An application writes its logs to an Amazon CloudWatch Logs log group, and each authentication failure produces a log line containing the token AuthFailure. The security team wants to be notified through Amazon SNS whenever more than fifty such failures occur within any five-minute window, and they want to reuse the log data already in CloudWatch Logs rather than stand up a separate pipeline. Which TWO actions together deliver this alerting? (Select TWO.)
- ASchedule a CloudWatch Logs Insights query every five minutes that counts AuthFailure lines and sends the count to the security team through Amazon SNS.
- BCreate a CloudWatch Logs metric filter on the log group that matches the AuthFailure token and increments a custom CloudWatch metric for each matching log event. Correct
- CAdd a subscription filter on the log group that streams matching events to an AWS Lambda function which tallies failures and publishes to Amazon SNS once fifty are seen.
- DCreate a CloudWatch alarm on the metric that the filter produces, set its threshold above fifty over a five-minute period, and target the Amazon SNS topic. Correct
Why A is wrong: A scheduled Logs Insights query can count the lines and is tempting because it reuses the same data, but it relies on periodic polling, adds query cost, and reacts on a timer rather than driving a native alarm threshold.
Why B is correct: A metric filter scans incoming log events for the pattern and turns matches into a numeric metric, which is the native way to convert log lines into a measurable signal without a separate consumer.
Why C is wrong: A subscription filter into Lambda could count and notify and feels close, but it introduces function code and state to maintain when a metric filter plus alarm already counts and thresholds natively.
Why D is correct: An alarm evaluating the filter metric over a five-minute period fires when the count exceeds fifty and publishes to the SNS topic, delivering the threshold-based notification the team needs.