SCS-C02 Security Logging and Monitoring Practice Question
Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse log collection services (CloudWatch Logs, S3) with analysis-only services (Athena) or event-recording services (CloudTrail), failing to recognize that CloudTrail generates logs but does not centrally collect them from multiple accounts without additional configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Logs
Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon CloudWatch Logs
Why this is correct
Amazon CloudWatch Logs is a central service that can aggregate logs from multiple AWS accounts and on-premises sources via cross-account subscriptions and log destinations. It provides a unified view for monitoring, querying, and setting metric filters on log data, making it a true central collection point for operational logs.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is an audit and governance service that records API activity and generates event logs, but it does not receive or aggregate logs from other services. It can deliver its own trails to S3 or CloudWatch Logs, yet it functions as a log source, not as a centrally managed log collector for heterogeneous log data.
- ✗
Amazon Kinesis Data Firehose
Why it's wrong here
Amazon Kinesis Data Firehose is a fully managed streaming delivery service that captures and transforms data before loading it into destinations such as S3, Redshift, or Splunk. It does not store or analyze data itself, so while it can be used in a log pipeline, it is not a service that centrally collects and stores logs for querying or retention.
- ✗
Amazon Athena
Why it's wrong here
Amazon Athena is an interactive query service that runs SQL queries directly against data in Amazon S3, but it cannot ingest, store, or centrally collect logs. It relies on logs already present in S3 and simply reads them on demand, making it a data-analytics tool rather than a log-collection mechanism.
- ✓
Amazon S3
Why this is correct
Amazon S3 provides durable, scalable object storage that can serve as a centralized repository for logs generated by many AWS services and accounts. You can configure CloudTrail, VPC Flow Logs, ELB logs, and other sources to deliver log files to a common S3 bucket, enabling central storage for compliance and analytics.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.