AWS Certified Data Engineer Associate DEA-C01 Practice Question

Creating an organization-wide CloudTrail trail automatically records every AWS API call in every member account. Delivering the trail to an S3 bucket that has S3 Object Lock in compliance mode makes the objects write-once-read-many (WORM), satisfying the 7-year immutability requirement without extra infrastructure. Enabling CloudTrail Lake in the log-archive account (and making that account the delegated administrator) creates an event data store that is automatically populated from the same trail. CloudTrail Lake supports SQL-based queries, so auditors can run ad-hoc searches on the stored events without moving the data.

Sending events to CloudWatch Logs and OpenSearch would capture the activity but does not provide native immutability and requires operating an OpenSearch cluster. AWS Config aggregates resource configuration changes, not all API calls, so it fails the capture requirement. Crawling individual account logs into Redshift adds ETL overhead, does not ensure immutability, and requires maintaining the Redshift cluster. Therefore, the organization CloudTrail plus CloudTrail Lake solution is the most efficient and compliant choice.