DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create IAM roles in each account to allow the central bucket to read logs.

  Why it's wrong here

  Creating IAM roles in each account to allow the central bucket to read logs is unnecessary and misdirected. The central bucket does not read logs; it receives writes from services like CloudTrail and VPC Flow Logs. Instead, you must attach a bucket policy to the central bucket granting the source accounts (or their services) s3:PutObject and s3:GetBucketAcl permissions. IAM roles would be needed for cross-account read access, not for write, and they don't configure the services themselves.

• ✓

  Create a bucket policy on the central S3 bucket that grants permissions to the source accounts.

  Why this is correct

  The central S3 bucket needs a resource-based policy that explicitly grants the source accounts' log-delivery services (e.g., CloudTrail, VPC Flow Logs) permission to write objects and read the bucket ACL. Without this bucket policy, cross-account writes from other accounts will be denied by default. The policy must reference the source account IDs or the organization ID and include conditions like aws:SourceAccount or aws:SourceArn to prevent confused deputy attacks. This is a mandatory step to enable centralized log collection.

• ✗

  Enable CloudTrail organization trail in the management account to deliver logs to the central bucket.

  Why it's wrong here

  Enabling a CloudTrail organization trail in the management account is not sufficient for all centralized logging requirements. It automatically delivers CloudTrail events from all member accounts to a single bucket, but it does not configure VPC Flow Logs, ALB access logs, or other service logs. Those services must be separately configured in each account to deliver to the same bucket, and the bucket policy must still allow writes. Moreover, if you already want centralized logging beyond CloudTrail, this option only addresses one log source.

• ✗

  Set up a cross-account subscription in CloudWatch Logs to forward logs to the central account.

  Why it's wrong here

  Setting up a cross-account subscription in CloudWatch Logs would require a Kinesis Data Stream or Lambda as the destination and is designed for streaming log data to a central account's CloudWatch Logs, not for delivering logs to S3. Since the goal is to have a central S3 bucket for long-term storage, this approach adds unnecessary complexity and does not directly enable S3 object delivery. It also does not replace the need for a bucket policy or per-service log delivery configuration.

• ✓

  Configure each account’s services (e.g., CloudTrail, VPC Flow Logs) to deliver logs to the central S3 bucket.

  Why this is correct

  Each source account must explicitly configure its services (CloudTrail, VPC Flow Logs, etc.) to send logs to the central S3 bucket. This involves specifying the target S3 bucket, setting appropriate bucket names and key prefixes, and ensuring the IAM permissions or service-linked roles allow the cross-account delivery. Without this per-account configuration, the log data never leaves the source account, regardless of any bucket policy.

Go deeper

Related to this question