A company has multiple AWS accounts in an AWS Organizations organization. The company needs to centralize storage of AWS account activity and run SQL queries against the activity from a central location. Which solution satisfies these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Use a delegated administrator account to create an AWS CloudTrail Lake data store. Specify CloudTrail management events for the data store. Enable the data store for all accounts in the organization. Query the data in CloudTrail Lake..
Why this is the answer
The correct solution leverages AWS CloudTrail Lake, which is designed for centralized, organization-wide activity logging and SQL querying. By using a delegated administrator account to create a CloudTrail Lake data store and enabling it for all accounts, the company centralizes all CloudTrail events in a single, queryable repository. CloudTrail Lake's SQL-compatible query engine allows for efficient analysis of activity across the entire organization. The other options are less effective: Creating individual CloudTrail trails and sending logs to CloudWatch Logs with cross-account observability adds complexity and doesn't offer the native SQL querying capabilities of CloudTrail Lake for organization-wide data. Creating an organization trail and querying from the CloudTrail event history page is not suitable for complex SQL queries across large datasets. Using CloudFormation StackSets to deploy individual CloudTrail Lake data stores in each account defeats the purpose of centralized storage and querying, as each account would have its own separate data store.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed