs to centralize CloudWatch Logs from 50 AWS accounts into a single Security account for SIEM ingestion. Which feature supports cross-account log streaming?
- CloudWatch Cross-Account Observability (sink/source model)
- CloudTrail Organization Trail + S3 replication
- VPC Flow Logs cross-account export
- CloudWatch Subscription Filters with cross-account Kinesis Data Streams (Correct answer)
Correct answer: CloudWatch Subscription Filters with cross-account Kinesis Data Streams
CloudWatch Subscription Filters can send log data to a Kinesis Data Stream in another account by setting the appropriate resource policy, enabling cross-account log aggregation.
Question 2: Which AWS service continuously records configuration changes to AWS resources and can trigger remediation when a resource drifts from a desired state?
- AWS CloudTrail
- AWS Systems Manager State Manager
- AWS Config (Correct answer)
- Amazon Inspector
Correct answer: AWS Config
AWS Config records resource configuration history and evaluates compliance against rules, with optional automatic remediation via Systems Manager Automation.
Question 3: A team wants to detect anomalous spikes in Lambda error rates using machine learning without writing threshold rules. Which CloudWatch feature provides this?
- CloudWatch Anomaly Detection (Correct answer)
- CloudWatch Contributor Insights
- CloudWatch Synthetics
- CloudWatch Application Insights
Correct answer: CloudWatch Anomaly Detection
CloudWatch Anomaly Detection uses ML to model expected metric behavior and can create alarms that fire when values deviate from the predicted band.
Question 4: During a blue/green deployment, which metric from an Application Load Balancer is most useful for determining when to shift 100% of traffic to the green environment?
- RequestCount
- TargetResponseTime p99
- HTTPCode_ELB_5XX_Count
- HealthyHostCount for the green target group (Correct answer)
Correct answer: HealthyHostCount for the green target group
HealthyHostCount for the green target group confirms all new instances have passed health checks and are ready to serve full traffic.
Question 5: A DevOps engineer must ensure that all CloudWatch Logs data older than 30 days is exported to S3 for cost-efficient long-term storage. Which native mechanism supports this?
- CloudWatch Log Group retention policy + S3 Lifecycle policy
- CloudWatch Logs subscription filter → Kinesis Firehose → S3
- CloudWatch Logs export task (CreateExportTask API) scheduled via EventBridge (Correct answer)
- CloudTrail S3 data events for log groups
Correct answer: CloudWatch Logs export task (CreateExportTask API) scheduled via EventBridge
The CreateExportTask API exports a log group's data to S3 for a specified time range; scheduling it via EventBridge Scheduler automates the 30-day export.
Question 6: Which CloudWatch dashboard widget type allows users to run a Log Insights query and display the results as a bar chart directly on the dashboard?
- Metric widget
- Text widget
- Log Insights query results widget (Correct answer)
- Alarm status widget
Correct answer: Log Insights query results widget
The Log Insights query results widget embeds a saved or inline Log Insights query in a CloudWatch dashboard and renders results as a table, bar, line, or pie chart.
Question 7: A company's CodePipeline runs multiple parallel stages. The team wants one unified view showing stage durations and failure rates over the last 7 days. Which is the most scalable approach?
- Manually review each pipeline execution history in the console
- Use EventBridge to capture pipeline events, store in DynamoDB, and build an API-backed dashboard (Correct answer)
- Use CloudTrail Lake to query CodePipeline API calls with SQL
- Use CodePipeline notification rules with Slack integration only
Correct answer: Use EventBridge to capture pipeline events, store in DynamoDB, and build an API-backed dashboard
EventBridge captures all pipeline state-change events; storing them in DynamoDB and exposing via an API provides a scalable, queryable source for a custom dashboard.
AWS DevOps Monitoring and Logging 4
An organization needs to centralize CloudWatch Logs from 50 AWS accounts into a single Security account for SIEM ingestion.
Which feature supports cross-account log streaming?