DOP-C02 Question #501: Real Exam Question with Answer & Explanation

Question

A company's applications run on Amazon EC2 instances and use AWS Lambda functions in multiple AWS accounts. All EC2 instances have the Amazon CloudWatch agent installed. All accounts belong to the same organization in AWS Organizations. The company has created a dedicated central log account. All logs that the applications produce must be sent to a central location. The logs must be encrypted with keys that the company manages. Which solution meets these requirements with the LEAST operational overhead?

Options

• AIn the central log account, enable logs as the data source in CloudWatch. Add the organization ID
• BCreate an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream
• CCreate an Amazon S3 bucket in each account. Create an Amazon OpenSearch Service cluster in
• DCreate an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream

Explanation

CloudWatch cross-account centralization for an AWS Organizations organization provides a managed way to aggregate logs from multiple accounts into a central log account with minimal per-account configuration by using the provided CloudFormation StackSet. CloudWatch Logs supports encryption with customer managed AWS KMS keys in the destination account, allowing the company to encrypt centralized logs with company-managed keys while keeping operational

No community discussion yet for this question.