Overview
Monitoring and Logging has three task statements. The first covers collection and storage: secure log storage, metric filters, CloudWatch metric streams to Amazon S3 or Firehose, custom metrics from the CloudWatch agent, retention and S3 lifecycle rules, subscription filters to Kinesis, Lambda or OpenSearch Service, searching with filter patterns or CloudWatch Logs Insights, and KMS encryption of log groups. The second covers analysis with dashboards, Amazon Quick Sight, alarms, AWS X-Ray tracing, Kinesis Data Streams and Amazon Athena.
The third task statement covers automation: auto scaling for DynamoDB, EC2, RDS storage and ECS, custom metrics with alarms and SNS or Lambda notifications, S3 event processing of log files, EventBridge rules, SSM Agent and CloudWatch agent installation, AWS Config remediation, and Route 53 or ALB health checks.
How it's tested
Domain 4 questions describe a visibility gap, a log volume or retention problem, or a need to react automatically to a signal. You choose the collection method, storage target, analysis tool or alarm and event wiring that delivers the data with the least custom code and correct latency.
-
Route the log data
Logs must reach another account, store or tool, and you choose subscription filters, Firehose, metric streams or S3 exports.
-
Pick the analysis tool
An investigation or report is needed, and you choose Logs Insights, Athena, X-Ray, OpenSearch Service or dashboards.
-
Wire the reaction
A metric or event must trigger action, and you choose alarms, EventBridge rules, SNS, Lambda or Config remediation.
A team must count HTTP 500 errors in application logs and alarm when they exceed 20 per minute. Exporting logs to S3 and querying with Athena adds delay and does not create an alarm. A CloudWatch Logs metric filter matching the status code publishes a metric continuously, and a CloudWatch alarm on that metric notifies through SNS, so the metric filter is the answer.
Task statements 3
Official task statements from the Amazon Web Services outline, in outline order.
4.1 Configure the collection, aggregation, and storage of logs and metricsSecure storage, metric filters, metric streams, custom metrics, lifecycle, subscriptions, search and encryption.
- What it means
- This task covers storing logs securely, creating metrics from log events with metric filters, streaming metrics to S3 or Firehose with metric streams, collecting custom metrics with the CloudWatch agent, managing retention and S3 lifecycles, routing logs with subscription filters to Kinesis, Lambda or OpenSearch Service, searching with filter patterns or Logs Insights, and encrypting log groups with AWS KMS.
- What to understand
- Log groups keep data forever unless retention is set, so retention is a cost control. Subscription filters stream log events in near real time, and cross-account delivery uses a destination in the receiving account. Metric streams send metrics continuously, unlike periodic API polling. KMS key policies must allow the CloudWatch Logs service principal before a log group can use the key.
- How it shows up
- Logs or metrics must be collected, centralized, kept or protected, and you choose the mechanism.
- Common confusion
- Confusing metric filters, which create metrics, with subscription filters, which forward raw log events.
4.2 Audit, monitor, and analyze logs and metrics to detect issuesDashboards, Quick Sight, alarms, X-Ray, real-time streams and log analytics.
- What it means
- This task covers building CloudWatch dashboards and Amazon Quick Sight visuals, attaching alarms to standard and custom metrics, configuring AWS X-Ray for containers, API Gateway and Lambda, analyzing real-time log streams with Kinesis Data Streams, and querying logs with Amazon Athena or CloudWatch Logs Insights.
- What to understand
- Logs Insights queries a log group directly with its own query language and suits fast troubleshooting. Athena queries logs stored in S3 with SQL and suits large historical analysis such as CloudTrail or ALB logs. X-Ray traces requests across services through the SDK, the X-Ray daemon or the AWS Distro for OpenTelemetry collector. Composite alarms combine several alarms to reduce noise.
- How it shows up
- A problem must be found or explained, and you pick the analysis or tracing tool that fits the data's location.
- Common confusion
- Using Athena for logs still in CloudWatch Logs, or Logs Insights for archives already in S3.
4.3 Automate monitoring and event management of complex environmentsAuto scaling setup, custom metrics and alarms, S3 log events, EventBridge, agents, Config remediation and health checks.
- What it means
- This task covers configuring auto scaling for DynamoDB, EC2 Auto Scaling groups, RDS storage and ECS capacity providers, building custom metrics, metric filters, alarms and SNS or Lambda notifications, processing log files with S3 event notifications, sending EventBridge notifications on event patterns, installing SSM Agent and the CloudWatch agent, remediating with AWS Config rules, and configuring Route 53 and ALB health checks.
- What to understand
- EventBridge rules match event patterns from AWS services and route them to targets such as SNS, Lambda, Step Functions or Systems Manager Automation. AWS Config remediation actions run Automation documents, manually or automatically. Systems Manager can install and configure the CloudWatch agent across a fleet using a configuration stored in Parameter Store.
- How it shows up
- A recurring condition needs an automatic response, and you choose the event source, rule and target.
- Common confusion
- Polling APIs with a scheduled Lambda when an EventBridge rule could react to the event as it happens.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Metric filter
Turns matching log events into a CloudWatch metric.
- Remember
- Applies only to new events after creation.
- Tested as
- Alarming on log content.
- Trap
- Expecting it to backfill historical logs.
-
Subscription filter
Streams log events to Kinesis, Firehose, Lambda or OpenSearch Service.
- Remember
- Cross-account delivery uses a log destination.
- Tested as
- Centralized log pipelines.
- Trap
- Mixing it up with a metric filter.
-
Metric streams
Continuous metric delivery through Firehose.
- Remember
- Feeds S3 or third-party tools.
- Tested as
- Exporting metrics at scale.
- Trap
- Polling GetMetricData in a loop.
-
CloudWatch agent
Collects OS-level metrics and log files.
- Remember
- Needed for memory and disk metrics.
- Tested as
- Custom metric questions.
- Trap
- Thinking SSM Agent publishes these metrics.
-
CloudWatch Logs Insights
Interactive query language over log groups.
- Remember
- Fast ad hoc troubleshooting.
- Tested as
- Analysis tool choice.
- Trap
- Using it on data already archived to S3.
-
Amazon Athena
Serverless SQL over data in S3.
- Remember
- Partitioning cuts scan cost.
- Tested as
- Historical log analysis.
- Trap
- Querying CloudWatch log groups directly.
-
AWS X-Ray
Distributed tracing with service maps.
- Remember
- Lambda and API Gateway need active tracing enabled.
- Tested as
- Latency and dependency questions.
- Trap
- Searching logs when a trace is needed.
-
Log group retention
Sets how long log events are kept.
- Remember
- Default is never expire.
- Tested as
- Storage cost questions.
- Trap
- Leaving infinite retention on noisy groups.
-
KMS-encrypted log groups
Log data encrypted with a customer managed key.
- Remember
- Key policy must allow the Logs service.
- Tested as
- Log security questions.
- Trap
- Associating a key without updating its policy.
-
EventBridge rules
Match event patterns and route to targets.
- Remember
- Can also run on schedules.
- Tested as
- Event-driven automation.
- Trap
- Using CloudTrail alone to trigger actions.
-
Composite alarms
Alarm state built from other alarms.
- Remember
- Reduces alert noise.
- Tested as
- Alert fatigue scenarios.
- Trap
- Creating many separate alarm notifications.
-
AWS Config remediation
Runs Automation documents on noncompliant resources.
- Remember
- Can be automatic with retries.
- Tested as
- Self-healing configuration.
- Trap
- Writing custom Lambda code for every fix.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Log processing paths
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Metric filter | Log pattern to metric | Produces numbers, not events | Expecting raw logs downstream |
| Subscription filter | Near real-time event stream | Forwards raw events | Using it only for counts |
| S3 export | Batch export of a log group | Not real time | Choosing it for live alerting |
Analysis tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Logs Insights | Queries CloudWatch log groups | Data stays in CloudWatch | Using it for S3 archives |
| Athena | SQL over S3 data | Pay per data scanned | Skipping partitions on large logs |
| X-Ray | Request traces across services | Shows latency per segment | Expecting it to analyze log text |
| OpenSearch Service | Search and dashboards over indexed logs | Full-text search at scale | Choosing it for simple counts |
Agents on EC2
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| CloudWatch agent | Sends metrics and logs | Memory, disk, custom logs | Assuming it is preinstalled |
| SSM Agent | Enables Systems Manager | Run Command, patching, sessions | Expecting it to send memory metrics |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Metric filter backfill
- What candidates pick
- Create a metric filter to report last week's errors.
- Why it looks right
- The filter matches the right pattern.
- Why it's wrong
- Metric filters only evaluate events ingested after creation, so past data needs Logs Insights.
Clue to watch for Question asks about historical log data.
-
SSM Agent for memory
- What candidates pick
- Rely on SSM Agent to publish memory utilization.
- Why it looks right
- SSM Agent is already installed on many AMIs.
- Why it's wrong
- Memory and disk metrics come from the CloudWatch agent, which Systems Manager can install.
Clue to watch for Missing memory or disk metric.
-
Athena on log groups
- What candidates pick
- Point Athena at a CloudWatch log group.
- Why it looks right
- Athena is the SQL log tool.
- Why it's wrong
- Athena reads S3 data; logs must be exported or delivered to S3 first, or use Logs Insights.
Clue to watch for Logs are still in CloudWatch Logs.
-
Cross-account logs with keys
- What candidates pick
- Give a central account access keys to read every log group.
- Why it looks right
- It seems direct.
- Why it's wrong
- Subscription filters with a cross-account destination push logs without sharing long-lived credentials.
Clue to watch for Centralize logs from many accounts.
-
Alarm on each instance
- What candidates pick
- Create separate alarms per instance for fleet errors.
- Why it looks right
- Granular alarms feel thorough.
- Why it's wrong
- Aggregate metrics or composite alarms scale better and reduce notification noise.
Clue to watch for Large or changing fleets.
-
CloudTrail as a trigger
- What candidates pick
- Use CloudTrail by itself to start remediation.
- Why it looks right
- CloudTrail records the API call.
- Why it's wrong
- CloudTrail records events; an EventBridge rule or Config rule must act on them.
Clue to watch for Requirement to respond automatically.
Answer framework
Use these steps when a question asks how to collect, analyze or act on logs and metrics.
- Identify the signal type: metric, log event, trace or AWS service event, and where it originates today.
- Decide the latency needed, since real-time needs subscription filters or EventBridge while reporting can use S3 and Athena.
- Choose the destination and analysis tool that fits the data's location, such as Logs Insights for log groups or Athena for S3.
- Add the reaction path: alarm, composite alarm, EventBridge rule or Config remediation, with SNS, Lambda or Automation as the target.
- Check retention, encryption and cross-account access so the design is secure, affordable and centrally viewable from one monitoring account for the whole organization.
Practice question
Want more like this? The DOP-C02 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Build a small logging pipeline end to end. Send application logs from an EC2 instance using the CloudWatch agent, add a metric filter and an alarm, then add a subscription filter that streams the same log group to Firehose and S3. Query the S3 copy with Athena and the live log group with Logs Insights, and note when each is the better tool.
Then add tracing and events. Enable X-Ray on a Lambda function behind API Gateway, read the service map, and create an EventBridge rule that reacts to an EC2 state change or an AWS Health event by sending an SNS notification. Attach an automatic remediation to a Config rule, for example one that turns on S3 bucket encryption.
Finally, practice the multi-account version: a central logging account with a cross-account destination and a KMS-encrypted log group. Many DOP-C02 questions in this domain hinge on that pattern, so be able to sketch it from memory.
FAQ
How much of the DOP-C02 exam is Monitoring and Logging?
Monitoring and Logging is 15% of scored content, which suggests about 10 of the 65 scored questions on the exam.
Do I need to know CloudWatch Logs Insights syntax?
Know what common commands such as fields, filter, stats and sort do. You will not write long queries, but recognizing a sensible query helps.
Did Kinesis Data Firehose get renamed?
Yes. AWS renamed Kinesis Data Firehose to Amazon Data Firehose in 2024. The exam guide still uses the older name in places.
Is OpenTelemetry covered?
The guide names AWS X-Ray. The AWS Distro for OpenTelemetry can send traces to X-Ray, so knowing that connection is useful, but X-Ray concepts come first.
What about Amazon Managed Grafana and Managed Service for Prometheus?
They can appear as monitoring options for container workloads. Focus first on CloudWatch, X-Ray and the services the task statements name.
Which health checks matter?
Route 53 health checks drive DNS failover and ALB target group health checks remove failed targets. Know both, and how Auto Scaling can use ELB health checks to replace instances.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have covered log collection, analysis and automated monitoring. Find out whether you can choose the right CloudWatch feature under exam timing.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the DOP-C02 AI tutor Get any concept explained your way