SAP-C02 Practice Question: Design Solutions for Organizational Complexity

A company is designing a multi-account strategy for its development, testing, and production environments. The security team requires that all accounts share a centralized logging solution. Which approach meets this requirement with the LEAST administrative overhead?

⚠ Common exam trap

The trap here is that candidates may overcomplicate the solution by choosing options that involve additional services (Glue, Kinesis, OpenSearch) or partial centralization (CloudWatch cross-account access), missing the simplicity and native support of CloudTrail's direct cross-account S3 delivery.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use AWS CloudTrail to deliver logs to a central S3 bucket in the logging account.

AWS CloudTrail can be configured to deliver logs from multiple accounts to a single central S3 bucket in a logging account by setting up a CloudTrail trail in each account that points to the same bucket. This approach requires minimal administrative overhead as it leverages native AWS cross-account logging capabilities without additional data movement or transformation services.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure each account to write logs to its own S3 bucket and use AWS Glue to copy them to a central bucket.
Why it's wrong here
AWS Glue crawlers, jobs and schedules must be built and operated in every account, and each account's bucket needs its own cross-account copy logic, multiplying administrative effort. Glue is the right choice for transforming and cataloguing data, not for simply replicating log objects into one central bucket.
✓
Use AWS CloudTrail to deliver logs to a central S3 bucket in the logging account.
Why this is correct
CloudTrail can deliver events from every account in an organisation to one central S3 bucket using an organisation trail, requiring only a bucket policy and no per-account configuration, which minimises administrative overhead across development, testing and production.
✗
Use Amazon CloudWatch Logs in each account and view logs from a central account via cross-account access.
Why it's wrong here
Cross-account access to CloudWatch Logs requires a role and trust policy in every source account plus a viewer in the central account, and log groups remain distributed rather than consolidated. CloudWatch cross-account observability suits querying metrics and alarms across accounts, not aggregating log data into one central store.
✗
Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon OpenSearch Service.
Why it's wrong here
Firehose buffers records before delivering, so it cannot write each arriving object straight into a central OpenSearch domain; per-account delivery streams and IAM roles must be provisioned and maintained. Firehose suits continuous streaming data into OpenSearch for near-real-time search, not consolidating existing S3 log archives.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question