CCSP Centralized logging Practice Question
An organization is setting up a centralized logging solution across multiple accounts in their cloud environment. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.
For cross-account log aggregation, the cloud provider's organizational structure can be used to centrally manage audit logging. A single audit logging configuration can be enabled that delivers logs from all accounts to a central storage container in the management account. Lifecycle policies on that container can then manage transitions to lower-cost storage classes after 90 days.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the cloud provider's native audit logging in each account and manually copy logs daily to the security account.
Why it's wrong here
Manually copying logs is inefficient and error-prone.
- ✗
Create an audit log configuration in each account and export logs to a centralized monitoring service, then use cross-account log forwarding to a central storage container.
Why it's wrong here
This approach uses a cross-account subscription, which is possible but not the simplest method; it requires additional configuration and may not leverage the organization management service.
- ✗
Use a serverless function to copy logs from each account's storage container to the central storage container.
Why it's wrong here
Using a serverless function introduces additional complexity and cost.
- ✓
Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.
Why this is correct
This leverages the organization management service to centrally manage audit trails, simplifying deployment and ensuring all logs are delivered to a single location.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.