SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a centralized logging account and multiple application accounts. Each application account sends CloudWatch Logs to a cross-account log group in the logging account. The security team wants to ensure that logs are encrypted at rest using a KMS key that only the logging account can manage. Which configuration is required?
⚠ Common exam trap
It's easy for candidates to confuse cross-account destinations (which require the destination to be in the logging account) with cross-account resource policies (which are placed in the source account), leading them to choose Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a cross-account destination in the logging account, configure subscription filters in source accounts, and attach a KMS key policy that allows CloudWatch Logs in source accounts to use the key.
It uses a cross-account destination in the logging account with subscription filters in the source accounts, which is the standard pattern for streaming CloudWatch Logs across accounts. The KMS key policy must grant the CloudWatch Logs service in the source accounts permission to use the key (via kms:Encrypt and kms:Decrypt) so that logs can be encrypted at rest in the logging account while only the logging account manages the key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use S3 replication with SSE-KMS to copy logs from source accounts to the logging account.
Why it's wrong here
Logs are in CloudWatch Logs, not S3.
- ✓
Create a cross-account destination in the logging account, configure subscription filters in source accounts, and attach a KMS key policy that allows CloudWatch Logs in source accounts to use the key.
Why this is correct
This enables cross-account log delivery with customer-managed KMS encryption.
- ✗
Create a cross-account destination in each source account and attach a resource policy that grants the logging account permission to write.
Why it's wrong here
Destination should be in the logging account, not source.
- ✗
Use the default AWS-managed KMS key for CloudWatch Logs in each source account.
Why it's wrong here
The security team wants the logging account to manage the key, not source accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.