DOP-C02 Monitoring and Logging Practice Question
A DevOps team is setting up centralized logging for a multi-account AWS environment. They want to aggregate logs from all accounts into a single S3 bucket. Which services should be used to achieve this? (Choose TWO.)
⚠ Common exam trap
It's easy for candidates to confuse Amazon Kinesis Data Firehose as a log aggregation service, but it is a delivery stream that requires a log source to send data to it, not a service that natively collects logs from multiple accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is correct because it can be configured to deliver log files from multiple accounts to a single S3 bucket by setting up a trail in the management account and using the 'Enable for all accounts in my organization' option, which automatically applies the trail to all member accounts in AWS Organizations. This centralizes CloudTrail logs without requiring per-account configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct primary service for multi-account log aggregation because it supports organization trails, which automatically capture API activity from every account in an AWS Organization and deliver the event history to a single centralized S3 bucket. This eliminates the need to configure individual trails per account, making it the native and most efficient solution for aggregating AWS API logs across accounts.
- ✗
AWS Config
Why it's wrong here
AWS Config is incorrect because it is a compliance and configuration auditing service, not a log aggregation service. It records configuration item changes and evaluates resources against specified rules, and while it can deliver configuration snapshots to S3, it does not aggregate operational or API logs from multiple accounts into a central location; its purpose is to track resource state, not to collect log events.
- ✓
Amazon CloudWatch Logs
Why this is correct
Amazon CloudWatch Logs is also correct for centralized logging because you can use subscription filters with cross-account log group subscriptions to stream logs from multiple accounts to a central account, or export log groups to a central S3 bucket. However, for capturing AWS API activity specifically, CloudTrail is the designated service, whereas CloudWatch Logs is more suited for application logs, custom metrics, and other non-API operational logs, and thus it is not the best single answer for API log aggregation.
- ✗
Amazon Kinesis Data Firehose
Why it's wrong here
Amazon Kinesis Data Firehose is wrong because it is a streaming data delivery service that loads data into destinations like S3, Redshift, or Splunk, but it does not natively aggregate or capture logs from multiple AWS accounts. To use Firehose, you would need CloudTrail or CloudWatch Logs to first deliver logs to the Firehose stream, making it an intermediary pipeline component rather than the primary aggregation service, and it adds unnecessary latency and cost for simple log centralization.
- ✗
Amazon S3 replication
Why it's wrong here
Amazon S3 replication is incorrect because it only copies already-existing S3 objects from one bucket to another for redundancy, compliance, or low-latency access, but it cannot collect logs from multiple accounts or services directly. The logs would have to be delivered to per-account S3 buckets first, then replication could copy them to a central bucket, which adds complexity and is not the intended method for initial log aggregation; it is a data duplication feature, not a log delivery service.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.