AWS Certified Solutions Architect Professional SAP-C02 Practice Question

The correct approach is to centralize logs in Amazon CloudWatch and then stream them to specialized services for different purposes. Using a CloudWatch Logs subscription filter to stream logs to an Amazon OpenSearch Service domain addresses the need for near real-time, complex query capabilities for security analysis and APM. For long-term, cost-effective archival, a separate subscription filter should send the logs to Amazon S3 via an Amazon Kinesis Data Firehose delivery stream. This allows the use of S3 Lifecycle policies to transition the data to the most cost-effective storage tier, such as S3 Glacier Deep Archive. This strategy meets all requirements using fully managed services, thereby reducing operational overhead.

Using Amazon Athena for security and APM analysis does not meet the near real-time requirement, as it is designed for ad-hoc interactive queries on data in S3, not for real-time alerting or monitoring. Deploying a self-managed Elasticsearch cluster on EC2 instances would introduce significant operational overhead for management, patching, and scaling, which contradicts a key requirement. Using Amazon Redshift is not optimal for this use case; Redshift is a data warehouse best suited for large-scale structured data analysis and business intelligence, not for searching and analyzing unstructured and semi-structured log data in real time.