DOP-C02 Monitoring and Logging Practice Question
A DevOps engineer is tasked with setting up a centralized logging solution for a multi-account AWS environment. Which service should be used to aggregate logs from multiple accounts?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Logs with cross-account subscription
Amazon CloudWatch Logs can aggregate logs across accounts using cross-account subscriptions with a central destination (e.g., Kinesis or Lambda). Option C is correct. Option A is incorrect because S3 is a storage service, not for real-time aggregation. Option B is incorrect as CloudTrail is for API activity, not application logs. Option D is incorrect because AWS Config is for configuration compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 with cross-region replication
Why it's wrong here
Amazon S3 is object storage, not a real-time log ingestion service. Cross-region replication (CRR) asynchronously copies existing objects between buckets, but it does not collect or aggregate logs from multiple accounts on its own. You would need external agents, Kinesis, or Lambda to push logs into S3, and CRR alone lacks subscription-based delivery and query capabilities for centralizing application logs.
- ✗
AWS CloudTrail with organization trails
Why it's wrong here
AWS CloudTrail organization trails aggregate management and data events across all accounts in an AWS Organization, but they record only AWS API activity and resource operations—not application-level logs such as runtime output, web server access, or framework logs. This makes CloudTrail suitable for auditing who made which API call, but not for a centralized application logging solution.
- ✓
Amazon CloudWatch Logs with cross-account subscription
Why this is correct
Amazon CloudWatch Logs cross-account subscriptions let you forward log events from multiple source accounts to a central destination (via a Kinesis Data Stream or Data Firehose) using subscription filters, enabling near-real-time aggregation of application logs. This is the correct pattern because it directly receives application log streams from existing CloudWatch Logs agents and routes them to a central account for storage and analysis.
- ✗
AWS Config with aggregated compliance rules
Why it's wrong here
AWS Config's aggregation feature consolidates configuration snapshots and compliance evaluations across accounts and regions, but it tracks resource configuration changes—not operational log data. Since it doesn't capture runtime application output, it cannot serve as a centralized log aggregation service; it is designed for compliance and configuration change management.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.