AWS Certified Data Engineer Associate DEA-C01 Practice Question

Your company's web application writes structured JSON logs to Amazon CloudWatch Logs. Security auditors need interactive searches with sub-second latency across the most recent 90 days of logs, while logs up to 12 months old must remain searchable at a lower cost and can tolerate higher latency. As the data engineer, what is the MOST cost-effective solution that minimizes operational overhead using Amazon OpenSearch Service?

Stream the logs to an Amazon OpenSearch Service domain that uses only hot data nodes; take daily snapshots to Amazon S3 and delete each index after 90 days to control storage cost.
Create a CloudWatch Logs subscription filter that streams the log group directly to an Amazon OpenSearch Service domain. Enable both hot and UltraWarm storage and attach an Index State Management policy that moves each index to UltraWarm after it is 90 days old.
Query the logs exclusively with CloudWatch Logs Insights after extending the log group retention period to 12 months.
Export the CloudWatch Logs group to Amazon S3 on a daily schedule, catalog the objects with AWS Glue, and run ad-hoc queries with Amazon Athena when analysis is required.

Report Issue

Answer Description

A CloudWatch Logs subscription filter can stream log events directly to an Amazon OpenSearch Service domain, removing the need for custom ingestion code. The hot tier keeps the latest 90 days of data on high-performance nodes for sub-second queries. UltraWarm provides a lower-cost, still-queryable tier ideal for older, read-only log data. An Index State Management (ISM) policy can automatically transition each daily index from hot to UltraWarm after it reaches 90 days, satisfying the retention and performance requirements with minimal administration. Exporting to S3 and querying with Athena would not meet the required query latency. Using only CloudWatch Logs Insights for a full-year retention would incur high query costs, and deleting indexes after 90 days would violate the 12-month searchability requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.