A company is migrating its Linux-based web servers to an Amazon EC2 Auto Scaling group. Currently, administrators SSH into static instances to retrieve log files, and the company frequently runs queries on the logs for application session and user issue analysis. The company wants to ensure that no logs are lost during scale-in events and to minimize cost. Which combination of actions should a security engineer take? (Choose two.)

Installing and configuring the Amazon CloudWatch agent on EC2 instances to stream logs to Amazon CloudWatch Logs ensures that logs are continuously collected and centralized. This prevents log loss during scale-in events because logs are immediately offloaded from the ephemeral instances. Using Amazon CloudWatch Logs Insights allows for efficient querying and analysis of these centralized logs, fulfilling the requirement for application session and user issue analysis. Setting up a cron job to upload to S3 is less real-time and could lead to data loss between uploads during a sudden scale-in. AWS Glue and Amazon Athena can query S3, but the primary issue of log collection and preventing loss during scale-in is not addressed by these services alone. Writing logs to Amazon EFS would incur higher costs compared to CloudWatch Logs for log storage and querying, and while it prevents loss, it doesn't offer the integrated querying capabilities of CloudWatch Logs Insights.