A security team must retain CloudTrail management events for seven years in a queryable store while minimizing operational overhead. Which approach best meets this requirement?
Show answer and explanation
Answer: B
A CloudTrail Lake event data store keeps events in a managed, SQL-queryable store with a retention period you choose, up to roughly seven years. It can ingest organization trails so events from all accounts land in one place, and queries run without managing servers or loading data elsewhere. This removes the need to build an archive pipeline over S3 log files.
Why the other options are wrong
- A. Event history keeps only 90 days of management events in the console and is not a long-term queryable archive.
- C. Downloading files to an on-premises server adds operational burden and provides no built-in querying.
- D. VPC Flow Logs capture network traffic, not CloudTrail management events.