SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?
⚠ Common exam trap
The trap here is that candidates often over-engineer the solution by choosing streaming services like Kinesis or CloudWatch Logs, thinking they are more scalable, but they fail to recognize that direct S3 delivery with Lifecycle policies is both more cost-effective and sufficiently scalable for centralized logging in AWS Organizations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.
Delivering logs from all accounts to a central Amazon S3 bucket in a logging account is the most scalable and cost-effective approach. S3 Lifecycle policies can automatically transition older logs to Amazon S3 Glacier, reducing storage costs while retaining data for compliance. This design avoids cross-account data transfer fees and minimizes operational overhead by using a single bucket with centralized access controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.
Why this is correct
S3 is cost-effective for central log storage.
- ✗
Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.
Why it's wrong here
Firehose adds unnecessary cost and complexity.
- ✗
Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.
Why it's wrong here
S3 Replication incurs additional costs.
- ✗
Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.
Why it's wrong here
CloudWatch Logs is more expensive for long-term storage.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?
medium- A.AWS Glue
- ✓ B.S3 Object Lock
- ✓ C.AWS CloudTrail
- ✓ D.Amazon S3
- E.Amazon Kinesis Data Streams
Why B: S3 Object Lock is correct because it enforces a write-once-read-many (WORM) model on S3 objects, preventing any deletion or overwriting for a specified retention period. Combined with Amazon S3 for durable storage and AWS CloudTrail for logging API activity across accounts, this meets the 7-year immutability and retention compliance requirements.
Variation 2. A company is designing a centralized logging solution for multiple AWS accounts. They need to aggregate VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts into a single S3 bucket. Which AWS service should be used to centralize the log collection?
easy- A.Amazon S3 cross-region replication
- B.Amazon Kinesis Data Firehose
- ✓ C.AWS CloudTrail
- D.AWS Config
Why C: AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket by setting up a trail in the management account and using CloudTrail's organization trail feature. This automatically aggregates VPC Flow Logs, CloudTrail logs, and DNS logs from all member accounts into the designated centralized S3 bucket without requiring additional infrastructure.
Variation 3. A company has multiple AWS accounts that are centrally managed using AWS Organizations. The security team requires that all API activity be logged and retained for 7 years. The logs must be stored in a central Amazon S3 bucket that is in the management account. Which solution meets these requirements with the least operational overhead?
easy- A.Enable CloudTrail in each account and use S3 Cross-Region Replication to copy logs to a central bucket.
- B.Use Amazon Kinesis Data Firehose to stream CloudTrail logs from each account to a central S3 bucket.
- C.Enable CloudTrail in each account individually and configure log file delivery to a bucket in that account.
- ✓ D.Enable AWS CloudTrail in the management account with organization trail, and configure the trail to deliver logs to an S3 bucket in the management account.
Why D: Enabling an organization trail in the management account automatically applies CloudTrail to all accounts in the AWS Organization, delivering logs to a single S3 bucket in the management account without any per-account configuration or additional replication mechanisms. This meets the 7-year retention requirement with the least operational overhead, as the trail is centrally managed and logs are stored directly in the central bucket.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.