Centralized Logging for Multiple AWS Accounts
A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)
Quick Answer
Building a centralized logging solution across multiple AWS accounts for three very different data types, network traffic, API activity, and DNS queries, works because each data type has its own native AWS logging feature, and each of those features supports delivering its output to a shared, centralized destination like an S3 bucket or a CloudWatch Logs group. VPC Flow Logs captures IP traffic metadata at the network interface, subnet, or VPC level and can be published to a central bucket for aggregation. AWS CloudTrail captures every API call made against AWS services, and an organization trail lets that activity be delivered centrally from every member account. Amazon Route 53 Resolver query logging fills the third gap by capturing DNS queries made by resources inside a VPC and can likewise be pointed at a central S3 bucket or CloudWatch Logs group, so the security team ends up with a consistent query and analysis workflow for all three data types once they land in one place. The concept worth generalizing is that AWS security logging is intentionally split into specialized services rather than one universal logger, so a requirement naming multiple distinct categories of activity, network traffic, API calls, DNS resolution, is really asking you to identify the one native logging feature that owns each category and confirm that each supports centralized, cross-account delivery to a shared destination.
⚠ Common exam trap
Test-takers frequently confuse AWS CloudHSM or AWS Config as logging services, but neither is designed for log collection or aggregation; CloudHSM is for key management and Config is for configuration auditing, not for aggregating VPC Flow Logs, CloudTrail logs, or DNS query logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Route 53 Resolver query logging
Amazon Route 53 Resolver query logging (Option C) is correct because it enables centralized collection of DNS query logs from VPCs across multiple AWS accounts. By configuring Route 53 Resolver query logging to send logs to a central Amazon S3 bucket or CloudWatch Logs group, the security team can aggregate DNS query logs from all accounts, meeting the requirement for centralized DNS logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudHSM
Why it's wrong here
CloudHSM is used for cryptographic key storage, not log aggregation.
- ✗
AWS Config
Why it's wrong here
AWS Config records configuration changes, not log events.
- ✓
Amazon Route 53 Resolver query logging
Why this is correct
Resolver query logs can be published to a central S3 bucket for DNS query logs.
- ✓
AWS CloudTrail
Why this is correct
An organization trail can deliver logs from all accounts to a single S3 bucket.
- ✓
VPC Flow Logs
Why this is correct
VPC Flow Logs can be published to a central S3 bucket or CloudWatch Logs for aggregation.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Organizations and wants to enable a central security team to view API activity across all member accounts. Which THREE steps are required? (Choose THREE.)
hard- ✓ A.Grant the security team read access to the central S3 bucket via bucket policy or IAM.
- B.Enable CloudTrail in the management account only.
- ✓ C.Configure each account's CloudTrail to deliver logs to a central S3 bucket in the security account.
- ✓ D.Enable CloudTrail in each member account.
- E.Create an IAM role in each account for the security team to assume.
Why A: To enable a central security team to view API activity across all member accounts in AWS Organizations, three steps are required: (A) Grant the security team read access to the central S3 bucket (via bucket policy or IAM) so they can retrieve the logs; (C) Configure each account's CloudTrail to deliver logs to a central S3 bucket in the security account, aggregating all logs in one location; and (D) Enable CloudTrail in each member account to generate the API activity logs. Option B is incorrect because enabling CloudTrail only in the management account would capture API activity only for that account, not for member accounts. Option E is unnecessary because cross-account access to the logs is provided via the bucket policy, eliminating the need to create IAM roles in each member account.
Variation 2. A company uses AWS Organizations and wants to centralize security logs from all member accounts into a single S3 bucket in the management account. The bucket policy allows only the management account's root user to write objects. However, logs are not being delivered from member accounts. What is the MOST likely cause?
hard- A.S3 Transfer Acceleration is not enabled.
- B.VPC endpoints are not configured for the logging service.
- C.The S3 bucket uses an AWS KMS key, and the key policy does not grant decrypt permissions to the logging service.
- ✓ D.The bucket policy denies write access to all principals except the management account's root user, preventing cross-account writes.
Why D: The bucket policy explicitly restricts write access to only the management account's root user. For cross-account log delivery from member accounts, the policy must grant write permissions to the logging service (e.g., AWS CloudTrail or AWS Config) in each member account. Without such permissions, the service cannot write objects to the bucket, causing log delivery to fail.
Variation 3. A security engineer is setting up centralized logging for an AWS organization. The engineer wants to collect CloudTrail logs, VPC Flow Logs, and AWS Config configuration items from all member accounts into a single S3 bucket in the management account. The engineer creates a new S3 bucket with a bucket policy that grants the required permissions. However, logs from member accounts are not being delivered. What is the most likely reason?
medium- A.VPC Flow Logs cannot be delivered to an S3 bucket in a different account.
- B.CloudTrail must be enabled in each member account individually.
- ✓ C.The S3 bucket policy does not grant write permissions to the member accounts' service principals.
- D.AWS Config must be enabled in the management account and configured to aggregate data from member accounts.
Why C: The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the CloudTrail, VPC Flow Logs, and AWS Config service principals from the member accounts. Without this, the services in member accounts cannot write logs to the bucket in the management account, even if the bucket exists and other permissions are set.
Variation 4. A company wants to centrally collect CloudTrail logs from multiple AWS accounts and enable real-time analysis. Which combination of services should be used?
easy- A.CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.
- ✓ B.CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.
- C.CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.
- D.CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).
Why B: It enables centralized collection of CloudTrail logs from multiple accounts by delivering logs to a central S3 bucket, then using S3 Event Notifications to trigger a Lambda function for real-time analysis. This pattern allows near-instant processing of log events as they arrive, meeting the requirement for real-time analysis without polling or batching delays.
Variation 5. A company wants to centrally collect VPC Flow Logs from multiple accounts into a single S3 bucket in the security account. Which solution is the MOST operationally efficient?
easy- A.Use CloudWatch Logs to stream flow logs to a Lambda function that writes to S3.
- ✓ B.Log in to each account and configure VPC Flow Logs to deliver to the central S3 bucket.
- C.Configure each account's VPC Flow Logs to a local S3 bucket, then use S3 replication to copy to the central bucket.
- D.Use AWS Organizations to centrally enable VPC Flow Logs in all accounts and deliver to the central S3 bucket.
Why B: VPC Flow Logs can be delivered directly to an S3 bucket in another account by configuring the flow log with the destination bucket ARN and ensuring the bucket policy grants write permissions to the flow log service. This eliminates the need for Lambda processing, S3 replication, or any unsupported central management feature. Configuring each account's VPC Flow Logs to deliver directly to the central S3 bucket is the simplest and most operationally efficient approach.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.