SOA-C02 Monitoring, Logging, and Remediation Practice Question
A company uses AWS Organizations with multiple accounts. The SysOps administrator needs to centralize the monitoring of all API calls made in any account for security analysis. The solution must collect logs from all accounts, both existing and future, and deliver them to a centralized S3 bucket in the management account. Which AWS service should the administrator use?
⚠ Common exam trap
Candidates often confuse AWS Config aggregator (which centralizes configuration data) with CloudTrail (which centralizes API call logs), or assume cross-account CloudWatch Logs subscriptions are the simpler solution, missing the automatic future-account coverage of an organization trail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail organization trail
AWS CloudTrail organization trails allow you to log all API calls across all accounts in an AWS Organization from a single management account. When you create an organization trail, it automatically applies to all existing and future accounts, delivering logs to a centralized S3 bucket in the management account without requiring per-account configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config aggregator
Why it's wrong here
An AWS Config aggregator centrally collects resource configuration and compliance snapshots from multiple accounts and Regions, but it does not capture API activity or user actions. While it can span an organization and include future accounts when configured as an organization aggregator, it is not designed to store or expose CloudTrail event history. Therefore, it cannot meet the requirement for centralized API logging.
- ✗
Amazon CloudWatch Logs with cross-account subscription
Why it's wrong here
Cross-account log subscriptions require manually creating subscription filters, destination log groups, and IAM roles in each member account's relevant log groups. AWS Organizations does not automatically propagate these subscriptions to newly created accounts, so future accounts would be missing unless someone reconfigures each one. Even if you forward CloudTrail events to CloudWatch Logs, the per-account setup does not provide a self-updating solution for an evolving organization.
- ✓
AWS CloudTrail organization trail
Why this is correct
An organization trail is created in the management account and, when the 'Enable for all accounts in my organization' option is selected, automatically captures API activity for every account in AWS Organizations, including accounts that join later. The event logs are delivered to a single S3 bucket designated by the management account, making it a centralized, scalable solution. This native integration eliminates the need to configure CloudTrail per member account.
- ✗
Amazon Detective
Why it's wrong here
Amazon Detective is a security analysis service that consumes data from existing sources such as CloudTrail, VPC Flow Logs, and GuardDuty findings; it does not ingest or aggregate raw logs directly from multiple accounts itself. To use Detective, you must first enable those sources and send their data to Detective, so it is not a mechanism for automatically collecting and storing API activity across an organization. It would be an incorrect choice for centralized log collection.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.