SOA-C02 Practice Question 2: Logs Metric Filter Alarm
AWS Certified SysOps Administrator – Associate (SOA-C02) · Test 1 · question 2 of 10
An application already streams its logs to an Amazon CloudWatch Logs log group. A SysOps administrator must send an Amazon SNS notification whenever the string ERROR appears in those logs more than five times within any 5-minute window. The solution must not require any additional compute resources to operate or maintain.
Which approach meets these requirements?
Show answer and explanation
Answer:
A metric filter is the purpose-built, serverless way to turn log text into a CloudWatch metric. The filter pattern matches incoming events as they are ingested and emits a metric data point (commonly a value of 1 per match). A standard CloudWatch alarm on the Sum statistic over a 5-minute period with a threshold greater than five then fires an SNS action. Nothing has to be provisioned or patched.
Option A is wrong because CloudWatch Logs Insights is an interactive, ad hoc query engine. Its queries are not a scheduled alarm source and cannot publish to SNS on their own.
Option B would work functionally, but it adds a Lambda function that must be written, permissioned, monitored, and maintained, exactly the additional operational component the stem rules out. Metric filters solve the same problem natively.
Option D is wrong because Contributor Insights identifies the top contributors to a log stream (for example the noisiest IP addresses). It is an analysis view, not a threshold-based notification mechanism for a specific string.