Exams / SAP-C03 / Study guide / Centralized security logging (organization trails, Security Lake, GuardDuty)
Centralized security logging (organization trails, Security Lake, GuardDuty): SAP-C03 study notes and practice questions
What to know about Centralized security logging (organization trails, Security Lake, GuardDuty) for the SAP-C03 exam, from the Security, Compliance, and Governance domain (25% of the exam guide), then 2 free questions to test it. Part of the SAP-C03 study guide.
These questions ask how a security team sees activity, configuration and threats across all accounts and Regions, including AI model calls, without asking each account to set anything up.
Activity and configuration
An organization trail in CloudTrail, created from the management account or a delegated administrator, logs every member account to one S3 bucket in the log archive account. Members can’t stop or delete it.
Protect the bucket: SSE-KMS with a customer managed key, a restrictive bucket policy, S3 Object Lock for write-once retention, and log file validation.
Add data events (S3 object reads, Lambda invokes) only where needed; they cost more.
AWS Config recording in every account and Region, with an aggregator in the audit or delegated administrator account, gives one view of resource configuration and compliance.
Send trails to CloudWatch Logs when you need metric filters and alarms on specific API calls.
Threat detection and findings
GuardDuty with a delegated administrator and auto-enable for new accounts analyzes CloudTrail, VPC Flow Logs and DNS logs with no agents, plus protection plans for S3, EKS, runtime monitoring, malware scanning and more. Extended threat detection correlates multi-stage attacks.
Security Hub gathers and correlates findings from GuardDuty, Inspector, Macie, Access Analyzer and Security Hub CSPM checks, with cross-Region aggregation to one home Region and automation through EventBridge.
Amazon Security Lake
Collects CloudTrail, VPC Flow Logs, Route 53 Resolver logs, Security Hub findings, EKS audit logs and third-party sources into an S3-based data lake in the OCSF format, across accounts and rollup Regions.
Subscribers (a SIEM, Athena, OpenSearch) get data access or query access, governed by Lake Formation.
Pick it when the scenario says normalize, long-term security analytics, or feed a third-party SIEM.
AI model invocations
Bedrock model invocation logging is off by default and set per Region. It writes full requests, responses and metadata to CloudWatch Logs and/or S3 in the same account and Region. Ship those logs to the central archive like any other log.
CloudTrail records Bedrock API calls (who invoked which model) but not prompt and response content.
How to choose
Scenario wording
Pick
All API activity, all accounts, tamper-resistant
Organization trail to log archive with Object Lock
One view of configuration compliance
Config aggregator
Threat detection in new accounts automatically
GuardDuty delegated admin with auto-enable
Normalized security data for a SIEM
Security Lake (OCSF)
Keep prompts and responses for audit
Bedrock model invocation logging
Common traps
A trail per account that local admins can disable.
CloudTrail for prompt content; it logs the call, not the payload.
Logs stored in the account that generated them.
Enabling services Region by Region by hand instead of delegated admin and auto-enable.
CloudTrail Lake for new designs: it closed to new customers on May 31, 2026.
A streaming company runs about 60 AWS accounts across four Regions. The security team needs a record of every management event in every account and Region, kept in one bucket in a dedicated log archive account. Each account is owned by a product team that has its own administrators.
Administrators in the member accounts must not be able to stop the logging or change the bucket, and accounts created next quarter must be covered without anyone setting up a trail for them.
Which solution meets these requirements?
Choose one answer.
AA. Have each account create its own CloudTrail trail that writes to a bucket in that account, and set each bucket's policy to read-only for the account's administrators.
BB. Create a trail in each account, and configure S3 replication from each account's bucket to the log archive bucket, so that copies of all logs end up in one place.
CC. Create an organization trail in the management account that logs all Regions and writes to a bucket in the log archive account, with a bucket policy that only the security team can change.
DD. Turn on Amazon EventBridge in each account and forward every API call to an event bus in the security account, and keep the events there for the audit period.
Show the answer and explanation
Answer: C
A. Wrong: Each account administrator can still stop or change the local trail, and the logs are split across 60 buckets. New accounts also need their own trail set up by hand.
B. Wrong: Member administrators can stop the trail or delete the source logs before replication runs. Each new account still needs a trail created for it.
C. Right: Correct. An organization trail records management events for every member account and Region, and member account administrators cannot stop or change it. The bucket sits in the log archive account, outside the members' control, and new accounts are covered automatically.
D. Wrong: EventBridge routes events but does not keep the management event history the way a trail does. Member accounts can also change or disable the forwarding rules.
Explanation
An organization trail gives one centrally managed record of management events for all accounts and Regions, delivered to a bucket that member administrators cannot change. Per-account or replicated trails leave the logging in the members' control, and EventBridge is not an audit record.
Member administrators cannot change the trail or the bucket, so the security team keeps one trusted record of every account and Region.
A logistics firm runs about 80 AWS accounts. Its security operations center uses a third-party SIEM and needs three years of CloudTrail management events, VPC Flow Logs and Security Hub findings from every account.
The analysts need the records in one consistent schema that they can query with Amazon Athena, and the data team does not want to build or run extract, transform and load pipelines for each log type.
Which solution meets these requirements?
Choose one answer.
AA. Export the raw CloudTrail logs, VPC Flow Logs and Security Hub findings to one central bucket, and build AWS Glue jobs that convert each log type into a custom schema that the SIEM and Athena can read.
BB. Send every account's logs to its own CloudWatch Logs log groups, and have the analysts run Logs Insights queries across the accounts when they need data.
CC. Enable Amazon Security Lake for all accounts from a delegated administrator, add the CloudTrail, VPC Flow Logs and Security Hub sources with three-year retention, and create a SIEM subscriber.
DD. Run a self-managed Elasticsearch cluster on EC2 instances, have a script copy the findings into it every night, and point the SIEM at the cluster.
Show the answer and explanation
Answer: C
A. Wrong: The Glue jobs are the extract, transform and load pipelines the data team wants to avoid. Each log type would also use a custom schema rather than one shared format.
B. Wrong: Logs Insights queries the raw logs in each log group, so the schemas differ across sources and the SIEM cannot read the data as one dataset. Keeping three years of raw logs in log groups is also costly.
C. Right: Correct. Security Lake collects these sources, normalizes them to the Open Cybersecurity Schema Framework, and stores them in Amazon S3. The SIEM subscribes to the data, and no ETL pipelines are needed.
D. Wrong: The team would patch, scale and back up the cluster itself, and the nightly copy would leave a gap in the data. The design does not give one normalized schema.
Explanation
Security Lake collects CloudTrail, Flow Logs and Security Hub findings into one normalized, queryable store across accounts with no pipelines to build. Glue ETL, per-account log groups and a self-managed cluster each miss the single-schema or operations requirement.
Want more on Centralized security logging (organization trails, Security Lake, GuardDuty)? The 5 full-length practice sets have 7 more Centralized security logging (organization trails, Security Lake, GuardDuty) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Centralized security logging (organization trails, Security Lake, GuardDuty)