The correct option is Install the CloudWatch agent on the data center servers and configure an IAM user's access key and secret key that allow publishing metrics and logs to CloudWatch. This approach lets you stream on premise host metrics and application logs into CloudWatch so they are aggregated with your EC2 telemetry.

This option is correct because on premise servers cannot use EC2 instance profiles so the CloudWatch agent must authenticate with credentials that are not tied to an EC2 instance. By deploying Install the CloudWatch agent on the data center servers and configure an IAM user's access key and secret key that allow publishing metrics and logs to CloudWatch you grant a specific IAM identity the CloudWatch and CloudWatch Logs permissions and the agent provides built in collection, buffering, and retry behavior for reliable delivery.

Build a scheduled script that gathers metrics and log files and uploads them to CloudWatch with the AWS CLI is inferior because it requires custom maintenance and it lacks the integrated collection features and resilience that the CloudWatch agent provides.

Register the servers as AWS Systems Manager hybrid managed instances so the CloudWatch agent can assume the Systems Manager role to send data to CloudWatch is incorrect because registering as a hybrid managed instance does not remove the need for valid credentials for CloudWatch API calls and the CloudWatch agent still requires an authenticated IAM identity to publish data.

Install the CloudWatch agent on the data center servers and attach an IAM role with CloudWatch permissions to those machines is not possible because IAM roles and instance profiles can only be attached to AWS resources such as EC2 instances and cannot be applied to physical on premise servers.

Full AWS Practitioner Certification Question