CloudWatch Logs quiz · Level 0 · Todo.io Learns AWS

Question 1How does output from Todo.io's containers on Fargate reach CloudWatch Logs?

Through the awslogs log driver set in the task definition, using the task execution role.Correct. Each container's output goes to a log stream in a log group you choose.Through CloudTrail.Not this one. CloudTrail records AWS API calls, not container output.By installing the CloudWatch agent on the host.Not this one. With Fargate you have no host to install anything on.By connecting to each task and copying the files.Not this one. There is no need; the log driver ships output as it happens.

Learn it: ECS and Fargate · CloudWatch Logs

Question 2Todo.io's Lambda function prints log lines, but nothing appears in CloudWatch Logs. What is the most likely cause?

Its execution role doesn't allow writing logs (such as logs:CreateLogStream and logs:PutLogEvents).Correct. Lambda sends output to CloudWatch Logs automatically, using the function's own role.Lambda can't send logs anywhere.Not this one. It sends them to CloudWatch Logs by default.The CloudWatch agent isn't installed.Not this one. The agent is for EC2. Lambda needs nothing installed.CloudTrail is turned off.Not this one. CloudTrail records API calls; it isn't where function output goes.

Learn it: Lambda · CloudWatch Logs

Question 3A user reports an error. Todo.io's engineers want to read what the app printed while handling that request. Where do they look?

Amazon CloudWatch Logs.Correct. Apps and AWS services send their log lines to CloudWatch Logs.AWS CloudTrail.Not this one. CloudTrail records AWS API calls, not your app's output.AWS Config.Not this one. Config records resource settings.The VPC route table.Not this one. Route tables record nothing.

Learn it: CloudWatch Logs

Question 4In CloudWatch Logs, what holds the logs for one app or one Lambda function?

A log group, with log streams inside it.Correct. You set retention and permissions on the log group.A bucket.Not this one. Buckets are S3.A trail.Not this one. Trails are CloudTrail.An organizational unit.Not this one. OUs group AWS accounts.

Learn it: CloudWatch Logs

Question 5Todo.io's logs are kept forever by default, and the bill keeps growing. It only needs 30 days. What should it do?

Set each log group's retention to 30 days.Correct. CloudWatch Logs then deletes older events for you.Delete old log lines by hand each month.Not this one. Retention does it automatically.Change CloudTrail's retention.Not this one. CloudTrail is a different service.Attach an SCP that limits logs.Not this one. SCPs limit API calls; they don't expire data.

Learn it: CloudWatch Logs

Question 6Todo.io's app on EC2 writes log files, but nothing shows up in CloudWatch Logs. What is needed?

Install the CloudWatch agent on the instance, and allow the instance's role to write logs.Correct. EC2 doesn't send logs by itself. Lambda and Fargate do, but an instance is your server.Nothing; EC2 sends every file automatically.Not this one. It sends nothing until the agent is set up.Turn on CloudTrail.Not this one. CloudTrail records API calls, not files on an instance.Open an inbound port on the instance.Not this one. The agent sends logs out; nothing needs to come in.

Learn it: EC2 (Elastic Compute Cloud) · CloudWatch Logs

Question 7Todo.io wants to be alerted when its app logs more than 10 ERROR lines in a minute. What should it set up?

A metric filter on the log group that counts ERROR lines, and a CloudWatch alarm on that metric.Correct. Logs become a number you can alarm on.A CloudTrail trail.Not this one. CloudTrail doesn't read app output.An AWS Config rule.Not this one. Config checks resource settings, not log lines.Someone reading the logs every morning.Not this one. That finds problems hours late.

Learn it: CloudWatch Logs

Question 8An EC2 instance in a public subnet sends its log lines to CloudWatch Logs. Which way do they travel?

Out through the internet gateway to CloudWatch Logs' public AWS endpoint.Correct. Like SQS and DynamoDB, CloudWatch Logs is a public AWS service, not something inside the VPC.They stay inside the VPC; CloudWatch Logs runs in every subnet.Not this one. It runs outside every customer VPC.Through the RDS database.Not this one. Logs don't pass through databases.Through an SQS queue.Not this one. The agent sends straight to CloudWatch Logs.

Learn it: VPC (Virtual Private Cloud) · CloudWatch Logs

Question 9Can Todo.io's CloudWatch Logs show who deleted the staging database?

No. Deleting a database is an AWS API call, which CloudTrail records. CloudWatch Logs holds what apps print.Correct. Don't mix them up: CloudTrail is who did what to AWS; CloudWatch Logs is what your software said.Yes, always.Not this one. Only if something happened to print it, and AWS API calls are not printed there.Only if the CloudWatch agent is installed.Not this one. The agent ships files from an instance; it doesn't see API calls.Only in CloudWatch metrics.Not this one. Metrics are numbers, not who did what.

Learn it: CloudWatch Logs · CloudTrail

Question 10Todo.io wants every log line from the last hour that mentions user u-123. What is the quickest way?

Search (or query with Logs Insights) the app's log group for the last hour.Correct. CloudWatch Logs can filter and query log events directly.Look up events in CloudTrail Event history.Not this one. CloudTrail has API calls, not app log lines.Check AWS Config.Not this one. Config has resource settings.Download every log file and search on a laptop.Not this one. It works, but it is slow and unnecessary.

Learn it: CloudWatch Logs

Question 11Todo.io's app logs each user's password when they sign in, to help with debugging. What should Todo.io do?

Stop logging passwords: anyone allowed to read the log group could read them.Correct. Logs are read by many people and kept for a long time. Secrets never belong in them.Nothing; log groups are encrypted, so it is safe.Not this one. Encryption protects the stored data, not what authorised readers see.Nothing; only the root user can read logs.Not this one. Anyone whose policy allows reading the log group can.Shorten retention to one day and carry on.Not this one. For a whole day, the passwords are still exposed.

Learn it: CloudWatch Logs

Question 12Inside a CloudWatch Logs log group, what is a log stream?

The sequence of log events from one source, such as one container or one Lambda instance.Correct. A log group holds many streams, one per source.Another name for a log group.Not this one. Streams sit inside a group.A CloudTrail trail.Not this one. Trails are CloudTrail.A real-time data stream for analytics.Not this one. That is a different service (Kinesis, Level 4).

Learn it: CloudWatch Logs

Question 13What does "CloudWatch Logs" mean?

Where applications and AWS services send their log lines.Correct. Think of it as: The building's logbook.A record of every AWS API call. Who did what, when, from where.Not this one. That describes CloudTrail.Records how your resources are configured over time and checks them against rules.Not this one. That describes AWS Config.Unlimited storage for files ("objects") in containers called buckets.Not this one. That describes S3 (Simple Storage Service).

Learn it: CloudWatch Logs

Question 14Which term is this? "Where applications and AWS services send their log lines."

CloudWatch LogsCorrect. Yes. Think of it as: The building's logbook.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets.

Learn it: CloudWatch Logs

Question 15Which AWS term is described by this analogy? "The building's logbook."

CloudWatch LogsCorrect. Yes: Where applications and AWS services send their log lines.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where. Its analogy: The building's CCTV and visitor book.AWS ConfigNot this one. AWS Config is: Records how your resources are configured over time and checks them against rules. Its analogy: A building inspector with a notebook and a camera.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets. Its analogy: A warehouse of labelled boxes you can reach from anywhere.

Learn it: CloudWatch Logs

CloudWatch Logs

Worth another look

Your weak spots

Services

Concepts