A new workload in ap-northeast-2 runs in three Amazon EC2 Auto Scaling groups. All workloads in this Region must retain system and application logs for 7 years. A security engineer must ensure logs are not lost during scaling and are retained only for the required period. Which combination of steps will meet these requirements? (Choose three.)
Choose an answer
Tap an option to check your answer.
Correct answer: Install the Amazon CloudWatch agent on all EC2 instances launched by the Auto Scaling groups. Create a CloudWatch agent configuration to forward the required logs to Amazon CloudWatch Logs., Configure the CloudWatch Logs retention policy for the required log groups to 7 years., Attach an IAM role to the launch configuration or launch template used by the Auto Scaling groups with permissions to publish logs to Amazon CloudWatch Logs..
Why this is the answer
The Amazon CloudWatch agent is essential for collecting system and application logs from EC2 instances and forwarding them to CloudWatch Logs, ensuring logs are not lost during scaling events. An IAM role with logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions must be attached to the Auto Scaling group's launch configuration or template, allowing instances to publish logs to CloudWatch. Finally, setting the CloudWatch Logs retention policy to 7 years directly fulfills the retention requirement. Using Amazon S3 for log storage would require additional configuration for log forwarding and lifecycle management, which is more complex than direct CloudWatch Logs integration for this specific requirement.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed