SCS-C02 Security Logging and Monitoring Practice Question
A company wants to centrally collect CloudTrail logs from multiple AWS accounts and enable real-time analysis. Which combination of services should be used?
⚠ Common exam trap
A common mix-up: candidates assume Kinesis Data Firehose or CloudWatch Logs are required for real-time analysis, but S3 Event Notifications with Lambda provide a simpler, cost-effective, and fully serverless solution for near-real-time processing of CloudTrail logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.
It enables centralized collection of CloudTrail logs from multiple accounts by delivering logs to a central S3 bucket, then using S3 Event Notifications to trigger a Lambda function for real-time analysis. This pattern allows near-instant processing of log events as they arrive, meeting the requirement for real-time analysis without polling or batching delays.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.
Why it's wrong here
A CloudTrail-to-Kinesis Data Firehose-to-S3 pipeline can make logs queryable by Athena after delivery, but Firehose's buffering (by size or time interval) adds minutes of latency and Athena is an interactive query engine, not a real-time analysis service. Without Lambda (or similar) consuming the stream, individual CloudTrail events are not parsed or alerted on in real time, and the extra streaming and query infrastructure adds cost and operational complexity when AWS-native S3 event triggering is simpler and cheaper.
- ✓
CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.
Why this is correct
This design works because CloudTrail delivers compressed log files as S3 objects, and S3 Event Notifications invoke Lambda for each new object. Lambda then unpacks the gzipped CloudTrail JSON, filters for key API activity, and writes normalized events to CloudWatch Logs or fires alerts, giving near-real-time analysis without managing servers or a streaming buffer. It is serverless, cost-effective, and tightly integrated with S3, making it the natural choice for a central log collection and analysis pipeline.
- ✗
CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.
Why it's wrong here
While CloudWatch Logs is excellent for log aggregation and analysis within a single account, it doesn't natively support direct, real-time cross-account log *collection* for centralisation in the way required by the stem. This option is tempting because CloudWatch Logs is a common destination for logs, and cross-account access is achievable, but it lacks the direct subscription mechanism for real-time ingestion from multiple sources into a single central repository without additional configuration.
- ✗
CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).
Why it's wrong here
S3 Event Notifications can publish object-created messages to an SQS queue, but the queue is only a buffer—it stores a note that a CloudTrail file arrived, not the parsed log events and not an analysis result. A separate consumer (usually a Lambda function polling or subscribed to the queue) is still required to read the message, pull the S3 object, and extract meaningful insights, so SQS alone cannot satisfy the requirement for real-time analysis. The architecture is also more complex than needed because CloudTrail file contents must be processed by an additional component anyway.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.