SAP-C03 practice question: Multi-account log aggregation and alerting
Operational Excellence and Automation A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retailer runs about 40 AWS accounts, each with its own application log groups in CloudWatch Logs. The central operations team wants the logs of all accounts searchable in one account in near real time, so that an incident can be investigated without switching accounts.
The log groups must stay in their source accounts for their own retention, and the central team does not want to copy the logs by hand or on a nightly schedule.
Which solution meets these requirements?
Choose one answer.
AA. Export each account's log groups to an Amazon S3 bucket in the central account every night with a scheduled export task, and have the central team search the exported files with Amazon Athena when needed.
BB. Set up CloudWatch cross-account observability with the central account as the monitoring account and the 40 accounts as source accounts sharing their log groups, and query with Logs Insights.
CC. Set up a CloudWatch dashboard in each account, and ask the central team to log in to each account to view its dashboards during an incident.
DD. Write a cron job on a server in each account that copies the new log lines to a central log group every 15 minutes.
Show the answer and explanation
Answer: B
A. Wrong: Nightly exports are not near real time, and the logs would be a day old during an incident. The option also adds a copy process the central team wants to avoid.
B. Right: Correct. Cross-account observability lets the monitoring account search and analyze the source accounts' log groups without copying them, so each log group keeps its own retention. New log events are available to the central team as they arrive.
C. Wrong: The central team would still switch accounts, which the team wants to avoid. Dashboards also show only the metrics they are built with, not the logs themselves.
D. Wrong: The cron jobs are custom copy processes that the central team wants to avoid, and each one must be maintained across 40 accounts. A 15-minute delay is also slower than the subscription approach.
Explanation
CloudWatch cross-account observability lets one monitoring account search the log groups of all linked accounts in near real time, while each log group stays in its source account with its own retention. Nightly exports, per-account dashboards and copy scripts each add delay or manual work the requirements rule out.
Want more on Multi-account log aggregation and alerting? The 5 full-length practice sets have 7 more Multi-account log aggregation and alerting questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →