The correct answer is CEF. Here's a detailed explanation:
The question asks for a solution to detect root user logins across an AWS Organization, send alerts, and provide a dashboard for log activity.
Let's break down why each selected option is correct and why the others aren't:

E: Create an AWS CloudTrail organization trail. Configure the organization trail to send events to Amazon CloudWatch Logs.
- Reasoning: CloudTrail is the AWS service responsible for logging API calls and other activities within your AWS environment. By creating an organization trail, you ensure that all activities, including root user logins, are captured across all accounts in your AWS Organization. Sending these logs to CloudWatch Logs provides a central location for analysis and monitoring. This is crucial for identifying root user activity.
C: Create an Amazon CloudWatch Logs metric filter to match root user login events. Configure a CloudWatch alarm and an Amazon Simple Notification Service (Amazon SNS) topic to send alerts to the company's monitoring system.
- Reasoning: Once the CloudTrail logs are in CloudWatch Logs, you can create a metric filter to specifically identify root user login events. The CloudWatch alarm triggers when the metric filter detects such an event, and SNS sends an alert to the monitoring system. This ensures that the company is notified immediately when a root user logs in.
F: Create an Amazon CloudWatch dashboard that uses a CloudWatch Logs Insights query.
- Reasoning: CloudWatch Logs Insights allows you to query the log data stored in CloudWatch Logs. By creating a dashboard with a Logs Insights query, you can visualize the root user activity over time and investigate specific events. This provides a comprehensive view of root user behavior for auditing and security purposes.

Now, let's examine why the other options are incorrect:

A: Enable AWS Config with a multi-account aggregator. Configure log forwarding to Amazon CloudWatch Logs.
- Reasoning: AWS Config is primarily for tracking configuration changes to AWS resources. While it can provide some information, it's not the primary tool for capturing login events like CloudTrail. Also, directly forwarding logs to CloudWatch Logs without processing is not what Config does, it needs CloudTrail to capture the logs first.
B: Create an Amazon QuickSight dashboard that uses an Amazon CloudWatch Logs query.
- Reasoning: While QuickSight can visualize data from various sources, including CloudWatch Logs, it is not the optimal solution for real-time alerting. CloudWatch alarms and SNS notifications are more suitable for immediate notifications of root user logins. Furthermore, QuickSight is more suited for BI (Business Intelligence) analytics than real-time security monitoring.
D: Create an Amazon CloudWatch Logs subscription filter to match root user login events. Configure the filter to forward events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure the SNS topic to send alerts to the company's monitoring system.
- Reasoning: Subscription filters are used for streaming log data to other services like Kinesis or Lambda, not primarily for alerting. While it can send events to SNS, it does not include aggregation and metrics, which C offers. Option C (metric filter + alarm) is better for creating an alarm based on root user logins.

Therefore, the combination of CloudTrail for capturing activity (E), CloudWatch metric filters and alarms for alerting (C), and CloudWatch Logs Insights for dashboarding (F) provides the most complete solution.

Citations:

AWS CloudTrail: https://aws.amazon.com/cloudtrail/
Amazon CloudWatch Logs: https://aws.amazon.com/cloudwatch/features/logs/
CloudWatch Logs Insights: https://aws.amazon.com/cloudwatch/features/logs-insights/
AWS Config: https://aws.amazon.com/config/
Amazon QuickSight: https://aws.amazon.com/quicksight/