SCS-C02 Threat Detection and Incident Response Practice Question
A security team needs to analyze historical CloudTrail logs across multiple AWS accounts to detect patterns of suspicious activity. Which solution provides the MOST cost-effective and scalable analysis?
⚠ Common exam trap
Many exam-takers choose CloudWatch Logs Insights (Option D) because it seems convenient for log analysis, but they overlook its high ingestion costs and limited retention for historical data, whereas Athena's serverless, pay-per-query model is far more cost-effective for large-scale, infrequent queries of archived logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Aggregate logs into a central S3 bucket and query with Amazon Athena
Aggregating CloudTrail logs into a central S3 bucket and querying with Amazon Athena is the most cost-effective and scalable solution because Athena uses a serverless, pay-per-query model with no infrastructure to manage, and it can directly analyze large volumes of structured log data stored in S3 using standard SQL. This approach avoids the cost of provisioning and maintaining dedicated clusters (as with Redshift or Elasticsearch) and avoids the per-GB ingestion and storage fees of CloudWatch Logs Insights, making it ideal for historical analysis across multiple accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Aggregate logs into a central S3 bucket and query with Amazon Athena
Why this is correct
Centralizing CloudTrail logs in a single S3 bucket is the AWS-recommended architecture for historical analysis. Amazon Athena uses serverless Presto/Trino to run SQL directly over S3 objects, charging only for bytes scanned, which is cost-effective for infrequent deep queries. Partitioning the data by date and converting to columnar formats like Parquet further reduces scan costs and speeds up analysis. This approach avoids provisioning any compute, making it the natural fit for auditing historical events across accounts.
- ✗
Stream logs to Amazon Elasticsearch Service and use Kibana
Why it's wrong here
Amazon Elasticsearch Service (now OpenSearch) is optimized for real-time log analytics, ingest, and interactive visualization through Kibana, not for infrequent historical queries. To analyze historical CloudTrail data you must first stream or batch-load all logs into a cluster, incurring ongoing costs for cluster compute, storage, and replication regardless of query activity. Large volumes of CloudTrail data quickly drive up cluster costs and require capacity planning, making this option significantly more expensive than serverless alternatives for occasional forensic queries. The infrastructure overhead also introduces unnecessary operational complexity when the underlying logs already exist in S3.
- ✗
Load logs into Amazon Redshift for analysis
Why it's wrong here
Amazon Redshift is a petabyte-scale data warehouse designed for complex SQL analytics on structured, relational data. Loading CloudTrail logs into Redshift requires defining schemas, performing COPY or ETL from S3, and managing a cluster that you pay for continuously, even when not running queries. For historical CloudTrail analysis, which typically involves scattered, exploratory SQL rather than sustained BI workloads, Redshift's all-of-the-time running cost and administrative burden make it disproportionately expensive and complex. Serverless Athena is a lower-cost, zero-maintenance alternative for querying the raw S3 logs directly.
- ✗
Use Amazon CloudWatch Logs Insights across all accounts
Why it's wrong here
CloudWatch Logs Insights is designed for real-time operational monitoring and troubleshooting, not long-term historical cross-account analysis. Each account's CloudTrail events must be delivered to CloudWatch Logs first, which incurs ingestion and storage costs and is subject to log-group retention limits—making it unsuitable for years of history. Cross-account queries require complex resource-share setup (CloudWatch Logs subscriptions/OpenSearch or a monitoring account) and even then are constrained by 20-minute query timeouts and lack of partition pruning. The logs natively reside in S3, so Athena can scan all historical data without this extra delivery, storage, and query indirection.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.