DOP-C02 Incident and Event Response Practice Question
A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all accounts automatically forward their CloudWatch Logs to a central logging account. Which solution should the team implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets to deploy a subscription filter and Lambda function in each account
AWS CloudFormation StackSets allows you to deploy infrastructure components across multiple accounts and regions in an AWS Organization. In this case, you can create a StackSet that includes a CloudWatch Logs subscription filter and a Lambda function to forward logs from each account to a central logging account. The subscription filter triggers the Lambda function to forward logs to a destination in the central account. This ensures all accounts automatically forward their CloudWatch Logs. Option A is incorrect because AWS Config aggregator aggregates configuration and compliance data, not logs. Option B is incorrect because AWS Service Catalog is used to create and manage IT service catalogs for approved products, not for log forwarding. Option D is incorrect because AWS Organizations does not have a native capability to forward logs; it manages policies and account structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS Config aggregator in the central account
Why it's wrong here
AWS Config aggregator is designed to aggregate configuration items, compliance statuses, and resource snapshots from multiple accounts into a single administrator account. It does not ingest or forward raw log data such as CloudTrail events, VPC Flow Logs, or application logs. Therefore, while it provides centralized visibility into resource state, it cannot serve as a mechanism to collect and forward actual log records to a central processing pipeline.
- ✗
Use AWS Service Catalog to create a product for log forwarding
Why it's wrong here
AWS Service Catalog lets organizations create and manage curated IT service catalogs that users can provision, but provisioning is typically initiated manually by an end user or requires additional orchestration. Simply creating a Service Catalog product for a log-forwarding stack does not automatically deploy that stack across all accounts in an organization. Without an automated trigger or integration like StackSets, the log-forwarding resources would remain unprovisioned or require per-account manual execution, making it unsuitable for an automated multi-account log-forwarding solution.
- ✓
Use AWS CloudFormation StackSets to deploy a subscription filter and Lambda function in each account
Why this is correct
AWS CloudFormation StackSets extends CloudFormation to deploy stacks across multiple accounts and regions within AWS Organizations, automatically and in a single operation. You can define a template containing a CloudWatch Logs subscription filter and a Lambda function, and StackSets will create those resources in every member account. The subscription filter streams selected log events from each account's log groups to the Lambda function, which then processes and forwards them to a centralized destination such as an S3 bucket, Kinesis, or a central CloudWatch account. This approach is fully automated, consistent, and the recommended pattern for centralized log forwarding.
- ✗
Configure AWS Organizations to automatically forward logs
Why it's wrong here
AWS Organizations is a governance service for centrally managing multiple AWS accounts, creating accounts, applying service control policies, and enabling consolidated billing. It has no built-in feature that intercepts, forwards, or routes log data from member accounts to a central location. While you can use organization trails with AWS CloudTrail to aggregate management events, that is a separate service feature and only covers CloudTrail logs, not all log types. Thus, simply configuring AWS Organizations itself will not forward logs from individual accounts.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.