SAA-C03 Practice Question 73: CloudTrail Organization Trail Integrity

Each requirement maps to one part of this answer. An organization trail created by the management account logs events for the management account and every member account into a single bucket, and users in member accounts cannot delete it, turn logging on or off, or change what it records; that is the second requirement, enforced by the service rather than by policy. Log file integrity validation covers the third: CloudTrail hashes every delivered log file and publishes a signed digest file hourly, each referencing the previous one, so you can demonstrate that a file was not modified, and also that none was deleted. Sending the logs to a separate account keeps them out of reach of anyone who compromises a workload account.

Option B leaves collection under each account's control. A member account administrator can disable or reconfigure a trail that lives in their own account, defeating the second requirement, and versioning protects against overwrite without providing any cryptographic evidence that a retained file is unaltered.

Option C is not a durable audit mechanism. Event history is a 90-day, per-account, per-Region view of management events, so it is neither centralized nor complete, and an export produces ordinary files with no integrity proof.

Option D gets the first two requirements right and is a reasonable hardening step, but Object Lock prevents deletion rather than proving integrity; it cannot tell an auditor whether the content of a retained file matches what CloudTrail delivered. Keeping the bucket in the management account also leaves the logs beside the account most worth protecting them from.

References: Creating a trail for an organization; Validating CloudTrail log file integrity