Aggregate organisation audit activity in CloudTrail Lake and query it with SQL
Short answer
B Create a CloudTrail Lake data store from a delegated administrator, enable it for all organization accounts, and query with SQL.
Question
Key Takeaways
CloudTrail Lake is a managed audit data store that accepts events from every account in the organization and is queried with SQL directly, so no export to S3, no Athena setup, and no per-account log pipeline is needed.
A company has multiple AWS accounts inside an AWS Organization and needs to store account activity in a central location and query that data using SQL. The audit data across the organization has to be brought together rather than queried account by account.
Common mistake: Querying the CloudTrail event history page. That page shows events for the current account over a limited period and is not a SQL-queryable store, so it cannot serve as the central queryable location the requirement describes.
Expert Analysis
Why the Answer Is Correct
The requirement has two parts, centrally store the activity and query it with SQL, and CloudTrail Lake satisfies both in a single managed service. A delegated administrator creates the CloudTrail Lake data store, specifies CloudTrail management events as the event source, and enables the data store for all accounts in the organization, so activity from every member account flows into one central store automatically as accounts are created. Queries are then run in CloudTrail Lake using SQL, so the security team gets a central queryable location without building an export pipeline. The delegated administrator model is what allows organisation-wide configuration, since a member account cannot configure this for the whole organization.
Why the Other Options Are Wrong
A: Creating a trail in every account and sending management events to CloudWatch Logs does centralise the logs through cross-account observability, but CloudWatch Logs Insights is a log query experience rather than SQL over a durable central audit store, so it does not meet the stated SQL requirement as directly. C: The event history page is a console view of recent events in a single account, it is not a central store and it does not support SQL, so it fails both parts of the requirement. D: Deploying a separate CloudTrail Lake data store in each account via CloudFormation StackSets creates many independent stores rather than one central location, and querying across them is not a single query, so the centralisation requirement is not met.
Community Comment Notes
The community voted 100 to 0 for B, and the top-voted comment noted that CloudTrail Lake lets you run SQL-based queries on your events. Another linked the AWS announcement describing CloudTrail Lake as a managed audit and security lake and observed that a delegated administrator is required to enable it, and a further commenter explained that enabling it for all accounts in the organization is what aggregates the events centrally.
Official Reference
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html
This link opens the official vendor documentation in a new tab.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Daniel76 👍 3 Answered BTo enable cloudtrail lake, you need to login with admin access to cloudtrail. https://aws.amazon.com/blogs/mt/announcing-aws-cloudtrail-lake-a-managed-audit-and-security-lake/
-
kupo777 👍 3B You can aggregate events within an Organization by enabling it for all accounts in the Organization with AWS CloudTrail Lake.
-
0b43291 👍 2By leveraging AWS CloudTrail Lake and a delegated administrator account in AWS Organizations, Option B provides a centralized and managed solution for ingesting, storing, and querying AWS account activity using SQL, meeting the company's requirements efficiently. The other options have drawbacks or do not fully meet the requirements: Option A: While it uses CloudWatch Logs and CloudWatch Logs Insights, it requires creating and managing CloudTrail trails in each account, which can be more complex and less centralized than using CloudTrail Lake. Option C: This option suggests using the CloudTrail event history page for querying, which does not provide the SQL querying capabilities required by the company. Additionally, it may not offer the same level of centralization and advanced analytics as CloudTrail Lake. Option D: While it uses CloudTrail Lake, deploying data stores in each account using CloudFormation StackSets can be more complex and less centralized than using a delegated administrator account to manage the data store for all accounts.
-
c22ddd8 👍 2 Answered BAWS CloudTrail Lake lets you run SQL-based queries on your events.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full SAP-C02 Practice Test →