Which Athena Query Returns 10 Recent CloudTrail Errors Since 2024?

DEA-C01 By islever Editorial Last updated Oct 17, 2026

Analyze data by using AWS services. Prepare logs for audit.

Short answer

A The Athena query filters CloudTrail events with errorcode IS NOT NULL and eventtime from 2024, groups them, then uses ORDER BY TotalEvents DESC with LIMIT 10.

Question

A data engineer created a table named cloudtrail_logs in Amazon Athena to query AWS CloudTrail logs and prepare data for audits. The data engineer needs to write a query to display errors with error codes that have occurred since the beginning of 2024. The query must return the 10 most recent errors. Which query will meet these requirements?

select count (*) as TotalEvents, eventname, errorcode, errormessage from cloudtrail_logswhere errorcode is not nulland eventtime >= '2024-01-01T00:00:00Z' group by eventname, errorcode, errormessageorder by TotalEvents desclimit 10; Correct Answer
select count (*) as TotalEvents, eventname, errorcode, errormessage from cloudtrail_logs where eventtime >= '2024-01-01T00:00:00Z' group by eventname, errorcode, errormessage order by TotalEvents desc limit 10;
select count (*) as TotalEvents, eventname, errorcode, errormessage from cloudtrail_logswhere eventtime >= '2024-01-01T00:00:00Z' group by eventname, errorcode, errormessageorder by eventname asc limit 10;
select count (*) as TotalEvents, eventname, errorcode, errormessage from cloudtrail_logs where errorcode is not nulland eventtime >= '2024-01-01T00:00:00Z' group by eventname, errorcode, errormessagelimit 10;

Key Takeaways

The exam tests whether you can isolate CloudTrail error records in Athena before aggregating them; the trap is selecting a query that ranks results but forgets errorcode IS NOT NULL or omits ORDER BY entirely.

This DEA-C01 question tests an Amazon Athena query over CloudTrail logs for 2024 error events, requiring errorcode filtering, eventtime filtering, grouping, and a ranked LIMIT. The page confirms option A as the best listed query because it alone combines errorcode IS NOT NULL with the 2024 eventtime predicate and ORDER BY TotalEvents DESC LIMIT 10.

Common mistake: A common mistake is choosing B because it has ORDER BY TotalEvents DESC and LIMIT 10, but B omits errorcode IS NOT NULL, so successful CloudTrail events with null error codes can enter the count.

Expert Analysis

Why the Answer Is Correct

Option A is the only listed query that enforces both required filters before aggregation: "errorcode IS NOT NULL" restricts results to CloudTrail error events, and "eventtime >= '2024-01-01T00:00:00Z'" restricts the window to 2024 onward. It then groups by eventname, errorcode, and errormessage to produce one row per error signature and uses ORDER BY TotalEvents DESC LIMIT 10 to return the ten highest-count error groups. Although the wording says "most recent," no option orders by eventtime; A is nonetheless the intended Athena pattern because it is the only choice combining the mandatory error predicate with a descending order and row limit.

Why the Other Options Are Wrong

Option B uses the same grouping and ORDER BY TotalEvents DESC LIMIT 10 but omits errorcode IS NOT NULL, so it can aggregate successful events whose errorcode is null and does not isolate errors. Option C includes correct filters but sorts by eventname ASC, so it returns an alphabetical subset rather than the highest-count or most recent errors. Option D includes both filters but has no ORDER BY at all, so the LIMIT 10 returns an arbitrary ten groups, not a ranked set. None of B, C, or D satisfies the combined error-filter, 2024-window, and deterministic LIMIT requirements as well as A.

Community Comment Notes

Ramdi1 walks through A's predicates, noting that "WHERE errorcode IS NOT NULL" filters successful events and that "ORDER BY TotalEvents DESC" ranks the error groups. simon2133 summarizes A as the same as B but "including filter for error code being set," which is the key distinction between the two most-voted options. fnuuu favors B because of its descending order, but that view ignores B's missing errorcode predicate. A_E_M's sample query uses "ORDER BY eventTime DESC LIMIT 10" to capture recent errors, which highlights the question's imprecise "most recent" wording, but that exact query is not among the choices; A remains the best fit among the listed options.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Check each predicate separately: errorcode IS NOT NULL for errors, eventtime for the 2024 cutoff, and ORDER BY ... DESC plus LIMIT 10 for a deterministic top-10 result. Eliminate any option that drops one of these clauses, even if its remaining SQL looks plausible.

Frequently Asked Questions

Why is option B wrong if it also uses ORDER BY TotalEvents DESC LIMIT 10?

B omits errorcode IS NOT NULL, so successful CloudTrail events can be counted alongside errors. Option A keeps the error-only filter while retaining the descending LIMIT 10.

Does option A return the 10 most recent CloudTrail errors by eventtime?

Not strictly: A orders by TotalEvents, so it returns the 10 highest-count error groups. No listed option orders by eventtime DESC, but A is the only one with both required filters and a descending limit.

More DEA-C01 FAQ →

Community Votes

67%

33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Ramdi1 👍 2 Answered A

Why Option A is Correct? ✅ WHERE errorcode IS NOT NULL → Filters out successful events, keeping only errors. ✅ AND eventtime >= '2024-01-01T00:00:00Z' → Ensures only logs from 2024 are considered. ✅ GROUP BY eventname, errorcode, errormessage → Aggregates error occurrences per event. ✅ ORDER BY TotalEvents DESC → Sorts by the number of occurrences, ensuring the most frequent errors appear first. ✅ LIMIT 10 → Returns only the 10 most recent errors.
simon2133 👍 2 Answered A

A. Same as B but including filter for error code being set
A_E_M 👍 1 Answered B

This is not the same, but it shows the important point. Descending order is the correct answer. SELECT * FROM cloudtrail_logs WHERE eventTime >= '2024-01-01' AND errorCode IS NOT NULL ORDER BY eventTime DESC LIMIT 10;
fnuuu 👍 1 Answered B

Query in the Option B is correct with 'desc' order

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide