What is the benefit of a centralized logging account in a SAP-C02 design?

• A. It stores logs in a separate, isolated bucket per account
• B. It aggregates logs from all accounts for compliance, monitoring, and security analysis
• C. It reduces the need for CloudTrail
• D. It disables logging for non-production accounts

Answer: (B)

Centralized logging in an SAP-C02 design gives you a single, authoritative place to collect and store logs from all AWS accounts in your organization. By routing CloudTrail, VPC flow logs, and other security telemetry to one central account, you create a unified view that makes governance, compliance, and security analysis much more efficient.

With a centralized approach, you can enable an organization-wide CloudTrail that records activity from every account into a single S3 bucket (with consistent retention, encryption, and access controls). This makes audits smoother, supports faster incident response, and simplifies the integration of logs with SIEM tools. It also ensures you don’t miss events from any account and makes cross-account correlation straightforward, which is essential for detecting complex threats and for comprehensive compliance reporting.

Other approaches that isolate logs per account or imply you can reduce logging or disable it in non-production accounts undermine visibility and the ability to perform across-account analytics. Centralization, by contrast, concentrates data for easier analysis while still allowing proper access controls and encryption.

So the primary benefit is aggregating logs from all accounts to enable consistent compliance checks, centralized monitoring, and thorough security analysis.