AWS Certified Data Engineer Associate DEA-C01 Practice Question

A security team needs to audit API activity across 50 AWS accounts that belong to a single AWS Organization. They must aggregate all CloudTrail management events in near-real time, keep the logs immutable for 365 days, and let analysts run ad-hoc SQL queries without exporting the data to another service. Which solution requires the LEAST ongoing operational effort?

In each member account, stream CloudTrail events to CloudWatch Logs and subscribe the log groups to an Amazon OpenSearch Service domain for search and analysis.
Configure an organization CloudTrail trail that delivers logs to an S3 bucket protected with S3 Object Lock, catalog the logs with AWS Glue, and query them using Amazon Athena.
Create an organization event data store in AWS CloudTrail Lake from the delegated administrator account, set one-year extendable retention, and grant analysts permission to run Lake SQL queries.
Enable Amazon Security Lake across the organization to collect CloudTrail management events and query the Parquet files in the Security Lake S3 buckets with Athena.

Report Issue

Answer Description

An organization event data store in AWS CloudTrail Lake automatically ingests management events from every account when created by the management or delegated administrator account. Event data stores are immutable collections, and the one-year extendable retention option meets the 365-day requirement without additional storage configuration. CloudTrail Lake provides a built-in SQL interface, so analysts can query the data directly-no Object Lock configuration, Glue cataloging, or streaming pipelines are needed. The S3/Object Lock and Security Lake options satisfy immutability but add Glue/Athena setup and data-movement overhead. Streaming logs to CloudWatch Logs and OpenSearch requires per-account trail configuration, subscription filters, and OpenSearch management, increasing operational burden and not guaranteeing immutability.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.