DOP-C02 Monitoring and Logging Practice Question
A company has a multi-account AWS environment using AWS Organizations. The security team needs to centrally monitor and analyze VPC Flow Logs from all accounts. The solution must be cost-effective and allow querying across accounts. Which approach should they take?
⚠ Common exam trap
The trap here is that candidates may overestimate the complexity of cross-account S3 access or underestimate the cost of CloudWatch Logs ingestion, leading them to choose Option D (central CloudWatch Logs group) which seems simpler but is actually more expensive and less query-friendly than S3+Athena.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.
It uses a centralized Amazon S3 bucket to aggregate VPC Flow Logs from all accounts, which is cost-effective (S3 storage costs are low) and enables cross-account querying via Amazon Athena using standard SQL. This approach avoids per-ingestion costs of services like CloudWatch Logs or Kinesis and provides a serverless, scalable query engine for analyzing logs across accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon Elasticsearch Service (Amazon OpenSearch Service) with a cross-account ingestion pipeline.
Why it's wrong here
Amazon OpenSearch Service with a cross-account ingestion pipeline is wrong because it forces you to run a dedicated Elasticsearch/OpenSearch cluster, provision instances, and manage index lifecycle, shards, and replication—creating significant operational overhead and cost. VPC Flow Logs are high-volume and typically queried infrequently for ad-hoc investigations, so the always-on compute cost of OpenSearch is wasteful compared to serverless options. Additionally, building a cross-account ingestion pipeline (e.g., using Logstash, Firehose, or Lambda) adds complexity and latency, and OpenSearch is optimized for free-text search and log analytics—not for SQL-based historical queries on tabular flow logs.
- ✗
Stream VPC Flow Logs from each account to Amazon Kinesis Data Analytics for real-time analysis.
Why it's wrong here
Streaming VPC Flow Logs to Amazon Kinesis Data Analytics for real-time analysis is wrong because Kinesis Data Analytics processes live streams with SQL or Apache Flink; it does not provide a persistent, queryable store for historical data. VPC Flow Logs are most valuable after-the-fact for security and troubleshooting, which requires storing and querying months of logs—not just analyzing a live window. Running a continuous analytics pipeline incurs 24/7 stream processing costs, and you would still need to sink the logs to S3 or another store for durable historical querying, making this approach expensive and redundant for the stated need.
- ✓
Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.
Why this is correct
Sending VPC Flow Logs from each account to a centralized Amazon S3 bucket is correct because it creates a single, durable, cost-effective data lake that scales to petabytes. You configure each account's VPC Flow Logs to deliver to the same S3 bucket (with a bucket policy allowing cross-account delivery, ideally scoped to your AWS Organization ID). Then Amazon Athena can query these logs directly using standard SQL, with per-query pricing and no server to manage; using partition projection on account, region, and date drastically reduces scan costs and speeds up investigations.
- ✗
Configure each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription.
Why it's wrong here
Configuring each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription is wrong because it is operationally complex, requiring careful IAM and Kinesis or Lambda setup to forward logs across accounts, and it couples all accounts to a single account's resource limits. CloudWatch Logs ingestion and storage costs are significantly higher than S3, and its built-in Logs Insights query engine is not optimized for massive, cross-account ad-hoc scans of historical flow logs. The subscription model introduces real-time ingestion bottlenecks, potential log loss during throttling, and it lacks the flexible SQL querying and partition pruning that Athena offers on S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.