DOP-C02 Practice Question 29: SCP Protect Organization Trail
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 3 · question 9 of 10
A company runs about 60 accounts in AWS Organizations with all features enabled. An organization trail delivers CloudTrail logs to a bucket in the Log Archive account. After an engineer in a workload account turned off logging during an outage, the security team must guarantee that no principal in any member account, including that account's root user, can stop, delete, or reconfigure the trail. A single break-glass IAM role in the Security Tooling member account must still be able to administer it, and the control must be preventive rather than after the fact.
What should the security team implement?
Show answer and explanation
Answer:
SCPs are the only control in the list that is both preventive and inescapable from inside a member account. The Organizations documentation states that an SCP "restricts permissions for IAM users and roles in member accounts, including the member account's root user," and that an account "has only those permissions permitted by every parent above it." Attaching the deny at the organization root covers every member account, existing and future, and a Condition on aws:PrincipalArn carves out the one break-glass role. That role lives in the Security Tooling account, a member account, so the exclusion is necessary; SCPs "don't affect users or roles in the management account," but they very much affect member accounts.
Option A cannot reach far enough. A permissions boundary only constrains the identity it is attached to, so it has to be attached to every principal and re-attached to every new one, and it does not apply to the account root user at all, the exact gap the security team is trying to close.
Option B protects the evidence, not the logging. Object Lock stops delivered log files from being altered or deleted and log file validation detects tampering, but neither prevents anyone from calling StopLogging, after which there are simply no new files to protect.
Option D is detective and reactive. A Config rule evaluates after the change has happened, and the remediation runs afterwards, leaving a window in which no API activity is recorded. The stem explicitly asks for a preventive control.
Reference: Service control policies (SCPs)