DOP-C02 Log and Metric Collection Guide

Study DOP-C02 log and metric collection for ingestion, custom metrics, retention, subscriptions, and storage.

DOP-C02 collection questions are about building a telemetry pipeline that is useful, secure, and maintainable. The exam is not impressed by “turn on every log.” It wants the right signals, in the right place, with the right retention and downstream path.

What AWS is testing in this task

The current AWS domain guidance points to:

  • collection of application and infrastructure metrics
  • real-time log ingestion
  • custom metrics
  • metric streams
  • log subscriptions and downstream processing
  • retention and lifecycle control
  • secure storage and permissions for telemetry

That means the question is often less about one service name and more about how raw signals move through the platform.

Telemetry pipeline mental model

Break the problem into four stages:

  1. Generate the signal
  2. Collect it securely
  3. Store it for the required retention window
  4. Forward it to the place where it will be searched, aggregated, or acted on

Weak answers skip straight from “service emits logs” to “team can investigate incidents” without designing the middle.

Strong collection patterns

Requirement Strongest first fit Why
Need standard infrastructure metrics and logs from EC2 CloudWatch agent with scoped permissions Clear path for system-level telemetry
Need to turn log events into alarmable metrics Metric filters on log data Converts raw log lines into actionable signals
Need near-real-time downstream processing Log subscriptions or metric streams to the right destination Keeps the processing path event-driven
Need long retention with cheaper storage Lifecycle-aware storage pattern Retention is part of the design, not an afterthought

Retention and cost matter

DOP-C02 questions like to separate operational usefulness from cost discipline. If the workload needs short-lived hot search and long-lived archival evidence, the strongest answer often uses different storage or lifecycle behavior for those needs.

If a choice keeps everything in the most expensive hot store forever, it is usually too blunt.

Secure telemetry collection

Logs and metrics can contain sensitive operational data. Strong answers usually include:

  • scoped IAM roles for agents and pipelines
  • encryption at rest and in transit where relevant
  • controlled subscription and export paths
  • retention settings that match policy, not convenience

If the solution creates broad access to raw logs or lets every workload publish anywhere, it is often too weak for DOP-C02.

Common traps

  • collecting logs without deciding how they will become metrics or investigations
  • emitting custom metrics for everything instead of only for decisions that need fast signal
  • forgetting lifecycle settings on log groups or downstream storage
  • using one giant undifferentiated sink for all telemetry without search or routing strategy

Fast decision rule

When the question is about getting telemetry in, think source, agent, storage, lifecycle, and downstream subscription path. Do not jump to dashboards or alarms until the signal pipeline is correct.

Revised on Monday, June 15, 2026