SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to implement a centralized logging solution for its multi-account AWS environment. The solution must be resilient to AWS Regional failures and provide near real-time log delivery. Which combination of services should the company use?
⚠ Common exam trap
Many exam-takers choose Option A (S3 cross-region replication) because it seems simple and resilient, but they overlook the requirement for near real-time delivery, which S3 replication cannot guarantee due to its eventual consistency model and potential for multi-minute delays.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Logs subscription filters in each account that stream log data to a Kinesis Data Stream in the central logging account, then use Kinesis Data Firehose to write to S3.
It uses CloudWatch Logs subscription filters to stream log data in near real-time to a Kinesis Data Stream in the central logging account, which then feeds into Kinesis Data Firehose for durable delivery to S3. This architecture is resilient to Regional failures because Kinesis Data Streams can be configured with cross-region replication or multi-region failover, and Firehose can buffer and retry writes to S3 across availability zones. It provides near real-time delivery (typically within 60 seconds) and centralizes logs without relying on per-account S3 replication or Lambda polling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
S3 buckets in each account with cross-region replication enabled to a central bucket.
Why it's wrong here
S3 replication is not near real-time and has latency.
- ✗
Lambda functions in each account that read CloudWatch Logs and write to a central S3 bucket.
Why it's wrong here
Lambda may introduce scaling issues and increased complexity.
- ✓
Amazon CloudWatch Logs subscription filters in each account that stream log data to a Kinesis Data Stream in the central logging account, then use Kinesis Data Firehose to write to S3.
Why this is correct
This provides near real-time streaming and cross-account aggregation.
- ✗
Amazon Kinesis Data Firehose delivery streams in each account sending logs to a centralized S3 bucket.
Why it's wrong here
Firehose per account increases complexity and cost.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.