SCS-C02 Question 138
Select 2Your company has configured Amazon CloudWatch Logs to capture application logs and store them in log groups. Compliance requires that logs be retained for a specific period and automatically deleted afterward. Additionally, you are tasked with ensuring the logs are sent to a secure, long-term storage solution for archival purposes. What combination of actions should you take to meet these requirements?
- A
Set a retention period for the CloudWatch log group to match compliance requirements.
- B
Enable log streaming to an Amazon S3 bucket with appropriate bucket policies for security.
- C
Set up an Amazon CloudWatch alarm to notify when the log group exceeds the retention period.
- D
Use AWS Glue to transform and store the logs in Amazon Redshift for analysis.
- E
Configure an AWS Lambda function to automatically delete logs from the S3 bucket after the retention period.
Show answer and explanation
Correct answers: A, B
Explanation
To meet compliance requirements, you need to set the retention period at the log group level in CloudWatch Logs to ensure old logs are deleted automatically. Simultaneously, streaming logs to an Amazon S3 bucket provides secure, long-term storage. This combination satisfies both compliance and archival needs without requiring additional alarm configurations or manual deletion processes.
- A. Correct.
Setting a retention period for the CloudWatch log group ensures that logs are retained only for the duration specified by compliance requirements. Logs older than the retention period are automatically deleted.
- B. Correct.
Streaming logs to an Amazon S3 bucket provides a secure and cost-effective long-term storage solution. Proper bucket policies ensure the logs are protected and meet security requirements.
- C. Incorrect.
Setting up a CloudWatch alarm to notify when the log group exceeds the retention period does not help in meeting compliance requirements or handling log lifecycle management. Retention policies automatically handle log deletion.
- D. Incorrect.
Using AWS Glue and Amazon Redshift is not relevant to long-term log storage or compliance with retention requirements. This is more suitable for data analysis and transformation, not log lifecycle management.
- E. Incorrect.
Configuring an AWS Lambda function to delete logs from the S3 bucket is not required in this scenario. S3 does not need manual intervention for log deletion if the logs are intended for archival purposes.