SAP-C02 Practice Question 23: Organization Trail Central Audit
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 3 · question 3 of 10
An internal audit has asked a company with 60 AWS accounts in AWS Organizations to produce a single, tamper-resistant record of management API activity across every account and every enabled Region, stored in a dedicated log archive account that workload administrators cannot write to. The same audit wants one place to query resource configuration and compliance state across all 60 accounts.
Accounts are created continuously by an internal platform, so coverage must extend to new accounts with no per-account action. Member account administrators have full administrative rights inside their own accounts and must not be able to stop the logging or delete the trail.
What should the solutions architect implement?
Show answer and explanation
Answer:
An organization trail is created once in the management account (or a delegated administrator account) and logs events for the management account and every member account into one S3 bucket. Users in member accounts can see the trail, but they do not have sufficient permissions to delete it, turn logging off, change what it logs, or otherwise modify it, which is exactly the tamper-resistance the auditors asked for. When an account is added to the organization, the trail and its service-linked role are added to that account automatically and logging starts with no per-account work. Pairing it with an AWS Config aggregator that is authorized for the organization gives the single cross-account, cross-Region view of configuration and compliance state.
Option B depends on 60 account owners doing the right thing and keeps each trail under the control of the administrator it is supposed to audit; any of them can stop logging or delete the bucket. Replication also copies objects rather than preventing their deletion at the source.
Option C misunderstands the coverage problem. A trail created in the management account without applying it to the organization logs only the management account, and a per-account EventBridge forwarding fabric is 60 rules to build, maintain, and re-create for every new account, with no guarantee of delivery durability.
Option D gives per-account compliance and per-account event stores, which is the opposite of the single queryable record requested, and StackSets deployment does not prevent a member account administrator from deleting the local stack's resources.
Reference: Creating a trail for an organization