DOP-C02 AWS Config conformance packs Practice Question
A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?
⚠ Common exam trap
Candidates might mistakenly believe that CloudTrail organization trails or Trusted Advisor can monitor compliance across all accounts, but neither provides the centralized rule enforcement and automated remediation that AWS Config conformance packs offer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.
AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.
Why it's wrong here
CloudTrail Insights is designed to analyze write-only management events to identify unusual activity, such as anomalies in API usage, not to monitor configuration changes to CloudTrail itself. An organization trail centralizes event logging, but it does not detect if the trail is disabled, its settings are altered, or if a new trail is created without proper coverage. Therefore, this option would not ensure that CloudTrail is enabled across the organization.
- ✓
Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.
Why this is correct
AWS Config conformance packs provide a way to deploy a collection of AWS Config rules and remediation actions across all accounts and Regions in an organization. A managed rule such as `cloudtrail-enabled` can be included in a conformance pack to verify that CloudTrail trails are configured and enabled, and the results are aggregated centrally in the AWS Config console for the entire organization. This approach gives a single, policy-as-code mechanism to enforce and audit CloudTrail enablement consistently across every account.
- ✗
Set up CloudWatch Events rules in each account to detect trail disabling.
Why it's wrong here
CloudWatch Events (now Amazon EventBridge) rules can capture API events like `DisableTrail`, but setting up these rules individually in each account is operationally burdensome and does not provide a centralized view of compliance. Since the rules must be created per account, there is no automatic propagation to new accounts, and auditing would require navigating each account's events separately. This solution lacks the organization-wide governance capabilities needed to continuously enforce CloudTrail enablement.
- ✗
Use AWS Trusted Advisor to check CloudTrail configuration in each account.
Why it's wrong here
AWS Trusted Advisor provides best-practice checks for individual accounts, but its checks are accessed per account and do not aggregate compliance status across an AWS Organization. Even though Trusted Advisor can identify that CloudTrail is not enabled in a specific account, the results are not centrally viewable or programmatically enforceable for all accounts at once. Thus, while useful for a single account, it does not meet the requirement for multi-account centralized monitoring.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.