SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Amazon Kinesis Data Streams to stream CloudTrail events from all accounts to the central S3 bucket

  Why it's wrong here

  CloudTrail does not support Amazon Kinesis Data Streams as a native delivery destination; its only targets are an Amazon S3 bucket and Amazon CloudWatch Logs. Even if you attempted to use a Kinesis Data Stream as an intermediary, you would need a separate consumer application to read the stream and write objects to S3, which is unnecessary complexity and not the centralized, fully-managed approach AWS provides. An organization trail is the native solution for multi-account logging.

• ✓

  Create an organization trail in the management account that logs all accounts

  Why this is correct

  Creating an organization trail in the management account of an AWS Organization automatically logs events from every member account, including future accounts as they are added. This trail delivers all cloud trail event history to a single S3 bucket you designate, eliminating the need to configure trails individually per account. It gives central administrators full visibility and control over governance, and it supports a single set of lifecycle policies and permissions applied across the entire organization.

• ✗

  Create a CloudTrail trail in each member account and specify the same S3 bucket

  Why it's wrong here

  While you can technically create a CloudTrail trail in each member account and point all of them to the same S3 bucket, this approach is decentralized and does not scale operationally. You must enable and maintain each trail separately, add a bucket policy that allows cross-account writes from every member account, and manually onboard any new account that joins the organization. It also risks inconsistent configuration and creates duplicated effort in managing event selectors and log file validation, whereas an organization trail centralizes these responsibilities.

• ✗

  Enable AWS Security Hub in the security account and configure it to collect CloudTrail logs

  Why it's wrong here

  AWS Security Hub does not collect or store raw CloudTrail logs; it is a cloud security posture management service that aggregates security findings from services like GuardDuty, Inspector, and AWS Config. While Security Hub can use CloudTrail data for its own audit recording, it does not provide a destination for your multi-account CloudTrail event history. To centralize CloudTrail logs, you need an S3 bucket and an organization trail, not Security Hub.

Go deeper

Related to this question