AWS Certified Data Engineer Associate DEA-C01 Practice Question

An enterprise has 30 AWS accounts in an AWS Organization. Compliance mandates that all API activity logs be retained for 7 years in immutable storage and that auditors can run ad-hoc SQL queries across the aggregated logs without building or managing ETL jobs. Which approach most effectively meets these requirements with minimal operational effort?

Create an organization-level CloudTrail Lake event data store with a 7-year retention period and grant auditors read-only Lake query permissions.
Enable AWS Config in all accounts, aggregate configuration snapshots to a central S3 bucket, and query the data with Athena.
Stream all CloudTrail events to CloudWatch Logs, forward them with Kinesis Data Firehose to Amazon OpenSearch Service, and allow auditors to run searches from Kibana.
In each account, configure CloudTrail to deliver logs to an S3 bucket protected by S3 Object Lock, then catalog the buckets with AWS Glue and query them using Amazon Athena.

Report Issue

Answer Description

A centralized organization-level CloudTrail Lake event data store automatically collects management and data events from every member account, stores them in an append-only, tamper-evident format, and supports retention periods of up to 7 years. CloudTrail Lake includes a built-in SQL query engine, so auditors can query the data directly without additional ETL or external services.

Sending CloudTrail logs to individual S3 buckets and querying with Athena adds operational overhead for bucket creation, partitioning, Glue crawlers, and retention management. AWS Config records configuration changes, not full API activity, so it does not meet the logging requirement. Streaming all logs to Amazon OpenSearch Service requires operating and scaling a cluster and uses the OpenSearch query DSL rather than standard SQL, adding complexity and management burden.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.