Question 738 of 256
Centralized Logging Across AWS Accounts to S3
A DevOps team is designing a centralized logging solution for multiple AWS accounts. The team needs to collect logs from EC2 instances, Lambda functions, and VPC Flow Logs, and store them in a central account for analysis. The solution must be cost-effective and support near real-time log aggregation. Which THREE steps should the team take? (Choose three.)
Quick Answer
The answer is to use CloudWatch cross-account subscription, Kinesis Data Firehose, and Athena. This combination works because CloudWatch cross-account subscription streams logs from source accounts into a central account’s log group, then Kinesis Data Firehose buffers and delivers that data to S3 at low cost, while Athena provides serverless querying directly on the S3 objects—enabling near real-time aggregation without expensive infrastructure. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of centralized logging across AWS accounts to S3, specifically how to avoid common traps like assuming VPC Flow Logs or Lambda logs can deliver directly to S3 in real time (they cannot) or defaulting to OpenSearch, which is overkill for cost-effective storage. A key memory tip is “Stream, Buffer, Query”: CloudWatch streams, Firehose buffers, Athena queries—never try to skip the buffer step for near real-time needs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deliver logs from the central account's CloudWatch Logs to Amazon Kinesis Data Firehose, which writes to Amazon S3.
Options B, D, and E are correct. CloudWatch cross-account subscription (Option E) allows streaming logs from source accounts to a central account's CloudWatch Logs for near real-time aggregation. From the central account, logs can be delivered to Amazon Kinesis Data Firehose (Option B), which buffers and writes them to Amazon S3 at low cost. Amazon Athena (Option D) can then query the S3 logs for analysis, supporting cost-effective ad-hoc queries. Option A is incorrect because VPC Flow Logs cannot be delivered directly to a Lambda function; they are delivered to CloudWatch Logs or S3. Option C (Amazon OpenSearch Service) is not one of the three required steps because the question specifies cost-effective storage and near real-time aggregation, and OpenSearch adds unnecessary cost and complexity for storage; the proposed solution uses S3 for cost-effective storage and Athena for querying.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure VPC Flow Logs to deliver to a Lambda function in each account, which forwards logs to the central account.
Why it's wrong here
Lambda is not a native destination for VPC Flow Logs; also, this adds complexity and cost.
- ✓
Deliver logs from the central account's CloudWatch Logs to Amazon Kinesis Data Firehose, which writes to Amazon S3.
Why this is correct
Kinesis Data Firehose provides near real-time delivery to S3 at low cost.
- ✗
Use Amazon OpenSearch Service to index and search the logs in near real time.
Why it's wrong here
OpenSearch is more expensive and adds operational overhead; not required for cost-effective solution.
- ✓
Use Amazon Athena to query the logs stored in S3 for analysis.
Why this is correct
Athena allows serverless SQL queries on S3 data, enabling cost-effective analysis.
- ✓
Use CloudWatch cross-account subscription to stream logs from source accounts to a central account's CloudWatch Logs.
Why this is correct
Cross-account subscription enables real-time log streaming to a central account.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps engineer needs to set up a centralized logging solution for multiple AWS accounts. The logs must be stored in a central Amazon S3 bucket for long-term retention and analysis. Which combination of services should the engineer use?
easy- A.Use AWS CloudTrail to deliver logs to the central S3 bucket.
- B.Use Amazon Athena and Amazon QuickSight to query logs across accounts.
- ✓ C.Use Amazon CloudWatch Logs and Amazon Kinesis Data Firehose to deliver logs to the central S3 bucket.
- D.Use Amazon VPC Flow Logs to send logs to the central S3 bucket.
Why C: Amazon CloudWatch Logs can collect logs from various AWS services and applications. To centralize logs from multiple accounts into a single S3 bucket, you can use subscription filters to deliver log events to Amazon Kinesis Data Firehose, which then streams the data to the central S3 bucket. Alternatively, you can use CloudWatch Logs export tasks. This combination enables centralized logging. Option A is incorrect because CloudTrail only captures API activity, not application or system logs. Option B is incorrect because Athena and QuickSight are analytics services, not log ingestion services. Option D is incorrect because VPC Flow Logs capture only network traffic metadata, not all logs.
Variation 2. A DevOps engineer is setting up centralized logging for multiple AWS accounts. They need to collect VPC Flow Logs, CloudTrail logs, and application logs into a single Amazon S3 bucket. What is the most efficient approach?
medium- A.Configure a Lambda function in each account to copy logs to a central S3 bucket.
- B.Create an S3 bucket in each account and use S3 replication.
- C.Use Amazon Kinesis Data Firehose to stream logs from all accounts to a central S3 bucket.
- ✓ D.Use an S3 bucket in a centralized logging account with a bucket policy that grants write access from all other accounts.
Why D: It uses a centralized logging account with a single S3 bucket configured with a bucket policy that grants write access (s3:PutObject) to all other accounts. This approach avoids data duplication, eliminates the need for replication or intermediate compute resources, and is the most efficient and cost-effective method for aggregating logs from multiple accounts into a single destination.
Last reviewed: Jun 20, 2026
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.