DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CloudWatch Logs must be encrypted with the same KMS key in both accounts.

  Why it's wrong here

  CloudWatch Logs encryption with AWS Key Management Service (KMS) is an optional configuration, not a mandatory requirement for sending logs, even in a cross-account scenario. Logs can be stored unencrypted or utilize AWS-managed encryption keys by default. Furthermore, if KMS encryption is enabled for a log group, each account can independently manage and use its own distinct KMS key; there is no technical necessity or requirement for both the source and destination accounts to share or use the same KMS key for their respective log storage.

• ✓

  The central account's log group must have a resource-based policy that grants the App Account's IAM role permissions to put logs.

  Why this is correct

  For successful cross-account logging, the destination CloudWatch Logs log group in the central account absolutely requires a resource-based policy. This policy must explicitly grant the `logs:PutLogEvents` permission to the specific IAM role or user from the application account that will be sending the logs. Without this explicit permission defined directly on the log group resource, the application account's IAM principal, even with local `logs:PutLogEvents` permissions, will be denied access to write to a log group owned by a different AWS account, establishing the necessary trust boundary.

• ✗

  The log group must be in the same region as the EC2 instances.

  Why it's wrong here

  CloudWatch Logs fully supports cross-region logging, meaning EC2 instances can send their logs to a log group located in a different AWS region than the instances themselves. While configuring the CloudWatch agent to target a different region requires specifying the desired region in its configuration, this is a standard and supported capability. Therefore, stating that the log group *must* be in the same region as the EC2 instances is incorrect and imposes an unnecessary architectural constraint.

• ✗

  The EC2 instances must be in a VPC with a VPC endpoint for CloudWatch Logs.

  Why it's wrong here

  EC2 instances can send logs to CloudWatch Logs over the public internet by default, provided they have outbound network connectivity and the necessary IAM permissions. A VPC endpoint for CloudWatch Logs is an optional feature that allows instances within a private VPC to communicate with the CloudWatch Logs service entirely within the AWS network, bypassing the internet gateway. While VPC endpoints offer benefits like enhanced security and reduced data transfer costs, they are not a mandatory requirement for logging functionality.

Go deeper

Related to this question