SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations and has a requirement that all API calls to AWS services must be logged and monitored. The security team wants to create a central CloudWatch dashboard that shows API activity across all accounts. Which solution should be implemented with the least operational overhead?
⚠ Common exam trap
Candidates often assume cross-account observability (Option C) is the simplest solution for central monitoring, but it does not natively aggregate CloudTrail logs and requires additional configuration, whereas an organization trail provides automatic, centralized logging with minimal overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable an organization trail in CloudTrail in the management account to deliver logs to a central S3 bucket. Use Amazon CloudWatch Logs to process the logs and create a metric filter, then build a dashboard.
Enabling an organization trail in CloudTrail from the management account automatically applies to all accounts in the AWS Organization, delivering logs to a central S3 bucket with minimal per-account configuration. Using CloudWatch Logs with metric filters on that S3 bucket allows the security team to create a central CloudWatch dashboard that monitors API activity across all accounts, satisfying the requirement with the least operational overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon EventBridge to capture API calls from all accounts and route them to a central CloudWatch Logs group.
Why it's wrong here
EventBridge does not capture all API calls by default.
- ✗
Enable CloudTrail in each account and configure the trail to send logs to a CloudWatch Logs group in that account. Then create a cross-account CloudWatch dashboard.
Why it's wrong here
Requires per-account setup and cross-account dashboard.
- ✗
Use CloudWatch cross-account observability to aggregate logs from all accounts into a single monitoring account.
Why it's wrong here
Adds complexity of setting up cross-account observability.
- ✓
Enable an organization trail in CloudTrail in the management account to deliver logs to a central S3 bucket. Use Amazon CloudWatch Logs to process the logs and create a metric filter, then build a dashboard.
Why this is correct
Organization trail centralizes logs, and CloudWatch Logs can create metrics and dashboards.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations and wants to establish a central logging solution. They need to collect CloudTrail logs from all accounts and store them in a central S3 bucket in the management account. Which TWO steps are required to achieve this?
medium- A.Create an AWS Config rule to monitor CloudTrail configuration.
- B.Apply a service control policy (SCP) to enforce CloudTrail logging.
- ✓ C.Create a new CloudTrail trail in the management account with organization trail enabled.
- ✓ D.Configure the trail to deliver logs to a central S3 bucket in the management account.
- E.Enable CloudTrail in each member account individually.
Why C: To centrally collect CloudTrail logs from all accounts in an AWS Organization, create an organization trail in the management account (C) which automatically enables CloudTrail in all member accounts and logs management events. Then configure that trail to deliver logs to a central S3 bucket in the management account (D). No individual account CloudTrail enablement is required because the organization trail handles it automatically.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.