SAP-C02 Practice Question 56: Cross Account Incident Visibility
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 6 · question 6 of 10
A checkout transaction crosses six AWS accounts: an edge account, two service accounts, a payments account, and two data accounts. During a recent incident, the on-call engineer spent 25 minutes switching roles between accounts to correlate CloudWatch metrics, search log groups, and follow an AWS X-Ray trace, and the post-incident review named that context switching as the biggest contributor to time-to-diagnose.
The company wants one place from which an engineer can search and visualize metrics, logs, and traces from all six accounts, wants accounts created later in the organization to be included without manual onboarding, and does not want to duplicate log data into a central account because of the storage cost and the retention policies attached to each account's log groups.
What should the solutions architect implement?
Show answer and explanation
Answer:
CloudWatch cross-account observability is built for this exact failure mode: it lets you "seamlessly search, visualize, and analyze your metrics, logs, traces ... in any of the linked accounts without account boundaries". One or more accounts are set up as monitoring accounts and linked to source accounts through a sink, and the shared telemetry explicitly includes CloudWatch metrics, CloudWatch Logs log groups, and AWS X-Ray traces, all three signals the engineer was chasing. AWS recommends linking source accounts via AWS Organizations precisely so that new accounts created later are onboarded automatically, which is the second requirement. And the data is shared rather than copied: log groups stay in their own accounts under their own retention settings, and AWS notes there is no extra cost for logs and metrics in cross-account observability.
Option A does duplicate the data, which the stem rules out on cost grounds, and it detaches the logs from the per-account retention policies. It also covers only logs, leaving metrics and traces scattered.
Option B helps with the graphs but not the diagnosis. Cross-account dashboards show pre-built metric views; the engineer still cannot search another account's log groups or open its X-Ray traces from the same place.
Option C is a tidier version of the status quo. Role switching remains in the critical path of every incident, which is what the post-incident review identified as the problem.
Reference: CloudWatch cross-account observability