SCS-C02 Security Logging and Monitoring Practice Question

A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?

⚠ Common exam trap

Candidates often confuse AWS Config (which records configuration changes) with CloudTrail (which records API calls), or they think VPC Flow Logs can substitute for API logging, leading them to select options that do not meet the requirement for centralized API call logging.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an organization trail in the management account

AWS Organizations allows you to create an organization trail in the management account that automatically logs API calls for all member accounts. This centralizes CloudTrail logs into a single S3 bucket without needing to configure individual trails per account, ensuring complete coverage and simplified management.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use AWS Config to record API calls across all accounts
Why it's wrong here
AWS Config records configuration changes, not API calls.
✗
Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena
Why it's wrong here
This is not centralized and requires manual aggregation.
✓
Create an organization trail in the management account
Why this is correct
Organization trails log events for all accounts and deliver to a single bucket.
✗
Enable VPC Flow Logs in each account and send to a central S3 bucket
Why it's wrong here
Flow Logs capture network traffic, not API calls.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Security Logging and Monitoring Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question