The answer is AWS CloudTrail, specifically using its organization trail feature to centralize VPC Flow Logs, CloudTrail, and DNS logs from multiple accounts into a single S3 bucket. This works because CloudTrail, when enabled for an AWS Organizations management account, can automatically aggregate logs from all member accounts without needing additional infrastructure or third-party tools. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of CloudTrail’s cross-account log delivery capabilities versus services like Amazon S3 replication or AWS Config, which are not designed for this specific aggregation. A common trap is assuming you need a separate logging service or complex Lambda functions, but the organization trail handles it natively. Memory tip: think “CloudTrail is the trailblazer for multi-account log centralization”—it’s the single service that can collect VPC, CloudTrail, and DNS logs into one bucket when paired with AWS Organizations.
SAP-C02 Practice Question: Design Solutions for Organizational Complexity
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is designing a centralized logging solution for multiple AWS accounts. They need to aggregate VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts into a single S3 bucket. Which AWS service should be used to centralize the log collection?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket by setting up a trail in the management account and using CloudTrail's organization trail feature. This automatically aggregates VPC Flow Logs, CloudTrail logs, and DNS logs from all member accounts into the designated centralized S3 bucket without requiring additional infrastructure.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Amazon S3 cross-region replication
Why it's wrong here
Replication copies objects after they are delivered, not collect them.
✗
Amazon Kinesis Data Firehose
Why it's wrong here
Kinesis Firehose can deliver streaming data but is not the primary service for multi-account log aggregation.
✓
AWS CloudTrail
Why this is correct
CloudTrail organization trail can deliver logs from all accounts to a single S3 bucket.
Related concept
Read the scenario before looking for a memorised answer.
✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes, not logs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse CloudTrail's log aggregation capability with other services like Kinesis Data Firehose or S3 replication, but CloudTrail is the only service that natively supports centralized log collection from multiple accounts via organization trails.
Detailed technical explanation
How to think about this question
CloudTrail organization trails use AWS Organizations to automatically apply a trail to all accounts in the organization, including future accounts, and deliver logs to a single S3 bucket in the management account. This leverages the CloudTrail service-linked role and the `EnableOrganizationTrail` API, which ensures that log delivery is consistent across accounts without manual setup per account. The centralized bucket can then be accessed by security teams using S3 bucket policies that grant cross-account access to member accounts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: AWS CloudTrail — AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket by setting up a trail in the management account and using CloudTrail's organization trail feature. This automatically aggregates VPC Flow Logs, CloudTrail logs, and DNS logs from all member accounts into the designated centralized S3 bucket without requiring additional infrastructure.
What should I do if I get this SAP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?
easy
✓ A.Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.
B.Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.
C.Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.
D.Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.
Why A: Option B is correct because cross-account delivery to a central S3 bucket with S3 Lifecycle policies minimizes storage costs and centralizes logs. Option A is wrong because CloudWatch Logs in each account requires separate retention and is not as cost-effective for long-term storage. Option C is wrong because Kinesis Data Firehose is more expensive and adds complexity. Option D is wrong because S3 replication incurs additional costs.
Variation 2. A company has multiple AWS accounts that are centrally managed using AWS Organizations. The security team requires that all API activity be logged and retained for 7 years. The logs must be stored in a central Amazon S3 bucket that is in the management account. Which solution meets these requirements with the least operational overhead?
easy
A.Enable CloudTrail in each account and use S3 Cross-Region Replication to copy logs to a central bucket.
B.Use Amazon Kinesis Data Firehose to stream CloudTrail logs from each account to a central S3 bucket.
C.Enable CloudTrail in each account individually and configure log file delivery to a bucket in that account.
✓ D.Enable AWS CloudTrail in the management account with organization trail, and configure the trail to deliver logs to an S3 bucket in the management account.
Why D: Option D is correct because enabling an organization trail in the management account automatically applies CloudTrail to all accounts in the AWS Organization, delivering logs to a single S3 bucket in the management account without any per-account configuration or additional replication mechanisms. This meets the 7-year retention requirement with the least operational overhead, as the trail is centrally managed and logs are stored directly in the central bucket.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.