Centralize CloudTrail Logs from All Accounts Using Organization Trail

• A.Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.
• B.Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.
• ✓ C.Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.
• D.Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.

Why C: Option C is correct because AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.

• A.Enable CloudWatch Logs in each account and stream to a central log group.
• B.Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.
• ✓ C.Create an organization trail in the management account with CloudTrail.
• D.Enable S3 server access logs on all accounts and send to a central bucket.

Why C: Option C is correct because AWS Organizations supports creating an organization trail in the management account that automatically logs API calls for all member accounts without requiring per-account configuration. This centralizes logging with minimal operational overhead, as CloudTrail handles the aggregation across the organization.

• ✓ A.Create a CloudTrail trail in the management account that applies to all accounts in the organization.
• B.Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.
• C.Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.
• D.Apply an SCP to require CloudTrail to be enabled in all accounts.

Why A: Option A is correct because AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.