SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an organization trail in the management account with logging enabled for all accounts.

  Why this is correct

  CloudTrail organization trails are created in the management account and automatically apply to every account in AWS Organizations, delivering all account logs to a single S3 bucket without per-account configuration. This is the native mechanism for centralizing management-event logging across an organization, and the management account owns and controls the trail. Because the trail is organization-wide, you get consistent logging coverage and centralized governance.

• ✗

  Use AWS Config to aggregate logs from all accounts into a central S3 bucket.

  Why it's wrong here

  AWS Config is a configuration and compliance service, not a log aggregation pipeline. It records resource configuration changes and can deliver configuration history to S3, but it does not capture CloudTrail management events, S3 data events, or application-level logs from multiple accounts. Using AWS Config would give you configuration snapshots and rule evaluations, not the centralized API activity log that CloudTrail provides.

• ✗

  Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.

  Why it's wrong here

  If each account creates its own CloudTrail trail and configures delivery to the same S3 bucket, the log files can collide in the same bucket path, especially when default prefixes are used, causing overwrites and potential data loss. Multiple independent trails writing to one bucket are not the supported pattern for centralized logging because there is no central management and you must manually coordinate prefixes and bucket policies across every account. An organization trail is the intended solution because it centrally manages the trail and handles log delivery for all accounts from the management account.

• ✗

  Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

  Why it's wrong here

  Amazon Kinesis Data Firehose in each account would require each account to have its own Firehose delivery stream, but the question demands centralised log collection from multiple accounts into a single S3 bucket without per-account stream management. This option is tempting because Firehose is designed for real-time streaming data ingestion into S3, and would be correct if the goal were to capture high-volume, near-real-time logs from a single account or a unified stream source, rather than aggregating logs across many accounts in an AWS Organizations structure.

Go deeper

Related to this question