Centralized logging and threat detection across accounts

WHAT THIS TESTS The interviewer wants a design that consolidates audit and threat data into an isolated account that even account owners cannot tamper with, following the security-account pattern of cloud landing zones.

A GOOD ANSWER COVERS Start from a multi-account structure managed by an organization, typically with separate accounts for workloads, a dedicated log-archive account, and a dedicated security or audit account. Enable an organization-wide audit trail, an organization CloudTrail or the Azure equivalent, that automatically captures management and data events from every existing and future account and delivers them centrally, so coverage does not depend on per-team setup. Logs land in the log-archive account in immutable, append-only storage with object lock or write-once retention, and access is split so the producing accounts can write but only the security team can read, preventing a compromised workload account from deleting its own evidence. Threat detection services like GuardDuty or Microsoft Defender for Cloud are enabled across all accounts with a delegated administrator in the security account, so findings from every account aggregate into one console. The security team gets least-privilege, read-only cross-account roles to investigate. Findings can fan into a SIEM for correlation and alerting. The defining principles are centralization, immutability, separation of duties, and automatic enrollment of new accounts.

COMMON WRONG ANSWERS Leaving logs in each source account, where a compromised account can alter or delete them. Relying on each team to enable logging manually, which drifts. Giving the security team broad write access instead of least-privilege read.

LIKELY FOLLOW-UPS How do you prevent the source account from deleting its own logs? What is a delegated administrator? How do new accounts get enrolled automatically?

ONE CONCRETE EXAMPLE An organization CloudTrail writes every account's events to an object-locked bucket in the log-archive account that no workload account can delete, while GuardDuty's delegated admin in the security account surfaces cross-account findings into one dashboard.