Logs are stored in CloudWatch Logs and must be archived to S3, be rarely accessed after 90 days, and retained for 10 years. Which combination of steps should the DevOps engineer take? (Choose two.)

To archive CloudWatch Logs to S3, a CloudWatch Logs subscription filter is used to stream logs to a destination. Amazon Kinesis Data Firehose is the most suitable service for this, as it can directly deliver streaming data to S3, handling buffering and compression efficiently. This addresses the requirement to transfer all logs to an S3 bucket. Once logs are in S3, an S3 bucket lifecycle policy is needed to manage their long-term retention and cost optimization. The requirement states logs should be rarely accessed after 90 days and retained for 10 years. Transitioning objects to S3 Glacier after 90 days is ideal for infrequently accessed data, offering significant cost savings. Expiring logs after 3,650 days (10 years) ensures they are deleted when no longer needed. Incorrect options: Using AWS Glue for log transfer is not the primary or most efficient method for streaming real-time logs from CloudWatch Logs to S3; Kinesis Data Firehose is designed for this. Streaming directly to S3 via a subscription filter is not a native CloudWatch Logs feature; it requires an intermediary service like Kinesis Data Firehose or Lambda. S3 Reduced Redundancy Storage (RRS) is a legacy storage class not suitable for archiving and has been superseded by other options like Standard-IA or Glacier for cost-effective long-term storage.