A healthcare startup must centralize logs for HIPAA audit across 15 accounts: all management API activity, VPC traffic metadata, and Route 53 DNS queries must be immutable for one year and searchable for incidents. Which log ingestion and storage design should the architect choose to meet the logging requirements?
Select an answer to reveal the explanation.
Short Explanation
You're juggling API calls, traffic, and DNS across 15 accounts, so you'll want them tucked into one tamper-proof vault like receipts in a safe-deposit box. An org-wide trail plus flow and Resolver logs sent to central S3 with Object Lock keeps everything unchangeable for a year while Athena lets you search fast when incidents pop up.
Full Explanation
The correct design succeeds because an organization trail captures management API activity across all 15 accounts, VPC flow logs capture VPC traffic metadata, and Route 53 Resolver query logs capture DNS queries, with delivery to a central S3 log archive that can enforce immutability with Object Lock and retention for one year while enabling incident search with services like Athena. The centralized S3 aggregation without Object Lock fails by immutability concept because HIPAA audit requires WORM protection and defined retention, and without Governance or Compliance mode plus retention, logs remain mutable and deletable and cannot prove one-year preservation. The CloudTrail plus VPC-only central archive with Object Lock and Athena fails by completeness concept because it omits Resolver query logs, leaving DNS resolution blind even though API and network layers are centralized, immutable and searchable. The per-account local S3 design with Object Lock and Athena fails by centralization concept because maintaining 15 isolated archives breaks single audit scope, complicates cross-account correlation, access control and lifecycle enforcement despite having the right log types, retention and search locally. Exam caveat: distinguish logging source coverage from storage controls, as questions often test whether all three required telemetry types plus central immutable searchable storage are present together. Practical check: verify organization trail status, VPC and Resolver log associations, central bucket policy, Object Lock enabled with one-year retention rule, and run a test Athena query across recent partitions for all three sources.