Centralizing Logs from Multiple AWS Accounts with CloudWatch Logs
A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?
Quick Answer
The answer is Amazon CloudWatch Logs, as it is the native AWS service designed to centralize logs from multiple accounts for monitoring and alerting. CloudWatch Logs achieves this through cross-account log group subscriptions, where logs from member accounts can be streamed into a central monitoring account, or by using Amazon Kinesis Data Streams as an intermediary to aggregate log data from various sources before ingestion. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of log aggregation architecture versus other services’ specific roles—a common trap is confusing CloudTrail (which only records API activity) or S3 (a storage layer, not a monitoring service) with CloudWatch Logs’ broader log collection capability. Remember the memory tip: “CloudWatch watches all logs; CloudTrail trails only API calls.”
⚠ Common exam trap
Candidates often confuse AWS CloudTrail (which records API calls) with a log aggregation service, but CloudTrail is a log source, not a centralized aggregation and analysis platform like CloudWatch Logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Logs
Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3
Why it's wrong here
S3 is object storage; it can store logs but not aggregate and monitor.
- ✗
AWS Config
Why it's wrong here
Config tracks configuration changes, not log aggregation.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail is for API activity logs, not general log aggregation.
- ✓
Amazon CloudWatch Logs
Why this is correct
CloudWatch Logs can aggregate logs from multiple sources and accounts.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Select TWO.)
easy- A.AWS Config
- ✓ B.Amazon Athena (to query logs in S3)
- ✓ C.Amazon S3 (as a central log repository)
- D.Amazon Inspector
- E.AWS Shield
Why B: Amazon S3 can serve as a centralized log repository by aggregating logs from multiple AWS accounts using cross-account S3 bucket policies. Amazon Athena can then query those logs directly in S3 using standard SQL, enabling centralized analysis without moving data. Together, they provide a scalable, serverless solution for multi-account log collection and analysis.
Variation 2. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)
medium- ✓ A.Amazon CloudWatch Logs
- B.AWS CloudTrail
- C.Amazon Kinesis Data Firehose
- D.Amazon Athena
- ✓ E.Amazon S3
Why A: Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.