Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 516 discussion

By leveraging AWS CloudTrail Lake and a delegated administrator account in AWS Organizations, Option B provides a centralized and managed solution for ingesting, storing, and querying AWS account activity using SQL, meeting the company's requirements efficiently. The other options have drawbacks or do not fully meet the requirements: Option A: While it uses CloudWatch Logs and CloudWatch Logs Insights, it requires creating and managing CloudTrail trails in each account, which can be more complex and less centralized than using CloudTrail Lake. Option C: This option suggests using the CloudTrail event history page for querying, which does not provide the SQL querying capabilities required by the company. Additionally, it may not offer the same level of centralization and advanced analytics as CloudTrail Lake. Option D: While it uses CloudTrail Lake, deploying data stores in each account using CloudFormation StackSets can be more complex and less centralized than using a delegated administrator account to manage the data store for all accounts.

To enable cloudtrail lake, you need to login with admin access to cloudtrail. https://aws.amazon.com/blogs/mt/announcing-aws-cloudtrail-lake-a-managed-audit-and-security-lake/

AWS CloudTrail Lake lets you run SQL-based queries on your events.

B You can aggregate events within an Organization by enabling it for all accounts in the Organization with AWS CloudTrail Lake.