Centralized Logging for Multiple AWS Accounts

• ✓ A.Grant the security team read access to the central S3 bucket via bucket policy or IAM.
• B.Enable CloudTrail in the management account only.
• ✓ C.Configure each account's CloudTrail to deliver logs to a central S3 bucket in the security account.
• ✓ D.Enable CloudTrail in each member account.
• E.Create an IAM role in each account for the security team to assume.

Why A: To enable a central security team to view API activity across all member accounts in AWS Organizations, three steps are required: (A) Grant the security team read access to the central S3 bucket (via bucket policy or IAM) so they can retrieve the logs; (C) Configure each account's CloudTrail to deliver logs to a central S3 bucket in the security account, aggregating all logs in one location; and (D) Enable CloudTrail in each member account to generate the API activity logs. Option B is incorrect because enabling CloudTrail only in the management account would capture API activity only for that account, not for member accounts. Option E is unnecessary because cross-account access to the logs is provided via the bucket policy, eliminating the need to create IAM roles in each member account.

• A.S3 Transfer Acceleration is not enabled.
• B.VPC endpoints are not configured for the logging service.
• C.The S3 bucket uses an AWS KMS key, and the key policy does not grant decrypt permissions to the logging service.
• ✓ D.The bucket policy denies write access to all principals except the management account's root user, preventing cross-account writes.

Why D: The bucket policy explicitly restricts write access to only the management account's root user. For cross-account log delivery from member accounts, the policy must grant write permissions to the logging service (e.g., AWS CloudTrail or AWS Config) in each member account. Without such permissions, the service cannot write objects to the bucket, causing log delivery to fail.

• A.VPC Flow Logs cannot be delivered to an S3 bucket in a different account.
• B.CloudTrail must be enabled in each member account individually.
• ✓ C.The S3 bucket policy does not grant write permissions to the member accounts' service principals.
• D.AWS Config must be enabled in the management account and configured to aggregate data from member accounts.

Why C: Option C is correct because the S3 bucket policy must explicitly grant the `s3:PutObject` permission to the CloudTrail, VPC Flow Logs, and AWS Config service principals from the member accounts. Without this, the services in member accounts cannot write logs to the bucket in the management account, even if the bucket exists and other permissions are set.

• A.CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.
• ✓ B.CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.
• C.CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.
• D.CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).

Why B: Option B is correct because it enables centralized collection of CloudTrail logs from multiple accounts by delivering logs to a central S3 bucket, then using S3 Event Notifications to trigger a Lambda function for real-time analysis. This pattern allows near-instant processing of log events as they arrive, meeting the requirement for real-time analysis without polling or batching delays.

• A.Use CloudWatch Logs to stream flow logs to a Lambda function that writes to S3.
• B.Log in to each account and configure VPC Flow Logs to deliver to the central S3 bucket.
• C.Configure each account's VPC Flow Logs to a local S3 bucket, then use S3 replication to copy to the central bucket.
• ✓ D.Use AWS Organizations to centrally enable VPC Flow Logs in all accounts and deliver to the central S3 bucket.

Why D: Option D is correct because AWS Organizations allows you to centrally configure VPC Flow Logs for all accounts using a service control policy (SCP) or, more precisely, by using the AWS Organizations delegated administrator feature with Amazon VPC Flow Logs. This enables you to enable flow logs across multiple accounts from a single management account and deliver them directly to a central S3 bucket in the security account, eliminating the need for per-account manual configuration or intermediary services. This approach is the most operationally efficient as it reduces administrative overhead and ensures consistent logging policies.