SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure each account to send logs to a central S3 bucket

  Why it's wrong here

  While you can technically configure every member account to run its own CloudTrail trail and write to the same central S3 bucket, this requires manually distributing bucket policies, creating a trail in each account, and reconciling overlapping permissions. It is brittle because you must monitor each account separately for trail health, and it does not natively capture new accounts that join the organization unless you update them individually. AWS's designed approach for multi-account CloudTrail is an organization trail, not ad-hoc per-account delivery to a common bucket.

• ✗

  Enable Amazon GuardDuty in each account and aggregate findings

  Why it's wrong here

  Amazon GuardDuty is a threat detection service that consumes CloudTrail management events, VPC Flow Logs, and DNS logs to generate security findings; it does not collect or archive raw CloudTrail log files. It can aggregate findings into a central account using GuardDuty administrator/member relationships, but that gives you findings, not the underlying API logs you need for full audit analysis. For central collection and analysis of CloudTrail logs, you need a delivery mechanism like S3 or CloudWatch Logs, not GuardDuty.

• ✗

  Use Amazon CloudWatch Logs to stream logs from each account to a central account

  Why it's wrong here

  CloudTrail can stream events to CloudWatch Logs in each account, and those log groups can be cross-account subscribed to a central account, but this pipeline introduces added latency, log-group limits, and metric-filter overhead. CloudWatch Logs is suited for real-time alarms and operational monitoring, not for durable, reviewable long-term audit archives, and using it as the primary transport misses the single-trail simplicity of an organization trail. An organization trail can optionally deliver to CloudWatch Logs in the management account while also archiving raw JSON in S3.

• ✓

  Use AWS Organizations to create a CloudTrail trail that applies to all accounts

  Why this is correct

  Using AWS Organizations, you can create an organization trail from the management account that automatically logs CloudTrail management events for every account in the organization, including future accounts, with no per-account configuration. The trail delivers log files to a single designated S3 bucket in the management account, enabling centralized collection and analysis through Athena, QuickSight, or other tools. This is the native, designed method for centralizing CloudTrail logs across multiple accounts.

Go deeper

Related to this question