AWS Certified Security – Specialty — Question 470

A company wants to analyze Amazon EC2 performance and utilization data in near real time for anomalies. The information that the company needs to analyze is in application logs. All the EC2 instances currently send logs to Amazon CloudWatch Logs.

A security engineer must set up the log aggregation. The security engineer must collect logs from all the company's AWS accounts into a centralized location to facilitate analysis.

Which solution will meet this requirement?

Answer options

• A. Log in to each account four times a day. Filter the required CloudWatch Logs data. Copy and paste the logs into an Amazon S3 bucket that is in the security engineer's account.
• B. Set up CloudWatch Logs Insights in each account. Use CloudWatch Logs subscriptions to send the CloudWatch Logs Insights query results to the security engineer's account.
• C. Set up an AWS Config aggregator to collect AWS configuration data from multiple sources. View the aggregator data from the security engineer's account.
• D. Set up Amazon CloudWatch cross-account log data sharing with subscriptions in each account. Send the logs to an Amazon Kinesis Data Firehose stream in the security engineer's account.

Correct answer: D

Explanation

Amazon CloudWatch subscription filters combined with cross-account destinations provide a highly scalable, near real-time mechanism to stream logs from multiple AWS accounts to a centralized Amazon Kinesis Data Firehose stream. Option A is an inefficient manual process that does not support near real-time analysis, and Option B is incorrect because CloudWatch Logs Insights is a query interface, not a streaming service. Option C is incorrect because AWS Config aggregates resource configuration histories rather than application log streams.