SCS-C02 Security Logging and Monitoring Practice Question
A company uses AWS Organizations with multiple accounts. The security team needs to centrally monitor all API calls made in the member accounts. The team wants to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the management account. Which configuration should the security team implement?
⚠ Common exam trap
Test-takers frequently think they need to configure CloudTrail in each member account individually (Option B) or use S3 replication (Option D), missing the fact that AWS Organizations provides a native, centralized organization trail feature that automatically applies to all accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an organization trail in the management account with the S3 bucket in the management account.
AWS Organizations supports creating an organization trail in the management account that automatically applies to all member accounts. This ensures that all API calls from every account in the organization are logged and delivered to a centralized S3 bucket in the management account without needing to configure individual trails or manage cross-account permissions manually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure CloudWatch cross-account subscription to send logs from member accounts to the management account.
Why it's wrong here
Amazon CloudWatch Logs cross-account subscriptions are designed for forwarding application log groups—not CloudTrail audit traces—from member accounts to a central monitoring account. To use this, you would first have to create a CloudTrail in each member account and configure it to deliver to CloudWatch Logs, then set up subscription filters, which is indirect and still misses AWS Organizations-level management events. The native mechanism for CloudTrail is an organization trail, which captures all events at the organization level. Therefore, this option is incorrect.
- ✗
Enable CloudTrail in each member account and configure each trail to deliver logs to the same S3 bucket.
Why it's wrong here
While individual account trails can deliver to a central S3 bucket, this approach fails to capture management events—such as account creation or policy changes—that occur at the AWS Organizations level, because those events are only recorded by a trail created in the management account itself. This option is tempting because it works well for aggregating data-plane API calls from member accounts when no central governance of organisational-level events is required, and it avoids granting the management account cross-account write permissions.
- ✓
Create an organization trail in the management account with the S3 bucket in the management account.
Why this is correct
An organization trail is created only in the management account (or delegated administrator) and automatically applies to all accounts in the AWS organization, with no per-account setup required. It records management events across all accounts, including AWS Organizations control-plane operations like CreateAccount and AttachPolicy, and delivers the aggregated logs to a single S3 bucket in the management account. This is the correct way to centrally collect CloudTrail logs for governance and compliance.
- ✗
Use Amazon S3 replication to copy logs from member account buckets to the management account bucket.
Why it's wrong here
Amazon S3 replication only copies objects from already-existing source buckets; you would still need to enable CloudTrail in every member account and configure each to write to its own S3 bucket before replication could start. Replication is asynchronous and does not capture AWS Organizations-level events that are only visible to a trail created in the management account. An organization trail with a central S3 bucket is the simpler, native mechanism, so this option is incorrect.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.