Get Your CertDOP-C02PlayCompete
‹ All DOP-C02 questions

DOP-C02 Practice Question 26: Metric Filter Error Alarm

AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 3 · question 6 of 10

Monitoring and Loggingmedium

An application writes structured JSON log events to a single Amazon CloudWatch Logs log group. The operations team must be paged within five minutes whenever more than 10 events with "level": "ERROR" and "service": "payments" are written in a five-minute period. They also want to chart the count of those events on a dashboard for the past 12 months, while the log group's retention is set to 30 days. The solution must add as little recurring cost and maintenance as possible.

Which solution meets these requirements?

Select one answer
Show answer and explanation

Answer:

  • C. Create a metric filter on the log group whose filter pattern matches both JSON fields and publishes a count to a custom metric, then create a CloudWatch alarm on that metric with a five-minute period, the Sum statistic, and a threshold of 10

Metric filters exist for exactly this: "CloudWatch Logs uses these metric filters to turn log data into numerical CloudWatch metrics that you can graph or set an alarm on." A JSON filter pattern can match on both fields at once, the metric value is 1 per matching event, and setting a default value of 0 keeps the metric from going sparse. Because the result is an ordinary CloudWatch metric, the alarm evaluates it in near real time and the data points remain available for 15 months, longer than the 12-month dashboard window, even though the raw logs are aged out after 30 days. There is no per-query charge and nothing to maintain.

Option A works but pays twice over: Logs Insights is billed on the volume of log data scanned by each query, and a query every five minutes forever is a recurring cost plus a Lambda function to own. It also cannot chart anything older than the log group's 30-day retention.

Option B is a batch pipeline. Delivery to Firehose and S3 plus a scheduled Athena query adds minutes of latency and several billable services, and the team still has to build the alarm logic that CloudWatch would give them for free.

Option D describes a capability that does not exist. Logs Insights is an interactive query interface; you cannot attach a CloudWatch alarm to a saved query. Turning a log pattern into an alarmable metric is what a metric filter is for.

Reference: Creating metrics from log events using filters

Practice Test 3 ›

Study guides for DOP-C02

AWS Service Control Policies Explained: SCPs and DenialsAWS service control policies explained: how SCPs cap permissions, why admins still get access denied, inheritance, deny vs allow lists and the exam traps.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Best DevOps certification: AWS, Azure, Google or CKAThe best DevOps certification for your stack: AWS DOP-C02, Azure AZ-400, Google Cloud DevOps Engineer and CKA compared on cost, level and prerequisites.
What Is AWS Lambda? Triggers, Concurrency and Cold StartsWhat is AWS Lambda? How functions run, cold starts, triggers vs event source mappings, concurrency, layers, aliases, pricing and the exam traps.
AWS CloudOps Engineer Associate (SOA-C03) exam guideAWS Certified CloudOps Engineer – Associate (SOA-C03) replaced SysOps Administrator. Format, cost, the five domains, what changed and how to prepare.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is Amazon EC2? Instances, AMIs, EBS and Auto ScalingAmazon EC2 explained: instances, AMIs, instance types, security groups, EBS, Auto Scaling groups and pricing options, with the traps AWS exams set.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.